‎HiJack This Log | DELL Technologies

Start a discussion

UNSOLVED

klo8904

updated

19 years ago

K

klo8904

19 Posts

0

1827

November 23rd, 2007 15:00

HiJack This Log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:20:14 AM, on 11/23/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\Program Files\Dell\QuickSet\bak\bak\quickset.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\Comcast\COMCAS~1\data\Xtras\bak\mssysmgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.comcast.net/toolbar2.0/search/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.comcast.net/toolbar2.0/search/
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: IE - {0CB66BA8-5E1F-4963-93D1-E1D6B78FE9A2} - C:\Program Files\WinBudget\bin\matrix.dll
O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll
O2 - BHO: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~1\COMCAS~1.DLL
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~1\COMCAS~1.DLL
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\bak\bak\quickset.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\Comcast\COMCAS~1\data\Xtras\bak\mssysmgr.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O15 - Trusted Zone: *.doginhispen.com
O15 - Trusted Zone: *.whataboutadog.com
O15 - Trusted Zone: *.whataboutarabit.com
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.costcophotocenter.com/CostcoActivia.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab
O16 - DPF: {4CCA4E80-9259-11D9-AC6E-444553544200} (FixController Control) - http://h30155.www3.hp.com/ediags/dd/install/HPInstallMgr_v01_6.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1195401682015
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://atv.disney.go.com/global/download/otoy/OTOYAX29b.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx
O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://a.download.toontown.com/sv1.0.30.16/ttinst.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: hpdj - HP - C:\DOCUME~1\kerry\LOCALS~1\Temp\hpdj.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
O24 - Desktop Component 0: (no name) - http://www.be-bratz.com/images/homepage/blobs_left.jpg

--
End of file - 6825 bytes

B
bamajim
1 Rookie
•
10376 Posts
319
0
Posted November 24th, 2007 00:00

klo8904

Please download Combofix and save to your desktop:

Note: It is important that it is saved directly to your desktop
Close any open browsers.
Double click on combofix.exe and follow the prompts.
When it's finished it will produce a log.
Post the contents of the C:\ComboFix.txt into your next reply.
Note: Do not mouseclick combofix's window whilst it's running.
That may cause the program to freeze/hang.

Microsoft MVP Windows-Security

CastleCops Instructor

"The world is what you make of it"
K
klo8904
19 Posts
319
0
Posted November 24th, 2007 12:00

****I had to delete the "P" from the first few files because it spelt c r a p and it wasnt

allowing me to submit this to you***

ComboFix 07-11-19.3 - kerry 2007-11-24 7:07:16.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.258 [GMT -6:00]
Running from: C:\Documents and Settings\kerry\Desktop\ComboFix.exe
* Created a new restore point
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\WinBudget
C:\Program Files\WinBudget\bin\cra.1192274295.old
C:\Program Files\WinBudget\bin\cra.1192471128.old
C:\Program Files\WinBudget\bin\cra.1193185020.old
C:\Program Files\WinBudget\bin\cra.1193833314.old
C:\Program Files\WinBudget\bin\cra.1194479785.old
C:\Program Files\WinBudget\bin\matrix.dat
C:\Program Files\WinBudget\bin\matrix.dll
C:\Program Files\WinBudget\bin\matrix.dll.1192471128.old
C:\Program Files\WinBudget\bin\matrix.dll.1193185018.old
C:\Program Files\WinBudget\bin\matrix.dll.1193833314.old
C:\Program Files\WinBudget\bin\matrix.dll.1194479785.old

.
(((((((((((((((((((((((((   Files Created from 2007-10-24 to 2007-11-24 )))))))))))))))))))))))))))))))
.

2007-11-23 11:19 d-------- C:\Program Files\Trend Micro
2007-11-22 19:01 6,058,496 --------- C:\WINDOWS\system32\dllcache\ieframe.dll
2007-11-22 19:01 2,455,488 --------- C:\WINDOWS\system32\dllcache\ieapfltr.dat
2007-11-22 19:01 991,232 --------- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2007-11-22 19:01 459,264 --------- C:\WINDOWS\system32\dllcache\msfeeds.dll
2007-11-22 19:01 383,488 --------- C:\WINDOWS\system32\dllcache\ieapfltr.dll
2007-11-22 19:01 267,776 --------- C:\WINDOWS\system32\dllcache\iertutil.dll
2007-11-22 19:01 63,488 --------- C:\WINDOWS\system32\dllcache\icardie.dll
2007-11-22 19:01 52,224 --------- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2007-11-22 19:01 13,824 --------- C:\WINDOWS\system32\dllcache\ieudinit.exe
2007-11-22 16:15 d-------- C:\Program Files\RegistryFix
2007-11-18 10:37 118 --a------ C:\WINDOWS\system32\MRT.INI
2007-11-18 10:35 d-------- C:\Program Files\MSXML 4.0
2007-11-18 10:35 129,400 --a------ C:\WINDOWS\system32\TZLog.log
2007-11-18 10:30 128,896 --------- C:\WINDOWS\system32\dllcache\fltmgr.sys
2007-11-18 10:30 23,040 --------- C:\WINDOWS\system32\dllcache\fltmc.exe
2007-11-18 10:30 16,896 --------- C:\WINDOWS\system32\dllcache\fltlib.dll
2007-11-18 10:18 582,656 --------- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2007-11-18 10:01 25,944 --a------ C:\WINDOWS\system32\wuapi.dll.mui
2007-10-31 13:03 245,408 --a------ C:\WINDOWS\system32\unicows.dll

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-24 13:02 --------- d-----w C:\Documents and Settings\kerry\Application Data\ComcastToolbar
2007-11-23 02:02 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2007-11-18 18:54 --------- d-----w C:\Program Files\iTunes
2007-11-18 16:37 --------- d-----w C:\Program Files\Apoint
2007-11-17 14:09 --------- d-----w C:\Program Files\NetJet
2007-10-20 12:49 39,504 ----a-w C:\Documents and Settings\kerry\Application Data\GDIPFONTCACHEV1.DAT
2007-10-12 17:36 --------- d-----w C:\Program Files\Disney
2007-10-03 17:49 --------- d-----w C:\Program Files\QuickTime
2007-10-03 17:49 --------- d-----w C:\Program Files\Dell Support
2007-10-02 01:32 --------- d-----w C:\Documents and Settings\kerry\Application Data\Comcast
2007-09-29 12:41 --------- d-----w C:\Program Files\Microsoft ActiveSync
2007-09-26 23:34 --------- d-----w C:\Program Files\ComcastToolbar
.

