smithfraud-c

M

mtellez

New member
need help with smithfruad. Can you help? have read several threads from other forums and want to get it right the first time.
 
Hjt log

Here is the HJT

ComboFix 08-03-27.1 - Thomas 2008-03-28 14:09:18.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.254 [GMT -5:00]
Running from: C:\Documents and Settings\Thomas\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Thomas\Application Data\WNSXS~1
C:\Documents and Settings\Thomas\Application Data\WNSXS~1\??rss.exe
C:\Program Files\install provider
C:\Program Files\install provider\InstallProvider.dlldat
C:\Program Files\JavaCore
C:\Program Files\JavaCore\JavaCore.exe
C:\Program Files\JavaCore\UnInstall.exe
C:\Program Files\MSN\lavufawe17.dll
C:\Program Files\MSN\lavufawe29.dll
C:\Program Files\MSN\lavufawe320.dll
C:\Program Files\MSN\lavufawe373.dll
C:\Program Files\NoDNS
C:\Program Files\NoDNS\UnInstall.exe
C:\Program Files\outerinfo
C:\Program Files\Temporary
C:\Temp\isgTi19
C:\temp\tn3
C:\WINDOWS\BMc3157e93.xml
C:\WINDOWS\cookies.ini
C:\WINDOWS\mbols~1
C:\WINDOWS\mbols~1\??mbols\
C:\WINDOWS\mbols~1\scanregw.exe
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\bbrqncxt.dll
C:\WINDOWS\system32\d4
C:\WINDOWS\system32\dsgrgnkn.dll
C:\WINDOWS\system32\e5
C:\WINDOWS\system32\e5\idencom1.exe
C:\WINDOWS\system32\eeowvkrr.dll
C:\WINDOWS\system32\fsrwqjvk.dll
C:\WINDOWS\system32\ftshelkp.ini
C:\WINDOWS\system32\g7
C:\WINDOWS\system32\gnwmhucu.dll
C:\WINDOWS\system32\hgnrjvno.dll
C:\WINDOWS\system32\hxtggcey.dll
C:\WINDOWS\system32\ihkmp.ini
C:\WINDOWS\system32\ihkmp.ini2
C:\WINDOWS\system32\ijkkj.ini
C:\WINDOWS\system32\ijkkj.ini2
C:\WINDOWS\system32\irqxmctd.dll
C:\WINDOWS\system32\jkkji.dll
C:\WINDOWS\system32\lvrdatcd.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\nGpxx07
C:\WINDOWS\system32\nGpxx07\nGpxx071084.exe
C:\WINDOWS\system32\nkngrgsd.ini
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\pklehstf.dll
C:\WINDOWS\system32\ptz.dll
C:\WINDOWS\system32\qommlij.dll
C:\WINDOWS\system32\t3
C:\WINDOWS\system32\t3\pepsco32.exe
C:\WINDOWS\system32\w8
C:\WINDOWS\system32\winlogo.exe
C:\WINDOWS\system32\wpeiotnr.dll
C:\WINDOWS\system32\wvuvwvs.dll
C:\WINDOWS\system32\xxyvvtq.dll
C:\WINDOWS\system32\yvmyjrbw.dll
C:\WINDOWS\tk58.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_NETWORK_MONITOR


((((((((((((((((((((((((( Files Created from 2008-02-28 to 2008-03-28 )))))))))))))))))))))))))))))))
.

