Virtumonde help

jiller1978 · Aug 20, 2008

Please help!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:10:58 PM, on 8/19/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Adobe\Photoshop Elements 6.0\apdproxy.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Documents and Settings\Owner\Desktop\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NSWosCheck] "C:\Program Files\Norton SystemWorks Basic Edition\osCheck.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Elements 6.0\apdproxy.exe"
O4 - HKLM\..\Run: [e005b032] rundll32.exe "C:\WINDOWS\system32\whjyfyyy.dll",b
O4 - HKLM\..\Run: [BMe33683ae] Rundll32.exe "C:\WINDOWS\system32\jqppssbq.dll",s
O4 - HKLM\..\RunOnce: [SymLnch] "C:\Documents and Settings\Owner\Application Data\Symantec\Layouts\Norton Internet Security\15.0\SymAllLanguages\NIS_RETAIL\20070828\Support\SymLnch\SymLnch.exe" "C:\Documents and Settings\Owner\Application Data\Symantec\Layouts\Norton Internet Security\15.0\SymAllLanguages\NIS_RETAIL\20070828\Setup.exe" "/REALUPREBOOT /temp /patched"
O4 - HKLM\..\RunOnce: [Spybot - Search & Destroy] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKLM\..\RunOnce: [SpybotDeletingA1597] command /c del "C:\WINDOWS\system32\jqppssbq.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC3453] cmd /c del "C:\WINDOWS\system32\jqppssbq.dll_old"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\RunOnce: [SpybotDeletingB7890] command /c del "C:\WINDOWS\system32\jqppssbq.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD6048] cmd /c del "C:\WINDOWS\system32\jqppssbq.dll_old"
O4 - HKCU\..\Policies\Explorer\Run: [NT Printing Services2] cleanmgrs.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Basic Edition\Norton Cleanup\WCQuick.lnk
O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Basic Edition\Norton Cleanup\WCQuick.lnk
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: uyamak.dll
O23 - Service: Adobe Active File Monitor V6 (AdobeActiveFileMonitor6.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Norton UnErase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe

--
End of file - 8580 bytes

pskelley · Aug 21, 2008

Welcome to Safer Networking, I wish to be sure you have viewed and understand this information.
"BEFORE you POST" (READ this Procedure before Requesting Assistance)
http://forums.spybot.info/showthread.php?t=288
All advice given is taken at your own risk.
Please make sure you have read this information so we are on the same page.

1) We need first to disable TeaTimer that it doesn't interfere with fixes. You can re-enable it when you're clean again:
* Run Spybot-S&D in Advanced Mode.
* If it is not already set to do this Go to the Mode menu select "Advanced Mode"
* On the left hand side, Click on Tools
* Then click on the Resident Icon in the List
* Uncheck "Resident TeaTimer" and OK any prompts.
* Restart your computer.
(leave TT disabled until we finish)

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own. This tool is not a toy and not for everyday use.

2) Remove any old copies of combofix before you proceed.

Thanks to sUBs and anyone else who helped with this fix.

It is important that it is saved directly to your Desktop.

Download ComboFix from Here to your Desktop

Double click combofix.exe and follow the prompts.
When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply

Note: Do not mouseclick combofix's window while its running. That may cause it to stall

Post the combofix log and a new HJT log.

Tutorial
http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Thanks

jiller1978 · Aug 22, 2008

ComboFix 08-08-21.01 - Owner 2008-08-21 18:04:50.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.166 [GMT -5:00]
Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Owner\Application Data\macromedia\Flash Player\#SharedObjects\48QSRDRA\interclick.com
C:\Documents and Settings\Owner\Application Data\macromedia\Flash Player\#SharedObjects\48QSRDRA\interclick.com\ud.sol
C:\Documents and Settings\Owner\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com
C:\Documents and Settings\Owner\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol
C:\WINDOWS\BMe33683ae.txt
C:\WINDOWS\BMe33683ae.xml
C:\WINDOWS\cookies.ini
C:\WINDOWS\loveletters.zip
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\aiyipbte.dll
C:\WINDOWS\system32\aodmya.dll
C:\WINDOWS\system32\arixursu.dll
C:\WINDOWS\system32\brmiohbk.dll
C:\WINDOWS\system32\brmuihkd.dll
C:\WINDOWS\system32\byXQkklm.dll
C:\WINDOWS\system32\bzbbcv.dll
C:\WINDOWS\system32\cbXOGWoO.dll
C:\WINDOWS\system32\cbXQjkLe.dll
C:\WINDOWS\system32\cdxxkijr.dll
C:\WINDOWS\system32\cevhmrrc.dll
C:\WINDOWS\system32\cjkktbve.dll
C:\WINDOWS\system32\ctrbsvmo.dll
C:\WINDOWS\system32\czrskw.dll
C:\WINDOWS\system32\dgqaqp.dll
C:\WINDOWS\system32\dkhiumrb.ini
C:\WINDOWS\system32\edejdswr.exe
C:\WINDOWS\system32\eikswctw.dll
C:\WINDOWS\system32\etbpiyia.ini
C:\WINDOWS\system32\exqxpkeg.exe
C:\WINDOWS\system32\gcuyqkwv.exe
C:\WINDOWS\system32\geBQjigd.dll
C:\WINDOWS\system32\geBqPfFw.dll
C:\WINDOWS\system32\geBqpNEU.dll
C:\WINDOWS\system32\geBqrrRI.dll
C:\WINDOWS\system32\geBrqpoP.dll
C:\WINDOWS\system32\geBtSIxw.dll
C:\WINDOWS\system32\hgkrfxax.dll
C:\WINDOWS\system32\hjxtfioe.dll
C:\WINDOWS\system32\hlqwuh.dll
C:\WINDOWS\system32\htmpxwxr.dll
C:\WINDOWS\system32\ibbxli.dll
C:\WINDOWS\system32\iifedbxu.dll
C:\WINDOWS\system32\jfinivga.exe
C:\WINDOWS\system32\jflnbfmf.ini
C:\WINDOWS\system32\jkkLFvSL.dll
C:\WINDOWS\system32\khfDwxYO.dll
C:\WINDOWS\system32\kqmrweor.ini
C:\WINDOWS\system32\kvvnbcxy.dll
C:\WINDOWS\system32\ljJBTNhI.dll
C:\WINDOWS\system32\ljJCrpqO.dll
C:\WINDOWS\system32\ljJcyaXO.dll
C:\WINDOWS\system32\ljJDWmmk.dll
C:\WINDOWS\system32\ljJYRLBT.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\nnnllLBS.dll
C:\WINDOWS\system32\obwkltbk.exe
C:\WINDOWS\system32\odymbj.dll
C:\WINDOWS\system32\oggkntrp.ini
C:\WINDOWS\system32\opnkhfEt.dll
C:\WINDOWS\system32\opnmLfEu.dll
C:\WINDOWS\system32\oubraiwy.dll
C:\WINDOWS\system32\ovacbmuc.dll
C:\WINDOWS\system32\pgrbnwpv.dll
C:\WINDOWS\system32\pmjnesxv.dll
C:\WINDOWS\system32\pmnlLfeB.dll
C:\WINDOWS\system32\pmnnOEuU.dll
C:\WINDOWS\system32\pmnnOEwU.dll
C:\WINDOWS\system32\rsbilg.dll
C:\WINDOWS\system32\rulwuvhj.ini
C:\WINDOWS\system32\sduptfcg.exe
C:\WINDOWS\system32\sqobttas.ini
C:\WINDOWS\system32\ssqRLFuv.dll
C:\WINDOWS\system32\thdorrqj.ini
C:\WINDOWS\system32\tuvTnMGW.dll
C:\WINDOWS\system32\tuvUKBsS.dll
C:\WINDOWS\system32\tuvWpPHA.dll
C:\WINDOWS\system32\tybvgtgi.dll
C:\WINDOWS\system32\uEfLmnpo.ini
C:\WINDOWS\system32\uEfLmnpo.ini2
C:\WINDOWS\system32\urqOHXnO.dll
C:\WINDOWS\system32\useuvcgj.dll
C:\WINDOWS\system32\uvdninkj.dll
C:\WINDOWS\system32\uvsplqjn.dll
C:\WINDOWS\system32\uyamak.dll
C:\WINDOWS\system32\vjftiz.dll
C:\WINDOWS\system32\vsxxxryw.dll
C:\WINDOWS\system32\vtUkhEtq.dll
C:\WINDOWS\system32\vtykypnr.exe
C:\WINDOWS\system32\wgoxmsyo.ini
C:\WINDOWS\system32\wpxhmhsx.dll
C:\WINDOWS\system32\wvUkLDWq.dll
C:\WINDOWS\system32\xrodfllm.exe
C:\WINDOWS\system32\xwmpamkm.dll
C:\WINDOWS\system32\ybulcfxa.exe
C:\WINDOWS\system32\yyyfyjhw.ini

.
((((((((((((((((((((((((( Files Created from 2008-07-21 to 2008-08-21 )))))))))))))))))))))))))))))))
.

2008-08-21 18:04 . 2008-08-21 18:04 6,736 --a------ C:\WINDOWS\system32\drivers\PROCEXP90.SYS
2008-08-19 21:04 . 2008-08-19 21:04 95 --a------ C:\WINDOWS\wininit.ini
2008-08-18 20:58 . 2008-08-18 20:59 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-08-18 20:58 . 2008-08-19 17:10 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-08-17 14:47 . 2008-08-17 14:47 7,680 --a------ C:\WINDOWS\system32\f14rs.exe
2008-08-16 20:42 . 2008-08-18 17:52 <DIR> d-------- C:\Program Files\OGG To MP3 Plus
2008-08-16 20:41 . 2008-08-16 20:41 <DIR> d-------- C:\Downloads
2008-08-16 20:41 . 2008-08-16 20:42 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\GetRightToGo
2008-08-15 20:30 . 2008-08-15 20:30 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\InstallShield
2008-08-15 20:27 . 2008-08-15 20:29 <DIR> d-------- C:\Program Files\Common Files\Jasc Software Inc
2008-08-15 20:26 . 2008-08-15 20:32 <DIR> d-------- C:\Program Files\Jasc Software Inc
2008-08-15 20:26 . 2008-08-15 20:26 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Jasc Software Inc
2008-08-15 05:42 . 2008-08-15 05:42 268 --ah----- C:\sqmdata07.sqm
2008-08-15 05:42 . 2008-08-15 05:42 244 --ah----- C:\sqmnoopt07.sqm
2008-08-13 21:09 . 2008-08-13 21:09 268 --ah----- C:\sqmdata06.sqm
2008-08-13 21:09 . 2008-08-13 21:09 244 --ah----- C:\sqmnoopt06.sqm
2008-08-13 21:01 . 2008-08-13 21:01 <DIR> d-------- C:\Program Files\Common Files\Macrovision Shared
2008-08-11 06:56 . 2008-08-11 06:56 268 --ah----- C:\sqmdata05.sqm
2008-08-11 06:56 . 2008-08-11 06:56 244 --ah----- C:\sqmnoopt05.sqm
2008-08-10 16:36 . 2008-08-17 09:30 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-10 16:36 . 2004-08-30 21:00 1,069,056 --a------ C:\WINDOWS\system32\gpedits.exe
2008-08-10 16:36 . 2008-08-17 19:33 367,104 --a------ C:\WINDOWS\system32\ciadvss.exe
2008-08-10 16:36 . 2008-08-10 16:36 52,224 --a------ C:\WINDOWS\system32\cleanmgrs.exe
2008-08-10 16:36 . 2008-08-10 16:36 7,680 --a------ C:\WINDOWS\system32\ftps.exe
2008-08-10 16:36 . 2008-08-17 14:47 7,680 --a------ C:\WINDOWS\system32\cliconfgs.exe
2008-08-10 16:36 . 2008-08-10 16:36 7,680 --a------ C:\WINDOWS\system32\ciadvs.exe
2008-08-10 16:36 . 2008-08-10 16:36 7,680 --a------ C:\WINDOWS\system32\chkdskss.exe
2008-08-10 16:36 . 2008-08-10 16:36 7,680 --a------ C:\WINDOWS\system32\chkdsks.exe
2008-08-10 16:36 . 2008-08-10 22:15 190 --a------ C:\WINDOWS\system32\Monitored3.dat
2008-08-10 16:36 . 2008-08-21 18:20 153 --a------ C:\WINDOWS\system32\Monitored2.dat
2008-08-09 22:30 . 2008-08-09 22:30 <DIR> d--h----- C:\WINDOWS\PIF
2008-08-09 17:35 . 2008-07-29 16:20 32,768 --a------ C:\Program Files\bcd_installed.exe
2008-08-05 19:51 . 2008-08-05 19:51 268 --ah----- C:\sqmdata04.sqm
2008-08-05 19:51 . 2008-08-05 19:51 244 --ah----- C:\sqmnoopt04.sqm
2008-08-05 09:19 . 2008-08-05 09:19 268 --ah----- C:\sqmdata03.sqm
2008-08-05 09:19 . 2008-08-05 09:19 244 --ah----- C:\sqmnoopt03.sqm
2008-08-04 21:15 . 2008-08-04 21:15 268 --ah----- C:\sqmdata02.sqm
2008-08-04 21:15 . 2008-08-04 21:15 244 --ah----- C:\sqmnoopt02.sqm
2008-08-04 18:42 . 2008-08-04 18:42 <DIR> d-------- C:\Program Files\iPod
2008-08-03 20:18 . 2008-08-03 20:18 253,368 --a------ C:\WINDOWS\teen.zip
2008-08-03 20:17 . 2008-08-03 20:17 249,093 --a------ C:\WINDOWS\castorgate.zip
2008-08-03 20:17 . 2008-08-03 20:17 50,025 --a------ C:\WINDOWS\oldrepublic.zip
2008-08-03 20:17 . 2008-08-03 20:17 41,092 --a------ C:\WINDOWS\juice.zip
2008-08-03 20:17 . 2008-08-03 20:17 37,486 --a------ C:\WINDOWS\tacosalad.zip
2008-08-03 20:17 . 2008-08-03 20:17 27,173 --a------ C:\WINDOWS\fashionvictim.zip
2008-08-03 20:17 . 2008-08-03 20:17 24,969 --a------ C:\WINDOWS\chancerycursive.zip
2008-08-03 20:17 . 2008-08-03 20:17 21,639 --a------ C:\WINDOWS\actionjackson.zip
2008-08-03 20:17 . 2008-08-03 20:17 17,486 --a------ C:\WINDOWS\lindaslament.zip
2008-08-03 20:17 . 2008-08-03 20:17 16,341 --a------ C:\WINDOWS\kidscrawl.zip
2008-08-03 20:17 . 2008-08-03 20:17 8,642 --a------ C:\WINDOWS\the_godfather.zip
2008-08-03 20:15 . 2008-08-03 20:15 60,283 --a------ C:\WINDOWS\tallpaul.zip
2008-08-03 20:15 . 2008-08-03 20:15 38,754 --a------ C:\WINDOWS\boingo.zip
2008-08-03 20:15 . 2008-08-03 20:15 36,872 --a------ C:\WINDOWS\girlsareweird.zip
2008-08-03 20:15 . 2008-08-03 20:15 32,318 --a------ C:\WINDOWS\gallery.zip
2008-08-03 20:15 . 2008-08-03 20:15 31,823 --a------ C:\WINDOWS\yahoo.zip
2008-08-03 20:15 . 2008-08-03 20:15 21,841 --a------ C:\WINDOWS\fortunaschwein.zip
2008-08-03 20:15 . 2008-08-03 20:15 21,180 --a------ C:\WINDOWS\amano.zip
2008-08-03 20:15 . 2008-08-03 20:15 19,710 --a------ C:\WINDOWS\calvinandhobbes.zip
2008-08-03 20:15 . 2008-08-03 20:15 13,185 --a------ C:\WINDOWS\allstar.zip
2008-08-03 20:15 . 2008-08-03 20:15 8,154 --a------ C:\WINDOWS\babebamboo.zip
2008-08-03 20:13 . 2008-08-03 20:13 85,917 --a------ C:\WINDOWS\sketchy.zip
2008-08-03 20:12 . 2008-08-03 20:12 230,932 --a------ C:\WINDOWS\acharmingfont.zip
2008-08-03 20:12 . 2008-08-03 20:12 58,464 --a------ C:\WINDOWS\scriptina.zip
2008-08-03 20:12 . 2008-08-03 20:12 46,922 --a------ C:\WINDOWS\freebooterscript.zip
2008-07-30 18:48 . 2008-07-30 18:48 268 --ah----- C:\sqmdata01.sqm
2008-07-30 18:48 . 2008-07-30 18:48 244 --ah----- C:\sqmnoopt01.sqm
2008-07-30 05:54 . 2008-07-30 05:54 376 --a------ C:\WINDOWS\ODBC.INI
2008-07-30 05:53 . 2008-07-30 05:53 <DIR> d-------- C:\Program Files\Microsoft ActiveSync
2008-07-30 05:52 . 2008-07-30 05:53 <DIR> d-------- C:\WINDOWS\ShellNew
2008-07-29 17:36 . 2008-07-29 17:36 268 --ah----- C:\sqmdata00.sqm
2008-07-29 17:36 . 2008-07-29 17:36 244 --ah----- C:\sqmnoopt00.sqm
2008-07-26 21:18 . 2008-08-15 20:24 <DIR> d-------- C:\Documents and Settings\Owner\Contacts
2008-07-26 21:16 . 2008-07-26 21:16 <DIR> d-------- C:\Program Files\MSN Messenger
2008-07-26 20:46 . 2008-08-21 17:46 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\skypePM
2008-07-26 20:46 . 2008-07-26 20:46 56 --ah----- C:\WINDOWS\system32\ezsidmv.dat
2008-07-26 20:40 . 2008-08-21 18:21 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Skype
2008-07-26 20:39 . 2008-07-26 20:44 <DIR> d-------- C:\Program Files\Skype
2008-07-26 20:39 . 2008-07-26 20:39 <DIR> d-------- C:\Program Files\Common Files\Skype
2008-07-26 20:38 . 2008-07-26 20:39 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Skype
2008-07-25 21:01 . 2008-08-16 21:17 <DIR> d-------- C:\Program Files\Full Tilt Poker.Net
2008-07-21 17:58 . 2008-08-09 17:55 <DIR> d-------- C:\Program Files\GameHouse
2008-07-21 17:52 . 2008-07-21 17:52 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Azureus
2008-07-21 17:51 . 2008-08-16 22:03 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Azureus

