Virtumonde infection

Status
Not open for further replies.
R

radiothesos

New member
I have a pretty nasty Virtumonde infection. So far I've used Spybot SD, Ad-Aware 2007, and VunodFix to no avail. I couldn't get Kaspersky to run using IE7. Any help is appreciated.

HJT Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:13:52 PM, on 1/24/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\$sys$filesystem\$sys$DRMServer.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\CDProxyServ.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\LTMSG.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Multimedia Card Reader\shwicon2k.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\Multimedia Card Reader\shwicon2k .exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Symantec Shared\ccApp .exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\PeerGuardian2\pg2.exe
C:\Program Files\iTunes\iTunesHelper .exe
C:\Program Files\PeerGuardian2\pg2 .exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://qus10.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer Provided by Cox High Speed Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
F3 - REG:win.ini: load=C:\WINDOWS\system32\ssttq.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [312D3531303738343] DFDBE3DFDEE5E6E.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [FLMK08KB] C:\Program Files\Muiltmedia keyboard utility\1.3\MMKEYBD.EXE
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask .exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\mrofinu572.exe 61A847B5BBF728173599284503996897C881250221C8670836AC4FA7C8833201749139
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [POSTRBT] C:\Program Files\Norton AntiVirus\Navw32.exe /REMEDIATE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [POSTRBT] C:\Program Files\Norton AntiVirus\Navw32.exe /REMEDIATE (User 'Default user')
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O15 - Trusted Zone: *.amaena.com
O15 - Trusted Zone: *.onerateld.com
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.burj-al-arab.com/flashcab/ipix/ipixx.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B6A9B1D6-F38A-420B-9CF6-0141C984485C}: NameServer = 68.105.28.12,68.105.29.12
O23 - Service: Plug and Play Device Manager ($sys$DRMServer) - First 4 Internet Ltd - C:\WINDOWS\system32\$sys$filesystem\$sys$DRMServer.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: XCP CD Proxy (CD_Proxy) - Unknown owner - C:\WINDOWS\CDProxyServ.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: VundoFix Service (VundoFixSvc) - Atribune.org - C:\WINDOWS\SYSTEM32\VundoFixSVC.exe

--
End of file - 8186 bytes
 
Hi

Download Superantispyware.

http://www.superantispyware.com/

Once downloaded and installed update the definitions
and then run a full system scan quarantine what it finds!

* Double-click SUPERAntiSypware.exe and use the default settings for installation.
* An icon will be created on your desktop. Double-click that icon to launch the program.
* If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download and unzip them from here.)

http://www.superantispyware.com/definitions.html

* Under "Configuration and Preferences", click the Preferences button.
* Click the Scanning Control tab.
* Under Scanner Options make sure the following are checked (leave all others unchecked):
o Close browsers before scanning.
o Scan for tracking cookies.
o Terminate memory threats before quarantining.
* Click the "Close" button to leave the control center screen.
* Back on the main screen, under "Scan for Harmful Software" click Scan your computer.
* On the left, make sure you check C:\Fixed Drive.
* On the right, under "Complete Scan", choose Perform Complete Scan.
* Click "Next" to start the scan. Please be patient while it scans your computer.
* After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
* Make sure everything has a checkmark next to it and click "Next".
* A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
* If asked if you want to reboot, click "Yes".
* To retrieve the removal information after reboot, launch SUPERAntispyware again.
o Click Preferences, then click the Statistics/Logs tab.
o Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
o If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
o Please copy and paste the Scan Log results in your next reply.
* Click Close to exit the program.

THEN ...