2008-03-28 14:13 . 2008-03-28 14:13 <DIR> d-------- C:\temp\tn3
2008-03-28 13:35 . 2008-03-28 13:35 <DIR> d-------- C:\Program Files\Lavasoft
2008-03-28 13:35 . 2008-03-28 13:44 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Lavasoft
2008-03-28 13:27 . 2008-03-28 13:27 23,552 --a------ C:\Documents and Settings\Thomas\winlogo.exe
2008-03-28 13:27 . 2008-03-28 13:27 223 --a------ C:\Documents and Settings\Thomas\6521.bat
2008-03-28 13:25 . 2008-03-28 13:34 <DIR> d-------- C:\Documents and Settings\Thomas\Application Data\AVG7
2008-03-28 13:25 . 2008-03-28 13:25 <DIR> d-------- C:\Documents and Settings\LocalService.NT AUTHORITY.000\Application Data\AVG7
2008-03-28 13:24 . 2008-03-28 13:24 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Grisoft
2008-03-28 13:24 . 2008-03-28 13:34 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\avg7
2008-03-28 12:07 . 2008-03-28 12:07 <DIR> d-------- C:\Program Files\Windows Defender
2008-03-28 12:06 . 2008-03-28 12:06 223 --a------ C:\Documents and Settings\Thomas\5733.bat
2008-03-28 11:19 . 2008-03-28 13:12 549 --a------ C:\WINDOWS\wininit.ini
2008-03-28 10:41 . 2008-03-28 10:45 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-03-28 10:41 . 2008-03-28 10:41 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy
2008-03-28 10:20 . 2008-03-28 10:20 <DIR> d-------- C:\Program Files\Executive Software
2008-03-28 10:17 . 2008-03-28 10:17 <DIR> d-------- C:\Program Files\CCleaner
2008-03-28 10:16 . 2008-03-28 13:13 4,236,457 --ahs---- C:\WINDOWS\system32\ydiincqk.ini
2008-03-20 14:55 . 2008-03-21 09:49 414 --ahs---- C:\WINDOWS\system32\yepealju.ini
2008-03-19 14:14 . 2008-03-19 14:14 5,120 --ahs---- C:\WINDOWS\system32\Thumbs.db
2008-03-18 10:56 . 2008-03-19 13:06 1,326,426 --ahs---- C:\WINDOWS\system32\lvsfhgal.ini
2008-03-18 10:55 . 2008-03-28 13:55 <DIR> d-------- C:\Program Files\CPV
2008-03-17 16:18 . 2008-03-18 10:55 1,359,127 --ahs---- C:\WINDOWS\system32\rujmtaqe.ini
2008-03-17 16:08 . 2008-03-17 16:08 <DIR> d-------- C:\WINDOWS\Ad-Ware Pro
2008-03-14 12:55 . 2008-03-17 16:15 1,366,803 --ahs---- C:\WINDOWS\system32\jsioihfv.ini
2008-03-14 12:49 . 2008-03-28 13:44 <DIR> d-------- C:\Program Files\nvcoi
2008-03-14 12:49 . 2008-03-14 12:49 223 --a------ C:\Documents and Settings\Thomas\7453.bat
2008-03-13 14:27 . 2008-03-13 14:27 223 --a------ C:\Documents and Settings\Thomas\1565.bat
2008-03-13 14:12 . 2008-03-13 14:12 223 --a------ C:\Documents and Settings\Thomas\7808.bat
2008-03-13 13:57 . 2008-03-13 13:57 223 --a------ C:\Documents and Settings\Thomas\4080.bat
2008-03-13 13:42 . 2008-03-13 13:42 223 --a------ C:\Documents and Settings\Thomas\2423.bat
2008-03-13 13:27 . 2008-03-13 13:27 223 --a------ C:\Documents and Settings\Thomas\3019.bat
2008-03-13 13:13 . 2008-03-13 13:13 223 --a------ C:\Documents and Settings\Thomas\5336.bat
2008-03-13 12:57 . 2008-03-13 12:57 223 --a------ C:\Documents and Settings\Thomas\7677.bat
2008-03-13 12:42 . 2008-03-13 12:42 223 --a------ C:\Documents and Settings\Thomas\2834.bat
2008-03-13 12:27 . 2008-03-13 12:27 223 --a------ C:\Documents and Settings\Thomas\9763.bat
2008-03-13 12:12 . 2008-03-13 12:12 223 --a------ C:\Documents and Settings\Thomas\8048.bat
2008-03-13 11:57 . 2008-03-13 11:57 223 --a------ C:\Documents and Settings\Thomas\7138.bat
2008-03-13 11:42 . 2008-03-13 11:42 223 --a------ C:\Documents and Settings\Thomas\2755.bat
2008-03-13 10:30 . 2008-03-13 10:30 223 --a------ C:\Documents and Settings\Thomas\3414.bat
2008-03-13 10:11 . 2008-03-17 16:12 <DIR> d-------- C:\Program Files\Registry Defender
2008-03-13 10:05 . 2008-03-13 10:05 <DIR> d-------- C:\Program Files\RegistryCleanFixer2008
2008-03-13 10:00 . 2008-03-13 10:00 223 --a------ C:\WINDOWS\system32\6177.bat
2008-03-13 09:56 . 2008-03-13 09:56 118 --a------ C:\WINDOWS\system32\MRT.INI
2008-03-13 09:47 . 2008-03-13 09:47 <DIR> d-------- C:\Documents and Settings\LocalService.NT AUTHORITY.000\Application Data\Yahoo!
2008-03-13 08:53 . 2008-03-13 08:53 <DIR> d-------- C:\WINDOWS\system32\iDlo05
2008-03-11 15:05 . 2008-03-28 14:14 218,606 --a------ C:\Program Files\c.zip
2008-03-11 15:05 . 2008-03-28 14:14 217,706 --a------ C:\Program Files\b.zip
2008-03-11 15:05 . 2008-03-28 14:14 217,706 --a------ C:\Program Files\a.zip
2008-03-11 15:05 . 2008-03-11 15:05 147,456 --a------ C:\WINDOWS\system32\vbzip10.dll
2008-03-04 16:32 . 2008-03-04 14:32 105,984 --------- C:\WINDOWS\b152.exe_tobedeleted_old
2008-02-29 15:07 . 2008-03-20 15:41 <DIR> d-------- C:\Documents and Settings\Thomas\Application Data\LimeWire
2008-02-29 15:04 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-02-29 14:59 . 2008-02-29 15:04 <DIR> d-------- C:\Program Files\LimeWire
2008-02-29 14:58 . 2008-02-29 14:59 4,506,256 --a------ C:\LimeWireWin.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-28 19:14 417,792 ----a-w C:\Program Files\Video.exe
2008-03-28 19:14 417,792 ----a-w C:\Program Files\Track_03.exe
2008-03-28 19:14 25,214 ----a-w C:\Program Files\B.ico
2008-03-28 19:14 25,214 ----a-w C:\Program Files\A.ico