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-18 22:37 --------- d-----w C:\Program Files\Norton SystemWorks Basic Edition
2008-08-16 04:14 --------- d-----w C:\Documents and Settings\Owner\Application Data\LimeWire
2008-08-16 01:27 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-08-15 01:39 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-08-14 02:01 --------- d-----w C:\Program Files\Common Files\Adobe
2008-08-14 01:47 9,464 ----a-w C:\WINDOWS\system32\drivers\cdralw2k.sys
2008-08-14 01:47 9,336 ----a-w C:\WINDOWS\system32\drivers\cdr4_xp.sys
2008-08-14 01:47 43,528 ----a-w C:\WINDOWS\system32\drivers\PxHelp20.sys
2008-08-14 01:47 129,784 ----a-w C:\WINDOWS\system32\pxafs.dll
2008-08-14 01:47 118,520 ----a-w C:\WINDOWS\system32\pxinsi64.exe
2008-08-14 01:47 116,472 ----a-w C:\WINDOWS\system32\pxcpyi64.exe
2008-08-09 23:00 --------- d-----w C:\Documents and Settings\Owner\Application Data\Yahoo!
2008-08-09 23:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-08-05 02:18 --------- d-----w C:\Program Files\Apple Software Update
2008-08-04 23:42 --------- d-----w C:\Program Files\iTunes
2008-08-04 21:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-08-04 01:19 780,482 ----a-w C:\WINDOWS\tattoogirl.zip
2008-08-04 01:19 64,578 ----a-w C:\WINDOWS\freak.zip
2008-08-04 01:19 49,726 ----a-w C:\WINDOWS\peanuts.zip
2008-08-04 01:19 39,796 ----a-w C:\WINDOWS\goofball.zip
2008-08-04 01:19 36,571 ----a-w C:\WINDOWS\facelift.zip
2008-08-04 01:19 30,578 ----a-w C:\WINDOWS\milkyway.zip
2008-08-04 01:19 26,127 ----a-w C:\WINDOWS\viuniversity.zip
2008-08-04 01:19 24,005 ----a-w C:\WINDOWS\myoldremington.zip
2008-08-04 01:19 19,016 ----a-w C:\WINDOWS\magiccards.zip
2008-08-04 01:19 17,681 ----a-w C:\WINDOWS\mixedup.zip
2008-08-04 01:19 125,658 ----a-w C:\WINDOWS\wc_manonegra.zip
2008-08-04 01:19 11,976 ----a-w C:\WINDOWS\ruthscript.zip
2008-08-04 01:16 51,094 ----a-w C:\WINDOWS\simpsonsfont.zip
2008-08-04 01:16 27,639 ----a-w C:\WINDOWS\feenacasual.zip
2008-08-04 01:16 24,628 ----a-w C:\WINDOWS\mickey.zip
2008-08-04 01:16 24,048 ----a-w C:\WINDOWS\markerfinepoint.zip
2008-08-04 01:16 221,517 ----a-w C:\WINDOWS\scribbledsans.zip
2008-08-04 01:16 21,047 ----a-w C:\WINDOWS\basicfont.zip
2008-08-04 01:16 197,295 ----a-w C:\WINDOWS\sffoxboroscript.zip
2008-08-04 01:16 19,740 ----a-w C:\WINDOWS\scrawnykids.zip
2008-08-04 01:16 16,910 ----a-w C:\WINDOWS\machinescript.zip
2008-08-04 01:16 16,673 ----a-w C:\WINDOWS\catholicschoolgirls.zip
2008-08-04 01:16 13,724 ----a-w C:\WINDOWS\chinesetakeaway.zip
2008-08-04 01:16 12,998 ----a-w C:\WINDOWS\carbontype.zip
2008-08-04 01:16 10,703 ----a-w C:\WINDOWS\vampiress.zip
2008-08-04 01:13 57,665 ----a-w C:\WINDOWS\darkcrystal.zip
2008-08-04 01:13 47,121 ----a-w C:\WINDOWS\angelina.zip
2008-08-04 01:13 36,078 ----a-w C:\WINDOWS\jane_austen.zip
2008-08-04 01:13 36,067 ----a-w C:\WINDOWS\carrington.zip
2008-08-04 01:13 31,290 ----a-w C:\WINDOWS\sabrina.zip
2008-08-04 01:13 29,220 ----a-w C:\WINDOWS\ayummyapology.zip
2008-08-04 01:13 26,497 ----a-w C:\WINDOWS\lokicola.zip
2008-08-04 01:13 24,593 ----a-w C:\WINDOWS\oakwood.zip
2008-08-04 01:13 22,312 ----a-w C:\WINDOWS\littledays.zip
2008-08-04 01:13 19,234 ----a-w C:\WINDOWS\heather.zip
2008-08-04 01:13 13,490 ----a-w C:\WINDOWS\wordsoflove.zip
2008-08-04 01:13 12,592 ----a-w C:\WINDOWS\scramble.zip
2008-07-30 22:42 23,888 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.sys
2008-07-30 22:28 706 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.inf
2008-07-30 22:28 10,537 ----a-w C:\WINDOWS\system32\drivers\coh_mon.cat
2008-07-26 02:01 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-24 11:07 --------- d-----w C:\Program Files\Norton AntiVirus
2008-07-24 10:55 805 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-07-24 10:55 60,800 ----a-w C:\WINDOWS\system32\S32EVNT1.DLL
2008-07-24 10:55 123,952 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-07-24 10:55 10,671 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-07-24 10:55 --------- d-----w C:\Program Files\Symantec
2008-07-21 17:01 --------- d-----w C:\Documents and Settings\Owner\Application Data\Symantec
2008-07-21 01:59 --------- d-----w C:\Documents and Settings\Owner\Application Data\Aim
2008-07-21 01:48 --------- d-----w C:\Program Files\Bejeweled 2 Deluxe
2008-07-21 01:47 720,896 ----a-w C:\WINDOWS\iun6002ev.exe
2008-07-20 21:58 --------- d-----w C:\Program Files\Windows Sidebar
2008-07-19 23:06 --------- d-----w C:\Documents and Settings\Owner\Application Data\Apple Computer
2008-07-18 01:28 604,799 ----a-w C:\WINDOWS\SharePod.zip
2008-07-17 05:21 --------- d-----w C:\Documents and Settings\All Users\Application Data\Trymedia
2008-07-17 05:19 --------- d-----w C:\Program Files\Java
2008-07-17 05:06 --------- d-----w C:\Documents and Settings\Owner\Application Data\Creative
2008-07-17 04:30 --------- d-----w C:\Program Files\Common Files\Java
2008-07-17 04:28 --------- d-----w C:\Program Files\TryMedia
2008-07-17 04:19 --------- d-----w C:\Program Files\Creative
2008-07-17 04:07 --------- d-----w C:\Program Files\Yahoo!
2008-07-17 04:07 --------- d-----w C:\Program Files\NOS
2008-07-17 04:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\NOS
2008-07-17 04:01 --------- d-----w C:\Program Files\QuickTime
2008-07-17 04:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-07-17 04:00 --------- d-----w C:\Program Files\Common Files\Apple
2008-07-17 04:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2008-07-17 03:58 --------- d-----w C:\Program Files\Common Files\Adobe AIR
2008-07-17 03:56 --------- d-----w C:\Program Files\AWS
2008-07-17 03:56 --------- d-----w C:\Program Files\AIM
2008-07-17 03:55 --------- d-----w C:\Program Files\Viewpoint
2008-07-17 03:55 --------- d-----w C:\Program Files\AOD
2008-07-17 03:55 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-07-17 03:50 5 ----a-w C:\WINDOWS\system32\drivers\DELL_DIM_3000.MRK
2008-07-17 03:50 5 ----a-w C:\WINDOWS\system32\drivers\1028_DELL_DIM_3000.MRK
2008-07-17 03:48 --------- d-----w C:\Program Files\Intel
2008-07-17 03:42 --------- d-----w C:\Program Files\microsoft frontpage
2008-07-07 20:32 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-13 19:45 579,464 ----a-w C:\WINDOWS\system32\SymNeti.dll
2008-06-13 19:45 207,240 ----a-w C:\WINDOWS\system32\SymRedir.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-12 08:56 15360]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-05-30 15:54 21718312]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 17:43 4670704]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 02:38 34672]
"AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 09:47 116040]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-05-27 10:50 413696]
"CTSysVol"="C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe" [2003-09-17 10:43 57344]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 01:00 90112]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-09-20 09:35 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-09-20 09:32 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-09-20 09:36 114688]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-02-14 11:01 51048]
"NSWosCheck"="C:\Program Files\Norton SystemWorks Basic Edition\osCheck.exe" [2007-09-18 08:22 25472]
"osCheck"="C:\Program Files\Norton AntiVirus\osCheck.exe" [2007-08-24 23:53 714608]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-30 10:47 289064]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Elements 6.0\apdproxy.exe" [2007-09-11 00:43 67488]
"P17Helper"="P17.dll" [2004-06-10 11:51 60928 C:\WINDOWS\system32\P17.dll]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"SymLnch"="C:\Documents and Settings\Owner\Application Data\Symantec\Layouts\Norton Internet Security\15.0\SymAllLanguages\NIS_RETAIL\20070828\Support\SymLnch\SymLnch.exe" [2007-08-26 19:04 687976]

[HKEY_CURRENT_USER\software\microsoft\windows\Currentversion\policies\explorer\Run]
"NT Printing Services2"="cleanmgrs.exe" [2008-08-10 16:36 52224 C:\WINDOWS\system32\cleanmgrs.exe]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=czrskw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"mW[íµˆÖ¾`=µú¾˜v%S8’ÿÙêé>grl>*Ý\†Ð=ŸàÛ±Þ"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\AIM\\aim.exe"=
"C:\\Documents and Settings\\Owner\\My Documents\\TextTwist\\TextTwist.exe"=
"C:\\Documents and Settings\\Owner\\My Documents\\Bejeweled 2 Deluxe\\WinBej2.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\program files\\bcd_installed.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R2 AdobeActiveFileMonitor6.0;Adobe Active File Monitor V6;C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe [2007-09-11 00:45]
R2 LiveUpdate Notice;LiveUpdate Notice;C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2008-02-14 11:02]
S3 COH_Mon;COH_Mon;C:\WINDOWS\system32\Drivers\COH_Mon.sys [2008-07-30 17:42]
.
Contents of the 'Scheduled Tasks' folder

2008-08-14 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]

2008-08-19 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Owner.job
- C:\Program Files\Norton AntiVirus\Navw32.exe [2007-08-26 20:19]

2008-08-18 C:\WINDOWS\Tasks\Norton SystemWorks One Button Checkup.job
- C:\Program Files\Norton SystemWorks Basic Edition\OBC.exe [2007-09-18 08:22]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-e005b032 - C:\WINDOWS\system32\fmfbnlfj.dll
HKLM-Run-BMe33683ae - C:\WINDOWS\system32\hjxtfioe.dll

.
------- Supplementary Scan -------
.
R1 -: HKCU-Internet Settings,ProxyOverride = *.local
O8 -: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-21 18:18:59
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\WINDOWS\system32\CTSVCCDA.EXE
C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
.
**************************************************************************
.
Completion time: 2008-08-21 18:26:42 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-21 23:26:26

Pre-Run: 19,259,514,880 bytes free
Post-Run: 19,348,955,136 bytes free

396 --- E O F --- 2008-08-15 11:46:03

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:38:50 PM, on 8/21/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
C:\Documents and Settings\Owner\Desktop\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NSWosCheck] "C:\Program Files\Norton SystemWorks Basic Edition\osCheck.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Elements 6.0\apdproxy.exe"
O4 - HKLM\..\RunOnce: [SymLnch] "C:\Documents and Settings\Owner\Application Data\Symantec\Layouts\Norton Internet Security\15.0\SymAllLanguages\NIS_RETAIL\20070828\Support\SymLnch\SymLnch.exe" "C:\Documents and Settings\Owner\Application Data\Symantec\Layouts\Norton Internet Security\15.0\SymAllLanguages\NIS_RETAIL\20070828\Setup.exe" "/REALUPREBOOT /temp /patched"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Policies\Explorer\Run: [NT Printing Services2] cleanmgrs.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Basic Edition\Norton Cleanup\WCQuick.lnk
O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Basic Edition\Norton Cleanup\WCQuick.lnk
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: czrskw.dll
O23 - Service: Adobe Active File Monitor V6 (AdobeActiveFileMonitor6.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Norton UnErase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe

--
End of file - 8108 bytes

pskelley · Aug 22, 2008

Thanks for returning your information, you had a bad infection, see all the Vundo files combofix removed!
That is usually an indication the infection has been active for a while.

If I may ask, what are all of those .zip files? Example:
2008-08-04 01:19 24,005 ----a-w C:\WINDOWS\myoldremington.zip

1) Please download ATF Cleaner by Atribune
http://www.atribune.org/public-beta/ATF-Cleaner.exe
Save it to your Desktop. We will use this later.

2) Open notepad and copy/paste the text in the codebox below into it:

Code:

File::
C:\WINDOWS\system32\cleanmgrs.exe]

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=-

Save this as CFScript

Referring to the picture above, drag CFScript into ComboFix.exe.

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log. (wait until you finish to post the logs)

3) Open HijackThis and choose "Do a system scan only" then check the box in front of these line items:

(may be gone)

O4 - HKCU\..\Policies\Explorer\Run: [NT Printing Services2] cleanmgrs.exe
O20 - AppInit_DLLs: czrskw.dll

Close all programs but HJT and all browser windows, then click on "Fix Checked"

4) Run ATF Cleaner
Double-click ATF-Cleaner.exe to run the program.
Click Select All found at the bottom of the list.
Click the Empty Selected button.
Click Exit on the Main menu to close the program.

*Cleaning Prefetch may results in a few slow starts until the folder is repopulated:
http://www.windowsnetworking.com/articles_tutorials/Gaining-Speed-Empty-Prefetch-XP.html

5) Download Malwarebytes' Anti-Malware to your Desktop
http://www.besttechie.net/tools/mbam-setup.exe

* Double-click mbam-setup.exe and follow the prompts to install the program.
* Be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform FULL SCAN, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad. Please save it to a convenient location. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt
* Please post the combofix log from CFScript, the log from MBAM and a new HJT log.

Please tell me how the computer is running now.

Thanks...Phil

jiller1978 · Aug 22, 2008

Thanks so much for your help so far! I'm posting this from my own computer, which means things are working better, since I was unable to get onto Internet Explorer before!

I'm still getting the "Your computer is infected!!" popups for almost every website.

I have no idea what those zip files are...nothing I downloaded/installed intentionally. Can I/should I delete them?

Here are the logs:

ComboFix 08-08-21.01 - Owner 2008-08-21 21:29:56.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.187 [GMT -5:00]
Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Owner\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\WINDOWS\system32\cleanmgrs.exe]
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\BMe33683ae.txt
C:\WINDOWS\BMe33683ae.xml
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\cbXRHyXn.dll
C:\WINDOWS\system32\hgGyvuTL.dll
C:\WINDOWS\system32\jkkLFwWn.dll
C:\WINDOWS\system32\kytqttlw.exe
C:\WINDOWS\system32\liitjbpn.dll
C:\WINDOWS\system32\nXyHRXbc.ini
C:\WINDOWS\system32\nXyHRXbc.ini2
C:\WINDOWS\system32\qmrslkws.dll
C:\WINDOWS\system32\swklsrmq.ini
C:\WINDOWS\system32\tebwtogm.dll
C:\WINDOWS\system32\trogdn.dll
.
---- Previous Run -------
.
C:\WINDOWS\BMe33683ae.txt
C:\WINDOWS\BMe33683ae.xml
C:\WINDOWS\cookies.ini
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\awttQIYP.dll
C:\WINDOWS\system32\bflvbdsi.dll
C:\WINDOWS\system32\bneihsuo.exe
C:\WINDOWS\system32\byXrRKAR.dll
C:\WINDOWS\system32\dnhgmnuj.dll
C:\WINDOWS\system32\glfqqgwb.dll
C:\WINDOWS\system32\hvhghdqx.dll
C:\WINDOWS\system32\jqseqisj.dll
C:\WINDOWS\system32\jsiqesqj.ini
C:\WINDOWS\system32\junmghnd.ini
C:\WINDOWS\system32\kbclwr.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mlJCTnlL.dll
C:\WINDOWS\system32\PYIQttwa.ini
C:\WINDOWS\system32\PYIQttwa.ini2
C:\WINDOWS\system32\qqecrt.dll
C:\WINDOWS\system32\tlibmopg.exe
C:\WINDOWS\system32\wtuwxqyx.dll

.
((((((((((((((((((((((((( Files Created from 2008-07-22 to 2008-08-22 )))))))))))))))))))))))))))))))
.