(((((((((((((((((((((((((((((((((((((((((((((   AWF   ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
----a-w               288 2007-09-24 17:49:28 C:\Documents and Settings\kerry\Application Data\Gtek\GTUpdate\AUpdate\bak\AUAgent.exc

----a-w           155,648 2004-09-13 21:33:20 C:\Program Files\Apoint\bak\Apoint.exe

----a-w           344,064 2004-12-04 02:00:00 C:\Program Files\ATI Technologies\ATI Control Panel\bak\atiptaxx.exe

----a-w           192,512 2005-05-09 23:16:15 C:\Program Files\Comcast\Comcast PhotoShow 4\data\Xtras\bak\mssysmgr.exe
----a-w            28,176 2007-10-03 17:47:13 C:\Program Files\Comcast\Comcast PhotoShow 4\data\Xtras\mssysmgr.exe

----a-w            81,920 2004-07-27 21:50:18 C:\Program Files\Common Files\InstallShield\UpdateService\bak\issch.exe

----a-w           221,184 2004-07-27 21:50:42 C:\Program Files\Common Files\InstallShield\UpdateService\bak\ISUSPM.exe

----a-w            53,248 2005-02-23 21:19:56 C:\Program Files\CyberLink\PowerDVD\bak\DVDLauncher.exe

----a-w           290,816 2004-04-12 01:15:14 C:\Program Files\Dell\Media Experience\bak\PCMService.exe

----a-w            28,176 2007-10-03 17:47:13 C:\Program Files\Dell\QuickSet\bak\quickset.exe
----a-w            24,080 2007-08-17 01:01:38 C:\Program Files\Dell\QuickSet\quickset.exe

----a-w           606,208 2005-03-04 16:26:08 C:\Program Files\Dell\QuickSet\bak\bak\quickset.exe
----a-w            24,080 2007-08-17 01:01:38 C:\Program Files\Dell\QuickSet\quickset.exe

----a-w           606,208 2005-03-04 16:26:08 C:\Program Files\Dell\QuickSet\bak\bak\quickset.exe
----a-w            28,176 2007-10-03 17:47:13 C:\Program Files\Dell\QuickSet\bak\quickset.exe

----a-w           306,688 2004-07-19 12:51:24 C:\Program Files\Dell Support\bak\DSAgnt.exe

----a-w            49,152 2003-06-25 16:24:48 C:\Program Files\Hewlett-Packard\HP Software Update\bak\HPWuSchd.exe

----a-w           233,472 2003-10-24 00:51:18 C:\Program Files\HP\hpcoretech\bak\hpcmpmgr.exe

----a-w               324 2007-11-17 17:50:20 C:\Program Files\HP\hpcoretech\bak\data\EvntData-1930643950.xml

----a-w           385,024 2004-10-30 19:59:54 C:\Program Files\Intel\Wireless\Bin\bak\ifrmewrk.exe

----a-w           257,088 2007-06-01 21:51:26 C:\Program Files\iTunes\bak\iTunesHelper.exe
----a-w           257,088 2007-06-01 22:51:26 C:\Program Files\iTunes\iTunesHelper.exe

----a-w            32,881 2003-11-19 22:48:14 C:\Program Files\Java\j2re1.4.2_03\bin\bak\jusched.exe

----a-w         1,667,584 2004-08-04 06:06:34 C:\Program Files\Messenger\bak\msmsgs.exe

----a-w            53,248 2004-09-14 13:50:48 C:\Program Files\MUSICMATCH\Musicmatch Jukebox\bak\mmtask.exe

----a-w           131,072 2004-09-14 13:50:48 C:\Program Files\MUSICMATCH\Musicmatch Jukebox\bak\mm_tray.exe

----a-w           282,624 2007-04-27 14:41:54 C:\Program Files\QuickTime\bak\qttask.exe

----a-w                60 2007-09-14 20:42:59 C:\Program Files\Real\RealPlayer\bak\channels.xml
----a-w             1,261 2007-08-17 00:23:39 C:\Program Files\Real\RealPlayer\channels.xml

----a-w            26,112 2005-06-21 02:32:44 C:\Program Files\Real\RealPlayer\bak\RealPlay.exe

----a-w           127,035 2004-12-06 06:05:00 C:\WINDOWS\system32\dla\bak\tfswctrl.exe

----a-w           188,416 2006-01-13 07:14:58 C:\WINDOWS\system32\spool\drivers\w32x86\3\bak\hpztsb09.exe

.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PhotoShow Deluxe Media Manager"="C:\PROGRA~1\Comcast\COMCAS~1\data\Xtras\bak\mssysmgr.exe" [2005-05-09 17:16]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 04:00]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\bak\bak\quickset.exe" [2005-03-04 10:26]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-06-01 16:51]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2005-06-20 20:23:58]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 00:01:04]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
C:\Program Files\Intel\Wireless\Bin\LgNotify.dll 2004-09-07 15:08 110592 C:\Program Files\Intel\Wireless\Bin\LgNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QBReminderFlash]
2004-11-11 09:26 26112 --a------ C:\Program Files\Intuit\QuickBooks 2005\Atom\QBReminder.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1cc71e06-5eed-11dc-8512-0012f09828b8}]
\Shell\AutoRun\command - E:\autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2918a028-6251-11dc-8521-0012f09828b8}]
\Shell\AutoRun\command - E:\autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ef835d06-5e65-11dc-850e-0012f09828b8}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL http://www.mgae.com/keylauncher/?code=3654335140462756

