cmdservice removal assistance badly needed...

F

fadingcaptain

New member
Hi,

I've gotten the dreaded cmdservice (and i'm sure a lot of other things by now) on my machine, and could use some help getting rid of it. Any assistance would be greatly appreciated!

Here's my HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:30:38 PM, on 1/31/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\Client Server Security Agent\ntrtscan.exe
C:\Program Files\Trend Micro\Client Server Security Agent\tmlisten.exe
C:\WINDOWS\TEMP\OD978F.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\STOPzilla!\STOPzilla.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Trend Micro\Client Server Security Agent\pccntmon.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\WINDOWS\system32\dxegpq.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Dot1XCfg\Dot1XCfg.exe
C:\WINDOWS\WNSXS~1\smss.exe
C:\Program Files\iPod\bin\iPodService.exe
H:\My Documents\a?sembly\r?gedit.exe
C:\Program Files\palmOne\Hotsync.exe
C:\Program Files\Trillian\trillian.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Sage Software\Peachtree\peachw.exe
C:\Program Files\Sage Software\Peachtree\W32MKDE.EXE
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
F2 - REG:system.ini: UserInit=userinit.exe
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: STOPzilla - {98828DED-A591-462F-83BA-D2F62A68B8B8} - C:\Program Files\STOPzilla!\SZSG.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\Client Server Security Agent\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [Microsoft Update Machine] dxegpq.exe
O4 - HKLM\..\Run: [f8c118d4] rundll32.exe "C:\WINDOWS\system32\fgdnvrsy.dll",b
O4 - HKLM\..\RunServices: [Microsoft Update Machine] dxegpq.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Microsoft Update Machine] dxegpq.exe
O4 - HKCU\..\Run: [Dot1XCfg] C:\Program Files\Dot1XCfg\Dot1XCfg.exe
O4 - HKCU\..\Run: [Etnr] "C:\WINDOWS\WNSXS~1\smss.exe" -vt yazb
O4 - HKCU\..\Run: [Ckgkfzp] "H:\My Documents\a?sembly\r?gedit.exe"
O4 - HKCU\..\Run: [qrzo] C:\PROGRA~1\COMMON~1\qrzo\qrzom.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: palmOne Registration.lnk = C:\Program Files\palmOne\register.exe
O4 - Startup: Trillian.lnk = C:\Program Files\Trillian\trillian.exe
O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Program Files\palmOne\Hotsync.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - https://email1.uncg.edu/iNotes6W.cab
O16 - DPF: {A922B6AB-3B87-11D3-B3C2-0008C7DA6CB9} (InetDownload Class) - https://media.pineconeresearch.com/ActiveX/downloadcontrol.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = TSNetServer.local
O17 - HKLM\Software\..\Telephony: DomainName = TSNetServer.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = TSNetServer.local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = TSNetServer.local
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Trend Micro Client/Server Security Agent RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\Client Server Security Agent\ntrtscan.exe
O23 - Service: STOPzilla Service (szserver) - iS3, Inc. - C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe
O23 - Service: Trend Micro Client/Server Security Agent Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\Client Server Security Agent\tmlisten.exe

--
End of file - 8409 bytes


THANKS!!!!
 
Hello fadingcaptain :)

Please download ComboFix by sUBs from HERE or HERE
  • You must download it to and run it from your Desktop
  • Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
  • Double click combofix.exe & follow the prompts.
  • When finished, it will produce a log. Please save that log to post in your next reply along with a fresh HJT log
  • Re-enable all the programs that were disabled during the running of ComboFix..

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
 
Here's the combofix log:

ComboFix 08-02.01.6 - andrew rush 2008-02-01 9:11:43.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1374 [GMT -5:00]
Running from: C:\Documents and Settings\Andrew Rush\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\pmkhe.dll
C:\WINDOWS\system32\rqrpqnk.dll
C:\WINDOWS\system32\rrmglwvh.dll
H:\My Documents\ASEMBL~1\r?gedit.exe
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\Program Files\Common Files\qrzo
C:\Program Files\Common Files\qrzo\qrzoa.lck
C:\Program Files\Common Files\qrzo\qrzod\class-barrel
C:\Program Files\Common Files\qrzo\qrzod\qrzoc.dll
C:\Program Files\Common Files\qrzo\qrzod\vocabulary
C:\Program Files\Common Files\qrzo\qrzol.exe
C:\Program Files\Common Files\qrzo\qrzol.lck
C:\Program Files\Common Files\qrzo\qrzom.lck
C:\Program Files\Common Files\qrzo\qrzop.exe
C:\Program Files\Insider
C:\Program Files\Insider\UnInstall.exe
C:\Program Files\outerinfo
C:\Program Files\security toolbar
C:\Program Files\security toolbar\Security Toolbar.dll
C:\Program Files\security toolbar\Uninstall.bat
C:\Program Files\Temporary
C:\Program Files\Temporary\kernInst.exe
C:\WINDOWS\b103.exe
C:\WINDOWS\b104.exe
C:\WINDOWS\b116.exe
C:\WINDOWS\b122.exe
C:\WINDOWS\b138.exe
C:\WINDOWS\b147.exe
C:\WINDOWS\b149.exe
C:\WINDOWS\qrzo
C:\WINDOWS\qrzo\qrzo.dat
C:\WINDOWS\qrzo\wu
C:\WINDOWS\system32\ehkmp.ini
C:\WINDOWS\system32\ehkmp.ini2
C:\WINDOWS\system32\fgdnvrsy.dll
C:\WINDOWS\system32\hph.dll
C:\WINDOWS\system32\nnnkjge.dll
C:\WINDOWS\system32\ohlhdtfu.dll
C:\WINDOWS\system32\pmkhe.dll
C:\WINDOWS\system32\rqrpqnk.dll
C:\WINDOWS\system32\rqtobyoj.dll
C:\WINDOWS\system32\rrmglwvh.dll
C:\WINDOWS\system32\rrmglwvh.dllbox
C:\WINDOWS\system32\ysrvndgf.ini
C:\WINDOWS\wnsxs~1
C:\WINDOWS\wnsxs~1\smss.exe
C:\WINDOWS\wnsxs~1\W?nSxS\

----- BITS: Possible infected sites -----

hxxp://au.download.windowsupdate.com
hxxp://au.download.windowsupdate.co
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_NETWORK_MONITOR


((((((((((((((((((((((((( Files Created from 2008-01-01 to 2008-02-01 )))))))))))))))))))))))))))))))
.