Download Combofix from any of the links below, and save it to your desktop. For information regarding this download, please visit this webpage: http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Link 1
Link 2
Link 3


**Note: It is important that it is saved directly to your desktop**

--------------------------------------------------------------------

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

--------------------------------------------------------------------

Double click on combofix.exe & follow the prompts.
  • When finished, it will produce a report for you.
  • Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.
Note:
Do not mouseclick combofix's window while it's running. That may cause it to stall

Please remember to post :-


1. SUPERAntiSpyware Scan Log
2. C:\ComboFix.txt
3. a new hijackthis log.( run after everything else)

steam
 
Part 1:

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 01/24/2008 at 04:57 PM

Application Version : 3.9.1008

Core Rules Database Version : 3387
Trace Rules Database Version: 1381

Scan type : Complete Scan
Total Scan Time : 01:37:24

Memory items scanned : 441
Memory threats detected : 6
Registry items scanned : 6033
Registry threats detected : 46
File items scanned : 78436
File threats detected : 232

Trojan.WinFixer
C:\WINDOWS\SYSTEM32\SSTTQ.DLL
C:\WINDOWS\SYSTEM32\SSTTQ.DLL
HKLM\Software\Classes\CLSID\{D11C83C7-5556-4428-81D6-F556CF639BFD}
HKCR\CLSID\{D11C83C7-5556-4428-81D6-F556CF639BFD}
HKCR\CLSID\{D11C83C7-5556-4428-81D6-F556CF639BFD}\InprocServer32
HKCR\CLSID\{D11C83C7-5556-4428-81D6-F556CF639BFD}\InprocServer32#ThreadingModel
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D11C83C7-5556-4428-81D6-F556CF639BFD}

Adware.Vundo Variant
C:\WINDOWS\SYSTEM32\AWTTRQN.DLL
C:\WINDOWS\SYSTEM32\AWTTRQN.DLL
HKLM\Software\Classes\CLSID\{A051B1FF-8D7E-418B-AABE-4FF82F4280A2}
HKCR\CLSID\{A051B1FF-8D7E-418B-AABE-4FF82F4280A2}
HKCR\CLSID\{A051B1FF-8D7E-418B-AABE-4FF82F4280A2}\InprocServer32
HKCR\CLSID\{A051B1FF-8D7E-418B-AABE-4FF82F4280A2}\InprocServer32#ThreadingModel
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{08106851-0770-4159-8daf-5803b393ad7d}
HKCR\CLSID\{08106851-0770-4159-8DAF-5803B393AD7D}
HKCR\CLSID\{08106851-0770-4159-8DAF-5803B393AD7D}\InprocServer32
HKCR\CLSID\{08106851-0770-4159-8DAF-5803B393AD7D}\InprocServer32#ThreadingModel
C:\WINDOWS\SYSTEM32\PXJTNRW.DLL
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A051B1FF-8D7E-418B-AABE-4FF82F4280A2}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks#{A051B1FF-8D7E-418B-AABE-4FF82F4280A2}
HKCR\CLSID\{A051B1FF-8D7E-418B-AABE-4FF82F4280A2}
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0170079.DLL
C:\VUNDOFIX BACKUPS\AWTTRQN.DLL.BAD
C:\VUNDOFIX BACKUPS\URQRPPM.DLL.BAD