.
Contents of the 'Scheduled Tasks' folder
"2007-10-20 21:23:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-24 07:11:13
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-24 7:13:28 - machine was rebooted
.
--- E O F ---
B
bamajim
1 Rookie
•
10376 Posts
319
0
Posted November 25th, 2007 14:00

klo8904

That's O.K. It's the forum smut filter

1. Open NotePad (not wordpad). Copy and paste the following into Notepad

Folder::
C:\Documents and Settings\kerry\Application Data\Gtek\GTUpdate\AUpdate\bak
C:\Program Files\Apoint\bak
C:\Program Files\ATI Technologies\ATI Control Panel\bak
C:\Program Files\Comcast\Comcast PhotoShow 4\data\Xtras\bak
C:\Program Files\Common Files\InstallShield\UpdateService\bak
C:\Program Files\Common Files\InstallShield\UpdateService\bak
C:\Program Files\CyberLink\PowerDVD\bak
C:\Program Files\Dell\Media Experience\bak
C:\Program Files\Dell\QuickSet\bak
C:\Program Files\Dell\QuickSet\bak\bak
C:\Program Files\Dell\QuickSet\bak\bak
C:\Program Files\Dell\QuickSet\bak
C:\Program Files\Dell Support\bak
C:\Program Files\Hewlett-Packard\HP Software Update\bak
C:\Program Files\HP\hpcoretech\bak
C:\Program Files\HP\hpcoretech\bak
C:\Program Files\Intel\Wireless\Bin\bak
C:\Program Files\iTunes\bak
C:\Program Files\Java\j2re1.4.2_03\bin\bak
C:\Program Files\Messenger\bak
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\bak
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\bak
C:\Program Files\QuickTime\bak
C:\Program Files\Real\RealPlayer\bak
C:\Program Files\Real\RealPlayer\bak
C:\WINDOWS\system32\dla\bak\tfswctrl.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\bak

Save the File as CFScript ->> Save it to your Desktop

Using the Image as a reference, drag CFScript into ComboFix.exe

You will be prompted to run Combofix again, Do so
Following the same rules as indicated in my first post
Then post the contents of the C:\ComboFix.txt log in your reply

Microsoft MVP Windows-Security

CastleCops Instructor

"The world is what you make of it"
K
klo8904
19 Posts
319
0
Posted November 25th, 2007 15:00
ComboFix 07-11-19.3 - kerry 2007-11-25 11:10:28.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.242 [GMT -6:00]
Running from: C:\Documents and Settings\kerry\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\kerry\Desktop\CFScript.txt
* Created a new restore point
.

(((((((((((((((((((((((((   Files Created from 2007-10-25 to 2007-11-25 )))))))))))))))))))))))))))))))
.

2007-11-23 11:19 d-------- C:\Program Files\Trend Micro
2007-11-22 19:01 6,058,496 --------- C:\WINDOWS\system32\dllcache\ieframe.dll
2007-11-22 19:01 2,455,488 --------- C:\WINDOWS\system32\dllcache\ieapfltr.dat
2007-11-22 19:01 991,232 --------- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2007-11-22 19:01 459,264 --------- C:\WINDOWS\system32\dllcache\msfeeds.dll
2007-11-22 19:01 383,488 --------- C:\WINDOWS\system32\dllcache\ieapfltr.dll
2007-11-22 19:01 267,776 --------- C:\WINDOWS\system32\dllcache\iertutil.dll
2007-11-22 19:01 63,488 --------- C:\WINDOWS\system32\dllcache\icardie.dll
2007-11-22 19:01 52,224 --------- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2007-11-22 19:01 13,824 --------- C:\WINDOWS\system32\dllcache\ieudinit.exe
2007-11-22 16:15 d-------- C:\Program Files\RegistryFix
2007-11-18 10:37 118 --a------ C:\WINDOWS\system32\MRT.INI
2007-11-18 10:35 d-------- C:\Program Files\MSXML 4.0
2007-11-18 10:35 129,400 --a------ C:\WINDOWS\system32\TZLog.log
2007-11-18 10:30 128,896 --------- C:\WINDOWS\system32\dllcache\fltmgr.sys
2007-11-18 10:30 23,040 --------- C:\WINDOWS\system32\dllcache\fltmc.exe
2007-11-18 10:30 16,896 --------- C:\WINDOWS\system32\dllcache\fltlib.dll
2007-11-18 10:18 582,656 --------- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2007-11-18 10:01 25,944 --a------ C:\WINDOWS\system32\wuapi.dll.mui
2007-10-31 13:03 245,408 --a------ C:\WINDOWS\system32\unicows.dll

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-25 16:38 --------- d-----w C:\Documents and Settings\kerry\Application Data\ComcastToolbar
2007-11-23 02:02 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2007-11-18 18:54 --------- d-----w C:\Program Files\iTunes
2007-11-18 16:37 --------- d-----w C:\Program Files\Apoint
2007-11-17 14:09 --------- d-----w C:\Program Files\NetJet
2007-10-26 03:34 8,460,288 ----a-w C:\WINDOWS\system32\dllcache\shell32.dll
2007-10-20 12:49 39,504 ----a-w C:\Documents and Settings\kerry\Application Data\GDIPFONTCACHEV1.DAT
2007-10-12 17:36 --------- d-----w C:\Program Files\Disney
2007-10-03 17:49 --------- d-----w C:\Program Files\QuickTime
2007-10-03 17:49 --------- d-----w C:\Program Files\Dell Support
2007-10-02 01:32 --------- d-----w C:\Documents and Settings\kerry\Application Data\Comcast
2007-09-29 12:41 --------- d-----w C:\Program Files\Microsoft ActiveSync
2007-09-26 23:34 --------- d-----w C:\Program Files\ComcastToolbar
.