2008-01-31 14:31 . 2008-01-31 14:31 2,048 --a------ C:\WINDOWS\system32\drivers\356D4712-EA57-43AB-9903-27CBE1E5C165.cxv
2008-01-31 14:27 . 2008-01-31 14:27 4,096 --a------ C:\WINDOWS\system32\drivers\01BA01C3-FE4A-46B8-A3EF-4811773EC267.cxv
2008-01-31 14:25 . 2008-01-31 14:25 <DIR> d-------- C:\Program Files\Common Files\iS3
2008-01-31 14:25 . 2008-01-31 15:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\STOPzilla!
2008-01-31 13:04 . 2008-01-31 14:27 <DIR> d--hs---- C:\WINDOWS\T3duZXI
2008-01-31 12:54 . 2008-01-31 12:54 <DIR> d-------- C:\WINDOWS\system32\F1F4F3F3F7FBF
2008-01-30 12:20 . 2008-01-30 12:20 <DIR> d-------- C:\Program Files\Dot1XCfg
2008-01-24 12:11 . 2007-11-02 11:26 <DIR> d---s---- C:\Documents and Settings\ADMIN INTERN\UserData
2008-01-24 12:11 . 2007-10-31 13:13 <DIR> d-------- C:\Documents and Settings\ADMIN INTERN\Application Data\Sonic
2008-01-24 12:11 . 2007-10-25 08:57 <DIR> d-------- C:\Documents and Settings\ADMIN INTERN\Application Data\PureEdge
2008-01-24 12:11 . 2008-01-24 12:11 <DIR> d-------- C:\Documents and Settings\ADMIN INTERN\Application Data\HotSync
2008-01-24 12:11 . 2008-01-24 12:11 <DIR> d-------- C:\Documents and Settings\ADMIN INTERN\Application Data\ATI
2008-01-24 12:11 . 2007-12-14 10:16 <DIR> d-------- C:\Documents and Settings\ADMIN INTERN\Application Data\AdobeUM
2008-01-22 08:54 . 2008-01-22 08:54 <DIR> d-------- C:\Documents and Settings\Andrew Rush\Application Data\Move Networks
2008-01-18 15:29 . 2008-01-18 15:29 <DIR> d-------- C:\Program Files\Analog Devices
2008-01-18 15:29 . 2006-07-10 15:42 49,152 --a------ C:\WINDOWS\system32\DSndUp.exe
2008-01-18 15:29 . 2002-04-17 15:05 45,056 --a------ C:\WINDOWS\system32\CleanUp.exe
2008-01-18 15:06 . 2007-06-12 17:05 920,344 --a------ C:\WINDOWS\system32\heciudlg.exe
2008-01-18 15:06 . 2007-06-12 17:05 45,056 --a------ C:\WINDOWS\system32\drivers\HECI.sys
2008-01-18 14:59 . 2008-01-18 14:59 <DIR> d-------- C:\Documents and Settings\Andrew Rush\Application Data\ATI
2008-01-18 14:53 . 2007-07-12 21:31 5,431,296 --a------ C:\WINDOWS\system32\atioglxx.dll
2008-01-18 14:53 . 2007-06-12 17:05 319,456 --a------ C:\WINDOWS\system32\difxapi.dll
2008-01-18 14:52 . 2001-09-19 13:47 765,952 --a------ C:\WINDOWS\system\crlds3d.dll
2008-01-18 14:52 . 2006-03-17 18:18 392,960 --a------ C:\WINDOWS\system32\drivers\senfilt.sys
2008-01-18 14:52 . 2007-05-11 15:21 306,176 --a------ C:\WINDOWS\system32\drivers\ADIHdAud.sys
2008-01-18 14:52 . 2007-03-27 10:36 28,160 --a------ C:\WINDOWS\system32\PostProc.dll
2008-01-18 14:50 . 2008-01-18 14:50 <DIR> d-------- C:\WINDOWS\system32\vmm32
2008-01-18 14:50 . 2008-01-18 14:50 <DIR> d-------- C:\Program Files\Dell
2008-01-18 14:43 . 2008-01-18 15:03 <DIR> d-------- C:\Program Files\Intel
2008-01-18 14:42 . 2008-01-18 14:42 <DIR> d-------- C:\Intel
2008-01-18 14:39 . 2007-04-13 13:33 254,872 --a------ C:\WINDOWS\system32\drivers\e1e5132.sys
2008-01-18 14:39 . 2007-01-17 15:59 179,048 --a------ C:\WINDOWS\system32\e1000msg.dll
2008-01-18 14:39 . 2007-01-17 16:02 66,424 --a------ C:\WINDOWS\system32\NicEtCoE.dll
2008-01-18 14:39 . 2007-01-29 14:36 62,840 --a------ C:\WINDOWS\system32\NicInstE.dll
2008-01-18 14:39 . 2007-01-17 16:02 28,536 --a------ C:\WINDOWS\system32\NicCo.dll
2008-01-18 14:39 . 2006-06-02 17:00 2,889 --a------ C:\WINDOWS\system32\e1e5132.din
2008-01-18 14:28 . 2008-01-18 14:28 0 --a------ C:\WINDOWS\ativpsrm.bin
2008-01-18 14:24 . 2008-01-18 14:54 <DIR> d-------- C:\Program Files\ATI Technologies
2008-01-18 14:24 . 2007-07-12 21:15 520,192 --a------ C:\WINDOWS\system32\ati2sgag.exe
2008-01-17 08:21 . 2008-01-17 08:21 <DIR> d-------- C:\Program Files\iPod
2008-01-10 15:27 . 2008-01-10 15:27 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
2008-01-10 15:27 . 2008-01-10 15:27 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts
2008-01-08 09:15 . 2008-01-08 09:15 <DIR> d-------- C:\Program Files\Snood

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-31 20:40 --------- d-----w C:\Program Files\Common Files\Adobe
2008-01-31 20:03 --------- d-----w C:\Program Files\Trend Micro
2008-01-31 19:29 --------- d-----w C:\Program Files\Trillian
2008-01-31 17:49 10 ----a-w C:\Program Files\.autoreg
2008-01-30 17:17 --------- d-----w C:\Documents and Settings\Andrew Rush\Application Data\Azureus
2008-01-29 22:10 --------- d-----w C:\Program Files\Soulseek
2008-01-25 17:39 --------- d-----w C:\Documents and Settings\All Users\Application Data\FLEXnet
2008-01-18 20:29 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-17 13:22 --------- d-----w C:\Program Files\iTunes
2008-01-17 13:19 --------- d-----w C:\Program Files\QuickTime
2008-01-08 14:10 --------- d-----w C:\Program Files\Azureus
2008-01-08 13:33 --------- d-----w C:\Program Files\Common Files\Peach
2007-12-10 04:27 --------- d-----w C:\Documents and Settings\wardrobe intern\Application Data\Apple Computer
2007-12-05 23:40 --------- d-----w C:\Documents and Settings\elmonmay\Application Data\Sonic
2007-12-05 23:40 --------- d-----w C:\Documents and Settings\elmonmay\Application Data\HotSync
2007-06-13 10:23 218,721 --sha-r C:\WINDOWS\system32\dxegpq.exe
2005-08-02 21:46 187,904 --sha-r C:\WINDOWS\T3duZXI\asappsrv.dll
2005-07-29 21:24 472 --sha-r C:\WINDOWS\T3duZXI\naxRtrK.vbs
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-30 08:01 68856]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 19:05 204288]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 11:24 1694208]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:00 15360]
"Microsoft Update Machine"="dxegpq.exe" [2007-06-13 05:23 218721 C:\WINDOWS\system32\dxegpq.exe]
"Dot1XCfg"="C:\Program Files\Dot1XCfg\Dot1XCfg.exe" [2008-01-30 12:20 61440]
"Etnr"="C:\WINDOWS\WNSXS~1\smss.exe" [ ]
"Ckgkfzp"="H:\My Documents\a?sembly\r?gedit.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11 132496]
"Synchronization Manager"="C:\WINDOWS\system32\mobsync.exe" [2004-08-04 07:00 143360]
"OfficeScanNT Monitor"="C:\Program Files\Trend Micro\Client Server Security Agent\pccntmon.exe" [2005-11-02 23:32 372813]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-08-13 01:05 122939]
"UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2004-01-07 01:01 110592]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-04-26 08:04 53248]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-09-20 08:35 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-09-20 08:32 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-09-20 08:36 114688]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-04-19 08:24 180269]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 10:09 63712]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 18:51 39792]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-10 15:27 385024]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-01-15 03:22 267048]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-09-25 09:12 90112]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2007-05-08 09:28 1015808]
"Microsoft Update Machine"="dxegpq.exe" [2007-06-13 05:23 218721 C:\WINDOWS\system32\dxegpq.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"Microsoft Update Machine"="dxegpq.exe" [2007-06-13 05:23 218721 C:\WINDOWS\system32\dxegpq.exe]

