UNSOLVED
Windows Police Pro
I am having a bad time with this windows police pro. Somebody please help! I cannot do anything without it popping up or keeping me from doing other tasks on my compuer. I am operating with Windows XP Professional SP3. I have to do anything I do on safemode. That is where I am now. I have looked at a lot of forums with no luck so far. Some of the forums said to open task manager and end the process there but when I open the task manager there is not anything named Windows Police Pro. I searched with the search option and found it yesterday in the C drive program files. So I sent it to the recyle bin and emptied the recycle bin but that did no good. I ran search again and now it does not show up anywhere. I tried to restore my computer but the computer just sits there and does nothing. I even got out my computer disk to just install the operating system again and can't do that. I am running AVG antivirus software but scanning with it does not find it. So I have been reading some of the forums here and hope you can help me. I noticed everyone is sending this hijack file. Here it is. I hope I did it right.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:07:50 PM, on 10/11/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Safe mode with network support
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://aol.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: ICQSys (IE PlugIn) - {77DC0B63-1535-4ba9-8BE8-D59EB676FA02} - C:\WINDOWS\system32\plugie.dll
O2 - BHO: AOL Toolbar Loader - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL Toolbar\aoltb.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL Toolbar\aoltb.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [ScanSoft PDF Professional 4-reminder] "C:\Program Files\ScanSoft\PDF Professional 4.0\Ereg\Ereg.exe" -r "C:\Documents and Settings\All Users\Application Data\ScanSoft\PDF Professional\4\Ereg\Ereg.ini
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [EPSON PictureMate] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2P1.EXE /P17 "EPSON PictureMate" /O6 "USB003" /M "PictureMate"
O4 - HKCU\..\Run: [haihaep] C:\Documents and Settings\Moak Petrolium\haihaep.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-21-255879815-3811564576-2564377081-1005\..\Run: [haihaep] C:\Documents and Settings\Moak Petrolium\haihaep.exe (User '?')
O4 - HKUS\S-1-5-21-255879815-3811564576-2564377081-1005\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '?')
O4 - Global Startup: NETGEAR WPN111 Smart Wizard.lnk = ?
O8 - Extra context menu item: Open with ScanSoft PDF Converter 4.1 - res://C:\Program Files\ScanSoft\PDF Professional 4.0\cnvres_eng.dll /100
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://www.pogo.com
O16 - DPF: {3107C2A8-9F0B-4404-A58B-21BD85268FBC} (PogoWebLauncher Control) - http://www.pogo.com/cdl/launcher/PogoWebLauncherInstaller.CAB
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-3-48.cab
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
--
End of file - 7167 bytes
677
0
Posted October 13th, 2009 21:00
Thank you for your help. Here is the file.
+++++++++++++++++++++++++++++++++
+ File Lister Version 1.1.1 +
+ +
+ By bamajim / SpywareHammer.com +
+++++++++++++++++++++++++++++++++Report ran on --->>> 10/13/2009 9:50:36 PM
====== Running Processes ======C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\WScript.exe====== BHO's ======
677
0
Posted October 14th, 2009 08:00
sheripatn
The FileLister log you posted is incomplete. Please Rerun FileLister and post a fresh FileLister log
677
0
Posted October 14th, 2009 19:00
I think it copied the whole file this time. When it finished I noticed a file in the filelister folder named hidden. I don't know if it is important or not but I am also attaching it also. Thank you.
+++++++++++++++++++++++++++++++++
+ File Lister Version 1.1.1 +
+ +
+ By bamajim / SpywareHammer.com +
+++++++++++++++++++++++++++++++++Report ran on --->>> 10/14/2009 7:04:37 PM
====== Running Processes ======C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2P1.EXE
C:\Documents and Settings\Moak Petrolium\haihaep.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\NETGEAR\WPN111\wpn111.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\System32\WScript.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE====== BHO's ======
BHO: (NO NAME) - -
====== HKLM\~\Run Keys ======
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
====== HKCU\~\Run Keys ======
====== DNS Info (List may be empty) ============ Folders and Files from "%\" and "%\Windows" Created Last 60 Days ======
10/12/2009 4:54:23 PM 1931632 C:\AVGTemp
10/12/2009 4:54:23 PM 1931632 C:\AVGTemp\avgproci_en
9/13/2009 2:31:48 PM 555240139 C:\MSOCache
9/13/2009 2:31:48 PM 555240139 C:\MSOCache\All Users
9/13/2009 2:32:04 PM 1632850 C:\MSOCache\All Users\{90120000-0010-0409-0000-0000000FF1CE}-C
9/13/2009 2:31:55 PM 15669675 C:\MSOCache\All Users\{90120000-0016-0409-0000-0000000FF1CE}-C
9/13/2009 2:32:01 PM 15068409 C:\MSOCache\All Users\{90120000-0018-0409-0000-0000000FF1CE}-C
9/13/2009 2:32:20 PM 12591459 C:\MSOCache\All Users\{90120000-0019-0409-0000-0000000FF1CE}-C
9/13/2009 2:31:58 PM 17091367 C:\MSOCache\All Users\{90120000-001A-0409-0000-0000000FF1CE}-C
9/13/2009 2:32:22 PM 17027228 C:\MSOCache\All Users\{90120000-001B-0409-0000-0000000FF1CE}-C
9/13/2009 2:32:10 PM 52395081 C:\MSOCache\All Users\{90120000-002C-0409-0000-0000000FF1CE}-C
9/13/2009 2:32:11 PM 22914224 C:\MSOCache\All Users\{90120000-002C-0409-0000-0000000FF1CE}-C\Proof.en
9/13/2009 2:32:17 PM 16972298 C:\MSOCache\All Users\{90120000-002C-0409-0000-0000000FF1CE}-C\Proof.es
9/13/2009 2:32:15 PM 11999590 C:\MSOCache\All Users\{90120000-002C-0409-0000-0000000FF1CE}-C\Proof.fr
9/13/2009 2:32:37 PM 295197868 C:\MSOCache\All Users\{90120000-0030-0000-0000-0000000FF1CE}-C
9/13/2009 2:32:05 PM 28792769 C:\MSOCache\All Users\{90120000-0044-0409-0000-0000000FF1CE}-C