(((((((((((((((((((((((((((((((((((((((((((((   AWF   ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
----a-w               288 2007-09-24 17:49:28 C:\Documents and Settings\kerry\Application Data\Gtek\GTUpdate\AUpdate\bak\AUAgent.exc

----a-w           155,648 2004-09-13 21:33:20 C:\Program Files\Apoint\bak\Apoint.exe

----a-w           344,064 2004-12-04 02:00:00 C:\Program Files\ATI Technologies\ATI Control Panel\bak\atiptaxx.exe

----a-w           192,512 2005-05-09 23:16:15 C:\Program Files\Comcast\Comcast PhotoShow 4\data\Xtras\bak\mssysmgr.exe
----a-w            28,176 2007-10-03 17:47:13 C:\Program Files\Comcast\Comcast PhotoShow 4\data\Xtras\mssysmgr.exe

----a-w            81,920 2004-07-27 21:50:18 C:\Program Files\Common Files\InstallShield\UpdateService\bak\issch.exe

----a-w           221,184 2004-07-27 21:50:42 C:\Program Files\Common Files\InstallShield\UpdateService\bak\ISUSPM.exe

----a-w            53,248 2005-02-23 21:19:56 C:\Program Files\CyberLink\PowerDVD\bak\DVDLauncher.exe

----a-w           290,816 2004-04-12 01:15:14 C:\Program Files\Dell\Media Experience\bak\PCMService.exe

----a-w            28,176 2007-10-03 17:47:13 C:\Program Files\Dell\QuickSet\bak\quickset.exe
----a-w            24,080 2007-08-17 01:01:38 C:\Program Files\Dell\QuickSet\quickset.exe

----a-w           606,208 2005-03-04 16:26:08 C:\Program Files\Dell\QuickSet\bak\bak\quickset.exe
----a-w            24,080 2007-08-17 01:01:38 C:\Program Files\Dell\QuickSet\quickset.exe

----a-w           606,208 2005-03-04 16:26:08 C:\Program Files\Dell\QuickSet\bak\bak\quickset.exe
----a-w            28,176 2007-10-03 17:47:13 C:\Program Files\Dell\QuickSet\bak\quickset.exe

----a-w           306,688 2004-07-19 12:51:24 C:\Program Files\Dell Support\bak\DSAgnt.exe

----a-w            49,152 2003-06-25 16:24:48 C:\Program Files\Hewlett-Packard\HP Software Update\bak\HPWuSchd.exe

----a-w           233,472 2003-10-24 00:51:18 C:\Program Files\HP\hpcoretech\bak\hpcmpmgr.exe

----a-w               324 2007-11-17 17:50:20 C:\Program Files\HP\hpcoretech\bak\data\EvntData-1930643950.xml

----a-w           385,024 2004-10-30 19:59:54 C:\Program Files\Intel\Wireless\Bin\bak\ifrmewrk.exe

----a-w           257,088 2007-06-01 21:51:26 C:\Program Files\iTunes\bak\iTunesHelper.exe
----a-w           257,088 2007-06-01 22:51:26 C:\Program Files\iTunes\iTunesHelper.exe

----a-w            32,881 2003-11-19 22:48:14 C:\Program Files\Java\j2re1.4.2_03\bin\bak\jusched.exe

----a-w         1,667,584 2004-08-04 06:06:34 C:\Program Files\Messenger\bak\msmsgs.exe

----a-w            53,248 2004-09-14 13:50:48 C:\Program Files\MUSICMATCH\Musicmatch Jukebox\bak\mmtask.exe

----a-w           131,072 2004-09-14 13:50:48 C:\Program Files\MUSICMATCH\Musicmatch Jukebox\bak\mm_tray.exe

----a-w           282,624 2007-04-27 14:41:54 C:\Program Files\QuickTime\bak\qttask.exe

----a-w                60 2007-09-14 20:42:59 C:\Program Files\Real\RealPlayer\bak\channels.xml
----a-w             1,261 2007-08-17 00:23:39 C:\Program Files\Real\RealPlayer\channels.xml

----a-w            26,112 2005-06-21 02:32:44 C:\Program Files\Real\RealPlayer\bak\RealPlay.exe

----a-w           127,035 2004-12-06 06:05:00 C:\WINDOWS\system32\dla\bak\tfswctrl.exe

----a-w           188,416 2006-01-13 07:14:58 C:\WINDOWS\system32\spool\drivers\w32x86\3\bak\hpztsb09.exe

.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PhotoShow Deluxe Media Manager"="C:\PROGRA~1\Comcast\COMCAS~1\data\Xtras\bak\mssysmgr.exe" [2005-05-09 17:16]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 04:00]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\bak\bak\quickset.exe" [2005-03-04 10:26]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-06-01 16:51]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2005-06-20 20:23:58]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 00:01:04]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
C:\Program Files\Intel\Wireless\Bin\LgNotify.dll 2004-09-07 15:08 110592 C:\Program Files\Intel\Wireless\Bin\LgNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QBReminderFlash]
2004-11-11 09:26 26112 --a------ C:\Program Files\Intuit\QuickBooks 2005\Atom\QBReminder.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1cc71e06-5eed-11dc-8512-0012f09828b8}]
\Shell\AutoRun\command - E:\autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2918a028-6251-11dc-8521-0012f09828b8}]
\Shell\AutoRun\command - E:\autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ef835d06-5e65-11dc-850e-0012f09828b8}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL http://www.mgae.com/keylauncher/?code=3654335140462756

.
Contents of the 'Scheduled Tasks' folder
"2007-10-20 21:23:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-25 11:11:02
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-25 11:11:32
C:\ComboFix2.txt ... 2007-11-25 11:08
C:\ComboFix3.txt ... 2007-11-24 07:13
.
--- E O F ---
B
bamajim
1 Rookie
•
10376 Posts
319
0
Posted November 25th, 2007 16:00

klo8904

It's a difficult infection to remove sometimes.