C:\Documents and Settings\Andrew Rush\Start Menu\Programs\Startup\
palmOne Registration.lnk - C:\Program Files\palmOne\register.exe [2005-09-19 12:20:36 2367488]
Trillian.lnk - C:\Program Files\Trillian\trillian.exe [2007-12-11 1873280]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HOTSYNCSHORTCUTNAME.lnk - C:\Program Files\palmOne\Hotsync.exe [2004-06-09 13:27:34 471040]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoWelcomeScreen"= 1 (0x1)


.
Contents of the 'Scheduled Tasks' folder
"2008-01-31 03:56:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-01 09:19:39
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Trend Micro\Client Server Security Agent\ntrtscan.exe
C:\Program Files\Trend Micro\Client Server Security Agent\tmlisten.exe
C:\Program Files\Windows Media Player\WMPNetwk.exe
C:\WINDOWS\TEMP\DJ9F86.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Trend Micro\Client Server Security Agent\pccntmon.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\dxegpq.exe
C:\Program Files\Dot1XCfg\Dot1XCfg.exe
C:\Program Files\palmOne\Hotsync.exe
C:\Program Files\Trillian\trillian.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
.
**************************************************************************
.
Completion time: 2008-02-01 9:26:44 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-01 14:26:41
.
2008-01-09 13:37:08 --- E O F ---
 
And here is the HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:29, on 2008-02-01
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\Client Server Security Agent\ntrtscan.exe
C:\Program Files\Trend Micro\Client Server Security Agent\tmlisten.exe
C:\WINDOWS\TEMP\DJ9F86.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Trend Micro\Client Server Security Agent\pccntmon.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\dxegpq.exe
C:\Program Files\Dot1XCfg\Dot1XCfg.exe
C:\Program Files\palmOne\Hotsync.exe
C:\Program Files\Trillian\trillian.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\Client Server Security Agent\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [Microsoft Update Machine] dxegpq.exe
O4 - HKLM\..\RunServices: [Microsoft Update Machine] dxegpq.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Microsoft Update Machine] dxegpq.exe
O4 - HKCU\..\Run: [Dot1XCfg] C:\Program Files\Dot1XCfg\Dot1XCfg.exe
O4 - HKCU\..\Run: [Etnr] "C:\WINDOWS\WNSXS~1\smss.exe" -vt yazb
O4 - HKCU\..\Run: [Ckgkfzp] "H:\My Documents\a?sembly\r?gedit.exe"
O4 - Startup: palmOne Registration.lnk = C:\Program Files\palmOne\register.exe
O4 - Startup: Trillian.lnk = C:\Program Files\Trillian\trillian.exe
O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Program Files\palmOne\Hotsync.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - https://email1.uncg.edu/iNotes6W.cab
O16 - DPF: {A922B6AB-3B87-11D3-B3C2-0008C7DA6CB9} (InetDownload Class) - https://media.pineconeresearch.com/ActiveX/downloadcontrol.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = TSNetServer.local
O17 - HKLM\Software\..\Telephony: DomainName = TSNetServer.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = TSNetServer.local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = TSNetServer.local
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Trend Micro Client/Server Security Agent RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\Client Server Security Agent\ntrtscan.exe
O23 - Service: Trend Micro Client/Server Security Agent Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\Client Server Security Agent\tmlisten.exe
--
End of file - 8257 bytes

Thanks!
 
Before we start fixing anything you should print out these instructions or copy them to a NotePad file so they will be accessible. Some steps will require you to disconnect from the Internet or use Safe Mode and you will not have access to this page.

Please download SDFix by AndyManchesta and save it to your desktop.
When using this tool, you must use the Administrator's account or an account with "Administrative rights"
  • Double click SDFix.exe and it will extract the files to %systemdrive%
  • (this is the drive that contains the Windows Directory, typically C:\SDFix).
  • DO NOT use it just yet.
Reboot your computer in "Safe Mode" using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode".

Open the SDFix folder and double click RunThis.bat to start the script.
  • Type Y to begin the cleanup process.
  • It will remove any Trojan Services or Registry Entries found then prompt you to press any key to Reboot.
  • Press any Key and it will restart the PC.
  • When the PC restarts, the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
  • Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt.
  • Copy and paste the contents of the results file Report.txt in your next replyalong with a new HijackThis log.
-- If this error message is displayed when running SDFix: "The command prompt has been disabled by your administrator. Press any key to continue..."
Please go to Start Menu > Run > and copy/paste the following line:
%systemdrive%\SDFix\apps\swreg IMPORT %systemdrive%\SDFix\apps\Enable_Command_Prompt.reg
Press Ok and then run SDFix again.

-- If the Command Prompt window flashes on then off again on XP or Win 2000, please go to Start Menu > Run > and copy/paste the following line:
%systemdrive%\SDFix\apps\FixPath.exe /Q
Reboot and then run SDFix again.

-- If SDFix still does not run, check the %comspec% variable. Right-click My Computer > click Properties > Advanced > Environment Variables and check that the ComSpec variable points to cmd.exe.
%SystemRoot%\system32\cmd.exe

STEP #1

Go to Microsoft's website => http://support.microsoft.com/kb/310994
Select the download that's appropriate for his/her Operating System## Important ##
As we do not know the name of the file that's downloaded, you have to save the file as RC.exe to the root of SystemDrive e.g. C:\RC.exe



STEP #2

Download the latest copy of ComboFix.exe => http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Open notepad and copy/paste the text in the quotebox below into it:

Code: 
RecoveryConsole::
C:\RC.EXE

Save this as "CFScript"


CFScript.gif


Referring to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you, C:\CF-RC.txt. Post that log in your next reply.


## Important ##
This is a precautionary measure. Please do not reboot the machine until we have reviewed the log & responded to you.
 
SDFix: Version 1.136

Run by andrew rush on 02/04/2008 at 09:03 AM

Microsoft Windows XP [Version 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:18:41 AM, on 02/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\Client Server Security Agent\ntrtscan.exe
C:\Program Files\Trend Micro\Client Server Security Agent\tmlisten.exe
C:\WINDOWS\TEMP\OU7641.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Trend Micro\Client Server Security Agent\pccntmon.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\palmOne\Hotsync.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Trillian\trillian.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\Client Server Security Agent\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Etnr] "C:\WINDOWS\WNSXS~1\smss.exe" -vt yazb
O4 - HKCU\..\Run: [Ckgkfzp] "H:\My Documents\a?sembly\r?gedit.exe"
O4 - Startup: palmOne Registration.lnk = C:\Program Files\palmOne\register.exe
O4 - Startup: Trillian.lnk = C:\Program Files\Trillian\trillian.exe
O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Program Files\palmOne\Hotsync.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - https://email1.uncg.edu/iNotes6W.cab
O16 - DPF: {A922B6AB-3B87-11D3-B3C2-0008C7DA6CB9} (InetDownload Class) - https://media.pineconeresearch.com/ActiveX/downloadcontrol.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = TSNetServer.local
O17 - HKLM\Software\..\Telephony: DomainName = TSNetServer.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = TSNetServer.local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = TSNetServer.local
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Trend Micro Client/Server Security Agent RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\Client Server Security Agent\ntrtscan.exe
O23 - Service: Trend Micro Client/Server Security Agent Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\Client Server Security Agent\tmlisten.exe

--
End of file - 8042 bytes
 
Unfortunately, when i drag the notepad into combofix, it attempts to run, but then stops and gives me an error saying "C:\RC.EXE cannot be found"

Am i doing something wrong?
 
Hello fadingcaptain :)

Did you make sure that the recovery console you downloaded was saved to drive C:\ as RC.EXE?
 
Okay...got it. Here's the log:

RC.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
 
Excellent, let's get a new CF log and begin anew :)

  • Double click combofix.exe & follow the prompts.
  • When finished, it will produce a log. Please save that log to post in your next reply along with a fresh HJT log
  • Re-enable all the programs that were disabled during the running of ComboFix..