2008-03-28 18:42 9,344 ----a-w C:\WINDOWS\system32\drivers\NSDriver.sys
2008-03-28 18:42 8,320 ----a-w C:\WINDOWS\system32\drivers\AWRTRD.sys
2008-03-28 18:35 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-03-28 18:23 --------- d-----w C:\Program Files\Java
2008-03-20 20:22 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-03-20 20:22 --------- d-----w C:\Program Files\TweakNow PowerPack 2006
2008-03-17 21:08 --------- d-----w C:\Program Files\Common Files\HP
2008-03-13 16:36 417,792 ----a-w C:\Program Files\Setup.exe
2008-03-13 13:54 86,016 ----a-w C:\WINDOWS\system32\drivers\dxapii.sys
2008-03-13 13:54 167,545 ----a-w C:\WINDOWS\system32\drivers\core.cache(9).dsk
2008-03-13 13:54 167,545 ----a-w C:\WINDOWS\system32\drivers\core.cache(8).dsk
2008-03-13 13:54 167,545 ----a-w C:\WINDOWS\system32\drivers\core.cache(7).dsk
2008-03-13 13:54 167,545 ----a-w C:\WINDOWS\system32\drivers\core.cache(6).dsk
2008-03-13 13:54 167,545 ----a-w C:\WINDOWS\system32\drivers\core.cache(5).dsk
2008-03-13 13:54 167,545 ----a-w C:\WINDOWS\system32\drivers\core.cache(4).dsk
2008-03-13 13:54 167,545 ----a-w C:\WINDOWS\system32\drivers\core.cache(3).dsk
2008-03-13 13:54 167,545 ----a-w C:\WINDOWS\system32\drivers\core.cache(2).dsk
2008-03-13 13:54 167,545 ----a-w C:\WINDOWS\system32\drivers\core.cache(10).dsk
2008-03-13 13:54 167,545 ------w C:\WINDOWS\system32\drivers\core.cache.dsk
2008-02-29 20:43 --------- d-----w C:\Program Files\EPSON Print CD
2008-02-27 19:55 --------- d-----w C:\Program Files\Common Files\Magix Shared
2008-02-07 19:57 --------- d-----w C:\Documents and Settings\Joseph\Application Data\Ahead
2008-02-06 15:52 --------- d-----w C:\Program Files\Rainbow Technologies
2007-06-13 10:23 78,360 --sha-r C:\WINDOWS\system32\p2pnetworking.exe
2005-07-29 21:24 472 --sha-r C:\WINDOWS\VGhvbWFzIEZlcnJlcg\p31SvqIWKHt5wBL5w0.vbs
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{15421B84-3488-49A7-AD18-CBF84A3EFAF6}]
C:\Program Files\CPV\CPV7.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{40943d6c-10ba-4431-b1ae-dfbd113ff605}]
C:\WINDOWS\system32\cffexwes.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{65485F41-EB99-46EF-E19E-259FBC232778}]
C:\Program Files\MSN\lavufawe352.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{88CA7762-EC95-4835-AF10-8A0F5743CFBF}]
C:\WINDOWS\system32\pmkhi.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-02-28 07:00 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-12-23 18:05 143360]
"YSearchProtection"="C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe" [2007-06-08 09:59 224248]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-08-13 19:04 5562368]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 11:24 1694208]
"RegistryCleanFixMFC"="C:\Program Files\RegistryCleanFixer2008\RegistryCleanFixer2008.exe" [2008-02-26 15:02 10760325]
"nvcoi"="C:\Program Files\nvcoi\nvcoi.exe" [ ]
"Oane"="C:\WINDOWS\MBOLS~1\scanregw.exe" [ ]
"Ptxjelvf"="C:\Documents and Settings\Thomas\Application Data\W?nSxS\??rss.exe" [ ]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2005-05-31 01:04 1415824]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-09-17 01:07 8491008]
"nwiz"="nwiz.exe" [2007-09-17 01:07 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-09-17 01:07 81920]
"EPSON Stylus Photo R220 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIA.exe" [2005-03-09 04:00 98304]
"RTHDCPL"="RTHDCPL.EXE" [2007-09-19 18:14 16844800 C:\WINDOWS\RTHDCPL.exe]
"RoxioEngineUtility"="C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe" [2003-05-01 18:44 65536]
"RoxioDragToDisc"="C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe" [2003-10-16 20:15 868352]
"RoxioAudioCentral"="C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe" [2003-07-15 12:38 319488]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 23:12 49152]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 15:40 155648]
"EPSON Stylus Photo R220 Series (Copy 1)"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIA.exe" [2005-03-09 04:00 98304]
"EPSON Stylus Photo R220 Series (Copy 2)"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIA.exe" [2005-03-09 04:00 98304]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 11:09 63712]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2005-01-12 03:01 32768]
"EPSON Stylus Photo R220 Series (Copy 3)"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIA.exe" [2005-03-09 04:00 98304]
"mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-08-03 23:33 582992]
"YSearchProtection"="C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe" [2007-06-08 09:59 224248]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe" [2007-12-14 04:42 144784]
"c0264d0f"="C:\WINDOWS\system32\kqcniidy.dll" [ ]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 18:20 866584]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-03-28 13:24 579072]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-08-13 19:04 5562368]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-03-28 13:24 219136]