Rerun FindAWF ->> Select option 2

When the second window opens, copy and paste this below the line, and follow the prompts

"C:\Program Files\Apoint\bak\Apoint.exe"
"C:\Program Files\Dell Support\bak\DSAgnt.exe"
"C:\Program Files\iTunes\bak\iTunesHelper.exe"
"C:\Program Files\Messenger\bak\msmsgs.exe"
"C:\Program Files\QuickTime\bak\qttask.exe"
"C:\Program Files\ATI Technologies\ATI Control Panel\bak\atiptaxx.exe"
"C:\Program Files\CyberLink\PowerDVD\bak\DVDLauncher.exe"
"C:\Program Files\Dell\Media Experience\bak\PCMService.exe"
"C:\Program Files\Dell\QuickSet\bak\quickset.exe"
"C:\Program Files\Dell\QuickSet\bak\bak\quickset.exe"
"C:\Program Files\Dell\QuickSet\bak\quickset.exe"
"C:\Program Files\Dell\QuickSet\bak\bak\quickset.exe"
"C:\Program Files\Hewlett-Packard\HP Software Update\bak\HPWuSchd.exe"
"C:\Program Files\HP\hpcoretech\bak\hpcmpmgr.exe"
"C:\Program Files\HP\hpcoretech\bak\data\EvntData-1930643950.xml"
"C:\Program Files\MUSICMATCH\Musicmatch Jukebox\bak\mmtask.exe"
"C:\Program Files\MUSICMATCH\Musicmatch Jukebox\bak\mm_tray.exe"
"C:\Program Files\Real\RealPlayer\bak\channels.xml"
"C:\Program Files\Real\RealPlayer\bak\RealPlay.exe"
"C:\WINDOWS\system32\dla\bak\tfswctrl.exe"
"C:\Program Files\Common Files\InstallShield\UpdateService\bak\issch.exe"
"C:\Program Files\Common Files\InstallShield\UpdateService\bak\ISUSPM.exe"
"C:\Program Files\Dell\QuickSet\bak\quickset.exe"
"C:\Program Files\Dell\QuickSet\bak\bak\quickset.exe"
"C:\Program Files\Java\j2re1.4.2_03\bin\bak\jusched.exe"
"C:\Program Files\Comcast\Comcast PhotoShow 4\data\Xtras\bak\mssysmgr.exe"
"C:\Documents and Settings\kerry\ApplicationData\Gtek\GTUpdate\AUpdate\bak\AUAgent.exc"
"C:\WINDOWS\system32\spool\drivers\w32x86\3\bak\hpztsb09.exe"

When it's done it will produce a second log. Copy and paste that log in your reply

Microsoft MVP Windows-Security

CastleCops Instructor

"The world is what you make of it"
B
bamajim
1 Rookie
•
10376 Posts
319
0
Posted November 25th, 2007 16:00

klo8904

Click HERE to download FindAWF.exe and save it to your desktop.

Double-click on the FindAWF.exe file to run it.
It will open a command prompt and ask you to Press any key to continue.
Press a key and the FindAWF tool will begin scanning your computer for the infected AWF files and the backups the trojan created.
It may take a few minutes to complete so be patient.
When the scan is finished, a text file in notepad called AWF.txt will automatically be saved to your desktop or whatever location you ran the file from.
Return to this thread and copy and paste the contents of the AWF.txt file in your next reply.

Microsoft MVP Windows-Security

CastleCops Instructor

"The world is what you make of it"
K
klo8904
19 Posts
319
0
Posted November 25th, 2007 16:00
Hi again....After press any key to cont it asks you to press1 for this and 2 for that etc...this is the log from one. thanks

Find AWF report by noahdfear ©2006
               Version 1.40

The current date is: Sun 11/25/2007
The current time is: 12:18:03.62

bak folders found
~~~~~~~~~~~

Directory of C:\PROGRA~1\APOINT\BAK

09/13/2004 03:33 PM           155,648 Apoint.exe
               1 File(s)        155,648 bytes

Directory of C:\PROGRA~1\DELLSU~1\BAK

07/19/2004 06:51 AM           306,688 DSAgnt.exe
               1 File(s)        306,688 bytes

Directory of C:\PROGRA~1\ITUNES\BAK

06/01/2007 03:51 PM           257,088 iTunesHelper.exe
               1 File(s)        257,088 bytes

Directory of C:\PROGRA~1\MESSEN~1\BAK

08/04/2004 12:06 AM         1,667,584 msmsgs.exe
               1 File(s)      1,667,584 bytes

Directory of C:\PROGRA~1\QUICKT~1\BAK

04/27/2007 08:41 AM           282,624 qttask.exe
               1 File(s)        282,624 bytes

Directory of C:\PROGRA~1\ATITEC~1\ATICON~1\BAK

12/03/2004 08:00 PM           344,064 atiptaxx.exe
               1 File(s)        344,064 bytes

Directory of C:\PROGRA~1\CYBERL~1\POWERDVD\BAK

02/23/2005 03:19 PM            53,248 DVDLauncher.exe
               1 File(s)         53,248 bytes

Directory of C:\PROGRA~1\DELL\MEDIAE~1\BAK

04/11/2004 07:15 PM           290,816 PCMService.exe
               1 File(s)        290,816 bytes

Directory of C:\PROGRA~1\DELL\QUICKSET\BAK

10/03/2007 11:47 AM            28,176 quickset.exe
               1 File(s)         28,176 bytes

Directory of C:\PROGRA~1\HEWLET~1\HPSOFT~1\BAK

06/25/2003 10:24 AM            49,152 HPWuSchd.exe
               1 File(s)         49,152 bytes

Directory of C:\PROGRA~1\HP\HPCORE~1\BAK

10/23/2003 06:51 PM           233,472 hpcmpmgr.exe
               1 File(s)        233,472 bytes

Directory of C:\PROGRA~1\MUSICM~1\MUSICM~3\BAK

09/14/2004 07:50 AM           131,072 mm_tray.exe
09/14/2004 07:50 AM            53,248 mmtask.exe
               2 File(s)        184,320 bytes

Directory of C:\PROGRA~1\REAL\REALPL~1\BAK

09/14/2007 02:42 PM                60 channels.xml
06/20/2005 08:32 PM            26,112 RealPlay.exe
               2 File(s)         26,172 bytes

Directory of C:\WINDOWS\SYSTEM32\DLA\BAK

12/06/2004 12:05 AM           127,035 tfswctrl.exe
               1 File(s)        127,035 bytes

Directory of C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\BAK

07/27/2004 03:50 PM            81,920 issch.exe
07/27/2004 03:50 PM           221,184 ISUSPM.exe
               2 File(s)        303,104 bytes

Directory of C:\PROGRA~1\DELL\QUICKSET\BAK\BAK

03/04/2005 10:26 AM           606,208 quickset.exe
               1 File(s)        606,208 bytes

Directory of C:\PROGRA~1\INTEL\WIRELESS\BIN\BAK

10/30/2004 01:59 PM           385,024 ifrmewrk.exe
               1 File(s)        385,024 bytes

Directory of C:\PROGRA~1\JAVA\J2RE14~1.2_0\BIN\BAK

11/19/2003 04:48 PM            32,881 jusched.exe
               1 File(s)         32,881 bytes

Directory of C:\PROGRA~1\COMCAST\COMCAS~1\DATA\XTRAS\BAK

05/09/2005 05:16 PM           192,512 mssysmgr.exe
               1 File(s)        192,512 bytes

Directory of C:\DOCUME~1\KERRY\APPLIC~1\GTEK\GTUPDATE\AUPDATE\BAK

09/24/2007 11:49 AM               288 AUAgent.exc
               1 File(s)            288 bytes

Directory of C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\BAK

01/13/2006 01:14 AM           188,416 hpztsb09.exe
               1 File(s)        188,416 bytes

Duplicate files of bak directory contents
~~~~~~~~~~~~~~~~~~~~~~~