Trojan.Vundo/Variant-Installer/A
C:\PROGRAM FILES\MULTIMEDIA CARD READER\SHWICON2K.EXE
C:\PROGRAM FILES\MULTIMEDIA CARD READER\SHWICON2K.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\PROGRAM FILES\ITUNES\ITUNESHELPER.EXE
C:\PROGRAM FILES\ITUNES\ITUNESHELPER.EXE
C:\PROGRAM FILES\PEERGUARDIAN2\PG2.EXE
C:\PROGRAM FILES\PEERGUARDIAN2\PG2.EXE
[KBD] C:\HP\KBD\KBD.EXE
C:\HP\KBD\KBD.EXE
[Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
C:\WINDOWS\SMINST\RECGUARD.EXE
[Sunkist2k] C:\PROGRAM FILES\MULTIMEDIA CARD READER\SHWICON2K.EXE
[ccApp] C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
[FLMK08KB] C:\PROGRAM FILES\MUILTMEDIA KEYBOARD UTILITY\1.3\MMKEYBD.EXE
C:\PROGRAM FILES\MUILTMEDIA KEYBOARD UTILITY\1.3\MMKEYBD.EXE
[Symantec PIF AlertEng] C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\PIF\{B8E1DD85-8582-4C61-B58F-2F227FCA9A08}\PIFSVC.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\PIF\{B8E1DD85-8582-4C61-B58F-2F227FCA9A08}\PIFSVC.EXE
[iTunesHelper] C:\PROGRAM FILES\ITUNES\ITUNESHELPER.EXE
[PeerGuardian] C:\PROGRAM FILES\PEERGUARDIAN2\PG2.EXE
HKLM\System\ControlSet001\Services\LiveUpdate Notice Service
HKLM\System\ControlSet002\Services\LiveUpdate Notice Service
HKLM\System\CurrentControlSet\Services\LiveUpdate Notice Service
HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\ccApp.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\ccApp.exe#PATH
C:\DOCUMENTS AND SETTINGS\OWNER\LOCAL SETTINGS\TEMP\RCX12.TMP
C:\DOCUMENTS AND SETTINGS\OWNER\LOCAL SETTINGS\TEMP\RCX18.TMP
C:\DOCUMENTS AND SETTINGS\OWNER\LOCAL SETTINGS\TEMP\RCX38.TMP
C:\DOCUMENTS AND SETTINGS\OWNER\LOCAL SETTINGS\TEMP\RCX3B.TMP
C:\DOCUMENTS AND SETTINGS\OWNER\LOCAL SETTINGS\TEMP\RCX44.TMP
C:\DOCUMENTS AND SETTINGS\OWNER\LOCAL SETTINGS\TEMP\RCX47.TMP
C:\DOCUMENTS AND SETTINGS\OWNER\LOCAL SETTINGS\TEMP\RCXD.TMP
C:\DOCUMENTS AND SETTINGS\OWNER\LOCAL SETTINGS\TEMP\RCXE.TMP
C:\PROGRAM FILES\QUICKTIME\QTTASK .EXE
C:\PROGRAM FILES\QUICKTIME\QTTASK .EXE
C:\PROGRAM FILES\QUICKTIME\QTTASK .EXE
C:\PROGRAM FILES\QUICKTIME\QTTASK .EXE
C:\PROGRAM FILES\QUICKTIME\QTTASK .EXE
C:\PROGRAM FILES\QUICKTIME\QTTASK .EXE
C:\PROGRAM FILES\QUICKTIME\QTTASK .EXE
C:\PROGRAM FILES\QUICKTIME\QTTASK .EXE
C:\PROGRAM FILES\QUICKTIME\QTTASK .EXE
C:\PROGRAM FILES\QUICKTIME\QTTASK.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1037\A0166789.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1038\A0166956.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1038\A0166958.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1038\A0166959.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1038\A0166960.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1038\A0166961.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1038\A0166962.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1038\A0166963.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1038\A0166964.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1038\A0166965.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1038\A0166966.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1038\A0166969.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1038\A0167957.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1038\A0167958.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1038\A0167959.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1038\A0167960.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1038\A0167961.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1038\A0167962.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1038\A0167963.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1038\A0167965.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0167997.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0167999.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0168000.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0168001.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0168002.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0168003.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0168004.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0168006.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0168995.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0168997.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0168998.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0168999.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0169000.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0169001.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0169002.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0169004.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0169006.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0169007.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0169009.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0169020.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0169021.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0169022.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0169023.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0169024.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0169026.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0169027.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0169028.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0169029.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0169030.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0170021.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0170022.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0170023.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0170024.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0170025.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0170026.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0170027.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0170028.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0170029.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0170030.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0170031.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0170038.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0170039.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0170041.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0170042.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0170043.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0170044.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0170045.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0170046.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0170047.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0170048.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0170066.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0170067.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0170068.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0170069.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0170070.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0170071.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0170072.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0170073.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0170074.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0170092.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0170095.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0170096.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0170097.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0170099.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0171086.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0171088.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0171089.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0171090.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0171091.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0171092.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0171093.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0171094.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0173114.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0173116.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0173117.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0173118.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0173119.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1040\A0173125.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1040\A0173127.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1040\A0173128.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1040\A0173129.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1040\A0173130.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1040\A0173131.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1040\A0173148.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1040\A0173163.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1040\A0173169.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1040\A0173254.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1040\A0173258.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1040\A0173260.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1040\A0173261.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1040\A0173262.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1040\A0173263.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1040\A0173264.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1040\A0173281.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1040\A0173282.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1040\A0173283.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1040\A0173284.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1040\A0173285.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1040\A0173305.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1040\A0173307.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1040\A0173308.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1040\A0173309.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1040\A0173310.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1041\A0173564.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1041\A0173566.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1041\A0173567.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1041\A0173568.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1041\A0173569.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1041\A0173570.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1041\A0173571.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1041\A0173573.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1041\A0173583.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1041\A0173585.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1041\A0173586.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1041\A0173587.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1041\A0173588.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1041\A0173589.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1041\A0173590.EXE
C:\VUNDOFIX BACKUPS\CTFMON.EXE.BAD
C:\VUNDOFIX BACKUPS\HPSYSDRV.EXE.BAD
C:\VUNDOFIX BACKUPS\MROFINU572.EXE.BAD
C:\VUNDOFIX BACKUPS\PS2.EXE.BAD
C:\WINDOWS\MROFINU572.EXE.TMP
C:\WINDOWS\SYSTEM32\OLD128.TMP
C:\WINDOWS\Prefetch\CCAPP.EXE-10E11A7C.pf
 