2008-08-21 21:38 . 2008-08-21 21:38 39,424 --a------ C:\WINDOWS\system32\iifcCtRi.dll
2008-08-21 21:38 . 2008-08-21 21:38 39,424 --a------ C:\WINDOWS\system32\awtrOfee.dll
2008-08-21 21:06 . 2008-08-21 21:30 6,736 --a------ C:\WINDOWS\system32\drivers\PROCEXP90.SYS
2008-08-19 21:04 . 2008-08-19 21:04 95 --a------ C:\WINDOWS\wininit.ini
2008-08-18 20:58 . 2008-08-18 20:59 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-08-18 20:58 . 2008-08-19 17:10 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-08-17 14:47 . 2008-08-17 14:47 7,680 --a------ C:\WINDOWS\system32\f14rs.exe
2008-08-16 20:42 . 2008-08-18 17:52 <DIR> d-------- C:\Program Files\OGG To MP3 Plus
2008-08-16 20:41 . 2008-08-16 20:41 <DIR> d-------- C:\Downloads
2008-08-16 20:41 . 2008-08-16 20:42 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\GetRightToGo
2008-08-15 20:30 . 2008-08-15 20:30 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\InstallShield
2008-08-15 20:27 . 2008-08-15 20:29 <DIR> d-------- C:\Program Files\Common Files\Jasc Software Inc
2008-08-15 20:26 . 2008-08-15 20:32 <DIR> d-------- C:\Program Files\Jasc Software Inc
2008-08-15 20:26 . 2008-08-15 20:26 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Jasc Software Inc
2008-08-15 05:42 . 2008-08-15 05:42 268 --ah----- C:\sqmdata07.sqm
2008-08-15 05:42 . 2008-08-15 05:42 244 --ah----- C:\sqmnoopt07.sqm
2008-08-13 21:09 . 2008-08-13 21:09 268 --ah----- C:\sqmdata06.sqm
2008-08-13 21:09 . 2008-08-13 21:09 244 --ah----- C:\sqmnoopt06.sqm
2008-08-13 21:01 . 2008-08-13 21:01 <DIR> d-------- C:\Program Files\Common Files\Macrovision Shared
2008-08-11 06:56 . 2008-08-11 06:56 268 --ah----- C:\sqmdata05.sqm
2008-08-11 06:56 . 2008-08-11 06:56 244 --ah----- C:\sqmnoopt05.sqm
2008-08-10 16:36 . 2008-08-17 09:30 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-10 16:36 . 2004-08-30 21:00 1,069,056 --a------ C:\WINDOWS\system32\gpedits.exe
2008-08-10 16:36 . 2008-08-17 19:33 367,104 --a------ C:\WINDOWS\system32\ciadvss.exe
2008-08-10 16:36 . 2008-08-10 16:36 52,224 --a------ C:\WINDOWS\system32\cleanmgrs.exe
2008-08-10 16:36 . 2008-08-10 16:36 7,680 --a------ C:\WINDOWS\system32\ftps.exe
2008-08-10 16:36 . 2008-08-17 14:47 7,680 --a------ C:\WINDOWS\system32\cliconfgs.exe
2008-08-10 16:36 . 2008-08-10 16:36 7,680 --a------ C:\WINDOWS\system32\ciadvs.exe
2008-08-10 16:36 . 2008-08-10 16:36 7,680 --a------ C:\WINDOWS\system32\chkdskss.exe
2008-08-10 16:36 . 2008-08-10 16:36 7,680 --a------ C:\WINDOWS\system32\chkdsks.exe
2008-08-10 16:36 . 2008-08-21 21:38 217 --a------ C:\WINDOWS\system32\Monitored2.dat
2008-08-10 16:36 . 2008-08-10 22:15 190 --a------ C:\WINDOWS\system32\Monitored3.dat
2008-08-09 22:30 . 2008-08-09 22:30 <DIR> d--h----- C:\WINDOWS\PIF
2008-08-09 17:35 . 2008-07-29 16:20 32,768 --a------ C:\Program Files\bcd_installed.exe
2008-08-05 19:51 . 2008-08-05 19:51 268 --ah----- C:\sqmdata04.sqm
2008-08-05 19:51 . 2008-08-05 19:51 244 --ah----- C:\sqmnoopt04.sqm
2008-08-05 09:19 . 2008-08-05 09:19 268 --ah----- C:\sqmdata03.sqm
2008-08-05 09:19 . 2008-08-05 09:19 244 --ah----- C:\sqmnoopt03.sqm
2008-08-04 21:15 . 2008-08-04 21:15 268 --ah----- C:\sqmdata02.sqm
2008-08-04 21:15 . 2008-08-04 21:15 244 --ah----- C:\sqmnoopt02.sqm
2008-08-04 18:42 . 2008-08-04 18:42 <DIR> d-------- C:\Program Files\iPod
2008-08-03 20:18 . 2008-08-03 20:18 253,368 --a------ C:\WINDOWS\teen.zip
2008-08-03 20:17 . 2008-08-03 20:17 249,093 --a------ C:\WINDOWS\castorgate.zip
2008-08-03 20:17 . 2008-08-03 20:17 50,025 --a------ C:\WINDOWS\oldrepublic.zip
2008-08-03 20:17 . 2008-08-03 20:17 41,092 --a------ C:\WINDOWS\juice.zip
2008-08-03 20:17 . 2008-08-03 20:17 37,486 --a------ C:\WINDOWS\tacosalad.zip
2008-08-03 20:17 . 2008-08-03 20:17 27,173 --a------ C:\WINDOWS\fashionvictim.zip
2008-08-03 20:17 . 2008-08-03 20:17 24,969 --a------ C:\WINDOWS\chancerycursive.zip
2008-08-03 20:17 . 2008-08-03 20:17 21,639 --a------ C:\WINDOWS\actionjackson.zip
2008-08-03 20:17 . 2008-08-03 20:17 17,486 --a------ C:\WINDOWS\lindaslament.zip
2008-08-03 20:17 . 2008-08-03 20:17 16,341 --a------ C:\WINDOWS\kidscrawl.zip
2008-08-03 20:17 . 2008-08-03 20:17 8,642 --a------ C:\WINDOWS\the_godfather.zip
2008-08-03 20:15 . 2008-08-03 20:15 60,283 --a------ C:\WINDOWS\tallpaul.zip
2008-08-03 20:15 . 2008-08-03 20:15 38,754 --a------ C:\WINDOWS\boingo.zip
2008-08-03 20:15 . 2008-08-03 20:15 36,872 --a------ C:\WINDOWS\girlsareweird.zip
2008-08-03 20:15 . 2008-08-03 20:15 32,318 --a------ C:\WINDOWS\gallery.zip
2008-08-03 20:15 . 2008-08-03 20:15 31,823 --a------ C:\WINDOWS\yahoo.zip
2008-08-03 20:15 . 2008-08-03 20:15 21,841 --a------ C:\WINDOWS\fortunaschwein.zip
2008-08-03 20:15 . 2008-08-03 20:15 21,180 --a------ C:\WINDOWS\amano.zip
2008-08-03 20:15 . 2008-08-03 20:15 19,710 --a------ C:\WINDOWS\calvinandhobbes.zip
2008-08-03 20:15 . 2008-08-03 20:15 13,185 --a------ C:\WINDOWS\allstar.zip
2008-08-03 20:15 . 2008-08-03 20:15 8,154 --a------ C:\WINDOWS\babebamboo.zip
2008-08-03 20:13 . 2008-08-03 20:13 85,917 --a------ C:\WINDOWS\sketchy.zip
2008-08-03 20:12 . 2008-08-03 20:12 230,932 --a------ C:\WINDOWS\acharmingfont.zip
2008-08-03 20:12 . 2008-08-03 20:12 58,464 --a------ C:\WINDOWS\scriptina.zip
2008-08-03 20:12 . 2008-08-03 20:12 46,922 --a------ C:\WINDOWS\freebooterscript.zip
2008-07-30 18:48 . 2008-07-30 18:48 268 --ah----- C:\sqmdata01.sqm
2008-07-30 18:48 . 2008-07-30 18:48 244 --ah----- C:\sqmnoopt01.sqm
2008-07-30 05:54 . 2008-07-30 05:54 376 --a------ C:\WINDOWS\ODBC.INI
2008-07-30 05:53 . 2008-07-30 05:53 <DIR> d-------- C:\Program Files\Microsoft ActiveSync
2008-07-30 05:52 . 2008-07-30 05:53 <DIR> d-------- C:\WINDOWS\ShellNew
2008-07-29 17:36 . 2008-07-29 17:36 268 --ah----- C:\sqmdata00.sqm
2008-07-29 17:36 . 2008-07-29 17:36 244 --ah----- C:\sqmnoopt00.sqm
2008-07-26 21:18 . 2008-08-15 20:24 <DIR> d-------- C:\Documents and Settings\Owner\Contacts
2008-07-26 21:16 . 2008-07-26 21:16 <DIR> d-------- C:\Program Files\MSN Messenger
2008-07-26 20:46 . 2008-08-21 17:46 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\skypePM
2008-07-26 20:46 . 2008-07-26 20:46 56 --ah----- C:\WINDOWS\system32\ezsidmv.dat
2008-07-26 20:40 . 2008-08-21 21:25 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Skype
2008-07-26 20:39 . 2008-07-26 20:44 <DIR> d-------- C:\Program Files\Skype
2008-07-26 20:39 . 2008-07-26 20:39 <DIR> d-------- C:\Program Files\Common Files\Skype
2008-07-26 20:38 . 2008-07-26 20:39 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Skype
2008-07-25 21:01 . 2008-08-16 21:17 <DIR> d-------- C:\Program Files\Full Tilt Poker.Net

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-21 23:34 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-08-18 22:37 --------- d-----w C:\Program Files\Norton SystemWorks Basic Edition
2008-08-17 03:03 --------- d-----w C:\Documents and Settings\Owner\Application Data\Azureus
2008-08-16 04:14 --------- d-----w C:\Documents and Settings\Owner\Application Data\LimeWire
2008-08-16 01:27 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-08-14 02:01 --------- d-----w C:\Program Files\Common Files\Adobe
2008-08-14 01:47 9,464 ----a-w C:\WINDOWS\system32\drivers\cdralw2k.sys
2008-08-14 01:47 9,336 ----a-w C:\WINDOWS\system32\drivers\cdr4_xp.sys
2008-08-14 01:47 43,528 ----a-w C:\WINDOWS\system32\drivers\PxHelp20.sys
2008-08-14 01:47 129,784 ----a-w C:\WINDOWS\system32\pxafs.dll
2008-08-14 01:47 118,520 ----a-w C:\WINDOWS\system32\pxinsi64.exe
2008-08-14 01:47 116,472 ----a-w C:\WINDOWS\system32\pxcpyi64.exe
2008-08-09 23:00 --------- d-----w C:\Documents and Settings\Owner\Application Data\Yahoo!
2008-08-09 23:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-08-09 22:55 --------- d-----w C:\Program Files\GameHouse
2008-08-05 02:18 --------- d-----w C:\Program Files\Apple Software Update
2008-08-04 23:42 --------- d-----w C:\Program Files\iTunes
2008-08-04 21:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-08-04 01:19 780,482 ----a-w C:\WINDOWS\tattoogirl.zip
2008-08-04 01:19 64,578 ----a-w C:\WINDOWS\freak.zip
2008-08-04 01:19 49,726 ----a-w C:\WINDOWS\peanuts.zip
2008-08-04 01:19 39,796 ----a-w C:\WINDOWS\goofball.zip
2008-08-04 01:19 36,571 ----a-w C:\WINDOWS\facelift.zip
2008-08-04 01:19 30,578 ----a-w C:\WINDOWS\milkyway.zip
2008-08-04 01:19 26,127 ----a-w C:\WINDOWS\viuniversity.zip
2008-08-04 01:19 24,005 ----a-w C:\WINDOWS\myoldremington.zip
2008-08-04 01:19 19,016 ----a-w C:\WINDOWS\magiccards.zip
2008-08-04 01:19 17,681 ----a-w C:\WINDOWS\mixedup.zip
2008-08-04 01:19 125,658 ----a-w C:\WINDOWS\wc_manonegra.zip
2008-08-04 01:19 11,976 ----a-w C:\WINDOWS\ruthscript.zip
2008-08-04 01:16 51,094 ----a-w C:\WINDOWS\simpsonsfont.zip
2008-08-04 01:16 27,639 ----a-w C:\WINDOWS\feenacasual.zip
2008-08-04 01:16 24,628 ----a-w C:\WINDOWS\mickey.zip
2008-08-04 01:16 24,048 ----a-w C:\WINDOWS\markerfinepoint.zip
2008-08-04 01:16 221,517 ----a-w C:\WINDOWS\scribbledsans.zip
2008-08-04 01:16 21,047 ----a-w C:\WINDOWS\basicfont.zip
2008-08-04 01:16 197,295 ----a-w C:\WINDOWS\sffoxboroscript.zip
2008-08-04 01:16 19,740 ----a-w C:\WINDOWS\scrawnykids.zip
2008-08-04 01:16 16,910 ----a-w C:\WINDOWS\machinescript.zip
2008-08-04 01:16 16,673 ----a-w C:\WINDOWS\catholicschoolgirls.zip
2008-08-04 01:16 13,724 ----a-w C:\WINDOWS\chinesetakeaway.zip
2008-08-04 01:16 12,998 ----a-w C:\WINDOWS\carbontype.zip
2008-08-04 01:16 10,703 ----a-w C:\WINDOWS\vampiress.zip
2008-08-04 01:13 57,665 ----a-w C:\WINDOWS\darkcrystal.zip
2008-08-04 01:13 47,121 ----a-w C:\WINDOWS\angelina.zip
2008-08-04 01:13 36,078 ----a-w C:\WINDOWS\jane_austen.zip
2008-08-04 01:13 36,067 ----a-w C:\WINDOWS\carrington.zip
2008-08-04 01:13 31,290 ----a-w C:\WINDOWS\sabrina.zip
2008-08-04 01:13 29,220 ----a-w C:\WINDOWS\ayummyapology.zip
2008-08-04 01:13 26,497 ----a-w C:\WINDOWS\lokicola.zip
2008-08-04 01:13 24,593 ----a-w C:\WINDOWS\oakwood.zip
2008-08-04 01:13 22,312 ----a-w C:\WINDOWS\littledays.zip
2008-08-04 01:13 19,234 ----a-w C:\WINDOWS\heather.zip
2008-08-04 01:13 13,490 ----a-w C:\WINDOWS\wordsoflove.zip
2008-08-04 01:13 12,592 ----a-w C:\WINDOWS\scramble.zip
2008-07-30 22:42 23,888 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.sys
2008-07-30 22:28 706 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.inf
2008-07-30 22:28 10,537 ----a-w C:\WINDOWS\system32\drivers\coh_mon.cat
2008-07-26 02:01 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-24 11:07 --------- d-----w C:\Program Files\Norton AntiVirus
2008-07-24 10:55 805 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-07-24 10:55 60,800 ----a-w C:\WINDOWS\system32\S32EVNT1.DLL
2008-07-24 10:55 123,952 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-07-24 10:55 10,671 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-07-24 10:55 --------- d-----w C:\Program Files\Symantec
2008-07-21 22:52 --------- d-----w C:\Documents and Settings\All Users\Application Data\Azureus
2008-07-21 17:01 --------- d-----w C:\Documents and Settings\Owner\Application Data\Symantec
2008-07-21 01:59 --------- d-----w C:\Documents and Settings\Owner\Application Data\Aim
2008-07-21 01:48 --------- d-----w C:\Program Files\Bejeweled 2 Deluxe
2008-07-21 01:47 720,896 ----a-w C:\WINDOWS\iun6002ev.exe
2008-07-20 21:58 --------- d-----w C:\Program Files\Windows Sidebar
2008-07-19 23:06 --------- d-----w C:\Documents and Settings\Owner\Application Data\Apple Computer
2008-07-18 01:28 604,799 ----a-w C:\WINDOWS\SharePod.zip
2008-07-17 05:21 --------- d-----w C:\Documents and Settings\All Users\Application Data\Trymedia
2008-07-17 05:19 --------- d-----w C:\Program Files\Java
2008-07-17 05:06 --------- d-----w C:\Documents and Settings\Owner\Application Data\Creative
2008-07-17 04:30 --------- d-----w C:\Program Files\Common Files\Java
2008-07-17 04:28 --------- d-----w C:\Program Files\TryMedia
2008-07-17 04:19 --------- d-----w C:\Program Files\Creative
2008-07-17 04:07 --------- d-----w C:\Program Files\Yahoo!
2008-07-17 04:07 --------- d-----w C:\Program Files\NOS
2008-07-17 04:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\NOS
2008-07-17 04:01 --------- d-----w C:\Program Files\QuickTime
2008-07-17 04:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-07-17 04:00 --------- d-----w C:\Program Files\Common Files\Apple
2008-07-17 04:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2008-07-17 03:58 --------- d-----w C:\Program Files\Common Files\Adobe AIR
2008-07-17 03:56 --------- d-----w C:\Program Files\AWS
2008-07-17 03:56 --------- d-----w C:\Program Files\AIM
2008-07-17 03:55 --------- d-----w C:\Program Files\Viewpoint
2008-07-17 03:55 --------- d-----w C:\Program Files\AOD
2008-07-17 03:55 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-07-17 03:50 5 ----a-w C:\WINDOWS\system32\drivers\DELL_DIM_3000.MRK
2008-07-17 03:50 5 ----a-w C:\WINDOWS\system32\drivers\1028_DELL_DIM_3000.MRK
2008-07-17 03:48 --------- d-----w C:\Program Files\Intel
2008-07-17 03:42 --------- d-----w C:\Program Files\microsoft frontpage
2008-07-07 20:32 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-13 19:45 579,464 ----a-w C:\WINDOWS\system32\SymNeti.dll
.