    176128 Oct 7 2005 "C:\dell\drivers\R113813\Apoint.exe"
    155648 Sep 13 2004 "C:\drivers\mouse\onboard\Apoint.exe"
    155648 Sep 13 2004 "C:\Program Files\Apoint\bak\Apoint.exe"
     24080 Aug 16 2007 "C:\WINDOWS\system32\ReinstallBackups\0011\DriverFiles\Apoint.exe"
    306688 Jul 19 2004 "C:\Program Files\Dell Support\bak\DSAgnt.exe"
    257088 Jun 1 2007 "C:\Program Files\iTunes\iTunesHelper.exe"
    257088 Jun 1 2007 "C:\Program Files\iTunes\bak\iTunesHelper.exe"
    102400 Nov 18 2007 "C:\WINDOWS\Installer\{553E56C3-7AA1-45FE-A2FC-2C43DC27F765}\iTunesIco.exe"
    116288 Jun 1 2007 "C:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 7.2.0.35\iTunesSetupAdmin.exe"
   1667584 Aug 4 2004 "C:\Program Files\Messenger\bak\msmsgs.exe"
    282624 Apr 27 2007 "C:\Program Files\QuickTime\bak\qttask.exe"
    344064 Dec 3 2004 "C:\Program Files\ATI Technologies\ATI Control Panel\bak\atiptaxx.exe"
     53248 Feb 23 2005 "C:\Program Files\CyberLink\PowerDVD\bak\DVDLauncher.exe"
    290816 Apr 11 2004 "C:\Program Files\Dell\Media Experience\bak\PCMService.exe"
     24080 Aug 16 2007 "C:\Program Files\Dell\QuickSet\quickset.exe"
     28176 Oct 3 2007 "C:\Program Files\Dell\QuickSet\bak\quickset.exe"
    606208 Mar 4 2005 "C:\Program Files\Dell\QuickSet\bak\bak\quickset.exe"
     24080 Aug 16 2007 "C:\Program Files\Dell\QuickSet\quickset.exe"
     28176 Oct 3 2007 "C:\Program Files\Dell\QuickSet\bak\quickset.exe"
    606208 Mar 4 2005 "C:\Program Files\Dell\QuickSet\bak\bak\quickset.exe"
     49152 Jun 25 2003 "C:\Program Files\Hewlett-Packard\HP Software Update\bak\HPWuSchd.exe"
    233472 Oct 23 2003 "C:\Program Files\HP\hpcoretech\bak\hpcmpmgr.exe"
       531 Aug 16 2007 "C:\Program Files\HP\hpcoretech\data\EvntData-2016045435.xml"
       324 Nov 17 2007 "C:\Program Files\HP\hpcoretech\bak\data\EvntData-1930643950.xml"
     53248 Sep 14 2004 "C:\Program Files\MUSICMATCH\MUSICMATCH Update\MMJB\mmtask.exe"
     53248 Sep 14 2004 "C:\Program Files\MUSICMATCH\Musicmatch Jukebox\bak\mmtask.exe"
    131072 Sep 14 2004 "C:\Program Files\MUSICMATCH\MUSICMATCH Update\MMJB\mm_tray.exe"
    131072 Sep 14 2004 "C:\Program Files\MUSICMATCH\Musicmatch Jukebox\bak\mm_tray.exe"
      1261 Aug 16 2007 "C:\Program Files\Real\RealPlayer\channels.xml"
        60 Sep 14 2007 "C:\Program Files\Real\RealPlayer\bak\channels.xml"
     26112 Jun 20 2005 "C:\Program Files\Real\RealPlayer\bak\RealPlay.exe"
    127035 Dec 6 2004 "C:\Program Files\Sonic\DLA\install\tfswctrl.exe"
    127035 Dec 6 2004 "C:\WINDOWS\system32\dla\bak\tfswctrl.exe"
     81920 Jul 27 2004 "C:\Program Files\Common Files\InstallShield\UpdateService\bak\issch.exe"
    221184 Jul 27 2004 "C:\Program Files\Common Files\InstallShield\UpdateService\bak\ISUSPM.exe"
     24080 Aug 16 2007 "C:\Program Files\Dell\QuickSet\quickset.exe"
     28176 Oct 3 2007 "C:\Program Files\Dell\QuickSet\bak\quickset.exe"
    606208 Mar 4 2005 "C:\Program Files\Dell\QuickSet\bak\bak\quickset.exe"
    385024 Oct 30 2004 "C:\Program Files\Intel\Wireless\Bin\bak\ifrmewrk.exe"
     32881 Nov 19 2003 "C:\Program Files\Java\j2re1.4.2_03\bin\bak\jusched.exe"
     28176 Oct 3 2007 "C:\Program Files\Comcast\Comcast PhotoShow 4\data\Xtras\mssysmgr.exe"
    192512 May 9 2005 "C:\Program Files\Comcast\Comcast PhotoShow 4\data\Xtras\bak\mssysmgr.exe"
       288 Sep 24 2007 "C:\Documents and Settings\kerry\Application Data\Gtek\GTUpdate\AUpdate\bak\AUAgent.exc"
    188416 Jan 13 2006 "C:\WINDOWS\system32\spool\drivers\w32x86\3\bak\hpztsb09.exe"

end of report
B
bamajim
1 Rookie
•
10376 Posts
236
0
Posted November 25th, 2007 17:00
klo8904