Pt 2:

Trojan.Downloader-ConHook
[load] C:\WINDOWS\SYSTEM32\SSTTQ.EXE
C:\WINDOWS\SYSTEM32\SSTTQ.EXE
[load] C:\WINDOWS\SYSTEM32\SSTTQ.EXE
[load] C:\WINDOWS\SYSTEM32\SSTTQ.EXE
C:\WINDOWS\Prefetch\SSTTQ.EXE-258133D5.pf

Browser Hijacker.Internet Explorer Zone Hijack
HKU\S-1-5-21-209863314-2956365045-1826906163-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\amaena.com
HKU\S-1-5-21-209863314-2956365045-1826906163-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\amaena.com#*
HKU\S-1-5-21-209863314-2956365045-1826906163-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\amaena.com\www
HKU\S-1-5-21-209863314-2956365045-1826906163-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\amaena.com\www#*

Adware.Tracking Cookie
C:\Documents and Settings\Owner\Cookies\owner@traffic-tracker[1].txt
C:\Documents and Settings\Owner\Cookies\owner@media.adrevolver[1].txt
C:\Documents and Settings\Owner\Cookies\owner@6283.555.clickshield[1].txt
C:\Documents and Settings\Owner\Cookies\owner@publishers.clickbooth[2].txt
C:\Documents and Settings\Owner\Cookies\owner@indiads[1].txt
C:\Documents and Settings\Owner\Cookies\owner@ads.monster[2].txt
C:\Documents and Settings\Owner\Cookies\owner@login.revenueloop[2].txt
C:\Documents and Settings\Owner\Cookies\owner@zedo[2].txt
C:\Documents and Settings\Owner\Cookies\owner@cpvfeed[1].txt
C:\Documents and Settings\Owner\Cookies\owner@atdmt[2].txt
C:\Documents and Settings\Owner\Cookies\owner@6115.8.clickshield[1].txt

Trojan.Windows Overlay Components/SysMon
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINDOWS_OVERLAY_COMPONENTS
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINDOWS_OVERLAY_COMPONENTS#NextInstance
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINDOWS_OVERLAY_COMPONENTS\0000
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINDOWS_OVERLAY_COMPONENTS\0000#Service
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINDOWS_OVERLAY_COMPONENTS\0000#Legacy
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINDOWS_OVERLAY_COMPONENTS\0000#ConfigFlags
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINDOWS_OVERLAY_COMPONENTS\0000#Class
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINDOWS_OVERLAY_COMPONENTS\0000#ClassGUID
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINDOWS_OVERLAY_COMPONENTS\0000#DeviceDesc

Trojan.Downloader-Gen/RetAd
HKLM\Software\Microsoft\Windows\CurrentVersion\Run#runner1 [ C:\WINDOWS\mrofinu572.exe 61A847B5BBF728173599284503996897C881250221C8670836AC4FA7C8833201749139 ]