9/13/2009 2:32:31 PM 32655135 C:\MSOCache\All Users\{90120000-00A1-0409-0000-0000000FF1CE}-C
9/13/2009 2:32:04 PM 4514093 C:\MSOCache\All Users\{90120000-0114-0409-0000-0000000FF1CE}-C
9/13/2009 2:32:04 PM 4009013 C:\MSOCache\All Users\{90120000-0114-0409-0000-0000000FF1CE}-C\Groove.en-us
9/13/2009 2:31:48 PM 32869192 C:\MSOCache\All Users\{90120000-0115-0409-0000-0000000FF1CE}-C
9/13/2009 2:31:55 PM 108872 C:\MSOCache\All Users\{90120000-0115-0409-0000-0000000FF1CE}-C\1033
9/13/2009 2:32:26 PM 29735013 C:\MSOCache\All Users\{90120000-0117-0409-0000-0000000FF1CE}-C
9/13/2009 2:32:26 PM 29229605 C:\MSOCache\All Users\{90120000-0117-0409-0000-0000000FF1CE}-C\Access.en-us
9/30/2009 4:30:05 PM 436 32 C:\2.js
10/12/2009 6:47:44 PM 590532 32 C:\Autoruns.zip
9/23/2009 3:30:19 PM 0 32 C:\butwwo.exe
9/23/2009 3:28:27 PM 0 32 C:\ddmishqi.exe
10/13/2009 9:50:36 PM 0 32 C:\Files.txt
9/23/2009 3:30:18 PM 0 32 C:\iusfdc.exe
9/16/2009 8:54:01 PM 2198 32 C:\LYPR.bat
9/23/2009 3:28:27 PM 0 32 C:\wuun.exe
9/9/2009 3:03:38 AM 778911 C:\WINDOWS\$NtUninstallKB956844$
9/9/2009 3:03:38 AM 625823 C:\WINDOWS\$NtUninstallKB956844$\spuninst
8/19/2009 3:01:34 AM 2133445 C:\WINDOWS\$NtUninstallKB968389$
8/19/2009 3:01:34 AM 629061 C:\WINDOWS\$NtUninstallKB968389$\spuninst
9/9/2009 3:03:43 AM 3083489 C:\WINDOWS\$NtUninstallKB968816_WM9$
9/9/2009 3:03:43 AM 625377 C:\WINDOWS\$NtUninstallKB968816_WM9$\spuninst
8/26/2009 3:00:27 AM 838190 C:\WINDOWS\$NtUninstallKB970653-v3$
8/26/2009 3:00:27 AM 640046 C:\WINDOWS\$NtUninstallKB970653-v3$\spuninst
9/9/2009 3:01:48 AM 1140912 C:\WINDOWS\$NtUninstallKB971961$
9/9/2009 3:01:48 AM 628912 C:\WINDOWS\$NtUninstallKB971961$\spuninst
10/9/2009 10:12:43 PM 128 C:\WINDOWS\CSC
10/9/2009 10:12:43 PM 0 C:\WINDOWS\CSC\d1
10/9/2009 10:12:43 PM 0 C:\WINDOWS\CSC\d2
10/9/2009 10:12:43 PM 0 C:\WINDOWS\CSC\d3
10/9/2009 10:12:43 PM 0 C:\WINDOWS\CSC\d4
10/9/2009 10:12:44 PM 0 C:\WINDOWS\CSC\d5
10/9/2009 10:12:44 PM 0 C:\WINDOWS\CSC\d6
10/9/2009 10:12:44 PM 0 C:\WINDOWS\CSC\d7
10/9/2009 10:12:44 PM 0 C:\WINDOWS\CSC\d8
10/6/2009 9:38:45 PM 35507264 C:\WINDOWS\ie8
10/6/2009 9:38:45 PM 1175984 C:\WINDOWS\ie8\spuninst
10/6/2009 9:39:55 PM 27041882 C:\WINDOWS\ie8updates
10/7/2009 12:54:30 AM 1351843 C:\WINDOWS\ie8updates\KB971961-IE8
10/7/2009 12:54:30 AM 625315 C:\WINDOWS\ie8updates\KB971961-IE8\spuninst
10/6/2009 9:39:55 PM 25062722 C:\WINDOWS\ie8updates\KB972260-IE8
10/6/2009 9:39:55 PM 635535 C:\WINDOWS\ie8updates\KB972260-IE8\spuninst
10/6/2009 9:40:12 PM 627317 C:\WINDOWS\ie8updates\KB973874-IE8
10/6/2009 9:40:12 PM 625269 C:\WINDOWS\ie8updates\KB973874-IE8\spuninst
10/10/2009 6:24:13 PM 140 32 C:\WINDOWS\DBStartup.log
10/11/2009 2:23:04 PM 1424 32 C:\WINDOWS\DHCPUPG.LOG
10/6/2009 9:38:31 PM 84347 32 C:\WINDOWS\ie8.log
9/9/2009 3:03:33 AM 36827 32 C:\WINDOWS\KB956844.log
8/18/2009 8:43:06 AM 15189 32 C:\WINDOWS\KB968389.log
9/9/2009 3:03:41 AM 36622 32 C:\WINDOWS\KB968816.log
8/26/2009 3:00:23 AM 3806 32 C:\WINDOWS\KB970653-v3.log
10/7/2009 12:54:17 AM 7176 32 C:\WINDOWS\KB971961-IE8.log
9/9/2009 3:00:36 AM 8853 32 C:\WINDOWS\KB971961.log
10/6/2009 9:39:38 PM 93598 32 C:\WINDOWS\KB972260-IE8.log
10/6/2009 9:40:11 PM 72634 32 C:\WINDOWS\KB973874-IE8.log
10/9/2009 10:12:34 PM 639778 32 C:\WINDOWS\ntbtlog.txt
10/9/2009 9:15:04 AM 333312 32 C:\WINDOWS\svohost.exe
10/11/2009 2:23:01 PM 145 32 C:\WINDOWS\WINNT32.LOG
10/9/2009 9:15:04 AM 4 32 C:\WINDOWS\wp3.dat
10/9/2009 9:15:04 AM 58 32 C:\WINDOWS\wp4.dat
10/9/2009 9:18:15 AM 211087 C:\WINDOWS\system32\schtml
10/9/2009 9:18:15 AM 64833 C:\WINDOWS\system32\schtml\images
10/9/2009 5:24:58 PM 4 32 C:\WINDOWS\system32\bincd32.dat
10/11/2009 3:54:56 PM 664 32 C:\WINDOWS\system32\d3d9caps.dat
8/22/2009 8:05:24 PM 94208 32 C:\WINDOWS\system32\DNIN50.dll
8/22/2009 8:05:24 PM 17149 32 C:\WINDOWS\system32\DNINDIS5.sys
9/15/2009 11:08:34 PM 145184 32 C:\WINDOWS\system32\java.exe
9/15/2009 11:08:34 PM 145184 32 C:\WINDOWS\system32\javaw.exe
9/15/2009 11:08:34 PM 149280 32 C:\WINDOWS\system32\javaws.exe
9/15/2009 11:08:18 PM 4240 32 C:\WINDOWS\system32\jupdate-1.6.0_15-b03.log
8/22/2009 8:05:24 PM 651264 32 C:\WINDOWS\system32\libeay32.dll
9/13/2009 2:45:38 PM 32592 32 C:\WINDOWS\system32\msonpmon.dll
10/9/2009 9:15:04 AM 9 32 C:\WINDOWS\system32\nuar.old
10/9/2009 9:15:04 AM 654336 32 C:\WINDOWS\system32\plugie.dll
10/9/2009 9:15:03 AM 556032 32 C:\WINDOWS\system32\pump.exe
10/9/2009 9:15:05 AM 36 32 C:\WINDOWS\system32\skynet.dat
8/22/2009 8:05:24 PM 147456 32 C:\WINDOWS\system32\ssleay32.dll====== Files under "\Administrator\Startup" Last 60 Days======
====== Files under "\All Users\Startup" Last 60 Days======8/22/2009 8:05:23 PM 1397 32 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\NETGEAR WPN111 Smart Wizard.lnk
====== Files and Folders under "\Program Files" Last 60 Days======
9/13/2009 2:38:05 PM 64159055 C:\Program Files\Microsoft Visual Studio 8
9/13/2009 2:43:38 PM 3178824 C:\Program Files\Microsoft Works
9/13/2009 2:41:04 PM 8152064 C:\Program Files\Microsoft.NET
8/22/2009 8:03:19 PM 6605554 C:\Program Files\NETGEAR
9/16/2009 8:54:15 PM 367720 C:\Program Files\SafetyCenter
9/7/2009 2:21:44 PM 3431088 C:\Program Files\Spybot - Search & Destroy
10/11/2009 9:07:36 PM 403456 C:\Program Files\Trend Micro====== Files under "\System32\Drivers" Last 60 Days======
8/22/2009 8:05:27 PM 17801 32 C:\WINDOWS\system32\drivers\AegisP.sys
====== Files Deleted under "%Temp%" ======
13 Files deleted====== Files and Folders under "All Users\Application Data" Last 60 Days======
9/13/2009 2:33:56 PM 66140 C:\Documents and Settings\All Users\Application Data\Microsoft Help
9/7/2009 2:21:44 PM 31477 C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
9/7/2009 2:25:10 PM 4677 C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Logs
9/7/2009 2:25:10 PM 0 C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery====== Values under HKLM\Software\microsoft\shared tools\msconfig\startupreg ======