Looks better. Let see a fresh Combofix log

Microsoft MVP Windows-Security

CastleCops Instructor

"The world is what you make of it"
K
klo8904
19 Posts
319
0
Posted November 25th, 2007 17:00

Find AWF report by noahdfear ©2006
               Version 1.40
Option 2 run successfully

The current date is: Sun 11/25/2007
The current time is: 13:04:45.46

bak folders found
~~~~~~~~~~~

Directory of C:\PROGRA~1\APOINT\BAK

09/13/2004 03:33 PM           155,648 Apoint.exe
               1 File(s)        155,648 bytes

Directory of C:\PROGRA~1\DELLSU~1\BAK

07/19/2004 06:51 AM           306,688 DSAgnt.exe
               1 File(s)        306,688 bytes

Directory of C:\PROGRA~1\ITUNES\BAK

06/01/2007 03:51 PM           257,088 iTunesHelper.exe
               1 File(s)        257,088 bytes

Directory of C:\PROGRA~1\MESSEN~1\BAK

08/04/2004 12:06 AM         1,667,584 msmsgs.exe
               1 File(s)      1,667,584 bytes

Directory of C:\PROGRA~1\QUICKT~1\BAK

04/27/2007 08:41 AM           282,624 qttask.exe
               1 File(s)        282,624 bytes

Directory of C:\PROGRA~1\ATITEC~1\ATICON~1\BAK

12/03/2004 08:00 PM           344,064 atiptaxx.exe
               1 File(s)        344,064 bytes

Directory of C:\PROGRA~1\CYBERL~1\POWERDVD\BAK

02/23/2005 03:19 PM            53,248 DVDLauncher.exe
               1 File(s)         53,248 bytes

Directory of C:\PROGRA~1\DELL\MEDIAE~1\BAK

04/11/2004 07:15 PM           290,816 PCMService.exe
               1 File(s)        290,816 bytes

Directory of C:\PROGRA~1\DELL\QUICKSET\BAK

03/04/2005 10:26 AM           606,208 quickset.exe
               1 File(s)        606,208 bytes

Directory of C:\PROGRA~1\HEWLET~1\HPSOFT~1\BAK

06/25/2003 10:24 AM            49,152 HPWuSchd.exe
               1 File(s)         49,152 bytes

Directory of C:\PROGRA~1\HP\HPCORE~1\BAK

10/23/2003 06:51 PM           233,472 hpcmpmgr.exe
               1 File(s)        233,472 bytes

Directory of C:\PROGRA~1\MUSICM~1\MUSICM~3\BAK

09/14/2004 07:50 AM           131,072 mm_tray.exe
09/14/2004 07:50 AM            53,248 mmtask.exe
               2 File(s)        184,320 bytes

Directory of C:\PROGRA~1\REAL\REALPL~1\BAK

09/14/2007 02:42 PM                60 channels.xml
06/20/2005 08:32 PM            26,112 RealPlay.exe
               2 File(s)         26,172 bytes

Directory of C:\WINDOWS\SYSTEM32\DLA\BAK

12/06/2004 12:05 AM           127,035 tfswctrl.exe
               1 File(s)        127,035 bytes

Directory of C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\BAK

07/27/2004 03:50 PM            81,920 issch.exe
07/27/2004 03:50 PM           221,184 ISUSPM.exe
               2 File(s)        303,104 bytes

Directory of C:\PROGRA~1\DELL\QUICKSET\BAK\BAK

03/04/2005 10:26 AM           606,208 quickset.exe
               1 File(s)        606,208 bytes

Directory of C:\PROGRA~1\INTEL\WIRELESS\BIN\BAK

10/30/2004 01:59 PM           385,024 ifrmewrk.exe
               1 File(s)        385,024 bytes

Directory of C:\PROGRA~1\JAVA\J2RE14~1.2_0\BIN\BAK

11/19/2003 04:48 PM            32,881 jusched.exe
               1 File(s)         32,881 bytes

Directory of C:\PROGRA~1\COMCAST\COMCAS~1\DATA\XTRAS\BAK

05/09/2005 05:16 PM           192,512 mssysmgr.exe
               1 File(s)        192,512 bytes

Directory of C:\DOCUME~1\KERRY\APPLIC~1\GTEK\GTUPDATE\AUPDATE\BAK

09/24/2007 11:49 AM               288 AUAgent.exc
               1 File(s)            288 bytes

Directory of C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\BAK

01/13/2006 01:14 AM           188,416 hpztsb09.exe
               1 File(s)        188,416 bytes

Duplicate files of bak directory contents
~~~~~~~~~~~~~~~~~~~~~~~