RootKit.TnCore/Trace
C:\WINDOWS\system32\drivers\core.cache.dsk

Trojan.Downloader-Gen/MROFIN
C:\DOCUMENTS AND SETTINGS\OWNER\LOCAL SETTINGS\TEMP\TMP52.TMP
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1036\A0166777.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1036\A0166788.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1038\A0167966.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0168007.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0169043.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0170076.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1040\A0173164.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1040\A0173251.EXE
C:\WINDOWS\MROFINU1000106.EXE

Adware.k8l
C:\PROGRAM FILES\COMMON FILES\RTEQE.HTML

Adware.FullContext
C:\PROGRAM FILES\EQTRAFFIC\SF.TXT

Adware.WebBuying Assistant-Installer
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1038\A0166947.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1038\A0166948.EXE
C:\WINDOWS\SYSTEM32\COMM7\EWBYDLLCOM6.EXE

Trojan.Vundo/Variant-Installer
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1038\A0166967.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1038\A0167967.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0168008.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0169010.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0169031.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0170032.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0170049.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0170077.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0171095.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1040\A0173123.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1040\A0173265.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1040\A0173287.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1040\A0173313.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1041\A0173574.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1041\A0173591.EXE
C:\VUNDOFIX BACKUPS\SSTTQ.EXE.BAD

Adware.Vundo-Variant
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0170078.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-49CC3FD4BC94}\RP1039\A0171100.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88A9728D-068D-4BE5-99BD-4
 
ComboFix Log

ComboFix 08-01-23.1B - Owner 2008-01-24 17:29:17.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.144 [GMT -6:00]
Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\hp\KBD\KBD .EXE
C:\hp\KBD\KBD.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp .exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\iTunes\iTunesHelper .exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Muiltmedia keyboard utility\1.3\MMKEYBD .EXE
C:\Program Files\Muiltmedia keyboard utility\1.3\MMKEYBD.EXE
C:\Program Files\Multimedia Card Reader\shwicon2k .exe
C:\Program Files\Multimedia Card Reader\shwicon2k.exe
C:\Program Files\PeerGuardian2\pg2 .exe
C:\Program Files\PeerGuardian2\pg2.exe
C:\Program Files\QuickTime\QTTask .exe
C:\Program Files\QuickTime\QTTask .exe
C:\Program Files\QuickTime\QTTask .exe
C:\Program Files\QuickTime\QTTask .exe
C:\Program Files\QuickTime\QTTask .exe
C:\Program Files\QuickTime\QTTask .exe
C:\Program Files\QuickTime\QTTask .exe
C:\Program Files\QuickTime\QTTask .exe
C:\Program Files\QuickTime\QTTask .exe
C:\Program Files\QuickTime\QTTask .exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware .exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Temp\1cb
C:\Temp\1cb\syscheck.log
C:\temp\tn3
C:\WINDOWS\SMINST\RECGUARD .EXE
C:\WINDOWS\SMINST\RECGUARD.EXE
C:\WINDOWS\system32\_000006_.tmp.dll
C:\WINDOWS\system32\_000007_.tmp.dll
C:\WINDOWS\system32\_000008_.tmp.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\qttss.ini
C:\WINDOWS\system32\qttss.ini2
C:\WINDOWS\system32\ssttq.dll
C:\WINDOWS\system32\ssttq.exe
D:\Autorun.inf
C:\WINDOWS\system32\drivers\core.cache.dsk . . . . failed to delete

Code: 
 <pre>
C:\hp\KBD\KBD .EXE ---> QooBox
C:\Program Files\Common Files\Symantec Shared\ccApp .exe ---> QooBox
C:\Program Files\iTunes\iTunesHelper .exe ---> QooBox
C:\Program Files\Muiltmedia keyboard utility\1.3\MMKEYBD .EXE ---> QooBox
C:\Program Files\Multimedia Card Reader\shwicon2k .exe ---> QooBox
C:\Program Files\PeerGuardian2\pg2 .exe ---> QooBox
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware .exe ---> QooBox
C:\WINDOWS\SMINST\RECGUARD .EXE ---> QooBox
</pre>
.
.
((((((((((((((((((((((((( Files Created from 2007-12-24 to 2008-01-24 )))))))))))))))))))))))))))))))
.