HKLM\Software\microsoft\shared tools\msconfig\startupreg\
====== Services ( Services that are Whitelisted are not shown) ======
ASCTRM (ASCTRM)- C:\WINDOWS\system32\drivers\ASCTRM.sys - Auto/Running
BVRPMPR5 (BVRPMPR5 NDIS Protocol Driver)- \??\C:\WINDOWS\system32\drivers\BVRPMPR5.SYS - Manual/Stopped
DNINDIS5 (DNINDIS5 NDIS Protocol Driver)- \??\C:\WINDOWS\system32\DNINDIS5.SYS - Manual/Stopped
E100B (Intel(R) PRO Adapter Driver)- C:\WINDOWS\system32\DRIVERS\e100b325.sys - Manual/Stopped
Mtlmnt5 (Mtlmnt5)- C:\WINDOWS\system32\DRIVERS\Mtlmnt5.sys - Manual/Stopped
Mtlstrm (Mtlstrm)- C:\WINDOWS\system32\DRIVERS\Mtlstrm.sys - Manual/Stopped
NtMtlFax (NtMtlFax)- C:\WINDOWS\system32\DRIVERS\NtMtlFax.sys - Manual/Stopped
NuidFltr (NUID filter driver)- C:\WINDOWS\system32\DRIVERS\NuidFltr.sys - Manual/Running
omci (OMCI WDM Device Driver)- C:\WINDOWS\system32\DRIVERS\omci.sys - System/Running
PalmUSBD (PalmUSBD)- C:\WINDOWS\system32\drivers\PalmUSBD.sys - Manual/Stopped
RecAgent (RecAgent)- C:\WINDOWS\system32\DRIVERS\RecAgent.sys - Boot/Running
RimUsb (BlackBerry Device)- C:\WINDOWS\system32\Drivers\RimUsb.sys - Manual/Stopped
RimVSerPort (RIM Virtual Serial Port v2)- C:\WINDOWS\system32\DRIVERS\RimSerial.sys - Manual/Stopped
senfilt (senfilt)- C:\WINDOWS\system32\drivers\senfilt.sys - Manual/Running
Slntamr (Smart Link 56K Modem Driver)- C:\WINDOWS\system32\DRIVERS\slntamr.sys - Manual/Stopped
SlNtHal (SlNtHal)- C:\WINDOWS\system32\DRIVERS\Slnthal.sys - Manual/Stopped
SlWdmSup (SlWdmSup)- C:\WINDOWS\system32\DRIVERS\SlWdmSup.sys - Manual/Stopped
smwdm (smwdm)- C:\WINDOWS\system32\drivers\smwdm.sys - Manual/Running
wanatw (WAN Miniport (ATW))- C:\WINDOWS\system32\DRIVERS\wanatw4.sys - Manual/Running
Wdf01000 (Wdf01000)- C:\WINDOWS\system32\DRIVERS\Wdf01000.sys - Manual/Running====== Uninstall List ======
======== Other Info ========
TOTAL PHYSICAL RAM: 1063 MB
Boot Info
[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
OS Type: Microsoft Windows XP Professional
Build: 5.1.2600
Service Pack: 3.0
====== Files with Hidden Attributes======C:\IO.SYS
C:\MSDOS.SYS
C:\pagefile.sys
C:\NTDETECT.COM==End of Report==
Hidden File
C:\IO.SYS
C:\MSDOS.SYS
C:\pagefile.sys
C:\NTDETECT.COM
C:\Documents and Settings\Administrator\IETldCache\index.dat
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\DOMStore\index.dat
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012009100920091010\index.dat
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012009101120091012\index.dat
C:\Documents and Settings\Administrator\PrivacIE\index.dat
C:\Documents and Settings\All Users\Application Data\Sonic\sarlicense9.dat
C:\Documents and Settings\Default User\NTUSER.DAT
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
C:\Documents and Settings\LocalService\NTUSER.DAT
C:\Documents and Settings\LocalService\IETldCache\index.dat
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
C:\Documents and Settings\Moak Petrolium\cuecuf.exe
C:\Documents and Settings\Moak Petrolium\haihaep.exe
C:\Documents and Settings\Moak Petrolium\kanef.exe
C:\Documents and Settings\Moak Petrolium\laqig.exe
C:\Documents and Settings\Moak Petrolium\pktier.exe
C:\Documents and Settings\Moak Petrolium\NTUSER.DAT
C:\Documents and Settings\Moak Petrolium\Application Data\Microsoft\Internet Explorer\UserData\index.dat
C:\Documents and Settings\Moak Petrolium\Application Data\Microsoft\Office\Recent\index.dat
C:\Documents and Settings\Moak Petrolium\IECompatCache\index.dat
C:\Documents and Settings\Moak Petrolium\IETldCache\index.dat
C:\Documents and Settings\Moak Petrolium\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat
C:\Documents and Settings\Moak Petrolium\Local Settings\Application Data\Microsoft\Internet Explorer\DOMStore\index.dat
C:\Documents and Settings\Moak Petrolium\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
C:\Documents and Settings\Moak Petrolium\Local Settings\History\History.IE5\MSHist012009100520091012\index.dat
C:\Documents and Settings\Moak Petrolium\Local Settings\History\History.IE5\MSHist012009101220091013\index.dat
C:\Documents and Settings\Moak Petrolium\Local Settings\History\History.IE5\MSHist012009101320091014\index.dat
C:\Documents and Settings\Moak Petrolium\Local Settings\History\History.IE5\MSHist012009101420091015\index.dat
C:\Documents and Settings\Moak Petrolium\PrivacIE\index.dat
C:\Documents and Settings\NetworkService\NTUSER.DAT
C:\Documents and Settings\NetworkService\Cookies\index.dat
C:\Documents and Settings\NetworkService\IETldCache\index.dat
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat
C:\i386\UsrClass.dat
C:\i386\oem10.inf
C:\i386\oem12.inf
C:\Program Files\Canon\MP Navigator 2.2\uinstrsc.dll
C:\Program Files\Canon\MP Navigator 2.2\Maint.exe
C:\Program Files\Chocolatier - Decadence by Design\chocolatier-decadence.exe
C:\Program Files\Common Files\AOL\TopSpeed\3.0\WBUnins.exe
C:\WINDOWS\assembly\pubpol14.dat
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\index90.dat
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\index91.dat
C:\WINDOWS\inf\oem10.inf
C:\WINDOWS\inf\oem12.inf
C:\WINDOWS\inf\oem19.inf
C:\WINDOWS\inf\oem20.inf
C:\WINDOWS\inf\oem21.inf
C:\WINDOWS\inf\oem22.inf
C:\WINDOWS\inf\oem26.inf
C:\WINDOWS\inf\oem27.inf
C:\WINDOWS\inf\oem32.inf
C:\WINDOWS\inf\oem33.inf
C:\WINDOWS\repair\ntuser.dat
C:\WINDOWS\system32\config\systemprofile\IETldCache\index.dat
C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012009100920091010\index.dat
C:\WINDOWS\Tasks\SA.DAT677
0
Posted October 15th, 2009 09:00
sheripatn
Please download Combofix and save to your desktop:
- Note: It is important that it is saved directly to your desktop
Close any open browsers.
Double click on combofix.exe and follow the prompts.
When it's finished it will produce a log.
Post the contents of the C:\ComboFix.txt into your next reply.
Note: Do not mouseclick combofix's window whilst it's running.
That may cause the program to freeze/hang.