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
 
OK...here's the log:

ComboFix 08-02.05.3 - andrew rush 2008-02-08 15:37:56.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1491 [GMT -5:00]
Running from: C:\Documents and Settings\Andrew Rush\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

H:\My Documents\ASEMBL~1

.
((((((((((((((((((((((((( Files Created from 2008-01-08 to 2008-02-08 )))))))))))))))))))))))))))))))
.

2008-02-05 14:43 . 2004-08-03 23:00 260,272 --a------ C:\cmldr
2008-02-05 14:41 . 2008-02-05 14:41 4,608,744 --a------ C:\RC.exe
2008-02-04 08:52 . 2008-02-04 08:52 <DIR> d-------- C:\WINDOWS\ERUNT
2008-02-04 08:51 . 2008-02-05 10:26 <DIR> d-------- C:\SDFix
2008-02-01 09:41 . 2008-02-01 09:41 <DIR> d-------- C:\WINDOWS\system32\NtmsData
2008-02-01 09:09 . 2008-02-01 09:09 1,592,659 --a------ C:\ComboFix.exe
2008-01-31 14:31 . 2008-01-31 14:31 2,048 --a------ C:\WINDOWS\system32\drivers\356D4712-EA57-43AB-9903-27CBE1E5C165.cxv
2008-01-31 14:27 . 2008-01-31 14:27 4,096 --a------ C:\WINDOWS\system32\drivers\01BA01C3-FE4A-46B8-A3EF-4811773EC267.cxv
2008-01-31 14:25 . 2008-01-31 14:25 <DIR> d-------- C:\Program Files\Common Files\iS3
2008-01-31 14:25 . 2008-01-31 15:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\STOPzilla!
2008-01-31 13:04 . 2008-01-31 14:27 <DIR> d--hs---- C:\WINDOWS\T3duZXI
2008-01-31 12:54 . 2008-01-31 12:54 <DIR> d-------- C:\WINDOWS\system32\F1F4F3F3F7FBF
2008-01-30 12:20 . 2008-02-04 08:56 <DIR> d-------- C:\Program Files\Dot1XCfg
2008-01-24 12:11 . 2007-11-02 11:26 <DIR> d---s---- C:\Documents and Settings\ADMIN INTERN\UserData
2008-01-24 12:11 . 2007-10-31 13:13 <DIR> d-------- C:\Documents and Settings\ADMIN INTERN\Application Data\Sonic
2008-01-24 12:11 . 2007-10-25 08:57 <DIR> d-------- C:\Documents and Settings\ADMIN INTERN\Application Data\PureEdge
2008-01-24 12:11 . 2008-01-24 12:11 <DIR> d-------- C:\Documents and Settings\ADMIN INTERN\Application Data\HotSync
2008-01-24 12:11 . 2008-01-24 12:11 <DIR> d-------- C:\Documents and Settings\ADMIN INTERN\Application Data\ATI
2008-01-24 12:11 . 2007-12-14 10:16 <DIR> d-------- C:\Documents and Settings\ADMIN INTERN\Application Data\AdobeUM
2008-01-22 08:54 . 2008-01-22 08:54 <DIR> d-------- C:\Documents and Settings\Andrew Rush\Application Data\Move Networks
2008-01-18 15:29 . 2008-01-18 15:29 <DIR> d-------- C:\Program Files\Analog Devices
2008-01-18 15:29 . 2006-07-10 15:42 49,152 --a------ C:\WINDOWS\system32\DSndUp.exe
2008-01-18 15:29 . 2002-04-17 15:05 45,056 --a------ C:\WINDOWS\system32\CleanUp.exe
2008-01-18 15:06 . 2007-06-12 17:05 920,344 --a------ C:\WINDOWS\system32\heciudlg.exe
2008-01-18 15:06 . 2007-06-12 17:05 45,056 --a------ C:\WINDOWS\system32\drivers\HECI.sys
2008-01-18 14:59 . 2008-01-18 14:59 <DIR> d-------- C:\Documents and Settings\Andrew Rush\Application Data\ATI
2008-01-18 14:53 . 2007-07-12 21:31 5,431,296 --a------ C:\WINDOWS\system32\atioglxx.dll
2008-01-18 14:53 . 2007-06-12 17:05 319,456 --a------ C:\WINDOWS\system32\difxapi.dll
2008-01-18 14:52 . 2001-09-19 13:47 765,952 --a------ C:\WINDOWS\system\crlds3d.dll
2008-01-18 14:52 . 2006-03-17 18:18 392,960 --a------ C:\WINDOWS\system32\drivers\senfilt.sys
2008-01-18 14:52 . 2007-05-11 15:21 306,176 --a------ C:\WINDOWS\system32\drivers\ADIHdAud.sys
2008-01-18 14:52 . 2007-03-27 10:36 28,160 --a------ C:\WINDOWS\system32\PostProc.dll
2008-01-18 14:50 . 2008-01-18 14:50 <DIR> d-------- C:\WINDOWS\system32\vmm32
2008-01-18 14:50 . 2008-01-18 14:50 <DIR> d-------- C:\Program Files\Dell
2008-01-18 14:43 . 2008-01-18 15:03 <DIR> d-------- C:\Program Files\Intel
2008-01-18 14:42 . 2008-01-18 14:42 <DIR> d-------- C:\Intel
2008-01-18 14:39 . 2007-04-13 13:33 254,872 --a------ C:\WINDOWS\system32\drivers\e1e5132.sys
2008-01-18 14:39 . 2007-01-17 15:59 179,048 --a------ C:\WINDOWS\system32\e1000msg.dll
2008-01-18 14:39 . 2007-01-17 16:02 66,424 --a------ C:\WINDOWS\system32\NicEtCoE.dll
2008-01-18 14:39 . 2007-01-29 14:36 62,840 --a------ C:\WINDOWS\system32\NicInstE.dll
2008-01-18 14:39 . 2007-01-17 16:02 28,536 --a------ C:\WINDOWS\system32\NicCo.dll
2008-01-18 14:39 . 2006-06-02 17:00 2,889 --a------ C:\WINDOWS\system32\e1e5132.din
2008-01-18 14:28 . 2008-01-18 14:28 0 --a------ C:\WINDOWS\ativpsrm.bin
2008-01-18 14:24 . 2008-01-18 14:54 <DIR> d-------- C:\Program Files\ATI Technologies
2008-01-18 14:24 . 2007-07-12 21:15 520,192 --a------ C:\WINDOWS\system32\ati2sgag.exe
2008-01-17 08:21 . 2008-01-17 08:21 <DIR> d-------- C:\Program Files\iPod
2008-01-10 15:27 . 2008-01-10 15:27 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
2008-01-10 15:27 . 2008-01-10 15:27 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts
2008-01-08 09:15 . 2008-01-08 09:15 <DIR> d-------- C:\Program Files\Snood