2008-01-24 17:34 . 2008-01-24 17:34 <DIR> d-------- C:\Temp\tn3
2008-01-24 17:34 . 2008-01-24 17:34 334,848 --a------ C:\WINDOWS\system32\ssttq.dll
2008-01-24 17:27 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\Nircmd.exe
2008-01-24 15:16 . 2008-01-24 17:32 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2008-01-24 13:27 . 2008-01-24 17:33 932 --------- C:\WINDOWS\system32\drivers\core.cache.dsk
2008-01-24 12:14 . 2008-01-24 12:14 <DIR> d-------- C:\Program Files\Trend Micro
2008-01-24 12:12 . 2004-08-04 00:07 59,264 --a------ C:\WINDOWS\system32\drivers\USBAUDIO.sys
2008-01-24 12:12 . 2004-08-04 00:07 59,264 --a--c--- C:\WINDOWS\system32\dllcache\usbaudio.sys
2008-01-23 12:21 . 2008-01-23 12:21 24,576 --a------ C:\WINDOWS\system32\VundoFixSVC.exe
2008-01-23 01:38 . 2008-01-24 11:27 1,374 --a------ C:\WINDOWS\imsins.BAK
2008-01-23 01:24 . 2008-01-23 12:21 <DIR> d-------- C:\VundoFix Backups
2008-01-22 23:19 . 2008-01-22 23:19 <DIR> d-------- C:\Program Files\Lavasoft
2008-01-22 23:18 . 2008-01-24 15:16 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-01-22 23:00 . 2008-01-22 23:42 3,142 --a------ C:\WINDOWS\system32\tmp.reg
2008-01-22 22:59 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-01-22 22:59 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-01-22 22:59 . 2007-12-20 23:11 81,920 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-01-22 22:59 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-01-22 22:59 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-01-22 22:56 . 2008-01-23 09:35 98,304 --a------ C:\WINDOWS\system32\ps2 .exe
2008-01-22 22:56 . 2008-01-23 09:35 52,736 --a------ C:\WINDOWS\system\hpsysdrv .exe
2008-01-22 22:56 . 2008-01-23 09:36 178 --a------ C:\WINDOWS\system\hpsysdrv .DAT
2008-01-22 20:59 . 2008-01-22 20:59 355,328 --a------ C:\WINDOWS\system32\OLD128.tmp
2008-01-22 20:54 . 2008-01-22 23:31 <DIR> d-------- C:\WINDOWS\system32\winzs6
2008-01-22 20:54 . 2008-01-22 20:54 <DIR> d-------- C:\WINDOWS\system32\nui4
2008-01-22 20:54 . 2008-01-22 20:54 <DIR> d-------- C:\WINDOWS\system32\extz1
2008-01-22 20:54 . 2008-01-24 17:14 <DIR> d-------- C:\WINDOWS\system32\comm7
2008-01-22 20:54 . 2008-01-22 20:54 <DIR> d-------- C:\Temp\gTiis19
2008-01-22 20:54 . 2008-01-23 09:34 376,320 --a------ C:\WINDOWS\mrofinu572.exe.tmp
2008-01-22 20:54 . 2008-01-22 20:54 86,016 --a------ C:\WINDOWS\system32\drivers\scsiportt.sys
2008-01-22 20:53 . 2008-01-22 20:53 <DIR> d-------- C:\WINDOWS\system32\nGpxx01
2008-01-22 20:53 . 2008-01-22 20:53 <DIR> d-------- C:\Temp\cXzz9
2008-01-22 20:53 . 2008-01-24 17:34 <DIR> d-------- C:\Temp
2008-01-20 13:19 . 2008-01-20 13:24 <DIR> d-------- C:\Program Files\Microsoft Money 2007
2007-12-30 14:22 . 2007-12-30 14:22 124 --a------ C:\WINDOWS\ImgTool.INI
2007-12-30 13:43 . 2004-02-22 10:11 719,872 --a------ C:\WINDOWS\system32\devil.dll
2007-12-30 13:43 . 2007-05-17 17:30 318,976 --a------ C:\WINDOWS\system32\avisynth.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-24 23:34 338,432 ----a-w C:\WINDOWS\system32\ssttq.exe
2008-01-24 23:33 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-01-24 23:32 --------- d-----w C:\Program Files\QuickTime
2008-01-24 23:32 --------- d-----w C:\Program Files\PeerGuardian2
2008-01-24 23:32 --------- d-----w C:\Program Files\Multimedia Card Reader
2008-01-24 23:32 --------- d-----w C:\Program Files\iTunes
2007-12-17 05:20 --------- d-----w C:\Program Files\iPod
2007-12-14 17:32 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe
2007-12-04 22:58 --------- d-----w C:\Program Files\AVI Codec Pack
2007-12-03 22:06 --------- d-----w C:\Program Files\AviSynth 2.5
2007-12-03 22:06 --------- d-----w C:\Program Files\Avi2Dvd
2007-12-03 17:32 --------- d-----w C:\Program Files\eRightSoft
2007-12-03 05:07 --------- d-----w C:\Program Files\WinMPG VideoConvert
2007-12-01 22:29 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE
2007-12-01 22:29 249,856 ------w C:\WINDOWS\Setup1.exe
2007-12-01 22:29 --------- d-----w C:\Program Files\MissionRisk
2007-12-01 22:29 --------- d-----w C:\Program Files\Common Files\Download Manager
2007-12-01 21:46 --------- d-----w C:\Program Files\Risk
2007-11-19 05:27 737,280 ----a-w C:\WINDOWS\iun6002.exe
2007-11-07 09:26 721,920 ----a-w C:\WINDOWS\system32\lsasrv.dll
2007-10-29 22:43 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
2007-10-27 23:40 222,720 ----a-w C:\WINDOWS\system32\wmasf.dll
2006-05-03 09:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll
2007-02-21 10:47 31,232 --sh--r C:\WINDOWS\system32\msfDX.dll
.
Code: 
<pre>
----a-w            52,736 2008-01-23 15:35:17  C:\WINDOWS\system\hpsysdrv .exe
----a-w            98,304 2008-01-23 15:35:26  C:\WINDOWS\system32\ps2 .exe
</pre>