((((((((((((((((((((((((((((( snapshot@2008-08-21_18.25.54.72 )))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-12 08:56 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 02:38 34672]
"AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 09:47 116040]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-05-27 10:50 413696]
"CTSysVol"="C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe" [2003-09-17 10:43 57344]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 01:00 90112]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-09-20 09:35 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-09-20 09:32 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-09-20 09:36 114688]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-02-14 11:01 51048]
"NSWosCheck"="C:\Program Files\Norton SystemWorks Basic Edition\osCheck.exe" [2007-09-18 08:22 25472]
"osCheck"="C:\Program Files\Norton AntiVirus\osCheck.exe" [2007-08-24 23:53 714608]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-30 10:47 289064]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Elements 6.0\apdproxy.exe" [2007-09-11 00:43 67488]
"e005b032"="C:\WINDOWS\system32\qmrslkws.dll" [BU]
"BMe33683ae"="C:\WINDOWS\system32\liitjbpn.dll" [BU]
"P17Helper"="P17.dll" [2004-06-10 11:51 60928 C:\WINDOWS\system32\P17.dll]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"SymLnch"="C:\Documents and Settings\Owner\Application Data\Symantec\Layouts\Norton Internet Security\15.0\SymAllLanguages\NIS_RETAIL\20070828\Support\SymLnch\SymLnch.exe" [2007-08-26 19:04 687976]

[HKEY_CURRENT_USER\software\microsoft\windows\Currentversion\policies\explorer\Run]
"NT Printing Services2"="cleanmgrs.exe" [2008-08-10 16:36 52224 C:\WINDOWS\system32\cleanmgrs.exe]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{D0790168-28C6-42AB-8858-92B956D46B1C}"= "C:\WINDOWS\system32\awtrOfee.dll" [2008-08-21 21:38 39424]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\awtrOfee]
2008-08-21 21:38 39424 C:\WINDOWS\system32\awtrOfee.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"mW[íµˆÖ¾`=µú¾˜v%S8’ÿÙêé>grl>*Ý\†Ð=ŸàÛ±Þ"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\AIM\\aim.exe"=
"C:\\Documents and Settings\\Owner\\My Documents\\TextTwist\\TextTwist.exe"=
"C:\\Documents and Settings\\Owner\\My Documents\\Bejeweled 2 Deluxe\\WinBej2.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\program files\\bcd_installed.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R2 AdobeActiveFileMonitor6.0;Adobe Active File Monitor V6;C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe [2007-09-11 00:45]
R2 LiveUpdate Notice;LiveUpdate Notice;C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2008-02-14 11:02]
S3 COH_Mon;COH_Mon;C:\WINDOWS\system32\Drivers\COH_Mon.sys [2008-07-30 17:42]
.
Contents of the 'Scheduled Tasks' folder

2008-08-14 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]

2008-08-19 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Owner.job
- C:\Program Files\Norton AntiVirus\Navw32.exe [2007-08-26 20:19]

2008-08-18 C:\WINDOWS\Tasks\Norton SystemWorks One Button Checkup.job
- C:\Program Files\Norton SystemWorks Basic Edition\OBC.exe [2007-09-18 08:22]
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-21 21:37:21
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

C:\WINDOWS\system32\awtrOfee.dll 39424 bytes executable
C:\WINDOWS\system32\iifcCtRi.dll 39424 bytes executable

scan completed successfully
hidden files: 2

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\awtrOfee.dll
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\WINDOWS\system32\CTSVCCDA.EXE
C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2008-08-21 21:43:43 - machine was rebooted [Owner]
ComboFix-quarantined-files.txt 2008-08-22 02:43:33
ComboFix2.txt 2008-08-21 23:26:44

Pre-Run: 21,925,457,920 bytes free
Post-Run: 21,876,199,424 bytes free

346 --- E O F --- 2008-08-15 11:46:03

Malwarebytes' Anti-Malware 1.25
Database version: 1076
Windows 5.1.2600 Service Pack 2

4:34:54 AM 8/22/2008
mbam-log-08-22-2008 (04-34-54).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 97119
Time elapsed: 1 hour(s), 29 minute(s), 47 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 1
Registry Keys Infected: 13
Registry Values Infected: 3
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 87

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
C:\WINDOWS\system32\awtrOfee.dll (Trojan.Vundo) -> Delete on reboot.

Registry Keys Infected:
HKEY_CLASSES_ROOT\minibugtransporter.minibugtransporterx (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\minibugtransporter.minibugtransporterx.1 (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{04a38f6b-006f-4247-ba4c-02a139d5531c} (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{3c2d2a1e-031f-4397-9614-87c932a848e0} (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IProxyProvider (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{d0790168-28c6-42ab-8858-92b956d46b1c} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\awtrofee (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bme33683ae (Trojan.Agent) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e005b032 (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{d0790168-28c6-42ab-8858-92b956d46b1c} (Trojan.Vundo) -> Delete on reboot.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Program Files\AWS\WeatherBug\MiniBugTransporter.dll (Adware.Minibug) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\bneihsuo.exe.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\byXQkklm.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\cbXOGWoO.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\cbXQjkLe.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\geBqpNEU.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\geBqrrRI.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\geBtSIxw.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\htmpxwxr.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\kytqttlw.exe.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\ljJBTNhI.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\ljJCrpqO.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\ljJcyaXO.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\pmnnOEuU.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\pmnnOEwU.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\edejdswr.exe.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\eikswctw.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\exqxpkeg.exe.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\gcuyqkwv.exe.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\geBQjigd.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\geBqPfFw.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\tuvUKBsS.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\tuvWpPHA.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\urqOHXnO.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\vtUkhEtq.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\vtykypnr.exe.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\xrodfllm.exe.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\ybulcfxa.exe.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\iifedbxu.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\jfinivga.exe.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\jkkLFvSL.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\khfDwxYO.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\sduptfcg.exe.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\tlibmopg.exe.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\tuvTnMGW.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\obwkltbk.exe.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\opnkhfEt.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BDDD5C44-2312-4F6A-874B-8A6817957A3C}\RP60\A0008832.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BDDD5C44-2312-4F6A-874B-8A6817957A3C}\RP61\A0009398.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BDDD5C44-2312-4F6A-874B-8A6817957A3C}\RP61\A0009434.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BDDD5C44-2312-4F6A-874B-8A6817957A3C}\RP61\A0009395.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BDDD5C44-2312-4F6A-874B-8A6817957A3C}\RP61\A0009396.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BDDD5C44-2312-4F6A-874B-8A6817957A3C}\RP61\A0009397.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BDDD5C44-2312-4F6A-874B-8A6817957A3C}\RP61\A0009399.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BDDD5C44-2312-4F6A-874B-8A6817957A3C}\RP61\A0009400.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BDDD5C44-2312-4F6A-874B-8A6817957A3C}\RP61\A0009401.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BDDD5C44-2312-4F6A-874B-8A6817957A3C}\RP61\A0009402.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BDDD5C44-2312-4F6A-874B-8A6817957A3C}\RP61\A0009403.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BDDD5C44-2312-4F6A-874B-8A6817957A3C}\RP61\A0009404.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BDDD5C44-2312-4F6A-874B-8A6817957A3C}\RP61\A0009405.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BDDD5C44-2312-4F6A-874B-8A6817957A3C}\RP61\A0009407.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BDDD5C44-2312-4F6A-874B-8A6817957A3C}\RP61\A0009408.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BDDD5C44-2312-4F6A-874B-8A6817957A3C}\RP61\A0009409.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BDDD5C44-2312-4F6A-874B-8A6817957A3C}\RP61\A0009410.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BDDD5C44-2312-4F6A-874B-8A6817957A3C}\RP61\A0009411.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BDDD5C44-2312-4F6A-874B-8A6817957A3C}\RP61\A0009412.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BDDD5C44-2312-4F6A-874B-8A6817957A3C}\RP61\A0009413.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BDDD5C44-2312-4F6A-874B-8A6817957A3C}\RP61\A0009414.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BDDD5C44-2312-4F6A-874B-8A6817957A3C}\RP61\A0009415.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BDDD5C44-2312-4F6A-874B-8A6817957A3C}\RP61\A0009419.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BDDD5C44-2312-4F6A-874B-8A6817957A3C}\RP61\A0009420.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BDDD5C44-2312-4F6A-874B-8A6817957A3C}\RP61\A0009423.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BDDD5C44-2312-4F6A-874B-8A6817957A3C}\RP61\A0009424.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BDDD5C44-2312-4F6A-874B-8A6817957A3C}\RP61\A0009425.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BDDD5C44-2312-4F6A-874B-8A6817957A3C}\RP61\A0009427.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BDDD5C44-2312-4F6A-874B-8A6817957A3C}\RP61\A0009428.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BDDD5C44-2312-4F6A-874B-8A6817957A3C}\RP61\A0009429.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BDDD5C44-2312-4F6A-874B-8A6817957A3C}\RP61\A0009430.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BDDD5C44-2312-4F6A-874B-8A6817957A3C}\RP61\A0009431.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BDDD5C44-2312-4F6A-874B-8A6817957A3C}\RP61\A0009432.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BDDD5C44-2312-4F6A-874B-8A6817957A3C}\RP61\A0009435.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BDDD5C44-2312-4F6A-874B-8A6817957A3C}\RP61\A0010278.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BDDD5C44-2312-4F6A-874B-8A6817957A3C}\RP63\A0010524.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BDDD5C44-2312-4F6A-874B-8A6817957A3C}\RP63\A0010533.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BDDD5C44-2312-4F6A-874B-8A6817957A3C}\RP65\A0010560.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\iwydtwgc.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\cgqexyrd.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\pskt.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\qoMfFwuV.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\awtrOfee.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\hgGyywus.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\iifcCtRi.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\iifcdAPf.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\iifecyyw.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\yaywxwWN.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\BMe33683ae.xml (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\BMe33683ae.txt (Trojan.Vundo) -> Quarantined and deleted successfully.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:13:51 AM, on 8/22/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Adobe\Photoshop Elements 6.0\apdproxy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Owner\Desktop\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: {c420cd92-06de-905a-6ef4-61c7c1c442c6} - {6c244c1c-7c16-4fe6-a509-ed6029dc024c} - C:\WINDOWS\system32\fkcjvo.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {77B6D5C2-42DE-49B7-A97F-75D0BE8D4237} - C:\WINDOWS\system32\hgGyywus.dll (file missing)
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NSWosCheck] "C:\Program Files\Norton SystemWorks Basic Edition\osCheck.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Elements 6.0\apdproxy.exe"
O4 - HKLM\..\RunOnce: [SymLnch] "C:\Documents and Settings\Owner\Application Data\Symantec\Layouts\Norton Internet Security\15.0\SymAllLanguages\NIS_RETAIL\20070828\Support\SymLnch\SymLnch.exe" "C:\Documents and Settings\Owner\Application Data\Symantec\Layouts\Norton Internet Security\15.0\SymAllLanguages\NIS_RETAIL\20070828\Setup.exe" "/REALUPREBOOT /temp /patched"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Policies\Explorer\Run: [NT Printing Services2] cleanmgrs.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Basic Edition\Norton Cleanup\WCQuick.lnk
O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Basic Edition\Norton Cleanup\WCQuick.lnk
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe Active File Monitor V6 (AdobeActiveFileMonitor6.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Norton UnErase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe

--
End of file - 8306 bytes

pskelley · Aug 22, 2008

Thanks for the feedback, by now you shoulld not be getting popups. You said:

I have no idea what those zip files are...nothing I downloaded/installed intentionally. Can I/should I delete them?

Scan a few of them to find out what they are, if anyone else uses the computer you should ask them about the files, they are easy to see in the combofix log.
If you are the only user and you say so, I will show you how to delete them all. I have cleaned 50,000 computers and I have never seen them before, from the looks of them they could be anything from valid files to compressed
p**n.

1) Files to scan:
C:\WINDOWS\machinescript.zip
C:\WINDOWS\catholicschoolgirls.zip
C:\WINDOWS\chinesetakeaway.zip
C:\WINDOWS\carbontype.zip
C:\WINDOWS\vampiress.zip
C:\WINDOWS\darkcrystal.zip
C:\WINDOWS\angelina.zip

2) You will probably need to show all files and folders:
http://www.xtra.co.nz/help/0,,4155-1916458,00.html

3) Click this link, I will post two more sites in case jotti is busy:
http://virusscan.jotti.org/
http://www.kaspersky.com/scanforvirus
http://www.virustotal.com/

Browse to the file/s and them click submit. Post the results from at least one file. I do not have a good feeling about this stuff.

So you will know, if you don't clean all of Vundo, the junk can morph and create new files, which I am sure these are:
C:\WINDOWS\system32\iifcCtRi.dll
C:\WINDOWS\system32\awtrOfee.dll

and there is more stuff that is new in the HJT log. If I did not say it before, this was a badly infected computer, and we still have work to do. You must keep this computer offline (unless you are troubleshooting this problem)

I see no reason to proceed until I know about those .zip files, so I am waiting on you.

Thanks

jiller1978 · Aug 23, 2008

It's amazing to me that things went downhill so fast on this computer. Honestly, the day I first posted was the second day I even had trouble with IE and downloaded spybot.

I *think* those files in the Windows folder are fonts I've downloaded from the internet, but I don't know for sure, and would rather delete them. All of them scanned as "OK." Here's the log for "catholic school girls" (which DEFINITELY soundd like compressed p*rn)!

File: catholicschoolgirls.zip
Status: OK
MD5: b4b9ce4da56b70ec18c3d79e682a4492
Packers detected: -

Scanner results
Scan taken on 22 Aug 2008 23:11:51 (GMT)
AntiVir Found nothing
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found nothing
CPsecure Found nothing
Dr.Web Found nothing
F-Prot Antivirus Found nothing
F-Secure Anti-Virus Found nothing
Fortinet Found nothing
Ikarus Found nothing
Kaspersky Anti-Virus Found nothing
NOD32 Found nothing
Norman Virus Control Found nothing
Panda Antivirus Found nothing
Sophos Antivirus Found nothing
VirusBuster Found nothing
VBA32 Found nothing

I am going to disconnect this computer and will get online only to try and fix it. When I went to get on tonight, I had the same trouble (IE not working), and even more popups than before -- it's definitely morphing!

Thanks again for your help!

pskelley · Aug 23, 2008

Thanks for the feedback, What a MESS!!!

I will make a startement here, if it is not true, post to let me know and DO NOT PROCEED:

You want me to show you how to delete all of the .zip files in the C:\Windows\ folder.

If that statement is true, proceed like this:

Open notepad and copy/paste the text in the codebox below into it:

Code:

File::
C:\WINDOWS\system32\fkcjvo.dll
C:\WINDOWS\system32\iifcCtRi.dll
C:\WINDOWS\system32\awtrOfee.dll
C:\Program Files\bcd_installed.exe
C:\WINDOWS\system32\gpedits.exe
C:\WINDOWS\system32\ciadvss.exe
C:\WINDOWS\system32\cleanmgrs.exe
C:\WINDOWS\system32\ftps.exe
C:\WINDOWS\system32\cliconfgs.exe
C:\WINDOWS\system32\ciadvs.exe
C:\WINDOWS\system32\chkdskss.exe
C:\WINDOWS\system32\chkdsks.exe
C:\WINDOWS\system32\Monitored3.dat
C:\WINDOWS\system32\Monitored2.dat
C:\WINDOWS\teen.zip
C:\WINDOWS\castorgate.zip
C:\WINDOWS\oldrepublic.zip
C:\WINDOWS\juice.zip
C:\WINDOWS\tacosalad.zip
C:\WINDOWS\fashionvictim.zip
C:\WINDOWS\chancerycursive.zip
C:\WINDOWS\actionjackson.zip
C:\WINDOWS\lindaslament.zip
C:\WINDOWS\kidscrawl.zip
C:\WINDOWS\the_godfather.zip
C:\WINDOWS\tallpaul.zip
C:\WINDOWS\boingo.zip
C:\WINDOWS\girlsareweird.zip
C:\WINDOWS\gallery.zip
C:\WINDOWS\yahoo.zip
C:\WINDOWS\fortunaschwein.zip
C:\WINDOWS\amano.zip
C:\WINDOWS\calvinandhobbes.zip
C:\WINDOWS\allstar.zip
C:\WINDOWS\babebamboo.zip
C:\WINDOWS\sketchy.zip
C:\WINDOWS\acharmingfont.zip
C:\WINDOWS\scriptina.zip
C:\WINDOWS\freebooterscript.zip
C:\WINDOWS\tattoogirl.zip
C:\WINDOWS\freak.zip
C:\WINDOWS\peanuts.zip
C:\WINDOWS\goofball.zip
C:\WINDOWS\facelift.zip
C:\WINDOWS\milkyway.zip
C:\WINDOWS\viuniversity.zip
C:\WINDOWS\myoldremington.zip
C:\WINDOWS\magiccards.zip
C:\WINDOWS\mixedup.zip
C:\WINDOWS\wc_manonegra.zip
C:\WINDOWS\ruthscript.zip
C:\WINDOWS\simpsonsfont.zip
C:\WINDOWS\feenacasual.zip
C:\WINDOWS\mickey.zip
C:\WINDOWS\markerfinepoint.zip
C:\WINDOWS\scribbledsans.zip
C:\WINDOWS\basicfont.zip
C:\WINDOWS\sffoxboroscript.zip
C:\WINDOWS\scrawnykids.zip
C:\WINDOWS\machinescript.zip
C:\WINDOWS\catholicschoolgirls.zip
C:\WINDOWS\chinesetakeaway.zip
C:\WINDOWS\carbontype.zip
C:\WINDOWS\vampiress.zip
C:\WINDOWS\darkcrystal.zip
C:\WINDOWS\angelina.zip
C:\WINDOWS\jane_austen.zip
C:\WINDOWS\carrington.zip
C:\WINDOWS\sabrina.zip
C:\WINDOWS\ayummyapology.zip
C:\WINDOWS\lokicola.zip
C:\WINDOWS\oakwood.zip
C:\WINDOWS\littledays.zip
C:\WINDOWS\heather.zip
C:\WINDOWS\wordsoflove.zip
C:\WINDOWS\scramble.zip

Save this as CFScript

Referring to the picture above, drag CFScript into ComboFix.exe.

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.