- Note: It is important that it is saved directly to your desktop
678
0
Posted October 15th, 2009 21:00
Here is the combofix report. Thank you
ComboFix 09-10-15.04 - Moak Petrolium 10/15/2009 22:16.2.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.513 [GMT -5:00]
Running from: c:\documents and settings\Moak Petrolium\Desktop\ComboFix.exe
AV: AVG Anti-Virus *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.c:\documents and settings\Moak Petrolium\cuecuf.exe
c:\documents and settings\Moak Petrolium\haihaep.exe
c:\documents and settings\Moak Petrolium\kanef.exe
c:\documents and settings\Moak Petrolium\laqig.exe
c:\documents and settings\Moak Petrolium\pktier.exe
c:\program files\FunWebProducts
c:\program files\FunWebProducts\ScreenSaver\Images\000399A1.urr
c:\program files\MyWebSearch
c:\program files\MyWebSearch\bar\History\search3
c:\program files\MyWebSearch\bar\Settings\s_pid.dat
c:\program files\MyWebSearch\bar\Settings\setting2.htm
c:\program files\MyWebSearch\bar\Settings\settings.dat
c:\program files\SafetyCenter
c:\program files\SafetyCenter\main.ico
c:\program files\SafetyCenter\sound.wav
c:\windows\Installer\15b01c.msp
c:\windows\Installer\16315.msp
c:\windows\Installer\1e5a3a.msp
c:\windows\Installer\1f9970d3.msp
c:\windows\Installer\3a1f2bc.msi
c:\windows\Installer\46d81b45.msp
c:\windows\Installer\46d81b59.msp
c:\windows\Installer\46d81b6d.msp
c:\windows\Installer\6bbb3a8.msi
c:\windows\Installer\6bbb3a9.msp
c:\windows\Installer\6bbb3aa.msp
c:\windows\Installer\6bbb3ab.msp
c:\windows\Installer\6bbb3ac.msp
c:\windows\Installer\6bbb3ad.msp
c:\windows\Installer\6bbb3ae.msp
c:\windows\Installer\6bbb3af.msp
c:\windows\Installer\6bbb3b0.msp
c:\windows\Installer\6bbb3b1.msp
c:\windows\Installer\7b53166.msp
c:\windows\Installer\7b53182.msp
c:\windows\Installer\7b531d5.msp
c:\windows\Installer\7b531ea.msp
c:\windows\Installer\7b5320f.msp
c:\windows\Installer\7b53223.msp
c:\windows\Installer\7b53239.msp
c:\windows\Installer\7b5324d.msp
c:\windows\Installer\7b53263.msp
c:\windows\Installer\7b5327a.msp
c:\windows\Installer\7b5328f.msp
c:\windows\Installer\7b532a3.msp
c:\windows\Installer\8fa65b9.msp
c:\windows\svohost.exe
c:\windows\system32\bincd32.dat
c:\windows\system32\bszip.dll
c:\windows\system32\gasfkyueqxbfal.dll
c:\windows\system32\nuar.old
c:\windows\system32\pump.exe
c:\windows\system32\schtml
c:\windows\system32\schtml\dbsinit.exe
c:\windows\system32\schtml\images\i1.gif
c:\windows\system32\schtml\images\i2.gif
c:\windows\system32\schtml\images\i3.gif
c:\windows\system32\schtml\images\j1.gif
c:\windows\system32\schtml\images\j2.gif
c:\windows\system32\schtml\images\j3.gif
c:\windows\system32\schtml\images\jj1.gif
c:\windows\system32\schtml\images\jj2.gif
c:\windows\system32\schtml\images\jj3.gif
c:\windows\system32\schtml\images\l1.gif
c:\windows\system32\schtml\images\l2.gif
c:\windows\system32\schtml\images\l3.gif
c:\windows\system32\schtml\images\pix.gif
c:\windows\system32\schtml\images\t1.gif
c:\windows\system32\schtml\images\t2.gif
c:\windows\system32\schtml\images\up1.gif
c:\windows\system32\schtml\images\up2.gif
c:\windows\system32\schtml\images\w1.gif
c:\windows\system32\schtml\images\w11.gif
c:\windows\system32\schtml\images\w2.gif
c:\windows\system32\schtml\images\w3.gif
c:\windows\system32\schtml\images\w3.jpg
c:\windows\system32\schtml\images\word.doc
c:\windows\system32\schtml\images\wt1.gif
c:\windows\system32\schtml\images\wt2.gif
c:\windows\system32\schtml\images\wt3.gif
c:\windows\system32\schtml\wispex.html
c:\windows\system32\skynet.dat
c:\windows\Tasks\At1.job
c:\windows\Tasks\At10.job
c:\windows\Tasks\At11.job
c:\windows\Tasks\At12.job
c:\windows\Tasks\At13.job
c:\windows\Tasks\At14.job
c:\windows\Tasks\At15.job
c:\windows\Tasks\At16.job
c:\windows\Tasks\At17.job
c:\windows\Tasks\At18.job
c:\windows\Tasks\At19.job
c:\windows\Tasks\At2.job
c:\windows\Tasks\At20.job
c:\windows\Tasks\At21.job
c:\windows\Tasks\At22.job
c:\windows\Tasks\At23.job
c:\windows\Tasks\At24.job
c:\windows\Tasks\At3.job
c:\windows\Tasks\At4.job
c:\windows\Tasks\At5.job
c:\windows\Tasks\At6.job
c:\windows\Tasks\At7.job
c:\windows\Tasks\At8.job
c:\windows\Tasks\At9.job.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.-------\Legacy_WDefend
-------\Service_WDefend
((((((((((((((((((((((((( Files Created from 2009-09-16 to 2009-10-16 )))))))))))))))))))))))))))))))
.2009-10-12 23:47 . 2009-10-12 23:47 590532 ----a-w- C:\Autoruns.zip
2009-10-12 21:54 . 2009-10-13 00:00 -------- d-----w- C:\AVGTemp
2009-10-12 02:07 . 2009-10-12 02:07 -------- d-----w- c:\program files\Trend Micro
2009-10-11 21:02 . 2009-10-11 21:02 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Adobe
2009-10-11 20:54 . 2009-10-14 10:58 664 ----a-w- c:\windows\system32\d3d9caps.dat
2009-10-10 03:13 . 2009-10-10 03:13 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE
2009-10-10 03:13 . 2009-10-10 03:13 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2009-10-09 14:15 . 2009-10-09 15:15 58 ----a-w- c:\windows\wp4.dat
2009-10-09 14:15 . 2009-10-09 15:15 4 ----a-w- c:\windows\wp3.dat
2009-10-09 14:15 . 2009-10-09 14:15 654336 ----a-w- c:\windows\system32\plugie.dll
2009-10-07 23:46 . 2009-10-07 23:46 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2009-10-07 03:30 . 2009-10-07 03:30 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2009-10-07 02:48 . 2009-10-07 02:48 -------- d-sh--w- c:\documents and settings\Moak Petrolium\IECompatCache
2009-10-07 02:43 . 2009-10-07 02:43 -------- d-sh--w- c:\documents and settings\Moak Petrolium\PrivacIE
2009-10-07 02:42 . 2009-10-07 02:42 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2009-10-07 02:42 . 2009-10-07 02:42 -------- d-sh--w- c:\documents and settings\Moak Petrolium\IETldCache
2009-10-07 02:39 . 2009-10-07 02:39 -------- d-----w- c:\windows\ie8updates
2009-10-07 02:38 . 2009-10-07 02:38 -------- dc-h--w- c:\windows\ie8
2009-10-07 02:36 . 2009-08-07 08:48 100352 ------w- c:\windows\system32\dllcache\iecompat.dll
2009-10-07 02:36 . 2009-07-03 17:09 12800 ------w- c:\windows\system32\dllcache\xpshims.dll
2009-10-07 02:36 . 2009-07-03 17:09 246272 ------w- c:\windows\system32\dllcache\ieproxy.dll
2009-09-23 20:30 . 2009-09-23 20:30 0 ----a-w- C:\butwwo.exe
2009-09-23 20:30 . 2009-09-23 20:30 0 ----a-w- C:\iusfdc.exe
2009-09-23 20:28 . 2009-09-23 20:28 0 ----a-w- C:\wuun.exe
2009-09-23 20:28 . 2009-09-23 20:28 0 ----a-w- C:\ddmishqi.exe
2009-09-17 01:54 . 2009-09-17 01:54 2198 ----a-w- C:\LYPR.bat.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-15 05:05 . 2008-12-12 20:03 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-10-14 04:17 . 2009-01-13 18:26 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2009-10-11 20:14 . 2009-06-12 13:02 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar
2009-10-09 02:47 . 2006-09-12 14:58 82160 -c--a-w- c:\documents and settings\Moak Petrolium\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-17 02:01 . 2009-09-07 19:21 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-09-17 01:57 . 2009-09-07 19:21 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-09-16 04:08 . 2006-09-07 04:49 -------- d-----w- c:\program files\Java
2009-09-14 08:03 . 2009-09-13 19:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-09-13 19:48 . 2009-09-13 19:38 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2009-09-13 19:43 . 2009-09-13 19:43 -------- d-----w- c:\program files\Microsoft Works
2009-09-13 19:43 . 2009-08-08 08:11 -------- d-----w- c:\program files\MSBuild
2009-09-13 19:41 . 2009-09-13 19:41 -------- d-----w- c:\program files\Microsoft.NET
2009-09-09 08:14 . 2009-08-04 23:12 -------- d-----w- c:\program files\Microsoft Silverlight
2009-09-05 14:38 . 2009-09-05 14:38 -------- d-----w- c:\documents and settings\Moak Petrolium\Application Data\Oberonv1001
2009-09-05 14:37 . 2009-06-13 14:33 -------- d-----w- c:\program files\Oberon Media
2009-08-23 01:05 . 2009-08-23 01:05 17801 ----a-w- c:\windows\system32\drivers\AegisP.sys
2009-08-23 01:05 . 2009-08-23 01:03 -------- d-----w- c:\program files\NETGEAR
2009-08-23 01:05 . 2007-01-20 21:09 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-08-23 01:04 . 2008-09-17 15:36 -------- d-----w- c:\documents and settings\Moak Petrolium\Application Data\InstallShield
2009-08-05 09:01 . 2004-08-11 22:00 204800 -c--a-w- c:\windows\system32\mswebdvd.dll
2009-07-29 13:46 . 2009-01-13 18:26 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-07-29 13:46 . 2009-01-13 18:26 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-07-29 13:46 . 2009-01-13 18:26 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-07-25 10:23 . 2009-01-08 19:27 411368 ----a-w- c:\windows\system32\deploytk.dll
.((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200][HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-09-02 16:58 1107200 ----a-w- c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200][HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200][HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ScanSoft PDF Professional 4-reminder"="c:\program files\ScanSoft\PDF Professional 4.0\Ereg\Ereg.exe" [2006-11-16 35368]
"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-11-29 583048]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2006-07-07 576320]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2006-07-07 600896]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-09-29 2023704]
"EPSON PictureMate"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S4I2P1.EXE" [2003-09-19 99840]c:\documents and settings\All Users\Start Menu\Programs\Startup\
NETGEAR WPN111 Smart Wizard.lnk - c:\program files\NETGEAR\WPN111\wpn111.exe [2009-8-22 884838][HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-07-29 13:46 11952 ----a-w- c:\windows\system32\avgrsstx.dll[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup=c:\windows\pss\Kodak EasyShare software.lnkCommon Startup[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk
backup=c:\windows\pss\QuickBooks Update Agent.lnkCommon Startup[HKLM\~\startupfolder\C:^Documents and Settings^Moak Petrolium^Start Menu^Programs^Startup^AOL Desktop.lnk]
path=c:\documents and settings\Moak Petrolium\Start Menu\Programs\Startup\AOL Desktop.lnk
backup=c:\windows\pss\AOL Desktop.lnkStartup[HKLM\~\startupfolder\C:^Documents and Settings^Moak Petrolium^Start Menu^Programs^Startup^Event Reminder.lnk]
path=c:\documents and settings\Moak Petrolium\Start Menu\Programs\Startup\Event Reminder.lnk
backup=c:\windows\pss\Event Reminder.lnkStartup[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"WDefend"=2 (0x2)
"RoxLiveShare9"=2 (0x2)
"QuickBooksDB17"=2 (0x2)
"QuickBooksDB"=2 (0x2)
"QBFCService"=3 (0x3)
"QBCFMonitorService"=2 (0x2)
"ose"=3 (0x3)
"odserv"=3 (0x3)
"Microsoft Office Groove Audit Service"=3 (0x3)
"MDM"=2 (0x2)
"LiveUpdate Notice Service"=2 (0x2)
"LiveUpdate Notice Ex"=2 (0x2)
"KodakCCS"=3 (0x3)
"JavaQuickStarterService"=2 (0x2)
"idsvc"=3 (0x3)
"IDriverT"=3 (0x3)
"Iap"=2 (0x2)
"hpdj"=2 (0x2)
"gusvc"=3 (0x3)
"GoogleDesktopManager"=3 (0x3)
"CLTNetCnService"=2 (0x2)
"AOL ACS"=2 (0x2)[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Intuit\\QuickBooks 2006\\QBDBMgrN.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"c:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe"=
"c:\\Program Files\\Intuit\\QuickBooks 2006\\QBW32PremierGeneric.exe"=
"c:\\Program Files\\Common Files\\Intuit\\QuickBooks\\QBServerUtilityMgr.exe"=
"c:\\Program Files\\Outlook Express\\msimn.exe"=
"c:\\Program Files\\Common Files\\AOL\\1159364574\\EE\\aolsoftware.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\3.0\\aoltpsd3.exe"=
"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"c:\\Program Files\\Common Files\\AOL\\1159364574\\EE\\AOLDesktop.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgam.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"c:\\WINDOWS\\system32\\dxdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"443:TCP"= 443:TCP:HTTPS
"21:TCP"= 21:TCP:FTPR0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [1/13/2009 1:26 PM 12552]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [1/13/2009 1:26 PM 335240]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [1/13/2009 1:26 PM 108552]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [1/13/2009 1:26 PM 297752]
S3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;c:\windows\system32\DNINDIS5.sys [8/22/2009 8:05 PM 17149]
S4 QuickBooksDB17;QuickBooksDB17;c:\progra~1\Intuit\QUICKB~1\QBDBMgrN.exe -hvQuickBooksDB17 --> c:\progra~1\Intuit\QUICKB~1\QBDBMgrN.exe -hvQuickBooksDB17 [?][HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder2009-10-16 c:\windows\Tasks\User_Feed_Synchronization-{038D821F-E787-43D8-99C0-7FD89C3500CC}.job
- c:\windows\system32\msfeedssync.exe [2007-08-14 09:31]
.
.
------- Supplementary Scan -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://aol.com/
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Open with ScanSoft PDF Converter 4.1 - c:\program files\ScanSoft\PDF Professional 4.0\cnvres_eng.dll /100
Trusted Zone: aol.com
Trusted Zone: pogo.com\www
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {3107C2A8-9F0B-4404-A58B-21BD85268FBC} - hxxp://www.pogo.com/cdl/launcher/PogoWebLauncherInstaller.CAB
.