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F4D7F3B2-7ED0-49E8-9D32-8CDAC44E2C43}]
2008-01-24 17:34 334848 --a------ C:\WINDOWS\system32\ssttq.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [ ]
"PeerGuardian"="C:\Program Files\PeerGuardian2\pg2.exe" [ ]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [ ]
"KBD"="C:\HP\KBD\KBD.EXE" [ ]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [ ]
"VTTimer"="VTTimer.exe" [2004-10-22 11:53 53248 C:\WINDOWS\system32\VTTimer.exe]
"LTMSG"="LTMSG.exe" [2003-07-14 19:52 40960 C:\WINDOWS\ltmsg.exe]
"PS2"="C:\WINDOWS\system32\ps2.exe" [ ]
"Sunkist2k"="C:\Program Files\Multimedia Card Reader\shwicon2k.exe" [ ]
"AlcxMonitor"="ALCXMNTR.EXE" [2004-09-07 13:47 57344 C:\WINDOWS\ALCXMNTR.EXE]
"312D3531303738343"="DFDBE3DFDEE5E6E.exe" []
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [ ]
"FLMK08KB"="C:\Program Files\Muiltmedia keyboard utility\1.3\MMKEYBD.EXE" [ ]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-24 12:42 1213440]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask .exe" [ ]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"POSTRBT"="C:\Program Files\Norton AntiVirus\Navw32.exe" [2007-05-23 12:13 173680]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_CURRENT_USER\software\microsoft\windows nt\currentversion\windows]
"load"=C:\WINDOWS\system32\ssttq.exe