Thanks

jiller1978 · Aug 23, 2008

Here ya go:

ComboFix 08-08-21.01 - Owner 2008-08-22 20:01:58.4 - NTFSx86
Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Owner\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\Program Files\bcd_installed.exe
C:\WINDOWS\acharmingfont.zip
C:\WINDOWS\actionjackson.zip
C:\WINDOWS\allstar.zip
C:\WINDOWS\amano.zip
C:\WINDOWS\angelina.zip
C:\WINDOWS\ayummyapology.zip
C:\WINDOWS\babebamboo.zip
C:\WINDOWS\basicfont.zip
C:\WINDOWS\boingo.zip
C:\WINDOWS\calvinandhobbes.zip
C:\WINDOWS\carbontype.zip
C:\WINDOWS\carrington.zip
C:\WINDOWS\castorgate.zip
C:\WINDOWS\catholicschoolgirls.zip
C:\WINDOWS\chancerycursive.zip
C:\WINDOWS\chinesetakeaway.zip
C:\WINDOWS\darkcrystal.zip
C:\WINDOWS\facelift.zip
C:\WINDOWS\fashionvictim.zip
C:\WINDOWS\feenacasual.zip
C:\WINDOWS\fortunaschwein.zip
C:\WINDOWS\freak.zip
C:\WINDOWS\freebooterscript.zip
C:\WINDOWS\gallery.zip
C:\WINDOWS\girlsareweird.zip
C:\WINDOWS\goofball.zip
C:\WINDOWS\heather.zip
C:\WINDOWS\jane_austen.zip
C:\WINDOWS\juice.zip
C:\WINDOWS\kidscrawl.zip
C:\WINDOWS\lindaslament.zip
C:\WINDOWS\littledays.zip
C:\WINDOWS\lokicola.zip
C:\WINDOWS\machinescript.zip
C:\WINDOWS\magiccards.zip
C:\WINDOWS\markerfinepoint.zip
C:\WINDOWS\mickey.zip
C:\WINDOWS\milkyway.zip
C:\WINDOWS\mixedup.zip
C:\WINDOWS\myoldremington.zip
C:\WINDOWS\oakwood.zip
C:\WINDOWS\oldrepublic.zip
C:\WINDOWS\peanuts.zip
C:\WINDOWS\ruthscript.zip
C:\WINDOWS\sabrina.zip
C:\WINDOWS\scramble.zip
C:\WINDOWS\scrawnykids.zip
C:\WINDOWS\scribbledsans.zip
C:\WINDOWS\scriptina.zip
C:\WINDOWS\sffoxboroscript.zip
C:\WINDOWS\simpsonsfont.zip
C:\WINDOWS\sketchy.zip
C:\WINDOWS\system32\awtrOfee.dll
C:\WINDOWS\system32\chkdsks.exe
C:\WINDOWS\system32\chkdskss.exe
C:\WINDOWS\system32\ciadvs.exe
C:\WINDOWS\system32\ciadvss.exe
C:\WINDOWS\system32\cleanmgrs.exe
C:\WINDOWS\system32\cliconfgs.exe
C:\WINDOWS\system32\fkcjvo.dll
C:\WINDOWS\system32\ftps.exe
C:\WINDOWS\system32\gpedits.exe
C:\WINDOWS\system32\iifcCtRi.dll
C:\WINDOWS\system32\Monitored2.dat
C:\WINDOWS\system32\Monitored3.dat
C:\WINDOWS\tacosalad.zip
C:\WINDOWS\tallpaul.zip
C:\WINDOWS\tattoogirl.zip
C:\WINDOWS\teen.zip
C:\WINDOWS\the_godfather.zip
C:\WINDOWS\vampiress.zip
C:\WINDOWS\viuniversity.zip
C:\WINDOWS\wc_manonegra.zip
C:\WINDOWS\wordsoflove.zip
C:\WINDOWS\yahoo.zip
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\bcd_installed.exe
C:\WINDOWS\acharmingfont.zip
C:\WINDOWS\actionjackson.zip
C:\WINDOWS\allstar.zip
C:\WINDOWS\amano.zip
C:\WINDOWS\angelina.zip
C:\WINDOWS\ayummyapology.zip
C:\WINDOWS\babebamboo.zip
C:\WINDOWS\basicfont.zip
C:\WINDOWS\BMe33683ae.txt
C:\WINDOWS\BMe33683ae.xml
C:\WINDOWS\boingo.zip
C:\WINDOWS\calvinandhobbes.zip
C:\WINDOWS\carbontype.zip
C:\WINDOWS\carrington.zip
C:\WINDOWS\castorgate.zip
C:\WINDOWS\catholicschoolgirls.zip
C:\WINDOWS\chancerycursive.zip
C:\WINDOWS\chinesetakeaway.zip
C:\WINDOWS\cookies.ini
C:\WINDOWS\darkcrystal.zip
C:\WINDOWS\facelift.zip
C:\WINDOWS\fashionvictim.zip
C:\WINDOWS\feenacasual.zip
C:\WINDOWS\fortunaschwein.zip
C:\WINDOWS\freak.zip
C:\WINDOWS\freebooterscript.zip
C:\WINDOWS\gallery.zip
C:\WINDOWS\girlsareweird.zip
C:\WINDOWS\goofball.zip
C:\WINDOWS\heather.zip
C:\WINDOWS\jane_austen.zip
C:\WINDOWS\juice.zip
C:\WINDOWS\kidscrawl.zip
C:\WINDOWS\lindaslament.zip
C:\WINDOWS\littledays.zip
C:\WINDOWS\lokicola.zip
C:\WINDOWS\machinescript.zip
C:\WINDOWS\magiccards.zip
C:\WINDOWS\markerfinepoint.zip
C:\WINDOWS\mickey.zip
C:\WINDOWS\milkyway.zip
C:\WINDOWS\mixedup.zip
C:\WINDOWS\myoldremington.zip
C:\WINDOWS\oakwood.zip
C:\WINDOWS\oldrepublic.zip
C:\WINDOWS\peanuts.zip
C:\WINDOWS\pskt.ini
C:\WINDOWS\ruthscript.zip
C:\WINDOWS\sabrina.zip
C:\WINDOWS\scramble.zip
C:\WINDOWS\scrawnykids.zip
C:\WINDOWS\scribbledsans.zip
C:\WINDOWS\scriptina.zip
C:\WINDOWS\sffoxboroscript.zip
C:\WINDOWS\simpsonsfont.zip
C:\WINDOWS\sketchy.zip
C:\WINDOWS\system32\almkcm.dll
C:\WINDOWS\system32\buksfmdo.dll
C:\WINDOWS\system32\chkdsks.exe
C:\WINDOWS\system32\chkdskss.exe
C:\WINDOWS\system32\ciadvs.exe
C:\WINDOWS\system32\ciadvss.exe
C:\WINDOWS\system32\cleanmgrs.exe
C:\WINDOWS\system32\cliconfgs.exe
C:\WINDOWS\system32\ddcaAQgd.dll
C:\WINDOWS\system32\dgQAacdd.ini
C:\WINDOWS\system32\dgQAacdd.ini2
C:\WINDOWS\system32\dryxeqgc.ini
C:\WINDOWS\system32\eahlwvli.ini
C:\WINDOWS\system32\efcCsqrO.dll
C:\WINDOWS\system32\fkcjvo.dll
C:\WINDOWS\system32\ftps.exe
C:\WINDOWS\system32\gpedits.exe
C:\WINDOWS\system32\ilvwlhae.dll
C:\WINDOWS\system32\iysievyr.dll
C:\WINDOWS\system32\Monitored2.dat
C:\WINDOWS\system32\Monitored3.dat
C:\WINDOWS\system32\nnnmjigd.dll
C:\WINDOWS\system32\opnMDsRL.dll
C:\WINDOWS\system32\ryveisyi.ini
C:\WINDOWS\system32\sckrqbgx.dll
C:\WINDOWS\system32\ssqoPigF.dll
C:\WINDOWS\system32\suwyyGgh.ini
C:\WINDOWS\system32\suwyyGgh.ini2
C:\WINDOWS\system32\tesgnavn.exe
C:\WINDOWS\system32\tnyexcmf.exe
C:\WINDOWS\system32\uebgwnhb.dll
C:\WINDOWS\system32\urqopoMC.dll
C:\WINDOWS\system32\xpxfnvei.dll
C:\WINDOWS\system32\yaywxYSJ.dll
C:\WINDOWS\system32\yxxkqhgw.dll
C:\WINDOWS\system32\zphdug.dll
C:\WINDOWS\tacosalad.zip
C:\WINDOWS\tallpaul.zip
C:\WINDOWS\tattoogirl.zip
C:\WINDOWS\teen.zip
C:\WINDOWS\the_godfather.zip
C:\WINDOWS\vampiress.zip
C:\WINDOWS\viuniversity.zip
C:\WINDOWS\wc_manonegra.zip
C:\WINDOWS\wordsoflove.zip
C:\WINDOWS\yahoo.zip

.
((((((((((((((((((((((((( Files Created from 2008-07-23 to 2008-08-23 )))))))))))))))))))))))))))))))
.

2008-08-21 21:49 . 2008-08-21 21:49 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-21 21:49 . 2008-08-21 21:49 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Malwarebytes
2008-08-21 21:49 . 2008-08-21 21:49 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-21 21:49 . 2008-08-17 15:01 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-21 21:49 . 2008-08-17 15:01 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-08-19 21:04 . 2008-08-19 21:04 95 --a------ C:\WINDOWS\wininit.ini
2008-08-18 20:58 . 2008-08-18 20:59 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-08-18 20:58 . 2008-08-19 17:10 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-08-17 14:47 . 2008-08-17 14:47 7,680 --a------ C:\WINDOWS\system32\f14rs.exe
2008-08-16 20:42 . 2008-08-18 17:52 <DIR> d-------- C:\Program Files\OGG To MP3 Plus
2008-08-16 20:41 . 2008-08-16 20:41 <DIR> d-------- C:\Downloads
2008-08-16 20:41 . 2008-08-16 20:42 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\GetRightToGo
2008-08-15 20:30 . 2008-08-15 20:30 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\InstallShield
2008-08-15 20:27 . 2008-08-15 20:29 <DIR> d-------- C:\Program Files\Common Files\Jasc Software Inc
2008-08-15 20:26 . 2008-08-15 20:32 <DIR> d-------- C:\Program Files\Jasc Software Inc
2008-08-15 20:26 . 2008-08-15 20:26 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Jasc Software Inc
2008-08-15 05:42 . 2008-08-15 05:42 268 --ah----- C:\sqmdata07.sqm
2008-08-15 05:42 . 2008-08-15 05:42 244 --ah----- C:\sqmnoopt07.sqm
2008-08-13 21:09 . 2008-08-13 21:09 268 --ah----- C:\sqmdata06.sqm
2008-08-13 21:09 . 2008-08-13 21:09 244 --ah----- C:\sqmnoopt06.sqm
2008-08-13 21:01 . 2008-08-13 21:01 <DIR> d-------- C:\Program Files\Common Files\Macrovision Shared
2008-08-11 06:56 . 2008-08-11 06:56 268 --ah----- C:\sqmdata05.sqm
2008-08-11 06:56 . 2008-08-11 06:56 244 --ah----- C:\sqmnoopt05.sqm
2008-08-10 16:36 . 2008-08-17 09:30 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-09 22:30 . 2008-08-09 22:30 <DIR> d--h----- C:\WINDOWS\PIF
2008-08-05 19:51 . 2008-08-05 19:51 268 --ah----- C:\sqmdata04.sqm
2008-08-05 19:51 . 2008-08-05 19:51 244 --ah----- C:\sqmnoopt04.sqm
2008-08-05 09:19 . 2008-08-05 09:19 268 --ah----- C:\sqmdata03.sqm
2008-08-05 09:19 . 2008-08-05 09:19 244 --ah----- C:\sqmnoopt03.sqm
2008-08-04 21:15 . 2008-08-04 21:15 268 --ah----- C:\sqmdata02.sqm
2008-08-04 21:15 . 2008-08-04 21:15 244 --ah----- C:\sqmnoopt02.sqm
2008-08-04 18:42 . 2008-08-04 18:42 <DIR> d-------- C:\Program Files\iPod
2008-08-03 20:14 . 2008-08-03 20:14 205,793 --a------ C:\WINDOWS\caffelatte.zip
2008-07-30 18:48 . 2008-07-30 18:48 268 --ah----- C:\sqmdata01.sqm
2008-07-30 18:48 . 2008-07-30 18:48 244 --ah----- C:\sqmnoopt01.sqm
2008-07-30 05:54 . 2008-07-30 05:54 376 --a------ C:\WINDOWS\ODBC.INI
2008-07-30 05:53 . 2008-07-30 05:53 <DIR> d-------- C:\Program Files\Microsoft ActiveSync
2008-07-30 05:52 . 2008-07-30 05:53 <DIR> d-------- C:\WINDOWS\ShellNew
2008-07-29 17:36 . 2008-07-29 17:36 268 --ah----- C:\sqmdata00.sqm
2008-07-29 17:36 . 2008-07-29 17:36 244 --ah----- C:\sqmnoopt00.sqm
2008-07-26 21:18 . 2008-08-15 20:24 <DIR> d-------- C:\Documents and Settings\Owner\Contacts
2008-07-26 21:16 . 2008-07-26 21:16 <DIR> d-------- C:\Program Files\MSN Messenger
2008-07-26 20:46 . 2008-08-21 17:46 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\skypePM
2008-07-26 20:46 . 2008-07-26 20:46 56 --ah----- C:\WINDOWS\system32\ezsidmv.dat
2008-07-26 20:40 . 2008-08-21 21:25 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Skype
2008-07-26 20:39 . 2008-07-26 20:44 <DIR> d-------- C:\Program Files\Skype
2008-07-26 20:39 . 2008-07-26 20:39 <DIR> d-------- C:\Program Files\Common Files\Skype
2008-07-26 20:38 . 2008-07-26 20:39 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Skype
2008-07-25 21:01 . 2008-08-16 21:17 <DIR> d-------- C:\Program Files\Full Tilt Poker.Net

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-21 23:34 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-08-18 22:37 --------- d-----w C:\Program Files\Norton SystemWorks Basic Edition
2008-08-17 03:03 --------- d-----w C:\Documents and Settings\Owner\Application Data\Azureus
2008-08-16 04:14 --------- d-----w C:\Documents and Settings\Owner\Application Data\LimeWire
2008-08-16 01:27 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-08-14 02:01 --------- d-----w C:\Program Files\Common Files\Adobe
2008-08-14 01:47 9,464 ----a-w C:\WINDOWS\system32\drivers\cdralw2k.sys
2008-08-14 01:47 9,336 ----a-w C:\WINDOWS\system32\drivers\cdr4_xp.sys
2008-08-14 01:47 43,528 ----a-w C:\WINDOWS\system32\drivers\PxHelp20.sys
2008-08-09 23:00 --------- d-----w C:\Documents and Settings\Owner\Application Data\Yahoo!
2008-08-09 23:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-08-09 22:55 --------- d-----w C:\Program Files\GameHouse
2008-08-05 02:18 --------- d-----w C:\Program Files\Apple Software Update
2008-08-04 23:42 --------- d-----w C:\Program Files\iTunes
2008-08-04 21:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-08-04 01:14 8,378 ----a-w C:\WINDOWS\walter.zip
2008-08-04 01:14 60,957 ----a-w C:\WINDOWS\aerosol.zip
2008-08-04 01:14 27,567 ----a-w C:\WINDOWS\cheri.zip
2008-08-04 01:14 27,525 ----a-w C:\WINDOWS\oreos.zip
2008-08-04 01:14 27,425 ----a-w C:\WINDOWS\heartbreaker.zip
2008-08-04 01:14 26,568 ----a-w C:\WINDOWS\dragonfly.zip
2008-08-04 01:14 26,548 ----a-w C:\WINDOWS\adamnmess.zip
2008-08-04 01:14 25,522 ----a-w C:\WINDOWS\ransom.zip
2008-08-04 01:14 23,681 ----a-w C:\WINDOWS\eagernat.zip
2008-08-04 01:14 21,557 ----a-w C:\WINDOWS\nadall.zip
2008-08-04 01:14 11,135 ----a-w C:\WINDOWS\harrypotter.zip
2008-08-04 01:14 10,307 ----a-w C:\WINDOWS\vanhelsing.zip
2008-07-30 22:42 23,888 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.sys
2008-07-30 22:28 706 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.inf
2008-07-30 22:28 10,537 ----a-w C:\WINDOWS\system32\drivers\coh_mon.cat
2008-07-26 02:01 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-24 11:07 --------- d-----w C:\Program Files\Norton AntiVirus
2008-07-24 10:55 805 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-07-24 10:55 123,952 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-07-24 10:55 10,671 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-07-24 10:55 --------- d-----w C:\Program Files\Symantec
2008-07-21 22:52 --------- d-----w C:\Documents and Settings\All Users\Application Data\Azureus
2008-07-21 17:01 --------- d-----w C:\Documents and Settings\Owner\Application Data\Symantec
2008-07-21 01:59 --------- d-----w C:\Documents and Settings\Owner\Application Data\Aim
2008-07-21 01:48 --------- d-----w C:\Program Files\Bejeweled 2 Deluxe
2008-07-21 01:47 720,896 ----a-w C:\WINDOWS\iun6002ev.exe
2008-07-20 21:58 --------- d-----w C:\Program Files\Windows Sidebar
2008-07-19 23:06 --------- d-----w C:\Documents and Settings\Owner\Application Data\Apple Computer
2008-07-18 01:28 604,799 ----a-w C:\WINDOWS\SharePod.zip
2008-07-17 05:21 --------- d-----w C:\Documents and Settings\All Users\Application Data\Trymedia
2008-07-17 05:19 --------- d-----w C:\Program Files\Java
2008-07-17 05:06 --------- d-----w C:\Documents and Settings\Owner\Application Data\Creative
2008-07-17 04:30 --------- d-----w C:\Program Files\Common Files\Java
2008-07-17 04:28 --------- d-----w C:\Program Files\TryMedia
2008-07-17 04:19 --------- d-----w C:\Program Files\Creative
2008-07-17 04:07 --------- d-----w C:\Program Files\Yahoo!
2008-07-17 04:07 --------- d-----w C:\Program Files\NOS
2008-07-17 04:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\NOS
2008-07-17 04:01 --------- d-----w C:\Program Files\QuickTime
2008-07-17 04:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-07-17 04:00 --------- d-----w C:\Program Files\Common Files\Apple
2008-07-17 04:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2008-07-17 03:58 --------- d-----w C:\Program Files\Common Files\Adobe AIR
2008-07-17 03:56 --------- d-----w C:\Program Files\AWS
2008-07-17 03:56 --------- d-----w C:\Program Files\AIM
2008-07-17 03:55 --------- d-----w C:\Program Files\Viewpoint
2008-07-17 03:55 --------- d-----w C:\Program Files\AOD
2008-07-17 03:55 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-07-17 03:50 5 ----a-w C:\WINDOWS\system32\drivers\DELL_DIM_3000.MRK
2008-07-17 03:50 5 ----a-w C:\WINDOWS\system32\drivers\1028_DELL_DIM_3000.MRK
2008-07-17 03:48 --------- d-----w C:\Program Files\Intel
2008-07-17 03:42 --------- d-----w C:\Program Files\microsoft frontpage
.