- - - - ORPHANS REMOVED - - - -HKCU-Run-haihaep - c:\documents and settings\Moak Petrolium\haihaep.exe
AddRemove-AOL Regclient - c:\program files\AOL\RC\uninstall.exe
AddRemove-AOL Toolbar 5.0 - c:\program files\AOL\AOL Toolbar 5.0\uninstall.exe
AddRemove-Port Magic - c:\program files\Pure Networks\Port Magic\PortAOL.exe**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-15 22:25
Windows 5.1.2600 Service Pack 3 NTFSscanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------[HKEY_USERS\S-1-5-21-255879815-3811564576-2564377081-1005\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------- - - - - - - > 'explorer.exe'(4032)
c:\windows\system32\WININET.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCR80.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\program files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
.
------------------------ Other Running Processes ------------------------
.
c:\progra~1\AVG\AVG8\avgam.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
.
**************************************************************************
.
Completion time: 2009-10-16 22:32 - machine was rebooted
ComboFix-quarantined-files.txt 2009-10-16 03:31Pre-Run: 51,524,202,496 bytes free
Post-Run: 51,451,289,600 bytes free341 --- E O F --- 2009-10-13 08:01
678
0
Posted October 16th, 2009 08:00
sheripatn
1. Open NotePad (not wordpad). Copy and paste the following into Notepad
File::
c:\windows\wp4.dat
c:\windows\wp3.dat
c:\windows\system32\plugie.dll
C:\butwwo.exe
C:\iusfdc.exe
C:\wuun.exe
C:\ddmishqi.exe
C:\LYPR.bat
Save the File as CFScript(exactly as shown no spaces) ->> Save it to your Desktop
Using the Image as a reference, drag CFScript into ComboFix.exe
- You will be prompted to run Combofix again, Do so
Following the same rules as indicated in my first post
Then post the contents of the C:\ComboFix.txt log in your reply
- You will be prompted to run Combofix again, Do so
678
0
Posted October 16th, 2009 19:00
Here is the file. Thank you
ComboFix 09-10-15.04 - Moak Petrolium 10/16/2009 19:54.3.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.478 [GMT -5:00]
Running from: c:\documents and settings\Moak Petrolium\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Moak Petrolium\Desktop\CFScript.txt
AV: AVG Anti-Virus *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}FILE ::
"C:\butwwo.exe"
"C:\ddmishqi.exe"
"C:\iusfdc.exe"
"C:\LYPR.bat"
"c:\windows\system32\plugie.dll"
"c:\windows\wp3.dat"
"c:\windows\wp4.dat"
"C:\wuun.exe"
.((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.C:\butwwo.exe
C:\ddmishqi.exe
C:\iusfdc.exe
C:\LYPR.bat
c:\windows\system32\plugie.dll
c:\windows\wp3.dat
c:\windows\wp4.dat
C:\wuun.exe.
((((((((((((((((((((((((( Files Created from 2009-09-17 to 2009-10-17 )))))))))))))))))))))))))))))))
.2009-10-16 10:57 . 2009-10-16 10:57 -------- d-----w- c:\windows\LastGood
2009-10-12 23:47 . 2009-10-12 23:47 590532 ----a-w- C:\Autoruns.zip
2009-10-12 21:54 . 2009-10-13 00:00 -------- d-----w- C:\AVGTemp
2009-10-12 02:07 . 2009-10-12 02:07 -------- d-----w- c:\program files\Trend Micro
2009-10-11 21:02 . 2009-10-11 21:02 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Adobe
2009-10-11 20:54 . 2009-10-14 10:58 664 ----a-w- c:\windows\system32\d3d9caps.dat
2009-10-10 03:13 . 2009-10-10 03:13 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE
2009-10-10 03:13 . 2009-10-10 03:13 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2009-10-07 23:46 . 2009-10-07 23:46 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2009-10-07 03:30 . 2009-10-07 03:30 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2009-10-07 02:48 . 2009-10-07 02:48 -------- d-sh--w- c:\documents and settings\Moak Petrolium\IECompatCache
2009-10-07 02:43 . 2009-10-07 02:43 -------- d-sh--w- c:\documents and settings\Moak Petrolium\PrivacIE
2009-10-07 02:42 . 2009-10-07 02:42 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2009-10-07 02:42 . 2009-10-07 02:42 -------- d-sh--w- c:\documents and settings\Moak Petrolium\IETldCache
2009-10-07 02:39 . 2009-10-07 02:39 -------- d-----w- c:\windows\ie8updates
2009-10-07 02:38 . 2009-10-07 02:38 -------- dc-h--w- c:\windows\ie8
2009-10-07 02:36 . 2009-08-07 08:48 100352 ------w- c:\windows\system32\dllcache\iecompat.dll
2009-10-07 02:36 . 2009-07-03 17:09 12800 ------w- c:\windows\system32\dllcache\xpshims.dll
2009-10-07 02:36 . 2009-07-03 17:09 246272 ------w- c:\windows\system32\dllcache\ieproxy.dll.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-17 00:46 . 2008-12-12 20:03 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-10-14 04:17 . 2009-01-13 18:26 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2009-10-11 20:14 . 2009-06-12 13:02 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar
2009-10-09 02:47 . 2006-09-12 14:58 82160 -c--a-w- c:\documents and settings\Moak Petrolium\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-17 02:01 . 2009-09-07 19:21 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-09-17 01:57 . 2009-09-07 19:21 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-09-16 04:08 . 2006-09-07 04:49 -------- d-----w- c:\program files\Java
2009-09-14 08:03 . 2009-09-13 19:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-09-13 19:48 . 2009-09-13 19:38 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2009-09-13 19:43 . 2009-09-13 19:43 -------- d-----w- c:\program files\Microsoft Works
2009-09-13 19:43 . 2009-08-08 08:11 -------- d-----w- c:\program files\MSBuild
2009-09-13 19:41 . 2009-09-13 19:41 -------- d-----w- c:\program files\Microsoft.NET
2009-09-09 08:14 . 2009-08-04 23:12 -------- d-----w- c:\program files\Microsoft Silverlight
2009-09-05 14:38 . 2009-09-05 14:38 -------- d-----w- c:\documents and settings\Moak Petrolium\Application Data\Oberonv1001
2009-09-05 14:37 . 2009-06-13 14:33 -------- d-----w- c:\program files\Oberon Media
2009-08-23 01:05 . 2009-08-23 01:05 17801 ----a-w- c:\windows\system32\drivers\AegisP.sys
2009-08-23 01:05 . 2009-08-23 01:03 -------- d-----w- c:\program files\NETGEAR
2009-08-23 01:05 . 2007-01-20 21:09 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-08-23 01:04 . 2008-09-17 15:36 -------- d-----w- c:\documents and settings\Moak Petrolium\Application Data\InstallShield
2009-08-05 09:01 . 2004-08-11 22:00 204800 -c--a-w- c:\windows\system32\mswebdvd.dll
2009-07-29 13:46 . 2009-01-13 18:26 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-07-29 13:46 . 2009-01-13 18:26 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-07-29 13:46 . 2009-01-13 18:26 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-07-25 10:23 . 2009-01-08 19:27 411368 ----a-w- c:\windows\system32\deploytk.dll
.((((((((((((((((((((((((((((( SnapShot@2009-10-16_03.25.58 )))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200][HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-09-02 16:58 1107200 ----a-w- c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200][HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200][HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ScanSoft PDF Professional 4-reminder"="c:\program files\ScanSoft\PDF Professional 4.0\Ereg\Ereg.exe" [2006-11-16 35368]
"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-11-29 583048]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2006-07-07 576320]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2006-07-07 600896]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-09-29 2023704]