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-08 20:39 --------- d-----w C:\Program Files\Trillian
2008-02-08 13:48 --------- d-----w C:\Program Files\Soulseek
2008-02-04 13:24 --------- d-----w C:\Documents and Settings\Andrew Rush\Application Data\Azureus
2008-01-31 20:40 --------- d-----w C:\Program Files\Common Files\Adobe
2008-01-31 20:03 --------- d-----w C:\Program Files\Trend Micro
2008-01-25 17:39 --------- d-----w C:\Documents and Settings\All Users\Application Data\FLEXnet
2008-01-18 20:29 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-17 13:22 --------- d-----w C:\Program Files\iTunes
2008-01-17 13:19 --------- d-----w C:\Program Files\QuickTime
2008-01-08 14:10 --------- d-----w C:\Program Files\Azureus
2008-01-08 13:33 --------- d-----w C:\Program Files\Common Files\Peach
2007-12-10 04:27 --------- d-----w C:\Documents and Settings\wardrobe intern\Application Data\Apple Computer
2007-06-13 10:23 218,721 --sha-r C:\WINDOWS\system32\dxegpq.exe
2005-08-02 21:46 187,904 --sha-r C:\WINDOWS\T3duZXI\asappsrv.dll
2005-07-29 21:24 472 --sha-r C:\WINDOWS\T3duZXI\naxRtrK.vbs
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-30 08:01 68856]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 19:05 204288]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:00 15360]
"Etnr"="C:\WINDOWS\WNSXS~1\smss.exe" [ ]
"Ckgkfzp"="H:\My Documents\a?sembly\r?gedit.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11 132496]
"Synchronization Manager"="C:\WINDOWS\system32\mobsync.exe" [2004-08-04 07:00 143360]
"OfficeScanNT Monitor"="C:\Program Files\Trend Micro\Client Server Security Agent\pccntmon.exe" [2005-11-02 23:32 372813]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-08-13 01:05 122939]
"UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2004-01-07 01:01 110592]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-04-26 08:04 53248]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-09-20 08:35 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-09-20 08:32 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-09-20 08:36 114688]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-04-19 08:24 180269]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 10:09 63712]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 18:51 39792]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-10 15:27 385024]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-01-15 03:22 267048]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-09-25 09:12 90112]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2007-05-08 09:28 1015808]

C:\Documents and Settings\Andrew Rush\Start Menu\Programs\Startup\
palmOne Registration.lnk - C:\Program Files\palmOne\register.exe [2005-09-19 12:20:36 2367488]
Trillian.lnk - C:\Program Files\Trillian\trillian.exe [2007-12-11 1873280]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HOTSYNCSHORTCUTNAME.lnk - C:\Program Files\palmOne\Hotsync.exe [2004-06-09 13:27:34 471040]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoWelcomeScreen"= 1 (0x1)


.
Contents of the 'Scheduled Tasks' folder
"2008-02-07 03:56:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-08 15:42:03
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-08 15:43:33
ComboFix-quarantined-files.txt 2008-02-08 20:42:42
ComboFix2.txt 2008-02-01 14:26:44
.
2008-01-09 13:37:08 --- E O F ---
 
And here's the fresh HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:50, on 2008-02-08
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\Client Server Security Agent\ntrtscan.exe
C:\Program Files\Trend Micro\Client Server Security Agent\tmlisten.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Trend Micro\Client Server Security Agent\pccntmon.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\palmOne\Hotsync.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceHelper.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\distnoted.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\Client Server Security Agent\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Etnr] "C:\WINDOWS\WNSXS~1\smss.exe" -vt yazb
O4 - HKCU\..\Run: [Ckgkfzp] "H:\My Documents\a?sembly\r?gedit.exe"
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
O4 - Startup: palmOne Registration.lnk = C:\Program Files\palmOne\register.exe
O4 - Startup: Trillian.lnk = C:\Program Files\Trillian\trillian.exe
O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Program Files\palmOne\Hotsync.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - https://email1.uncg.edu/iNotes6W.cab
O16 - DPF: {A922B6AB-3B87-11D3-B3C2-0008C7DA6CB9} (InetDownload Class) - https://media.pineconeresearch.com/ActiveX/downloadcontrol.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = TSNetServer.local
O17 - HKLM\Software\..\Telephony: DomainName = TSNetServer.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = TSNetServer.local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = TSNetServer.local
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Trend Micro Client/Server Security Agent RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\Client Server Security Agent\ntrtscan.exe
O23 - Service: Trend Micro Client/Server Security Agent Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\Client Server Security Agent\tmlisten.exe

--
End of file - 8004 bytes
 
Hello fadingcaptain :)

Jotti File Submission:
  • Please go to Jotti's malware scan
  • Copy and paste the following file path into the "File to upload & scan"box on the top of the page:
    • C:\WINDOWS\system32\dxegpq.exe
  • Click on the submit button
  • Please post the results in your next reply.

1. Please open Notepad
  • Click Start , then Run
  • Type notepad .exe in the Run Box.
2. Now copy/paste the entire content of the codebox below into the Notepad window:
File::
C:\WINDOWS\system32\drivers\356D4712-EA57-43AB-9903-27CBE1E5C165.cxv
C:\WINDOWS\system32\drivers\01BA01C3-FE4A-46B8-A3EF-4811773EC267.cxv
DirLook::
C:\WINDOWS\system32\F1F4F3F3F7FBF
C:\Program Files\Dot1XCfg
Folder::
C:\WINDOWS\T3duZXI
Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Etnr"=-
"Ckgkfzp"=-
Click to expand...

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Save the above as CFScript.txt

4. Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.

5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

CFScript.gif



6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next replyafter you re-enable all the programs that were disabled during the running of ComboFix:
  • Combofix.txt
  • A new HijackThis log.
Please take note:

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
 
Jotti Results:
Scan taken on 11 Feb 2008 13:53:24 (GMT)
A-Squared
Found Backdoor.Win32.Rbot.ghb
AntiVir
Found WORM/Rbot.218721
ArcaVir
Found Trojan.Rbot.Ghb
Avast
Found nothing
AVG Antivirus
Found IRC/BackDoor.SdBot3.YJO
BitDefender
Found Backdoor.IRCBot.ABHS
ClamAV
Found Trojan.Pakes-994
CPsecure
Found nothing
Dr.Web
Found nothing
F-Prot Antivirus
Found nothing
F-Secure Anti-Virus
Found Backdoor.Win32.Rbot.ghb
Fortinet
Found W32/RBot.GHB!tr.bdr
Ikarus
Found Backdoor.Win32.Rbot.ghb
Kaspersky Anti-Virus
Found Backdoor.Win32.Rbot.ghb
NOD32
Found Win32/Rbot
Norman Virus Control
Found nothing
Panda Antivirus
Found nothing
Rising Antivirus
Found nothing
Sophos Antivirus
Found Mal/Generic-A
VirusBuster
Found Worm.Rbot.VDO
VBA32
Found Backdoor.Win32.Rbot.ghb
 
ComboFix log:

ComboFix 08-02.05.3 - andrew rush 2008-02-11 8:49:41.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1393 [GMT -5:00]
Running from: C:\Documents and Settings\Andrew Rush\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Andrew Rush\Desktop\CFScript.txt
* Created a new restore point

FILE
C:\WINDOWS\system32\drivers\01BA01C3-FE4A-46B8-A3EF-4811773EC267.cxv
C:\WINDOWS\system32\drivers\356D4712-EA57-43AB-9903-27CBE1E5C165.cxv
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\drivers\01BA01C3-FE4A-46B8-A3EF-4811773EC267.cxv
C:\WINDOWS\system32\drivers\356D4712-EA57-43AB-9903-27CBE1E5C165.cxv
C:\WINDOWS\T3duZXI
C:\WINDOWS\T3duZXI\asappsrv.dll
C:\WINDOWS\T3duZXI\naxRtrK.vbs

.
((((((((((((((((((((((((( Files Created from 2008-01-11 to 2008-02-11 )))))))))))))))))))))))))))))))
.