C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\
dllhost.exe [2008-03-13 11:36:00 417792]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wvuvwvs]
wvuvwvs.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=

R1 dxapii;dxapii;C:\WINDOWS\system32\drivers\dxapii.sys [2008-03-13 08:54]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3f94b0e2-71cb-11dc-97fe-001731053070}]
\Shell\AutoRun\command - Autorun.exe /run
\Shell\Shell00\Command - Autorun.exe /run
\Shell\Shell01\Command - Autorun.exe /action
\Shell\Shell02\Command - Autorun.exe /uninstall


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
Contents of the 'Scheduled Tasks' folder
"2007-11-20 20:51:22 C:\WINDOWS\Tasks\McDefragTask.job"
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe'
"2007-11-20 20:51:21 C:\WINDOWS\Tasks\McQcTask.job"
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe
"2008-03-28 18:32:57 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************

disk not found C:\

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

disk not found C:\

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\explorer.exe
-> C:\Program Files\ArcSoft\PhotoImpression 5\share\pihook.dll
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Windows Defender\MsMpEng.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\dllhost.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
.
**************************************************************************
.
Completion time: 2008-03-28 14:17:25 - machine was rebooted
ComboFix-quarantined-files.txt 2008-03-28 19:16:34
Pre-Run: 205,941,149,696 bytes free
Post-Run: 205,898,285,056 bytes free
.
2008-03-20 15:19:16 --- E O F ---
 
Kasperfly Log:

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Friday, March 28, 2008 4:15:52 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 28/03/2008
Kaspersky Anti-Virus database records: 668934
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - Critical Areas:
C:\WINDOWS
C:\DOCUME~1\Thomas\LOCALS~1\Temp\

Scan Statistics:
Total number of scanned objects: 18648
Number of viruses found: 1
Number of infected objects: 1
Number of suspicious objects: 0
Duration of the scan process: 00:15:39

Infected Object Name / Virus Name / Last Action
C:\WINDOWS\b152.exe_tobedeleted_old Infected: not-a-virus:AdWare.Win32.Insider.c skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\regedit.exe Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edbtmp.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\cmd.exe Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\drivers\core.cache.dsk Object is locked skipped
C:\WINDOWS\system32\drivers\dxapii.sys Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\iDlo05\iDlo051080.exe Object is locked skipped
C:\WINDOWS\system32\ipconfig.exe Object is locked skipped
C:\WINDOWS\system32\netstat.exe Object is locked skipped
C:\WINDOWS\system32\ping.exe Object is locked skipped
C:\WINDOWS\system32\regedt32.exe Object is locked skipped
C:\WINDOWS\system32\taskkill.exe Object is locked skipped
C:\WINDOWS\system32\taskmgr.exe Object is locked skipped
C:\WINDOWS\system32\tracert.exe Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Temp\mcmsc_3Gud0wIDXW93Ns7 Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
C:\DOCUME~1\Thomas\LOCALS~1\Temp\hsperfdata_Thomas\3004 Object is locked skipped
C:\DOCUME~1\Thomas\LOCALS~1\Temp\~DF39F9.tmp Object is locked skipped
C:\DOCUME~1\Thomas\LOCALS~1\Temp\~DFDC33.tmp Object is locked skipped

Scan process completed.
 
HJT Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:52:22 PM, on 3/28/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIA.EXE
C:\WINDOWS\RTHDCPL.EXE
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIA.EXE
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe
C:\Program Files\MySpace\IM\MySpaceIM.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\dllhost.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\WINDOWS\explorer.exe
C:\Program Files\LimeWire\LimeWire.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Documents and Settings\Thomas\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn2\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn2\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: testCPV6 - {15421B84-3488-49A7-AD18-CBF84A3EFAF6} - (no file)
O2 - BHO: {506ff311-dbfd-ea1b-1344-ab01c6d34904} - {40943d6c-10ba-4431-b1ae-dfbd113ff605} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: 0 - {65485F41-EB99-46EF-E19E-259FBC232778} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {88CA7762-EC95-4835-AF10-8A0F5743CFBF} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn2\yt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [EPSON Stylus Photo R220 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIA.EXE /P30 "EPSON Stylus Photo R220 Series" /O6 "USB001" /M "Stylus Photo R220"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [EPSON Stylus Photo R220 Series (Copy 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIA.EXE /P39 "EPSON Stylus Photo R220 Series (Copy 1)" /O6 "USB003" /M "Stylus Photo R220"
O4 - HKLM\..\Run: [EPSON Stylus Photo R220 Series (Copy 2)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIA.EXE /P39 "EPSON Stylus Photo R220 Series (Copy 2)" /O6 "USB004" /M "Stylus Photo R220"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [RemoteControl] C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [EPSON Stylus Photo R220 Series (Copy 3)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIA.EXE /P39 "EPSON Stylus Photo R220 Series (Copy 3)" /O6 "USB005" /M "Stylus Photo R220"
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\RunOnce: [SpybotDeletingA9230] command /c del "C:\WINDOWS\system32\drivers\core.cache.dsk_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5743] cmd /c del "C:\WINDOWS\system32\drivers\core.cache.dsk_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
O4 - HKCU\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [RegistryCleanFixMFC] C:\Program Files\RegistryCleanFixer2008\RegistryCleanFixer2008.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\RunOnce: [SpybotDeletingB9214] command /c del "C:\WINDOWS\system32\drivers\core.cache.dsk_tobedeleted"
O4 - HKCU\..\RunOnce: [SpybotDeletingD345] cmd /c del "C:\WINDOWS\system32\drivers\core.cache.dsk_tobedeleted"
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O4 - Global Startup: dllhost.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1191426921171
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1192804088906
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O20 - Winlogon Notify: wvuvwvs - wvuvwvs.dll (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--
End of file - 12427 bytes
 
You must log in or register to reply here.
Back
Top