"EPSON PictureMate"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S4I2P1.EXE" [2003-09-19 99840]c:\documents and settings\All Users\Start Menu\Programs\Startup\
NETGEAR WPN111 Smart Wizard.lnk - c:\program files\NETGEAR\WPN111\wpn111.exe [2009-8-22 884838][HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-07-29 13:46 11952 ----a-w- c:\windows\system32\avgrsstx.dll[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup=c:\windows\pss\Kodak EasyShare software.lnkCommon Startup[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk
backup=c:\windows\pss\QuickBooks Update Agent.lnkCommon Startup[HKLM\~\startupfolder\C:^Documents and Settings^Moak Petrolium^Start Menu^Programs^Startup^AOL Desktop.lnk]
path=c:\documents and settings\Moak Petrolium\Start Menu\Programs\Startup\AOL Desktop.lnk
backup=c:\windows\pss\AOL Desktop.lnkStartup[HKLM\~\startupfolder\C:^Documents and Settings^Moak Petrolium^Start Menu^Programs^Startup^Event Reminder.lnk]
path=c:\documents and settings\Moak Petrolium\Start Menu\Programs\Startup\Event Reminder.lnk
backup=c:\windows\pss\Event Reminder.lnkStartup[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"WDefend"=2 (0x2)
"RoxLiveShare9"=2 (0x2)
"QuickBooksDB17"=2 (0x2)
"QuickBooksDB"=2 (0x2)
"QBFCService"=3 (0x3)
"QBCFMonitorService"=2 (0x2)
"ose"=3 (0x3)
"odserv"=3 (0x3)
"Microsoft Office Groove Audit Service"=3 (0x3)
"MDM"=2 (0x2)
"LiveUpdate Notice Service"=2 (0x2)
"LiveUpdate Notice Ex"=2 (0x2)
"KodakCCS"=3 (0x3)
"JavaQuickStarterService"=2 (0x2)
"idsvc"=3 (0x3)
"IDriverT"=3 (0x3)
"Iap"=2 (0x2)
"hpdj"=2 (0x2)
"gusvc"=3 (0x3)
"GoogleDesktopManager"=3 (0x3)
"CLTNetCnService"=2 (0x2)
"AOL ACS"=2 (0x2)[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Intuit\\QuickBooks 2006\\QBDBMgrN.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"c:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe"=
"c:\\Program Files\\Intuit\\QuickBooks 2006\\QBW32PremierGeneric.exe"=
"c:\\Program Files\\Common Files\\Intuit\\QuickBooks\\QBServerUtilityMgr.exe"=
"c:\\Program Files\\Outlook Express\\msimn.exe"=
"c:\\Program Files\\Common Files\\AOL\\1159364574\\EE\\aolsoftware.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\3.0\\aoltpsd3.exe"=
"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"c:\\Program Files\\Common Files\\AOL\\1159364574\\EE\\AOLDesktop.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgam.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"c:\\WINDOWS\\system32\\dxdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"443:TCP"= 443:TCP:HTTPS
"21:TCP"= 21:TCP:FTPR0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [1/13/2009 1:26 PM 12552]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [1/13/2009 1:26 PM 335240]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [1/13/2009 1:26 PM 108552]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [1/13/2009 1:26 PM 297752]
S3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;c:\windows\system32\DNINDIS5.sys [8/22/2009 8:05 PM 17149]
S4 QuickBooksDB17;QuickBooksDB17;c:\progra~1\Intuit\QUICKB~1\QBDBMgrN.exe -hvQuickBooksDB17 --> c:\progra~1\Intuit\QUICKB~1\QBDBMgrN.exe -hvQuickBooksDB17 [?][HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder2009-10-16 c:\windows\Tasks\User_Feed_Synchronization-{038D821F-E787-43D8-99C0-7FD89C3500CC}.job
- c:\windows\system32\msfeedssync.exe [2007-08-14 09:31]
.
.
------- Supplementary Scan -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://aol.com/
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Open with ScanSoft PDF Converter 4.1 - c:\program files\ScanSoft\PDF Professional 4.0\cnvres_eng.dll /100
Trusted Zone: aol.com
Trusted Zone: pogo.com\www
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {3107C2A8-9F0B-4404-A58B-21BD85268FBC} - hxxp://www.pogo.com/cdl/launcher/PogoWebLauncherInstaller.CAB
.**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-16 20:00
Windows 5.1.2600 Service Pack 3 NTFSscanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------[HKEY_USERS\S-1-5-21-255879815-3811564576-2564377081-1005\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
Completion time: 2009-10-17 20:03
ComboFix-quarantined-files.txt 2009-10-17 01:02
ComboFix2.txt 2009-10-16 03:32Pre-Run: 51,269,496,832 bytes free
Post-Run: 51,239,567,360 bytes free220 --- E O F --- 2009-10-16 08:01
678
0
Posted October 16th, 2009 20:00
Also, turn off your system restore, or it will reload. You can turn it back on once you get clean.
Go to Start, then right click "My Computer", then pick the system restore tab. Check the box "Turn off system restore", then Aplly, then OK. Check this setting after each reboot, it has a tendancy to turn the system restore back on so it can reload.
599
0
Posted October 17th, 2009 00:00
OK I turned off system restore and ran combofix again. This is the new scan. Thank you
ComboFix 09-10-15.04 - Moak Petrolium 10/17/2009 0:55.4.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.482 [GMT -5:00]
Running from: c:\documents and settings\Moak Petrolium\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Moak Petrolium\Desktop\CFScript.txt
AV: AVG Anti-Virus *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}FILE ::
"C:\butwwo.exe"
"C:\ddmishqi.exe"
"C:\iusfdc.exe"
"C:\LYPR.bat"
"c:\windows\system32\plugie.dll"
"c:\windows\wp3.dat"
"c:\windows\wp4.dat"
"C:\wuun.exe"
.((((((((((((((((((((((((( Files Created from 2009-09-17 to 2009-10-17 )))))))))))))))))))))))))))))))
.2009-10-16 10:57 . 2009-10-16 10:57 -------- d-----w- c:\windows\LastGood
2009-10-12 23:47 . 2009-10-12 23:47 590532 ----a-w- C:\Autoruns.zip
2009-10-12 21:54 . 2009-10-13 00:00 -------- d-----w- C:\AVGTemp
2009-10-12 02:07 . 2009-10-12 02:07 -------- d-----w- c:\program files\Trend Micro
2009-10-11 21:02 . 2009-10-11 21:02 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Adobe
2009-10-11 20:54 . 2009-10-14 10:58 664 ----a-w- c:\windows\system32\d3d9caps.dat
2009-10-10 03:13 . 2009-10-10 03:13 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE
2009-10-10 03:13 . 2009-10-10 03:13 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2009-10-07 23:46 . 2009-10-07 23:46 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2009-10-07 03:30 . 2009-10-07 03:30 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2009-10-07 02:48 . 2009-10-07 02:48 -------- d-sh--w- c:\documents and settings\Moak Petrolium\IECompatCache
2009-10-07 02:43 . 2009-10-07 02:43 -------- d-sh--w- c:\documents and settings\Moak Petrolium\PrivacIE
2009-10-07 02:42 . 2009-10-07 02:42 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2009-10-07 02:42 . 2009-10-07 02:42 -------- d-sh--w- c:\documents and settings\Moak Petrolium\IETldCache
2009-10-07 02:39 . 2009-10-07 02:39 -------- d-----w- c:\windows\ie8updates
2009-10-07 02:38 . 2009-10-07 02:38 -------- dc-h--w- c:\windows\ie8
2009-10-07 02:36 . 2009-08-07 08:48 100352 ------w- c:\windows\system32\dllcache\iecompat.dll
2009-10-07 02:36 . 2009-07-03 17:09 12800 ------w- c:\windows\system32\dllcache\xpshims.dll
2009-10-07 02:36 . 2009-07-03 17:09 246272 ------w- c:\windows\system32\dllcache\ieproxy.dll.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-17 00:46 . 2008-12-12 20:03 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-10-14 04:17 . 2009-01-13 18:26 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2009-10-11 20:14 . 2009-06-12 13:02 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar
2009-10-09 02:47 . 2006-09-12 14:58 82160 -c--a-w- c:\documents and settings\Moak Petrolium\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-17 02:01 . 2009-09-07 19:21 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-09-17 01:57 . 2009-09-07 19:21 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-09-16 04:08 . 2006-09-07 04:49 -------- d-----w- c:\program files\Java
2009-09-14 08:03 . 2009-09-13 19:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-09-13 19:48 . 2009-09-13 19:38 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2009-09-13 19:43 . 2009-09-13 19:43 -------- d-----w- c:\program files\Microsoft Works
2009-09-13 19:43 . 2009-08-08 08:11 -------- d-----w- c:\program files\MSBuild
2009-09-13 19:41 . 2009-09-13 19:41 -------- d-----w- c:\program files\Microsoft.NET
2009-09-09 08:14 . 2009-08-04 23:12 -------- d-----w- c:\program files\Microsoft Silverlight
2009-09-05 14:38 . 2009-09-05 14:38 -------- d-----w- c:\documents and settings\Moak Petrolium\Application Data\Oberonv1001
2009-09-05 14:37 . 2009-06-13 14:33 -------- d-----w- c:\program files\Oberon Media
2009-08-23 01:05 . 2009-08-23 01:05 17801 ----a-w- c:\windows\system32\drivers\AegisP.sys
2009-08-23 01:05 . 2009-08-23 01:03 -------- d-----w- c:\program files\NETGEAR
2009-08-23 01:05 . 2007-01-20 21:09 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-08-23 01:04 . 2008-09-17 15:36 -------- d-----w- c:\documents and settings\Moak Petrolium\Application Data\InstallShield
2009-08-05 09:01 . 2004-08-11 22:00 204800 -c--a-w- c:\windows\system32\mswebdvd.dll
2009-07-29 13:46 . 2009-01-13 18:26 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-07-29 13:46 . 2009-01-13 18:26 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-07-29 13:46 . 2009-01-13 18:26 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-07-25 10:23 . 2009-01-08 19:27 411368 ----a-w- c:\windows\system32\deploytk.dll
.((((((((((((((((((((((((((((( SnapShot@2009-10-16_03.25.58 )))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200][HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-09-02 16:58 1107200 ----a-w- c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200][HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200][HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ScanSoft PDF Professional 4-reminder"="c:\program files\ScanSoft\PDF Professional 4.0\Ereg\Ereg.exe" [2006-11-16 35368]
"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-11-29 583048]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2006-07-07 576320]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2006-07-07 600896]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-09-29 2023704]
"EPSON PictureMate"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S4I2P1.EXE" [2003-09-19 99840]c:\documents and settings\All Users\Start Menu\Programs\Startup\
NETGEAR WPN111 Smart Wizard.lnk - c:\program files\NETGEAR\WPN111\wpn111.exe [2009-8-22 884838][HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-07-29 13:46 11952 ----a-w- c:\windows\system32\avgrsstx.dll[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup=c:\windows\pss\Kodak EasyShare software.lnkCommon Startup[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk
backup=c:\windows\pss\QuickBooks Update Agent.lnkCommon Startup[HKLM\~\startupfolder\C:^Documents and Settings^Moak Petrolium^Start Menu^Programs^Startup^AOL Desktop.lnk]
path=c:\documents and settings\Moak Petrolium\Start Menu\Programs\Startup\AOL Desktop.lnk
backup=c:\windows\pss\AOL Desktop.lnkStartup[HKLM\~\startupfolder\C:^Documents and Settings^Moak Petrolium^Start Menu^Programs^Startup^Event Reminder.lnk]
path=c:\documents and settings\Moak Petrolium\Start Menu\Programs\Startup\Event Reminder.lnk
backup=c:\windows\pss\Event Reminder.lnkStartup[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"WDefend"=2 (0x2)
"RoxLiveShare9"=2 (0x2)
"QuickBooksDB17"=2 (0x2)
"QuickBooksDB"=2 (0x2)
"QBFCService"=3 (0x3)
"QBCFMonitorService"=2 (0x2)
"ose"=3 (0x3)
"odserv"=3 (0x3)
"Microsoft Office Groove Audit Service"=3 (0x3)
"MDM"=2 (0x2)
"LiveUpdate Notice Service"=2 (0x2)
"LiveUpdate Notice Ex"=2 (0x2)
"KodakCCS"=3 (0x3)
"JavaQuickStarterService"=2 (0x2)
"idsvc"=3 (0x3)
"IDriverT"=3 (0x3)
"Iap"=2 (0x2)
"hpdj"=2 (0x2)
"gusvc"=3 (0x3)
"GoogleDesktopManager"=3 (0x3)
"CLTNetCnService"=2 (0x2)
"AOL ACS"=2 (0x2)[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Intuit\\QuickBooks 2006\\QBDBMgrN.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"c:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe"=
"c:\\Program Files\\Intuit\\QuickBooks 2006\\QBW32PremierGeneric.exe"=
"c:\\Program Files\\Common Files\\Intuit\\QuickBooks\\QBServerUtilityMgr.exe"=
"c:\\Program Files\\Outlook Express\\msimn.exe"=
"c:\\Program Files\\Common Files\\AOL\\1159364574\\EE\\aolsoftware.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\3.0\\aoltpsd3.exe"=
"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"c:\\Program Files\\Common Files\\AOL\\1159364574\\EE\\AOLDesktop.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgam.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"c:\\WINDOWS\\system32\\dxdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"443:TCP"= 443:TCP:HTTPS
"21:TCP"= 21:TCP:FTPR0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [1/13/2009 1:26 PM 12552]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [1/13/2009 1:26 PM 335240]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [1/13/2009 1:26 PM 108552]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [1/13/2009 1:26 PM 297752]
S3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;c:\windows\system32\DNINDIS5.sys [8/22/2009 8:05 PM 17149]
S4 QuickBooksDB17;QuickBooksDB17;c:\progra~1\Intuit\QUICKB~1\QBDBMgrN.exe -hvQuickBooksDB17 --> c:\progra~1\Intuit\QUICKB~1\QBDBMgrN.exe -hvQuickBooksDB17 [?][HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder2009-10-17 c:\windows\Tasks\User_Feed_Synchronization-{038D821F-E787-43D8-99C0-7FD89C3500CC}.job
- c:\windows\system32\msfeedssync.exe [2007-08-14 09:31]
.
.
------- Supplementary Scan -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://aol.com/
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Open with ScanSoft PDF Converter 4.1 - c:\program files\ScanSoft\PDF Professional 4.0\cnvres_eng.dll /100
Trusted Zone: aol.com
Trusted Zone: pogo.com\www
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {3107C2A8-9F0B-4404-A58B-21BD85268FBC} - hxxp://www.pogo.com/cdl/launcher/PogoWebLauncherInstaller.CAB
.**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-17 00:59
Windows 5.1.2600 Service Pack 3 NTFSscanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------[HKEY_USERS\S-1-5-21-255879815-3811564576-2564377081-1005\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------- - - - - - - > 'explorer.exe'(5436)
c:\windows\system32\WININET.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCR80.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2009-10-17 1:02
ComboFix-quarantined-files.txt 2009-10-17 06:01
ComboFix2.txt 2009-10-17 01:03
ComboFix3.txt 2009-10-16 03:32Pre-Run: 53,290,041,344 bytes free
Post-Run: 53,295,775,744 bytes free220 --- E O F --- 2009-10-16 08:01
bamajim
10376 Posts
677
0
Posted October 13th, 2009 10:00
1. Go HERE and download File Lister.
Copy and paste the contents of that log in your reply.