2008-02-10 13:03 . 2008-02-10 13:03 <DIR> d-------- C:\Documents and Settings\tsguest.TSNETSERVER\Application Data\ATI
2008-02-05 14:43 . 2004-08-03 23:00 260,272 --a------ C:\cmldr
2008-02-05 14:41 . 2008-02-05 14:41 4,608,744 --a------ C:\RC.exe
2008-02-05 10:38 . 2004-08-04 07:00 388,608 --a------ C:\kmd.exe
2008-02-04 08:52 . 2008-02-04 08:52 <DIR> d-------- C:\WINDOWS\ERUNT
2008-02-04 08:51 . 2008-02-05 10:26 <DIR> d-------- C:\SDFix
2008-02-01 09:41 . 2008-02-01 09:41 <DIR> d-------- C:\WINDOWS\system32\NtmsData
2008-02-01 09:09 . 2008-02-01 09:09 1,592,659 --a------ C:\ComboFix.exe
2008-01-31 14:25 . 2008-01-31 14:25 <DIR> d-------- C:\Program Files\Common Files\iS3
2008-01-31 14:25 . 2008-01-31 15:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\STOPzilla!
2008-01-31 12:54 . 2008-01-31 12:54 <DIR> d-------- C:\WINDOWS\system32\F1F4F3F3F7FBF
2008-01-30 12:20 . 2008-02-04 08:56 <DIR> d-------- C:\Program Files\Dot1XCfg
2008-01-24 12:11 . 2007-11-02 11:26 <DIR> d---s---- C:\Documents and Settings\ADMIN INTERN\UserData
2008-01-24 12:11 . 2007-10-31 13:13 <DIR> d-------- C:\Documents and Settings\ADMIN INTERN\Application Data\Sonic
2008-01-24 12:11 . 2007-10-25 08:57 <DIR> d-------- C:\Documents and Settings\ADMIN INTERN\Application Data\PureEdge
2008-01-24 12:11 . 2008-01-24 12:11 <DIR> d-------- C:\Documents and Settings\ADMIN INTERN\Application Data\HotSync
2008-01-24 12:11 . 2008-01-24 12:11 <DIR> d-------- C:\Documents and Settings\ADMIN INTERN\Application Data\ATI
2008-01-24 12:11 . 2007-12-14 10:16 <DIR> d-------- C:\Documents and Settings\ADMIN INTERN\Application Data\AdobeUM
2008-01-22 08:54 . 2008-01-22 08:54 <DIR> d-------- C:\Documents and Settings\Andrew Rush\Application Data\Move Networks
2008-01-18 15:29 . 2008-01-18 15:29 <DIR> d-------- C:\Program Files\Analog Devices
2008-01-18 15:29 . 2006-07-10 15:42 49,152 --a------ C:\WINDOWS\system32\DSndUp.exe
2008-01-18 15:29 . 2002-04-17 15:05 45,056 --a------ C:\WINDOWS\system32\CleanUp.exe
2008-01-18 15:06 . 2007-06-12 17:05 920,344 --a------ C:\WINDOWS\system32\heciudlg.exe
2008-01-18 15:06 . 2007-06-12 17:05 45,056 --a------ C:\WINDOWS\system32\drivers\HECI.sys
2008-01-18 14:59 . 2008-01-18 14:59 <DIR> d-------- C:\Documents and Settings\Andrew Rush\Application Data\ATI
2008-01-18 14:53 . 2007-07-12 21:31 5,431,296 --a------ C:\WINDOWS\system32\atioglxx.dll
2008-01-18 14:53 . 2007-06-12 17:05 319,456 --a------ C:\WINDOWS\system32\difxapi.dll
2008-01-18 14:52 . 2001-09-19 13:47 765,952 --a------ C:\WINDOWS\system\crlds3d.dll
2008-01-18 14:52 . 2006-03-17 18:18 392,960 --a------ C:\WINDOWS\system32\drivers\senfilt.sys
2008-01-18 14:52 . 2007-05-11 15:21 306,176 --a------ C:\WINDOWS\system32\drivers\ADIHdAud.sys
2008-01-18 14:52 . 2007-03-27 10:36 28,160 --a------ C:\WINDOWS\system32\PostProc.dll
2008-01-18 14:50 . 2008-01-18 14:50 <DIR> d-------- C:\WINDOWS\system32\vmm32
2008-01-18 14:50 . 2008-01-18 14:50 <DIR> d-------- C:\Program Files\Dell
2008-01-18 14:43 . 2008-01-18 15:03 <DIR> d-------- C:\Program Files\Intel
2008-01-18 14:42 . 2008-01-18 14:42 <DIR> d-------- C:\Intel
2008-01-18 14:39 . 2007-04-13 13:33 254,872 --a------ C:\WINDOWS\system32\drivers\e1e5132.sys
2008-01-18 14:39 . 2007-01-17 15:59 179,048 --a------ C:\WINDOWS\system32\e1000msg.dll
2008-01-18 14:39 . 2007-01-17 16:02 66,424 --a------ C:\WINDOWS\system32\NicEtCoE.dll
2008-01-18 14:39 . 2007-01-29 14:36 62,840 --a------ C:\WINDOWS\system32\NicInstE.dll
2008-01-18 14:39 . 2007-01-17 16:02 28,536 --a------ C:\WINDOWS\system32\NicCo.dll
2008-01-18 14:39 . 2006-06-02 17:00 2,889 --a------ C:\WINDOWS\system32\e1e5132.din
2008-01-18 14:28 . 2008-01-18 14:28 0 --a------ C:\WINDOWS\ativpsrm.bin
2008-01-18 14:24 . 2008-01-18 14:54 <DIR> d-------- C:\Program Files\ATI Technologies
2008-01-18 14:24 . 2007-07-12 21:15 520,192 --a------ C:\WINDOWS\system32\ati2sgag.exe
2008-01-17 08:21 . 2008-01-17 08:21 <DIR> d-------- C:\Program Files\iPod

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-08 20:39 --------- d-----w C:\Program Files\Trillian
2008-02-08 13:48 --------- d-----w C:\Program Files\Soulseek
2008-02-04 13:24 --------- d-----w C:\Documents and Settings\Andrew Rush\Application Data\Azureus
2008-01-31 20:40 --------- d-----w C:\Program Files\Common Files\Adobe
2008-01-31 20:03 --------- d-----w C:\Program Files\Trend Micro
2008-01-25 17:39 --------- d-----w C:\Documents and Settings\All Users\Application Data\FLEXnet
2008-01-18 20:29 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-17 13:22 --------- d-----w C:\Program Files\iTunes
2008-01-17 13:19 --------- d-----w C:\Program Files\QuickTime
2008-01-08 14:15 --------- d-----w C:\Program Files\Snood
2008-01-08 14:10 --------- d-----w C:\Program Files\Azureus
2008-01-08 13:33 --------- d-----w C:\Program Files\Common Files\Peach
2007-06-13 10:23 218,721 --sha-r C:\WINDOWS\system32\dxegpq.exe
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

---- Directory of C:\Program Files\Dot1XCfg ----


---- Directory of C:\WINDOWS\system32\F1F4F3F3F7FBF ----

2008-01-31 12:54 13988 --a------ C:\WINDOWS\system32\F1F4F3F3F7FBF\242726262A2E2


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-30 08:01 68856]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 19:05 204288]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:00 15360]
"AdobeUpdater"="C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-02-28 22:06 2321600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11 132496]
"Synchronization Manager"="C:\WINDOWS\system32\mobsync.exe" [2004-08-04 07:00 143360]
"OfficeScanNT Monitor"="C:\Program Files\Trend Micro\Client Server Security Agent\pccntmon.exe" [2005-11-02 23:32 372813]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-08-13 01:05 122939]
"UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2004-01-07 01:01 110592]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-04-26 08:04 53248]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-09-20 08:35 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-09-20 08:32 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-09-20 08:36 114688]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-04-19 08:24 180269]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 10:09 63712]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 18:51 39792]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-10 15:27 385024]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-01-15 03:22 267048]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-09-25 09:12 90112]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2007-05-08 09:28 1015808]