((((((((((((((((((((((((((((( snapshot@2008-08-21_18.25.54.72 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-08-22 22:58:10 2,048 ----a-w C:\WINDOWS\system32\wgutgioq.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-12 08:56 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 02:38 34672]
"AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 09:47 116040]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-05-27 10:50 413696]
"CTSysVol"="C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe" [2003-09-17 10:43 57344]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 01:00 90112]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-09-20 09:35 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-09-20 09:32 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-09-20 09:36 114688]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-02-14 11:01 51048]
"NSWosCheck"="C:\Program Files\Norton SystemWorks Basic Edition\osCheck.exe" [2007-09-18 08:22 25472]
"osCheck"="C:\Program Files\Norton AntiVirus\osCheck.exe" [2007-08-24 23:53 714608]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-30 10:47 289064]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Elements 6.0\apdproxy.exe" [2007-09-11 00:43 67488]
"BMe33683ae"="C:\WINDOWS\system32\xpxfnvei.dll" [BU]
"e005b032"="C:\WINDOWS\system32\ilvwlhae.dll" [BU]
"P17Helper"="P17.dll" [2004-06-10 11:51 60928 C:\WINDOWS\system32\P17.dll]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"SymLnch"="C:\Documents and Settings\Owner\Application Data\Symantec\Layouts\Norton Internet Security\15.0\SymAllLanguages\NIS_RETAIL\20070828\Support\SymLnch\SymLnch.exe" [2007-08-26 19:04 687976]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"mW[íµˆÖ¾`=µú¾˜v%S8’ÿÙêé>grl>*Ý\†Ð=ŸàÛ±Þ"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\AIM\\aim.exe"=
"C:\\Documents and Settings\\Owner\\My Documents\\TextTwist\\TextTwist.exe"=
"C:\\Documents and Settings\\Owner\\My Documents\\Bejeweled 2 Deluxe\\WinBej2.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R2 AdobeActiveFileMonitor6.0;Adobe Active File Monitor V6;C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe [2007-09-11 00:45]
R2 LiveUpdate Notice;LiveUpdate Notice;C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2008-02-14 11:02]
S3 COH_Mon;COH_Mon;C:\WINDOWS\system32\Drivers\COH_Mon.sys [2008-07-30 17:42]
.
Contents of the 'Scheduled Tasks' folder

2008-08-14 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]

2008-08-19 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Owner.job
- C:\Program Files\Norton AntiVirus\Navw32.exe [2007-08-26 20:19]

2008-08-18 C:\WINDOWS\Tasks\Norton SystemWorks One Button Checkup.job
- C:\Program Files\Norton SystemWorks Basic Edition\OBC.exe [2007-09-18 08:22]
.
- - - - ORPHANS REMOVED - - - -

BHO-{77B6D5C2-42DE-49B7-A97F-75D0BE8D4237} - C:\WINDOWS\system32\hgGyywus.dll
HKCU-Explorer_Run-NT Printing Services2 - cleanmgrs.exe

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-22 20:13:04
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\WINDOWS\system32\CTSVCCDA.EXE
C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2008-08-22 20:18:36 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-23 01:18:30
ComboFix2.txt 2008-08-22 02:43:45
ComboFix3.txt 2008-08-21 23:26:44

Pre-Run: 22,599,925,760 bytes free
Post-Run: 22,561,931,264 bytes free

412 --- E O F --- 2008-08-15 11:46:03

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:27:11 PM, on 8/22/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
C:\Documents and Settings\Owner\Desktop\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NSWosCheck] "C:\Program Files\Norton SystemWorks Basic Edition\osCheck.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Elements 6.0\apdproxy.exe"
O4 - HKLM\..\Run: [BMe33683ae] Rundll32.exe "C:\WINDOWS\system32\xpxfnvei.dll",s
O4 - HKLM\..\Run: [e005b032] rundll32.exe "C:\WINDOWS\system32\ilvwlhae.dll",b
O4 - HKLM\..\RunOnce: [SymLnch] "C:\Documents and Settings\Owner\Application Data\Symantec\Layouts\Norton Internet Security\15.0\SymAllLanguages\NIS_RETAIL\20070828\Support\SymLnch\SymLnch.exe" "C:\Documents and Settings\Owner\Application Data\Symantec\Layouts\Norton Internet Security\15.0\SymAllLanguages\NIS_RETAIL\20070828\Setup.exe" "/REALUPREBOOT /temp /patched"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Basic Edition\Norton Cleanup\WCQuick.lnk
O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Basic Edition\Norton Cleanup\WCQuick.lnk
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe Active File Monitor V6 (AdobeActiveFileMonitor6.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Norton UnErase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe

--
End of file - 7912 bytes

pskelley · Aug 23, 2008

Open notepad and copy/paste the text in the codebox below into it:

Code:

File::
C:\WINDOWS\system32\wgutgioq.exe
C:\WINDOWS\system32\xpxfnvei.dll
C:\WINDOWS\system32\ilvwlhae.dll
C:\WINDOWS\caffelatte.zip
C:\WINDOWS\walter.zip
C:\WINDOWS\aerosol.zip
C:\WINDOWS\cheri.zip
C:\WINDOWS\oreos.zip
C:\WINDOWS\heartbreaker.zip
C:\WINDOWS\dragonfly.zip
C:\WINDOWS\adamnmess.zip
C:\WINDOWS\ransom.zip
C:\WINDOWS\eagernat.zip
C:\WINDOWS\nadall.zip
C:\WINDOWS\harrypotter.zip
C:\WINDOWS\vanhelsing.zip
C:\WINDOWS\SharePod.zip

Save this as CFScript

Referring to the picture above, drag CFScript into ComboFix.exe.

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.

(wait until after the MBAM scan to post the logs)

Restart the computer in Safe Mode:
http://spyware-free.us/tutorials/safemode/

Scan again with MBAM in Safe Mode, remove what it finds, then post the MBAM log, CFScript log and a new HJT log. Please report on how the computer is running now.

Thanks

jiller1978 · Aug 23, 2008

OK, here we go!

Combofix log (not in safe mode)

ComboFix 08-08-21.01 - Owner 2008-08-23 8:08:12.5 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.255 [GMT -5:00]
Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Owner\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\WINDOWS\adamnmess.zip
C:\WINDOWS\aerosol.zip
C:\WINDOWS\caffelatte.zip
C:\WINDOWS\cheri.zip
C:\WINDOWS\dragonfly.zip
C:\WINDOWS\eagernat.zip
C:\WINDOWS\harrypotter.zip
C:\WINDOWS\heartbreaker.zip
C:\WINDOWS\nadall.zip
C:\WINDOWS\oreos.zip
C:\WINDOWS\ransom.zip
C:\WINDOWS\SharePod.zip
C:\WINDOWS\system32\ilvwlhae.dll
C:\WINDOWS\system32\wgutgioq.exe
C:\WINDOWS\system32\xpxfnvei.dll
C:\WINDOWS\vanhelsing.zip
C:\WINDOWS\walter.zip
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\adamnmess.zip
C:\WINDOWS\aerosol.zip
C:\WINDOWS\caffelatte.zip
C:\WINDOWS\cheri.zip
C:\WINDOWS\dragonfly.zip
C:\WINDOWS\eagernat.zip
C:\WINDOWS\harrypotter.zip
C:\WINDOWS\heartbreaker.zip
C:\WINDOWS\nadall.zip
C:\WINDOWS\oreos.zip
C:\WINDOWS\ransom.zip
C:\WINDOWS\SharePod.zip
C:\WINDOWS\system32\wgutgioq.exe
C:\WINDOWS\vanhelsing.zip
C:\WINDOWS\walter.zip

.
((((((((((((((((((((((((( Files Created from 2008-07-23 to 2008-08-23 )))))))))))))))))))))))))))))))
.

2008-08-21 21:49 . 2008-08-21 21:49 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-21 21:49 . 2008-08-21 21:49 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Malwarebytes
2008-08-21 21:49 . 2008-08-21 21:49 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-21 21:49 . 2008-08-17 15:01 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-21 21:49 . 2008-08-17 15:01 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-08-19 21:04 . 2008-08-19 21:04 95 --a------ C:\WINDOWS\wininit.ini
2008-08-18 20:58 . 2008-08-18 20:59 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-08-18 20:58 . 2008-08-19 17:10 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-08-17 14:47 . 2008-08-17 14:47 7,680 --a------ C:\WINDOWS\system32\f14rs.exe
2008-08-16 20:42 . 2008-08-18 17:52 <DIR> d-------- C:\Program Files\OGG To MP3 Plus
2008-08-16 20:41 . 2008-08-16 20:41 <DIR> d-------- C:\Downloads
2008-08-16 20:41 . 2008-08-16 20:42 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\GetRightToGo
2008-08-15 20:30 . 2008-08-15 20:30 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\InstallShield
2008-08-15 20:27 . 2008-08-15 20:29 <DIR> d-------- C:\Program Files\Common Files\Jasc Software Inc
2008-08-15 20:26 . 2008-08-15 20:32 <DIR> d-------- C:\Program Files\Jasc Software Inc
2008-08-15 20:26 . 2008-08-15 20:26 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Jasc Software Inc
2008-08-15 05:42 . 2008-08-15 05:42 268 --ah----- C:\sqmdata07.sqm
2008-08-15 05:42 . 2008-08-15 05:42 244 --ah----- C:\sqmnoopt07.sqm
2008-08-13 21:09 . 2008-08-13 21:09 268 --ah----- C:\sqmdata06.sqm
2008-08-13 21:09 . 2008-08-13 21:09 244 --ah----- C:\sqmnoopt06.sqm
2008-08-13 21:01 . 2008-08-13 21:01 <DIR> d-------- C:\Program Files\Common Files\Macrovision Shared
2008-08-11 06:56 . 2008-08-11 06:56 268 --ah----- C:\sqmdata05.sqm
2008-08-11 06:56 . 2008-08-11 06:56 244 --ah----- C:\sqmnoopt05.sqm
2008-08-10 16:36 . 2008-08-17 09:30 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-09 22:30 . 2008-08-09 22:30 <DIR> d--h----- C:\WINDOWS\PIF
2008-08-05 19:51 . 2008-08-05 19:51 268 --ah----- C:\sqmdata04.sqm
2008-08-05 19:51 . 2008-08-05 19:51 244 --ah----- C:\sqmnoopt04.sqm
2008-08-05 09:19 . 2008-08-05 09:19 268 --ah----- C:\sqmdata03.sqm
2008-08-05 09:19 . 2008-08-05 09:19 244 --ah----- C:\sqmnoopt03.sqm
2008-08-04 21:15 . 2008-08-04 21:15 268 --ah----- C:\sqmdata02.sqm
2008-08-04 21:15 . 2008-08-04 21:15 244 --ah----- C:\sqmnoopt02.sqm
2008-08-04 18:42 . 2008-08-04 18:42 <DIR> d-------- C:\Program Files\iPod
2008-07-30 18:48 . 2008-07-30 18:48 268 --ah----- C:\sqmdata01.sqm
2008-07-30 18:48 . 2008-07-30 18:48 244 --ah----- C:\sqmnoopt01.sqm
2008-07-30 05:54 . 2008-07-30 05:54 376 --a------ C:\WINDOWS\ODBC.INI
2008-07-30 05:53 . 2008-07-30 05:53 <DIR> d-------- C:\Program Files\Microsoft ActiveSync
2008-07-30 05:52 . 2008-07-30 05:53 <DIR> d-------- C:\WINDOWS\ShellNew
2008-07-29 17:36 . 2008-07-29 17:36 268 --ah----- C:\sqmdata00.sqm
2008-07-29 17:36 . 2008-07-29 17:36 244 --ah----- C:\sqmnoopt00.sqm
2008-07-26 21:18 . 2008-08-15 20:24 <DIR> d-------- C:\Documents and Settings\Owner\Contacts
2008-07-26 21:16 . 2008-07-26 21:16 <DIR> d-------- C:\Program Files\MSN Messenger
2008-07-26 20:46 . 2008-08-21 17:46 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\skypePM
2008-07-26 20:46 . 2008-07-26 20:46 56 --ah----- C:\WINDOWS\system32\ezsidmv.dat
2008-07-26 20:40 . 2008-08-21 21:25 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Skype
2008-07-26 20:39 . 2008-07-26 20:44 <DIR> d-------- C:\Program Files\Skype
2008-07-26 20:39 . 2008-07-26 20:39 <DIR> d-------- C:\Program Files\Common Files\Skype
2008-07-26 20:38 . 2008-07-26 20:39 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Skype
2008-07-25 21:01 . 2008-08-16 21:17 <DIR> d-------- C:\Program Files\Full Tilt Poker.Net

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-21 23:34 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-08-18 22:37 --------- d-----w C:\Program Files\Norton SystemWorks Basic Edition
2008-08-17 03:03 --------- d-----w C:\Documents and Settings\Owner\Application Data\Azureus
2008-08-16 04:14 --------- d-----w C:\Documents and Settings\Owner\Application Data\LimeWire
2008-08-16 01:27 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-08-14 02:01 --------- d-----w C:\Program Files\Common Files\Adobe
2008-08-14 01:47 9,464 ----a-w C:\WINDOWS\system32\drivers\cdralw2k.sys
2008-08-14 01:47 9,336 ----a-w C:\WINDOWS\system32\drivers\cdr4_xp.sys
2008-08-14 01:47 43,528 ----a-w C:\WINDOWS\system32\drivers\PxHelp20.sys
2008-08-14 01:47 129,784 ----a-w C:\WINDOWS\system32\pxafs.dll
2008-08-14 01:47 118,520 ----a-w C:\WINDOWS\system32\pxinsi64.exe
2008-08-14 01:47 116,472 ----a-w C:\WINDOWS\system32\pxcpyi64.exe
2008-08-09 23:00 --------- d-----w C:\Documents and Settings\Owner\Application Data\Yahoo!
2008-08-09 23:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-08-09 22:55 --------- d-----w C:\Program Files\GameHouse
2008-08-05 02:18 --------- d-----w C:\Program Files\Apple Software Update
2008-08-04 23:42 --------- d-----w C:\Program Files\iTunes
2008-08-04 21:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-07-30 22:42 23,888 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.sys
2008-07-30 22:28 706 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.inf
2008-07-30 22:28 10,537 ----a-w C:\WINDOWS\system32\drivers\coh_mon.cat
2008-07-26 02:01 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-24 11:07 --------- d-----w C:\Program Files\Norton AntiVirus
2008-07-24 10:55 805 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-07-24 10:55 60,800 ----a-w C:\WINDOWS\system32\S32EVNT1.DLL
2008-07-24 10:55 123,952 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-07-24 10:55 10,671 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-07-24 10:55 --------- d-----w C:\Program Files\Symantec
2008-07-21 22:52 --------- d-----w C:\Documents and Settings\All Users\Application Data\Azureus
2008-07-21 17:01 --------- d-----w C:\Documents and Settings\Owner\Application Data\Symantec
2008-07-21 01:59 --------- d-----w C:\Documents and Settings\Owner\Application Data\Aim
2008-07-21 01:48 --------- d-----w C:\Program Files\Bejeweled 2 Deluxe
2008-07-21 01:47 720,896 ----a-w C:\WINDOWS\iun6002ev.exe
2008-07-20 21:58 --------- d-----w C:\Program Files\Windows Sidebar
2008-07-19 23:06 --------- d-----w C:\Documents and Settings\Owner\Application Data\Apple Computer
2008-07-17 05:21 --------- d-----w C:\Documents and Settings\All Users\Application Data\Trymedia
2008-07-17 05:19 --------- d-----w C:\Program Files\Java
2008-07-17 05:06 --------- d-----w C:\Documents and Settings\Owner\Application Data\Creative
2008-07-17 04:30 --------- d-----w C:\Program Files\Common Files\Java
2008-07-17 04:28 --------- d-----w C:\Program Files\TryMedia
2008-07-17 04:19 --------- d-----w C:\Program Files\Creative
2008-07-17 04:07 --------- d-----w C:\Program Files\Yahoo!
2008-07-17 04:07 --------- d-----w C:\Program Files\NOS
2008-07-17 04:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\NOS
2008-07-17 04:01 --------- d-----w C:\Program Files\QuickTime
2008-07-17 04:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-07-17 04:00 --------- d-----w C:\Program Files\Common Files\Apple
2008-07-17 04:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2008-07-17 03:58 --------- d-----w C:\Program Files\Common Files\Adobe AIR
2008-07-17 03:56 --------- d-----w C:\Program Files\AWS
2008-07-17 03:56 --------- d-----w C:\Program Files\AIM
2008-07-17 03:55 --------- d-----w C:\Program Files\Viewpoint
2008-07-17 03:55 --------- d-----w C:\Program Files\AOD
2008-07-17 03:55 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-07-17 03:50 5 ----a-w C:\WINDOWS\system32\drivers\DELL_DIM_3000.MRK
2008-07-17 03:50 5 ----a-w C:\WINDOWS\system32\drivers\1028_DELL_DIM_3000.MRK
2008-07-17 03:48 --------- d-----w C:\Program Files\Intel
2008-07-17 03:42 --------- d-----w C:\Program Files\microsoft frontpage
2008-07-07 20:32 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-23 16:57 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-13 19:45 579,464 ----a-w C:\WINDOWS\system32\SymNeti.dll
2008-06-13 19:45 207,240 ----a-w C:\WINDOWS\system32\SymRedir.dll
.