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 C:\WINDOWS\system32\ssttq

R0 $sys$cor;$sys$cor;C:\WINDOWS\system32\Drivers\$sys$cor.sys [2005-07-04 06:52]
R1 $sys$crater;$sys$crater;C:\WINDOWS\system32\$sys$filesystem\crater.sys [2005-07-04 04:51]
R1 scsiportt;scsiportt;C:\WINDOWS\system32\drivers\scsiportt.sys [2008-01-22 20:54]
R2 $sys$DRMServer;Plug and Play Device Manager;C:\WINDOWS\system32\$sys$filesystem\$sys$DRMServer.exe [2004-12-14 03:49]
R2 CD_Proxy;XCP CD Proxy;C:\WINDOWS\CDProxyServ.exe [2004-10-07 08:42]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\Shell\AutoRun\command - D:\Info.exe folder.htt 480 480

.
Contents of the 'Scheduled Tasks' folder
"2008-01-19 04:00:36 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Owner.job"
- C:\PROGRA~1\NORTON~1\Navw32.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-24 17:34:47
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2900.3156]
-> C:\WINDOWS\system32\ssttq.dll
.
Completion time: 2008-01-24 17:39:03 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-24 23:38:57
.
2008-01-24 17:31:09 --- E O F ---
 
HJT Log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:40:23 PM, on 1/24/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\$sys$filesystem\$sys$DRMServer.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\CDProxyServ.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\LTMSG.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://qus10.hpwis.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
F3 - REG:win.ini: load=C:\WINDOWS\system32\ssttq.exe
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [312D3531303738343] DFDBE3DFDEE5E6E.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [FLMK08KB] C:\Program Files\Muiltmedia keyboard utility\1.3\MMKEYBD.EXE
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask .exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [POSTRBT] C:\Program Files\Norton AntiVirus\Navw32.exe /REMEDIATE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [POSTRBT] C:\Program Files\Norton AntiVirus\Navw32.exe /REMEDIATE (User 'Default user')
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O15 - Trusted Zone: *.onerateld.com
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.burj-al-arab.com/flashcab/ipix/ipixx.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B6A9B1D6-F38A-420B-9CF6-0141C984485C}: NameServer = 68.105.28.12,68.105.29.12
O23 - Service: Plug and Play Device Manager ($sys$DRMServer) - First 4 Internet Ltd - C:\WINDOWS\system32\$sys$filesystem\$sys$DRMServer.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: XCP CD Proxy (CD_Proxy) - Unknown owner - C:\WINDOWS\CDProxyServ.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: VundoFix Service (VundoFixSvc) - Atribune.org - C:\WINDOWS\SYSTEM32\VundoFixSVC.exe

--
End of file - 7449 bytes
 
Hi radiothesos

I see you are on-line ... just to let you know I've just logged on & will be posting to your thread within the next 30 minutes ...

steam
 
Hi

Open notepad and copy/paste the text in the code box below into it:
NOTE* make sure to only highlight and copy what is inside the code box nothing out side of it.
Also ..

Pay particular attention to this :-

Make sure the word File:: is on the first line of the text file you save (no blank line above it, & no space in front of it)
Code: 
File::
C:\WINDOWS\system32\ssttq.exe
C:\WINDOWS\system32\ssttq.dll
C:\WINDOWS\system32\drivers\core.cache.dsk
C:\WINDOWS\system32\drivers\scsiportt.sys
C:\WINDOWS\mrofinu572.exe.tmp

Folder::
C:\Temp
C:\VundoFix Backups
C:\WINDOWS\system32\winzs6
C:\WINDOWS\system32\nui4
C:\WINDOWS\system32\extz1
C:\WINDOWS\system32\comm7
C:\WINDOWS\system32\nGpxx01

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F4D7F3B2-7ED0-49E8-9D32-8CDAC44E2C43}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"312D3531303738343"=-

[HKEY_CURRENT_USER\software\microsoft\windows nt\currentversion\windows]
"load"=-

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"Authentication Packages"=hex(7):6d,73,76,31,5f,30,00,00

RenV::
C:\WINDOWS\system\hpsysdrv .exe
C:\WINDOWS\system32\ps2 .exe

Save this as "CFScript.txt"

Then drag the CFScript.txt into ComboFix.exe as you see in the screenshot below.
CFScript.gif


This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.

steam
 
Sorry for the delay.

I chose to backup a few important files and then reformatted my drive.

Everything seems to be running smoothly now, but I appreciate your help.

Thanks!
 
Status
Not open for further replies.
Back
Top