C:\Documents and Settings\Andrew Rush\Start Menu\Programs\Startup\
palmOne Registration.lnk - C:\Program Files\palmOne\register.exe [2005-09-19 12:20:36 2367488]
Trillian.lnk - C:\Program Files\Trillian\trillian.exe [2007-12-11 1873280]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HOTSYNCSHORTCUTNAME.lnk - C:\Program Files\palmOne\Hotsync.exe [2004-06-09 13:27:34 471040]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoWelcomeScreen"= 1 (0x1)


.
Contents of the 'Scheduled Tasks' folder
"2008-02-07 03:56:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-11 08:50:21
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-11 8:51:27
ComboFix-quarantined-files.txt 2008-02-11 13:50:49
ComboFix2.txt 2008-02-08 20:43:33
ComboFix3.txt 2008-02-01 14:26:44
.
2008-01-09 13:37:08 --- E O F ---
 
HJT Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:57, on 2008-02-11
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\Client Server Security Agent\ntrtscan.exe
C:\Program Files\Trend Micro\Client Server Security Agent\tmlisten.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Trend Micro\Client Server Security Agent\pccntmon.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\palmOne\Hotsync.exe
C:\Program Files\Trillian\trillian.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Sage Software\Peachtree\peachw.exe
C:\Program Files\Sage Software\Peachtree\W32MKDE.EXE
C:\WINDOWS\explorer.exe
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceHelper.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\distnoted.exe
C:\WINDOWS\system32\dxegpq.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\Client Server Security Agent\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [Microsoft Update Machine] dxegpq.exe
O4 - HKLM\..\RunServices: [Microsoft Update Machine] dxegpq.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
O4 - HKCU\..\Run: [Microsoft Update Machine] dxegpq.exe
O4 - HKUS\S-1-5-21-1312592511-137365415-2714469920-1137\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User '?')
O4 - HKUS\S-1-5-21-1312592511-137365415-2714469920-1137\..\Run: [Aim6] "C:\Program Files\Common Files\AOL\Launch\AOLLaunch.exe" /d locale=en-US ee://aol/imApp (User '?')
O4 - HKUS\S-1-5-21-1312592511-137365415-2714469920-1157\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User '?')
O4 - Startup: palmOne Registration.lnk = C:\Program Files\palmOne\register.exe
O4 - Startup: Trillian.lnk = C:\Program Files\Trillian\trillian.exe
O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Program Files\palmOne\Hotsync.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - https://email1.uncg.edu/iNotes6W.cab
O16 - DPF: {A922B6AB-3B87-11D3-B3C2-0008C7DA6CB9} (InetDownload Class) - https://media.pineconeresearch.com/ActiveX/downloadcontrol.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = TSNetServer.local
O17 - HKLM\Software\..\Telephony: DomainName = TSNetServer.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = TSNetServer.local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = TSNetServer.local
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Trend Micro Client/Server Security Agent RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\Client Server Security Agent\ntrtscan.exe
O23 - Service: Trend Micro Client/Server Security Agent Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\Client Server Security Agent\tmlisten.exe

--
End of file - 8720 bytes
 
Hello fadingcaptain :)

A. Please RUN HijackThis
  1. Click the SCAN button to produce a log.

  2. Place a check mark beside each one of the following items:

    O4 - HKLM\..\Run: [Microsoft Update Machine] dxegpq.exe
    O4 - HKLM\..\RunServices: [Microsoft Update Machine] dxegpq.exe
    O4 - HKCU\..\Run: [Microsoft Update Machine] dxegpq.exe

  3. Now with all the items selected, and all windows closed except for HJT, delete them by clicking the FIX checked button. Close the HijackThis window.
B. 1. Please open Notepad
  • Click Start , then Run
  • Type notepad .exe in the Run Box.
2. Now copy/paste the entire content of the codebox below into the Notepad window:

http://forums.spybot.info/showthread.php?p=163561#post163561

Collect::[27]
C:\WINDOWS\system32\dxegpq.exe
Folder::
C:\WINDOWS\system32\F1F4F3F3F7FBF
C:\Program Files\Dot1XCfg
Click to expand...
3. Save the above as CFScript.txt

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

4. Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.

5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

CFScript.gif



6. Additonally, ComboFix will generate the following files on your desktop
  • A zipped file on your desktop called Submit [Date Time].zip
  • And another file named - CF-Submit.htm
7. ComboFix may need to reboot to finish its work. Let it.

8. When CF has finished running, it will generate the ComboFix.log which will appear on your screen.

9. Next, a window will popup prompting you to "Submit Files for further analysis". Click "OK" but first, re-enable all the programs that were disabled during the running of ComboFix.

10. Your system's browser will automatically respond by loading the CF-Submit.htm file and open a window :
  • Click the "Browse" button and locate the Submit [Date Time].zip file on your desktop.
  • Click on the file to Select it.
  • Submit the file by clicking "OK"
11. Post the following reports/logs into your next reply:
  • Combofix.txt
  • A new HijackThis log.
CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
 
It was submitted successfully...

Combofix Log:

ComboFix 08-02.05.3 - andrew rush 2008-02-12 14:52:07.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1475 [GMT -5:00]
Running from: C:\Documents and Settings\Andrew Rush\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Andrew Rush\Desktop\CFScript.txt
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\Dot1XCfg
C:\WINDOWS\system32\dxegpq.exe
C:\WINDOWS\system32\F1F4F3F3F7FBF
C:\WINDOWS\system32\F1F4F3F3F7FBF\242726262A2E2

.
((((((((((((((((((((((((( Files Created from 2008-01-12 to 2008-02-12 )))))))))))))))))))))))))))))))
.