((((((((((((((((((((((((((((( snapshot@2008-08-21_18.25.54.72 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-03-06 01:22:34 22,752 -c----w C:\WINDOWS\ie7updates\KB938127-IE7\spcustom.dll
+ 2007-03-06 01:22:36 14,048 -c----w C:\WINDOWS\ie7updates\KB938127-IE7\spmsg.dll
+ 2007-03-06 01:22:41 213,216 -c----w C:\WINDOWS\ie7updates\KB938127-IE7\spuninst.exe
+ 2007-03-06 01:22:41 213,216 -c----w C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe
+ 2007-03-06 01:23:51 371,424 -c----w C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\updspapi.dll
+ 2007-03-06 01:22:59 716,000 -c----w C:\WINDOWS\ie7updates\KB938127-IE7\update.exe
+ 2007-03-06 01:23:51 371,424 -c----w C:\WINDOWS\ie7updates\KB938127-IE7\updspapi.dll
+ 2007-08-13 23:54:10 765,952 -c----w C:\WINDOWS\ie7updates\KB938127-IE7\vgx.dll
- 2007-08-13 23:39:00 123,904 ----a-w C:\WINDOWS\system32\advpack.dll
+ 2008-06-23 16:57:27 124,928 ----a-w C:\WINDOWS\system32\advpack.dll
- 2007-08-13 23:39:00 123,904 -c--a-w C:\WINDOWS\system32\dllcache\advpack.dll
+ 2008-06-23 16:57:27 124,928 -c--a-w C:\WINDOWS\system32\dllcache\advpack.dll
- 2007-08-13 23:35:46 346,624 -c--a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll
+ 2008-06-23 16:57:27 347,136 -c--a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll
- 2007-08-13 23:35:38 214,528 -c--a-w C:\WINDOWS\system32\dllcache\dxtrans.dll
+ 2008-06-23 16:57:27 214,528 -c--a-w C:\WINDOWS\system32\dllcache\dxtrans.dll
- 2007-08-13 23:54:10 131,584 -c--a-w C:\WINDOWS\system32\dllcache\extmgr.dll
+ 2008-06-23 16:57:27 133,120 -c--a-w C:\WINDOWS\system32\dllcache\extmgr.dll
- 2007-08-13 23:39:06 54,784 -c--a-w C:\WINDOWS\system32\dllcache\ie4uinit.exe
+ 2008-06-23 09:20:25 70,656 -c--a-w C:\WINDOWS\system32\dllcache\ie4uinit.exe
- 2007-08-13 23:39:26 152,064 -c--a-w C:\WINDOWS\system32\dllcache\ieakeng.dll
+ 2008-06-23 16:57:29 153,088 -c--a-w C:\WINDOWS\system32\dllcache\ieakeng.dll
- 2007-08-13 23:39:54 229,376 -c--a-w C:\WINDOWS\system32\dllcache\ieaksie.dll
+ 2008-06-23 16:57:29 230,400 -c--a-w C:\WINDOWS\system32\dllcache\ieaksie.dll
- 2007-08-13 22:56:54 161,792 -c--a-w C:\WINDOWS\system32\dllcache\ieakui.dll
+ 2008-06-21 05:23:54 161,792 -c--a-w C:\WINDOWS\system32\dllcache\ieakui.dll
- 2007-08-13 23:39:50 382,976 -c--a-w C:\WINDOWS\system32\dllcache\iedkcs32.dll
+ 2008-06-23 16:57:29 384,512 -c--a-w C:\WINDOWS\system32\dllcache\iedkcs32.dll
- 2007-08-13 23:39:10 43,008 -c--a-w C:\WINDOWS\system32\dllcache\iernonce.dll
+ 2008-06-23 16:57:33 44,544 -c--a-w C:\WINDOWS\system32\dllcache\iernonce.dll
- 2007-08-13 23:43:56 622,080 -c--a-w C:\WINDOWS\system32\dllcache\iexplore.exe
+ 2008-06-23 09:20:52 625,664 -c--a-w C:\WINDOWS\system32\dllcache\iexplore.exe
- 2007-08-13 23:54:10 27,136 -c--a-w C:\WINDOWS\system32\dllcache\jsproxy.dll
+ 2008-06-23 16:57:35 27,648 -c--a-w C:\WINDOWS\system32\dllcache\jsproxy.dll
- 2007-08-13 23:54:12 3,578,368 -c--a-w C:\WINDOWS\system32\dllcache\mshtml.dll
+ 2008-06-24 15:57:40 3,592,192 -c--a-w C:\WINDOWS\system32\dllcache\mshtml.dll
- 2007-08-13 23:54:10 475,648 -c--a-w C:\WINDOWS\system32\dllcache\mshtmled.dll
+ 2008-06-23 16:57:39 477,696 -c--a-w C:\WINDOWS\system32\dllcache\mshtmled.dll
- 2007-08-13 23:44:26 192,000 -c--a-w C:\WINDOWS\system32\dllcache\msrating.dll
+ 2008-06-23 16:57:39 193,024 -c--a-w C:\WINDOWS\system32\dllcache\msrating.dll
- 2007-08-13 23:54:10 670,720 -c--a-w C:\WINDOWS\system32\dllcache\mstime.dll
+ 2008-06-23 16:57:40 671,232 -c--a-w C:\WINDOWS\system32\dllcache\mstime.dll
- 2007-08-13 23:44:06 101,376 -c--a-w C:\WINDOWS\system32\dllcache\occache.dll
+ 2008-06-23 16:57:40 102,912 -c--a-w C:\WINDOWS\system32\dllcache\occache.dll
- 2007-08-13 23:36:12 44,544 -c--a-w C:\WINDOWS\system32\dllcache\pngfilt.dll
+ 2008-06-23 16:57:40 44,544 -c--a-w C:\WINDOWS\system32\dllcache\pngfilt.dll
- 2007-08-13 23:44:30 105,984 -c--a-w C:\WINDOWS\system32\dllcache\url.dll
+ 2008-06-23 16:57:40 105,984 -c--a-w C:\WINDOWS\system32\dllcache\url.dll
- 2007-08-13 23:54:10 1,162,240 -c--a-w C:\WINDOWS\system32\dllcache\urlmon.dll
+ 2008-06-23 16:57:40 1,159,680 -c--a-w C:\WINDOWS\system32\dllcache\urlmon.dll
- 2007-08-13 23:54:10 765,952 -c--a-w C:\WINDOWS\system32\dllcache\VGX.dll
+ 2007-07-12 23:31:54 765,952 -c--a-w C:\WINDOWS\system32\dllcache\vgx.dll
- 2007-08-13 23:54:10 231,424 -c--a-w C:\WINDOWS\system32\dllcache\webcheck.dll
+ 2008-06-23 16:57:41 233,472 -c--a-w C:\WINDOWS\system32\dllcache\webcheck.dll
- 2007-08-13 23:54:10 818,688 -c--a-w C:\WINDOWS\system32\dllcache\wininet.dll
+ 2008-06-23 16:57:41 826,368 -c--a-w C:\WINDOWS\system32\dllcache\wininet.dll
- 2007-08-13 23:35:46 346,624 ----a-w C:\WINDOWS\system32\dxtmsft.dll
+ 2008-06-23 16:57:27 347,136 ----a-w C:\WINDOWS\system32\dxtmsft.dll
- 2007-08-13 23:35:38 214,528 ----a-w C:\WINDOWS\system32\dxtrans.dll
+ 2008-06-23 16:57:27 214,528 ----a-w C:\WINDOWS\system32\dxtrans.dll
- 2007-08-13 23:54:10 131,584 ----a-w C:\WINDOWS\system32\extmgr.dll
+ 2008-06-23 16:57:27 133,120 ----a-w C:\WINDOWS\system32\extmgr.dll
- 2007-08-13 23:36:26 61,952 ----a-w C:\WINDOWS\system32\icardie.dll
+ 2008-06-23 16:57:28 63,488 ----a-w C:\WINDOWS\system32\icardie.dll
- 2007-08-13 23:39:06 54,784 ----a-w C:\WINDOWS\system32\ie4uinit.exe
+ 2008-06-23 09:20:25 70,656 ----a-w C:\WINDOWS\system32\ie4uinit.exe
- 2007-08-13 23:39:26 152,064 ----a-w C:\WINDOWS\system32\ieakeng.dll
+ 2008-06-23 16:57:29 153,088 ----a-w C:\WINDOWS\system32\ieakeng.dll
- 2007-08-13 23:39:54 229,376 ----a-w C:\WINDOWS\system32\ieaksie.dll
+ 2008-06-23 16:57:29 230,400 ----a-w C:\WINDOWS\system32\ieaksie.dll
- 2007-08-13 22:56:54 161,792 ----a-w C:\WINDOWS\system32\ieakui.dll
+ 2008-06-21 05:23:54 161,792 ----a-w C:\WINDOWS\system32\ieakui.dll
- 2007-02-12 21:10:12 2,451,312 ----a-w C:\WINDOWS\system32\ieapfltr.dat
+ 2007-04-17 09:32:38 2,455,488 ----a-w C:\WINDOWS\system32\ieapfltr.dat
- 2007-07-11 17:27:48 383,488 ----a-w C:\WINDOWS\system32\ieapfltr.dll
+ 2008-06-23 16:57:29 383,488 ----a-w C:\WINDOWS\system32\ieapfltr.dll
- 2007-08-13 23:39:50 382,976 ----a-w C:\WINDOWS\system32\iedkcs32.dll
+ 2008-06-23 16:57:29 384,512 ----a-w C:\WINDOWS\system32\iedkcs32.dll
- 2007-08-13 23:54:10 6,049,280 ----a-w C:\WINDOWS\system32\ieframe.dll
+ 2008-06-23 16:57:33 6,066,176 ----a-w C:\WINDOWS\system32\ieframe.dll
- 2007-08-13 23:39:10 43,008 ----a-w C:\WINDOWS\system32\iernonce.dll
+ 2008-06-23 16:57:33 44,544 ----a-w C:\WINDOWS\system32\iernonce.dll
- 2007-08-13 23:34:04 266,752 ----a-w C:\WINDOWS\system32\iertutil.dll
+ 2008-06-23 16:57:34 267,776 ----a-w C:\WINDOWS\system32\iertutil.dll
- 2007-08-13 23:39:10 13,312 ----a-w C:\WINDOWS\system32\ieudinit.exe
+ 2008-06-23 09:20:26 13,824 ----a-w C:\WINDOWS\system32\ieudinit.exe
- 2007-08-13 23:54:10 27,136 ----a-w C:\WINDOWS\system32\jsproxy.dll
+ 2008-06-23 16:57:35 27,648 ----a-w C:\WINDOWS\system32\jsproxy.dll
- 2007-08-13 23:54:10 458,752 ----a-w C:\WINDOWS\system32\msfeeds.dll
+ 2008-06-23 16:57:36 459,264 ----a-w C:\WINDOWS\system32\msfeeds.dll
- 2007-08-13 23:54:10 50,688 ----a-w C:\WINDOWS\system32\msfeedsbs.dll
+ 2008-06-23 16:57:36 52,224 ----a-w C:\WINDOWS\system32\msfeedsbs.dll
- 2007-08-13 23:54:12 3,578,368 ----a-w C:\WINDOWS\system32\mshtml.dll
+ 2008-06-24 15:57:40 3,592,192 ----a-w C:\WINDOWS\system32\mshtml.dll
- 2007-08-13 23:54:10 475,648 ----a-w C:\WINDOWS\system32\mshtmled.dll
+ 2008-06-23 16:57:39 477,696 ----a-w C:\WINDOWS\system32\mshtmled.dll
- 2007-08-13 23:44:26 192,000 ----a-w C:\WINDOWS\system32\msrating.dll
+ 2008-06-23 16:57:39 193,024 ----a-w C:\WINDOWS\system32\msrating.dll
- 2007-08-13 23:54:10 670,720 ----a-w C:\WINDOWS\system32\mstime.dll
+ 2008-06-23 16:57:40 671,232 ----a-w C:\WINDOWS\system32\mstime.dll
- 2007-08-13 23:44:06 101,376 ----a-w C:\WINDOWS\system32\occache.dll
+ 2008-06-23 16:57:40 102,912 ----a-w C:\WINDOWS\system32\occache.dll
- 2007-08-13 23:36:12 44,544 ----a-w C:\WINDOWS\system32\pngfilt.dll
+ 2008-06-23 16:57:40 44,544 ----a-w C:\WINDOWS\system32\pngfilt.dll
- 2007-08-13 23:44:30 105,984 ----a-w C:\WINDOWS\system32\url.dll
+ 2008-06-23 16:57:40 105,984 ----a-w C:\WINDOWS\system32\url.dll
- 2007-08-13 23:54:10 1,162,240 ----a-w C:\WINDOWS\system32\urlmon.dll
+ 2008-06-23 16:57:40 1,159,680 ----a-w C:\WINDOWS\system32\urlmon.dll
- 2007-08-13 23:54:10 231,424 ----a-w C:\WINDOWS\system32\webcheck.dll
+ 2008-06-23 16:57:41 233,472 ----a-w C:\WINDOWS\system32\webcheck.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-12 08:56 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 02:38 34672]
"AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 09:47 116040]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-05-27 10:50 413696]
"CTSysVol"="C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe" [2003-09-17 10:43 57344]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 01:00 90112]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-09-20 09:35 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-09-20 09:32 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-09-20 09:36 114688]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-02-14 11:01 51048]
"NSWosCheck"="C:\Program Files\Norton SystemWorks Basic Edition\osCheck.exe" [2007-09-18 08:22 25472]
"osCheck"="C:\Program Files\Norton AntiVirus\osCheck.exe" [2007-08-24 23:53 714608]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-30 10:47 289064]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Elements 6.0\apdproxy.exe" [2007-09-11 00:43 67488]
"BMe33683ae"="C:\WINDOWS\system32\xpxfnvei.dll" [BU]
"e005b032"="C:\WINDOWS\system32\ilvwlhae.dll" [BU]
"P17Helper"="P17.dll" [2004-06-10 11:51 60928 C:\WINDOWS\system32\P17.dll]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"SymLnch"="C:\Documents and Settings\Owner\Application Data\Symantec\Layouts\Norton Internet Security\15.0\SymAllLanguages\NIS_RETAIL\20070828\Support\SymLnch\SymLnch.exe" [2007-08-26 19:04 687976]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"mW[íµˆÖ¾`=µú¾˜v%S8’ÿÙêé>grl>*Ý\†Ð=ŸàÛ±Þ"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\AIM\\aim.exe"=
"C:\\Documents and Settings\\Owner\\My Documents\\TextTwist\\TextTwist.exe"=
"C:\\Documents and Settings\\Owner\\My Documents\\Bejeweled 2 Deluxe\\WinBej2.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R2 AdobeActiveFileMonitor6.0;Adobe Active File Monitor V6;C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe [2007-09-11 00:45]
R2 LiveUpdate Notice;LiveUpdate Notice;C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2008-02-14 11:02]
S3 COH_Mon;COH_Mon;C:\WINDOWS\system32\Drivers\COH_Mon.sys [2008-07-30 17:42]

*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder

2008-08-14 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]

2008-08-19 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Owner.job
- C:\Program Files\Norton AntiVirus\Navw32.exe [2007-08-26 20:19]

2008-08-18 C:\WINDOWS\Tasks\Norton SystemWorks One Button Checkup.job
- C:\Program Files\Norton SystemWorks Basic Edition\OBC.exe [2007-09-18 08:22]
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-23 08:10:49
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-08-23 8:13:03
ComboFix-quarantined-files.txt 2008-08-23 13:12:06
ComboFix2.txt 2008-08-23 01:18:37
ComboFix3.txt 2008-08-22 02:43:45
ComboFix4.txt 2008-08-21 23:26:44

Pre-Run: 22,503,899,136 bytes free
Post-Run: 22,490,091,520 bytes free

358 --- E O F --- 2008-08-23 03:57:00

MBAM log before safe mode

Malwarebytes' Anti-Malware 1.25
Database version: 1076
Windows 5.1.2600 Service Pack 2

9:56:39 AM 8/23/2008
mbam-log-08-23-2008 (09-56-39).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 97115
Time elapsed: 1 hour(s), 30 minute(s), 19 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 2
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 6

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bme33683ae (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e005b032 (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\QooBox\Quarantine\C\WINDOWS\system32\wgutgioq.exe.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\tesgnavn.exe.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\tnyexcmf.exe.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BDDD5C44-2312-4F6A-874B-8A6817957A3C}\RP69\A0011088.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BDDD5C44-2312-4F6A-874B-8A6817957A3C}\RP69\A0011089.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BDDD5C44-2312-4F6A-874B-8A6817957A3C}\RP71\A0011212.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

MBAM log (in safe mode)

Malwarebytes' Anti-Malware 1.25
Database version: 1076
Windows 5.1.2600 Service Pack 2

1:32:24 PM 8/23/2008
mbam-log-08-23-2008 (13-32-24).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 96845
Time elapsed: 1 hour(s), 59 minute(s), 22 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

HJT log (safe mode)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:33:20 PM, on 8/23/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Safe mode

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\Owner\Desktop\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NSWosCheck] "C:\Program Files\Norton SystemWorks Basic Edition\osCheck.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Elements 6.0\apdproxy.exe"
O4 - HKLM\..\RunOnce: [SymLnch] "C:\Documents and Settings\Owner\Application Data\Symantec\Layouts\Norton Internet Security\15.0\SymAllLanguages\NIS_RETAIL\20070828\Support\SymLnch\SymLnch.exe" "C:\Documents and Settings\Owner\Application Data\Symantec\Layouts\Norton Internet Security\15.0\SymAllLanguages\NIS_RETAIL\20070828\Setup.exe" "/REALUPREBOOT /temp /patched"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Basic Edition\Norton Cleanup\WCQuick.lnk
O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Basic Edition\Norton Cleanup\WCQuick.lnk
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe Active File Monitor V6 (AdobeActiveFileMonitor6.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Norton UnErase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe

--
End of file - 6777 bytes

HJT log (not in safe mode, after everything else and connected to internet again)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:42:10 PM, on 8/23/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Adobe\Photoshop Elements 6.0\apdproxy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\SoftwareDistribution\Download\66b1d8e81a20b4b541ab3e558f2fd638\update\update.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Owner\Desktop\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NSWosCheck] "C:\Program Files\Norton SystemWorks Basic Edition\osCheck.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Elements 6.0\apdproxy.exe"
O4 - HKLM\..\RunOnce: [SymLnch] "C:\Documents and Settings\Owner\Application Data\Symantec\Layouts\Norton Internet Security\15.0\SymAllLanguages\NIS_RETAIL\20070828\Support\SymLnch\SymLnch.exe" "C:\Documents and Settings\Owner\Application Data\Symantec\Layouts\Norton Internet Security\15.0\SymAllLanguages\NIS_RETAIL\20070828\Setup.exe" "/REALUPREBOOT /temp /patched"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Basic Edition\Norton Cleanup\WCQuick.lnk
O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Basic Edition\Norton Cleanup\WCQuick.lnk
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe Active File Monitor V6 (AdobeActiveFileMonitor6.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Norton UnErase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe

--
End of file - 8132 bytes

So far, so good...no more popups for websites. *keeping my fingers crossed*

pskelley · Aug 23, 2008

Thanks for returning your information and the feedback, the HJT log looks fine except for one item. Let's do this:

1) no need to post logs HJT logs in Safe mode

2) Open notepad and copy/paste the text in the codebox below into it:

Code:

File::
C:\WINDOWS\SoftwareDistribution\Download\66b1d8e81a20b4b541ab3e558f2fd638\update\update.exe

Save this as CFScript

Referring to the picture above, drag CFScript into ComboFix.exe.

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.

Post the CFScript and a HJT log <<< see the next instruction #3

3) Let's get HJT off that Desktop, to post the HJT log follow these directions:
Download Trend Micro Hijack This™ to your Desktop
http://download.bleepingcomputer.com/hijackthis/HJTInstall.exe
Doubleclick the HJTInstall.exe to start it.
By default it will install HijackThis in the Program Files\Trendmicro folder and create a desktop shortcut.
HijackThis will open after install. Press the Scan button below.
This will start the scan and open a log.
Copy and paste the contents of the log in your next reply.

Everything still running as it should?

Thanks

jiller1978 · Aug 23, 2008

Still running well!

ComboFix 08-08-23.01 - Owner 2008-08-23 17:25:44.6 - NTFSx86
Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Owner\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\WINDOWS\SoftwareDistribution\Download\66b1d8e81a20b4b541ab3e558f2fd638\update\update.exe
.

((((((((((((((((((((((((( Files Created from 2008-07-23 to 2008-08-23 )))))))))))))))))))))))))))))))
.

2008-08-23 13:37 . 2008-08-23 14:10 <DIR> d-------- C:\WINDOWS\system32\CatRoot_bak
2008-08-21 21:49 . 2008-08-21 21:49 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-21 21:49 . 2008-08-21 21:49 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Malwarebytes
2008-08-21 21:49 . 2008-08-21 21:49 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-21 21:49 . 2008-08-17 15:01 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-21 21:49 . 2008-08-17 15:01 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-08-19 21:04 . 2008-08-19 21:04 95 --a------ C:\WINDOWS\wininit.ini
2008-08-18 20:58 . 2008-08-18 20:59 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-08-18 20:58 . 2008-08-19 17:10 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-08-17 14:47 . 2008-08-17 14:47 7,680 --a------ C:\WINDOWS\system32\f14rs.exe
2008-08-16 20:42 . 2008-08-18 17:52 <DIR> d-------- C:\Program Files\OGG To MP3 Plus
2008-08-16 20:41 . 2008-08-16 20:41 <DIR> d-------- C:\Downloads
2008-08-16 20:41 . 2008-08-16 20:42 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\GetRightToGo
2008-08-15 20:30 . 2008-08-15 20:30 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\InstallShield
2008-08-15 20:27 . 2008-08-15 20:29 <DIR> d-------- C:\Program Files\Common Files\Jasc Software Inc
2008-08-15 20:26 . 2008-08-15 20:32 <DIR> d-------- C:\Program Files\Jasc Software Inc
2008-08-15 20:26 . 2008-08-15 20:26 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Jasc Software Inc
2008-08-15 05:42 . 2008-08-15 05:42 268 --ah----- C:\sqmdata07.sqm
2008-08-15 05:42 . 2008-08-15 05:42 244 --ah----- C:\sqmnoopt07.sqm
2008-08-13 21:09 . 2008-08-13 21:09 268 --ah----- C:\sqmdata06.sqm
2008-08-13 21:09 . 2008-08-13 21:09 244 --ah----- C:\sqmnoopt06.sqm
2008-08-13 21:01 . 2008-08-13 21:01 <DIR> d-------- C:\Program Files\Common Files\Macrovision Shared
2008-08-11 06:56 . 2008-08-11 06:56 268 --ah----- C:\sqmdata05.sqm
2008-08-11 06:56 . 2008-08-11 06:56 244 --ah----- C:\sqmnoopt05.sqm
2008-08-10 16:36 . 2008-08-17 09:30 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-09 22:30 . 2008-08-09 22:30 <DIR> d--h----- C:\WINDOWS\PIF
2008-08-05 19:51 . 2008-08-05 19:51 268 --ah----- C:\sqmdata04.sqm
2008-08-05 19:51 . 2008-08-05 19:51 244 --ah----- C:\sqmnoopt04.sqm
2008-08-05 09:19 . 2008-08-05 09:19 268 --ah----- C:\sqmdata03.sqm
2008-08-05 09:19 . 2008-08-05 09:19 244 --ah----- C:\sqmnoopt03.sqm
2008-08-04 21:15 . 2008-08-04 21:15 268 --ah----- C:\sqmdata02.sqm
2008-08-04 21:15 . 2008-08-04 21:15 244 --ah----- C:\sqmnoopt02.sqm
2008-08-04 18:42 . 2008-08-04 18:42 <DIR> d-------- C:\Program Files\iPod
2008-07-30 18:48 . 2008-07-30 18:48 268 --ah----- C:\sqmdata01.sqm
2008-07-30 18:48 . 2008-07-30 18:48 244 --ah----- C:\sqmnoopt01.sqm
2008-07-30 05:54 . 2008-07-30 05:54 376 --a------ C:\WINDOWS\ODBC.INI
2008-07-30 05:53 . 2008-07-30 05:53 <DIR> d-------- C:\Program Files\Microsoft ActiveSync
2008-07-30 05:52 . 2008-07-30 05:53 <DIR> d-------- C:\WINDOWS\ShellNew
2008-07-29 17:36 . 2008-07-29 17:36 268 --ah----- C:\sqmdata00.sqm
2008-07-29 17:36 . 2008-07-29 17:36 244 --ah----- C:\sqmnoopt00.sqm
2008-07-26 21:18 . 2008-08-15 20:24 <DIR> d-------- C:\Documents and Settings\Owner\Contacts
2008-07-26 21:16 . 2008-07-26 21:16 <DIR> d-------- C:\Program Files\MSN Messenger
2008-07-26 20:46 . 2008-08-21 17:46 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\skypePM
2008-07-26 20:46 . 2008-07-26 20:46 56 --ah----- C:\WINDOWS\system32\ezsidmv.dat
2008-07-26 20:40 . 2008-08-21 21:25 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Skype
2008-07-26 20:39 . 2008-07-26 20:44 <DIR> d-------- C:\Program Files\Skype
2008-07-26 20:39 . 2008-07-26 20:39 <DIR> d-------- C:\Program Files\Common Files\Skype
2008-07-26 20:38 . 2008-07-26 20:39 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Skype
2008-07-25 21:01 . 2008-08-16 21:17 <DIR> d-------- C:\Program Files\Full Tilt Poker.Net

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-21 23:34 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-08-18 22:37 --------- d-----w C:\Program Files\Norton SystemWorks Basic Edition
2008-08-17 03:03 --------- d-----w C:\Documents and Settings\Owner\Application Data\Azureus
2008-08-16 04:14 --------- d-----w C:\Documents and Settings\Owner\Application Data\LimeWire
2008-08-16 01:27 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-08-14 02:01 --------- d-----w C:\Program Files\Common Files\Adobe
2008-08-14 01:47 9,464 ----a-w C:\WINDOWS\system32\drivers\cdralw2k.sys
2008-08-14 01:47 9,336 ----a-w C:\WINDOWS\system32\drivers\cdr4_xp.sys
2008-08-14 01:47 43,528 ----a-w C:\WINDOWS\system32\drivers\PxHelp20.sys
2008-08-14 01:47 129,784 ----a-w C:\WINDOWS\system32\pxafs.dll
2008-08-14 01:47 118,520 ----a-w C:\WINDOWS\system32\pxinsi64.exe
2008-08-14 01:47 116,472 ----a-w C:\WINDOWS\system32\pxcpyi64.exe
2008-08-09 23:00 --------- d-----w C:\Documents and Settings\Owner\Application Data\Yahoo!
2008-08-09 23:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-08-09 22:55 --------- d-----w C:\Program Files\GameHouse
2008-08-05 02:18 --------- d-----w C:\Program Files\Apple Software Update
2008-08-04 23:42 --------- d-----w C:\Program Files\iTunes
2008-08-04 21:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-07-30 22:42 23,888 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.sys
2008-07-30 22:28 706 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.inf
2008-07-30 22:28 10,537 ----a-w C:\WINDOWS\system32\drivers\coh_mon.cat
2008-07-26 02:01 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-24 11:07 --------- d-----w C:\Program Files\Norton AntiVirus
2008-07-24 10:55 805 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-07-24 10:55 60,800 ----a-w C:\WINDOWS\system32\S32EVNT1.DLL
2008-07-24 10:55 123,952 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-07-24 10:55 10,671 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-07-24 10:55 --------- d-----w C:\Program Files\Symantec
2008-07-21 22:52 --------- d-----w C:\Documents and Settings\All Users\Application Data\Azureus
2008-07-21 17:01 --------- d-----w C:\Documents and Settings\Owner\Application Data\Symantec
2008-07-21 01:59 --------- d-----w C:\Documents and Settings\Owner\Application Data\Aim
2008-07-21 01:48 --------- d-----w C:\Program Files\Bejeweled 2 Deluxe
2008-07-21 01:47 720,896 ----a-w C:\WINDOWS\iun6002ev.exe
2008-07-20 21:58 --------- d-----w C:\Program Files\Windows Sidebar
2008-07-19 23:06 --------- d-----w C:\Documents and Settings\Owner\Application Data\Apple Computer
2008-07-17 05:21 --------- d-----w C:\Documents and Settings\All Users\Application Data\Trymedia
2008-07-17 05:19 --------- d-----w C:\Program Files\Java
2008-07-17 05:06 --------- d-----w C:\Documents and Settings\Owner\Application Data\Creative
2008-07-17 04:30 --------- d-----w C:\Program Files\Common Files\Java
2008-07-17 04:28 --------- d-----w C:\Program Files\TryMedia
2008-07-17 04:19 --------- d-----w C:\Program Files\Creative
2008-07-17 04:07 --------- d-----w C:\Program Files\Yahoo!
2008-07-17 04:07 --------- d-----w C:\Program Files\NOS
2008-07-17 04:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\NOS
2008-07-17 04:01 --------- d-----w C:\Program Files\QuickTime
2008-07-17 04:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-07-17 04:00 --------- d-----w C:\Program Files\Common Files\Apple
2008-07-17 04:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2008-07-17 03:58 --------- d-----w C:\Program Files\Common Files\Adobe AIR
2008-07-17 03:56 --------- d-----w C:\Program Files\AWS
2008-07-17 03:56 --------- d-----w C:\Program Files\AIM
2008-07-17 03:55 --------- d-----w C:\Program Files\Viewpoint
2008-07-17 03:55 --------- d-----w C:\Program Files\AOD
2008-07-17 03:55 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-07-17 03:50 5 ----a-w C:\WINDOWS\system32\drivers\DELL_DIM_3000.MRK
2008-07-17 03:50 5 ----a-w C:\WINDOWS\system32\drivers\1028_DELL_DIM_3000.MRK
2008-07-17 03:48 --------- d-----w C:\Program Files\Intel
2008-07-17 03:42 --------- d-----w C:\Program Files\microsoft frontpage
2008-07-07 20:32 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-23 16:57 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-13 19:45 579,464 ----a-w C:\WINDOWS\system32\SymNeti.dll
2008-06-13 19:45 207,240 ----a-w C:\WINDOWS\system32\SymRedir.dll
.

((((((((((((((((((((((((((((( snapshot_2008-08-23_ 8.11.48.26 )))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-12 08:56 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 02:38 34672]
"AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 09:47 116040]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-05-27 10:50 413696]
"CTSysVol"="C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe" [2003-09-17 10:43 57344]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 01:00 90112]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-09-20 09:35 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-09-20 09:32 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-09-20 09:36 114688]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-02-14 11:01 51048]
"NSWosCheck"="C:\Program Files\Norton SystemWorks Basic Edition\osCheck.exe" [2007-09-18 08:22 25472]
"osCheck"="C:\Program Files\Norton AntiVirus\osCheck.exe" [2007-08-24 23:53 714608]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-30 10:47 289064]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Elements 6.0\apdproxy.exe" [2007-09-11 00:43 67488]
"P17Helper"="P17.dll" [2004-06-10 11:51 60928 C:\WINDOWS\system32\P17.dll]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"SymLnch"="C:\Documents and Settings\Owner\Application Data\Symantec\Layouts\Norton Internet Security\15.0\SymAllLanguages\NIS_RETAIL\20070828\Support\SymLnch\SymLnch.exe" [2007-08-26 19:04 687976]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"mW[íµˆÖ¾`=µú¾˜v%S8’ÿÙêé>grl>*Ý\†Ð=ŸàÛ±Þ"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\AIM\\aim.exe"=
"C:\\Documents and Settings\\Owner\\My Documents\\TextTwist\\TextTwist.exe"=
"C:\\Documents and Settings\\Owner\\My Documents\\Bejeweled 2 Deluxe\\WinBej2.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R2 AdobeActiveFileMonitor6.0;Adobe Active File Monitor V6;C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe [2007-09-11 00:45]
R2 LiveUpdate Notice;LiveUpdate Notice;C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2008-02-14 11:02]
S3 COH_Mon;COH_Mon;C:\WINDOWS\system32\Drivers\COH_Mon.sys [2008-07-30 17:42]
.
Contents of the 'Scheduled Tasks' folder

2008-08-14 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]

2008-08-19 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Owner.job
- C:\Program Files\Norton AntiVirus\Navw32.exe [2007-08-26 20:19]

2008-08-18 C:\WINDOWS\Tasks\Norton SystemWorks One Button Checkup.job
- C:\Program Files\Norton SystemWorks Basic Edition\OBC.exe [2007-09-18 08:22]
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-23 17:29:34
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-08-23 17:32:05
ComboFix-quarantined-files.txt 2008-08-23 22:31:34
ComboFix2.txt 2008-08-23 13:13:04
ComboFix3.txt 2008-08-23 01:18:37
ComboFix4.txt 2008-08-22 02:43:45
ComboFix5.txt 2008-08-23 22:24:50

Pre-Run: 20,643,516,416 bytes free
Post-Run: 20,663,685,120 bytes free

210 --- E O F --- 2008-08-23 03:57:00

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:44:57 PM, on 8/23/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NSWosCheck] "C:\Program Files\Norton SystemWorks Basic Edition\osCheck.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Elements 6.0\apdproxy.exe"
O4 - HKLM\..\RunOnce: [SymLnch] "C:\Documents and Settings\Owner\Application Data\Symantec\Layouts\Norton Internet Security\15.0\SymAllLanguages\NIS_RETAIL\20070828\Support\SymLnch\SymLnch.exe" "C:\Documents and Settings\Owner\Application Data\Symantec\Layouts\Norton Internet Security\15.0\SymAllLanguages\NIS_RETAIL\20070828\Setup.exe" "/REALUPREBOOT /temp /patched"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Basic Edition\Norton Cleanup\WCQuick.lnk
O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Basic Edition\Norton Cleanup\WCQuick.lnk
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe Active File Monitor V6 (AdobeActiveFileMonitor6.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Norton UnErase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe

--
End of file - 7833 bytes

pskelley · Aug 24, 2008

Thanks for returning your information and the feedback, this is the next bridge we must cross.

I am sure you saw this:
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
Review that information to understand Recovery Console. Installation is optional but if you do not have the CD's needed, as is explained, it can be installed before we remove combofix.
If you do not have access to Recovery Console via a Windows CD, I strongly advise you to install this tool.
If you do not wish to install RC, let me know so I can continue with the cleanup.
If you install RC, post the C:\*CF-RC.txt*.

Since we do not need to scan with combofix, click NO

Thanks

jiller1978 · Aug 24, 2008

I installed RC...Here you go!

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

I just got the notification that XP Service Pack 3 has been downloaded and is ready for install. Do you recommend I wait until I'm all fresh and clean before installing it? Thanks!

pskelley · Aug 24, 2008

I just got the notification that XP Service Pack 3 has been downloaded and is ready for install. Do you recommend I wait until I'm all fresh and clean before installing it?

Yes, I installed it on my main computer and had to remove it. I purchased the CD for $10.00 with S&H. Just because I had an issue, does not mean you will. Here is the link to the CD if you do need it:
http://support.microsoft.com/kb/322389
and Microsoft is making free help available:
Microsoft Windows XP Service Pack 3 (All Languages)
http://support.microsoft.com/oas/default.aspx?ln=en-us&prid=11273&gprid=522131

Let's get you finished up, then go for it.

RC was installed propersly, good job:bigthumb: Some information for you.
http://support.microsoft.com/kb/314058
http://support.microsoft.com/kb/307654
Recovery Console is a tool that will allow you to recover from a catastrophic system failure, so let's hope you never need it. Many experts believe Microsoft should have installed it by default.

Remove combofix from the computer like this:

Click START then RUN
Now type or copy Combofix /u in the runbox and click OK.
Note the space between the X and the U, it needs to be there.

Clean infected System Restore files like this:

Turn off System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

Reboot

Turn ON System Restore,
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK.

Run MBAM again to make sure we missed nothing, no need to post a clean scan result.

Update Symantec/Norton and run a system scan to be sure it is running right and scanning clean. If you have any problems with the program, contect tech support for instructions:
http://www.symantec.com/enterprise/support/index.jsp

I'll post this information for you now so you can benefit from it.

Some good information for you:
http://users.telenet.be/bluepatchy/miekiemoes/slowcomputer.html
http://www.microsoft.com/windowsxp/using/helpandsupport/learnmore/tips/mcgill1.mspx

Here is some great information from experts in this field that will help you stay clean and safe online.
http://users.telenet.be/bluepatchy/miekiemoes/prevention.html
http://forums.spybot.info/showthread.php?t=279
http://russelltexas.com/malware/allclear.htm
http://forum.malwareremoval.com/viewtopic.php?t=14
http://www.bleepingcomputer.com/forums/topict2520.html
http://cybercoyote.org/security/not-admin.shtml

http://www.malwarecomplaints.info/

Thanks...pskelley
Safer Networking Forums
http://www.spybot.info/en/donate/index.html
If you are reading this information...thank a teacher,
If you are reading it in English...thank a soldier.

http://users.telenet.be/bluepatchy/miekiemoes/Links.html

Virtumonde help

jiller1978

New member

pskelley

In Memoriam -Always in our heart

jiller1978

New member

pskelley

In Memoriam -Always in our heart

jiller1978

New member

pskelley

In Memoriam -Always in our heart

jiller1978

New member

pskelley

In Memoriam -Always in our heart

jiller1978

New member

pskelley

In Memoriam -Always in our heart

jiller1978

New member

pskelley

In Memoriam -Always in our heart

jiller1978

New member

pskelley

In Memoriam -Always in our heart

jiller1978

New member

pskelley

In Memoriam -Always in our heart