2008-02-12 10:20 . 2008-02-12 10:20 <DIR> d-------- C:\WINDOWS\LastGood
2008-02-12 10:20 . 2008-02-12 10:20 <DIR> d-------- C:\Program Files\Pocket Tunes
2008-02-11 15:48 . 2008-02-11 15:48 <DIR> d-------- C:\Program Files\NoviiMedia
2008-02-11 08:49 . 2004-08-04 07:00 388,608 --a------ C:\kmd.exe
2008-02-10 13:03 . 2008-02-10 13:03 <DIR> d-------- C:\Documents and Settings\tsguest.TSNETSERVER\Application Data\ATI
2008-02-05 14:43 . 2004-08-03 23:00 260,272 --a------ C:\cmldr
2008-02-05 14:41 . 2008-02-05 14:41 4,608,744 --a------ C:\RC.exe
2008-02-04 08:52 . 2008-02-04 08:52 <DIR> d-------- C:\WINDOWS\ERUNT
2008-02-04 08:51 . 2008-02-05 10:26 <DIR> d-------- C:\SDFix
2008-02-01 09:41 . 2008-02-01 09:41 <DIR> d-------- C:\WINDOWS\system32\NtmsData
2008-02-01 09:09 . 2008-02-01 09:09 1,592,659 --a------ C:\ComboFix.exe
2008-01-31 14:25 . 2008-01-31 14:25 <DIR> d-------- C:\Program Files\Common Files\iS3
2008-01-31 14:25 . 2008-01-31 15:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\STOPzilla!
2008-01-24 12:11 . 2007-11-02 11:26 <DIR> d---s---- C:\Documents and Settings\ADMIN INTERN\UserData
2008-01-24 12:11 . 2007-10-31 13:13 <DIR> d-------- C:\Documents and Settings\ADMIN INTERN\Application Data\Sonic
2008-01-24 12:11 . 2007-10-25 08:57 <DIR> d-------- C:\Documents and Settings\ADMIN INTERN\Application Data\PureEdge
2008-01-24 12:11 . 2008-01-24 12:11 <DIR> d-------- C:\Documents and Settings\ADMIN INTERN\Application Data\HotSync
2008-01-24 12:11 . 2008-01-24 12:11 <DIR> d-------- C:\Documents and Settings\ADMIN INTERN\Application Data\ATI
2008-01-24 12:11 . 2007-12-14 10:16 <DIR> d-------- C:\Documents and Settings\ADMIN INTERN\Application Data\AdobeUM
2008-01-22 08:54 . 2008-01-22 08:54 <DIR> d-------- C:\Documents and Settings\Andrew Rush\Application Data\Move Networks
2008-01-18 15:29 . 2008-01-18 15:29 <DIR> d-------- C:\Program Files\Analog Devices
2008-01-18 15:29 . 2006-07-10 15:42 49,152 --a------ C:\WINDOWS\system32\DSndUp.exe
2008-01-18 15:29 . 2002-04-17 15:05 45,056 --a------ C:\WINDOWS\system32\CleanUp.exe
2008-01-18 15:06 . 2007-06-12 17:05 920,344 --a------ C:\WINDOWS\system32\heciudlg.exe
2008-01-18 15:06 . 2007-06-12 17:05 45,056 --a------ C:\WINDOWS\system32\drivers\HECI.sys
2008-01-18 14:59 . 2008-01-18 14:59 <DIR> d-------- C:\Documents and Settings\Andrew Rush\Application Data\ATI
2008-01-18 14:53 . 2007-07-12 21:31 5,431,296 --a------ C:\WINDOWS\system32\atioglxx.dll
2008-01-18 14:53 . 2007-06-12 17:05 319,456 --a------ C:\WINDOWS\system32\difxapi.dll
2008-01-18 14:52 . 2001-09-19 13:47 765,952 --a------ C:\WINDOWS\system\crlds3d.dll
2008-01-18 14:52 . 2006-03-17 18:18 392,960 --a------ C:\WINDOWS\system32\drivers\senfilt.sys
2008-01-18 14:52 . 2007-05-11 15:21 306,176 --a------ C:\WINDOWS\system32\drivers\ADIHdAud.sys
2008-01-18 14:52 . 2007-03-27 10:36 28,160 --a------ C:\WINDOWS\system32\PostProc.dll
2008-01-18 14:50 . 2008-01-18 14:50 <DIR> d-------- C:\WINDOWS\system32\vmm32
2008-01-18 14:50 . 2008-01-18 14:50 <DIR> d-------- C:\Program Files\Dell
2008-01-18 14:43 . 2008-01-18 15:03 <DIR> d-------- C:\Program Files\Intel
2008-01-18 14:42 . 2008-01-18 14:42 <DIR> d-------- C:\Intel
2008-01-18 14:39 . 2007-04-13 13:33 254,872 --a------ C:\WINDOWS\system32\drivers\e1e5132.sys
2008-01-18 14:39 . 2007-01-17 15:59 179,048 --a------ C:\WINDOWS\system32\e1000msg.dll
2008-01-18 14:39 . 2007-01-17 16:02 66,424 --a------ C:\WINDOWS\system32\NicEtCoE.dll
2008-01-18 14:39 . 2007-01-29 14:36 62,840 --a------ C:\WINDOWS\system32\NicInstE.dll
2008-01-18 14:39 . 2007-01-17 16:02 28,536 --a------ C:\WINDOWS\system32\NicCo.dll
2008-01-18 14:39 . 2006-06-02 17:00 2,889 --a------ C:\WINDOWS\system32\e1e5132.din
2008-01-18 14:28 . 2008-01-18 14:28 0 --a------ C:\WINDOWS\ativpsrm.bin
2008-01-18 14:24 . 2008-01-18 14:54 <DIR> d-------- C:\Program Files\ATI Technologies
2008-01-18 14:24 . 2007-07-12 21:15 520,192 --a------ C:\WINDOWS\system32\ati2sgag.exe
2008-01-17 08:21 . 2008-01-17 08:21 <DIR> d-------- C:\Program Files\iPod

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-12 15:03 --------- d-----w C:\Documents and Settings\Andrew Rush\Application Data\Azureus
2008-02-11 21:48 --------- d-----w C:\Program Files\Trillian
2008-02-08 13:48 --------- d-----w C:\Program Files\Soulseek
2008-01-31 20:40 --------- d-----w C:\Program Files\Common Files\Adobe
2008-01-31 20:03 --------- d-----w C:\Program Files\Trend Micro
2008-01-25 17:39 --------- d-----w C:\Documents and Settings\All Users\Application Data\FLEXnet
2008-01-18 20:29 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-17 13:22 --------- d-----w C:\Program Files\iTunes
2008-01-17 13:19 --------- d-----w C:\Program Files\QuickTime
2008-01-08 14:15 --------- d-----w C:\Program Files\Snood
2008-01-08 14:10 --------- d-----w C:\Program Files\Azureus
2008-01-08 13:33 --------- d-----w C:\Program Files\Common Files\Peach
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-30 08:01 68856]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:00 15360]
"AdobeUpdater"="C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-02-28 22:06 2321600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11 132496]
"Synchronization Manager"="C:\WINDOWS\system32\mobsync.exe" [2004-08-04 07:00 143360]
"OfficeScanNT Monitor"="C:\Program Files\Trend Micro\Client Server Security Agent\pccntmon.exe" [2005-11-02 23:32 372813]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-08-13 01:05 122939]
"UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2004-01-07 01:01 110592]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-04-26 08:04 53248]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-09-20 08:35 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-09-20 08:32 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-09-20 08:36 114688]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-04-19 08:24 180269]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 10:09 63712]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 18:51 39792]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-10 15:27 385024]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-01-15 03:22 267048]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-09-25 09:12 90112]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2007-05-08 09:28 1015808]

C:\Documents and Settings\Andrew Rush\Start Menu\Programs\Startup\
palmOne Registration.lnk - C:\Program Files\palmOne\register.exe [2005-09-19 12:20:36 2367488]
Trillian.lnk - C:\Program Files\Trillian\trillian.exe [2007-12-11 1873280]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HOTSYNCSHORTCUTNAME.lnk - C:\Program Files\palmOne\Hotsync.exe [2004-06-09 13:27:34 471040]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoWelcomeScreen"= 1 (0x1)


*Newly Created Service* - WUDFPF
*Newly Created Service* - WUDFSVC
.
Contents of the 'Scheduled Tasks' folder
"2008-02-07 03:56:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-12 14:52:42
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-12 14:53:31
ComboFix-quarantined-files.txt 2008-02-12 19:52:59
ComboFix2.txt 2008-02-11 13:51:27
ComboFix3.txt 2008-02-08 20:43:33
ComboFix4.txt 2008-02-01 14:26:44
.
2008-01-09 13:37:08 --- E O F ---
 
New HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:55, on 2008-02-12
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\Client Server Security Agent\ntrtscan.exe
C:\Program Files\Trend Micro\Client Server Security Agent\tmlisten.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Trend Micro\Client Server Security Agent\pccntmon.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\palmOne\Hotsync.exe
C:\Program Files\Trillian\trillian.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\Client Server Security Agent\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
O4 - Startup: palmOne Registration.lnk = C:\Program Files\palmOne\register.exe
O4 - Startup: Trillian.lnk = C:\Program Files\Trillian\trillian.exe
O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Program Files\palmOne\Hotsync.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - https://email1.uncg.edu/iNotes6W.cab
O16 - DPF: {A922B6AB-3B87-11D3-B3C2-0008C7DA6CB9} (InetDownload Class) - https://media.pineconeresearch.com/ActiveX/downloadcontrol.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = TSNetServer.local
O17 - HKLM\Software\..\Telephony: DomainName = TSNetServer.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = TSNetServer.local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = TSNetServer.local
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Trend Micro Client/Server Security Agent RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\Client Server Security Agent\ntrtscan.exe
O23 - Service: Trend Micro Client/Server Security Agent Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\Client Server Security Agent\tmlisten.exe

--
End of file - 7726 bytes
 
You must log in or register to reply here.
Back
Top