    155648 Sep 13 2004 "C:\Program Files\Apoint\Apoint.exe"
    176128 Oct 7 2005 "C:\dell\drivers\R113813\Apoint.exe"
    155648 Sep 13 2004 "C:\drivers\mouse\onboard\Apoint.exe"
    155648 Sep 13 2004 "C:\Program Files\Apoint\bak\Apoint.exe"
     24080 Aug 16 2007 "C:\WINDOWS\system32\ReinstallBackups\0011\DriverFiles\Apoint.exe"
    306688 Jul 19 2004 "C:\Program Files\Dell Support\DSAgnt.exe"
    306688 Jul 19 2004 "C:\Program Files\Dell Support\bak\DSAgnt.exe"
    257088 Jun 1 2007 "C:\Program Files\iTunes\iTunesHelper.exe"
    257088 Jun 1 2007 "C:\Program Files\iTunes\bak\iTunesHelper.exe"
    102400 Nov 18 2007 "C:\WINDOWS\Installer\{553E56C3-7AA1-45FE-A2FC-2C43DC27F765}\iTunesIco.exe"
    116288 Jun 1 2007 "C:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 7.2.0.35\iTunesSetupAdmin.exe"
   1667584 Aug 4 2004 "C:\Program Files\Messenger\msmsgs.exe"
   1667584 Aug 4 2004 "C:\Program Files\Messenger\bak\msmsgs.exe"
    282624 Apr 27 2007 "C:\Program Files\QuickTime\qttask.exe"
    282624 Apr 27 2007 "C:\Program Files\QuickTime\bak\qttask.exe"
    344064 Dec 3 2004 "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
    344064 Dec 3 2004 "C:\Program Files\ATI Technologies\ATI Control Panel\bak\atiptaxx.exe"
     53248 Feb 23 2005 "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
     53248 Feb 23 2005 "C:\Program Files\CyberLink\PowerDVD\bak\DVDLauncher.exe"
    290816 Apr 11 2004 "C:\Program Files\Dell\Media Experience\PCMService.exe"
    290816 Apr 11 2004 "C:\Program Files\Dell\Media Experience\bak\PCMService.exe"
    606208 Mar 4 2005 "C:\Program Files\Dell\QuickSet\quickset.exe"
    606208 Mar 4 2005 "C:\Program Files\Dell\QuickSet\bak\quickset.exe"
    606208 Mar 4 2005 "C:\Program Files\Dell\QuickSet\bak\bak\quickset.exe"
    606208 Mar 4 2005 "C:\Program Files\Dell\QuickSet\quickset.exe"
    606208 Mar 4 2005 "C:\Program Files\Dell\QuickSet\bak\quickset.exe"
    606208 Mar 4 2005 "C:\Program Files\Dell\QuickSet\bak\bak\quickset.exe"
     49152 Jun 25 2003 "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
     49152 Jun 25 2003 "C:\Program Files\Hewlett-Packard\HP Software Update\bak\HPWuSchd.exe"
    233472 Oct 23 2003 "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
    233472 Oct 23 2003 "C:\Program Files\HP\hpcoretech\bak\hpcmpmgr.exe"
       531 Aug 16 2007 "C:\Program Files\HP\hpcoretech\data\EvntData-2016045435.xml"
       324 Nov 17 2007 "C:\Program Files\HP\hpcoretech\bak\data\EvntData-1930643950.xml"
     53248 Sep 14 2004 "C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mmtask.exe"
     53248 Sep 14 2004 "C:\Program Files\MUSICMATCH\MUSICMATCH Update\MMJB\mmtask.exe"
     53248 Sep 14 2004 "C:\Program Files\MUSICMATCH\Musicmatch Jukebox\bak\mmtask.exe"
    131072 Sep 14 2004 "C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe"
    131072 Sep 14 2004 "C:\Program Files\MUSICMATCH\MUSICMATCH Update\MMJB\mm_tray.exe"
    131072 Sep 14 2004 "C:\Program Files\MUSICMATCH\Musicmatch Jukebox\bak\mm_tray.exe"
        60 Sep 14 2007 "C:\Program Files\Real\RealPlayer\channels.xml"
        60 Sep 14 2007 "C:\Program Files\Real\RealPlayer\bak\channels.xml"
     26112 Jun 20 2005 "C:\Program Files\Real\RealPlayer\RealPlay.exe"
     26112 Jun 20 2005 "C:\Program Files\Real\RealPlayer\bak\RealPlay.exe"
    127035 Dec 6 2004 "C:\WINDOWS\system32\dla\tfswctrl.exe"
    127035 Dec 6 2004 "C:\Program Files\Sonic\DLA\install\tfswctrl.exe"
    127035 Dec 6 2004 "C:\WINDOWS\system32\dla\bak\tfswctrl.exe"
     81920 Jul 27 2004 "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe"
     81920 Jul 27 2004 "C:\Program Files\Common Files\InstallShield\UpdateService\bak\issch.exe"
    221184 Jul 27 2004 "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe"
    221184 Jul 27 2004 "C:\Program Files\Common Files\InstallShield\UpdateService\bak\ISUSPM.exe"
    606208 Mar 4 2005 "C:\Program Files\Dell\QuickSet\quickset.exe"
    606208 Mar 4 2005 "C:\Program Files\Dell\QuickSet\bak\quickset.exe"
    606208 Mar 4 2005 "C:\Program Files\Dell\QuickSet\bak\bak\quickset.exe"
    385024 Oct 30 2004 "C:\Program Files\Intel\Wireless\Bin\bak\ifrmewrk.exe"
     32881 Nov 19 2003 "C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe"
     32881 Nov 19 2003 "C:\Program Files\Java\j2re1.4.2_03\bin\bak\jusched.exe"
    192512 May 9 2005 "C:\Program Files\Comcast\Comcast PhotoShow 4\data\Xtras\mssysmgr.exe"
    192512 May 9 2005 "C:\Program Files\Comcast\Comcast PhotoShow 4\data\Xtras\bak\mssysmgr.exe"
       288 Sep 24 2007 "C:\Documents and Settings\kerry\Application Data\Gtek\GTUpdate\AUpdate\bak\AUAgent.exc"
    188416 Jan 13 2006 "C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe"
    188416 Jan 13 2006 "C:\WINDOWS\system32\spool\drivers\w32x86\3\bak\hpztsb09.exe"

end of report
K
klo8904
19 Posts
236
0
Posted November 25th, 2007 17:00
ComboFix 07-11-19.3 - kerry 2007-11-25 13:44:54.5 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.239 [GMT -6:00]
Running from: C:\Documents and Settings\kerry\Desktop\ComboFix.exe
.

(((((((((((((((((((((((((   Files Created from 2007-10-25 to 2007-11-25 )))))))))))))))))))))))))))))))
.

2007-11-23 11:19 d-------- C:\Program Files\Trend Micro
2007-11-22 19:01 6,058,496 --------- C:\WINDOWS\system32\dllcache\ieframe.dll
2007-11-22 19:01 2,455,488 --------- C:\WINDOWS\system32\dllcache\ieapfltr.dat
2007-11-22 19:01 991,232 --------- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2007-11-22 19:01 459,264 --------- C:\WINDOWS\system32\dllcache\msfeeds.dll
2007-11-22 19:01 383,488 --------- C:\WINDOWS\system32\dllcache\ieapfltr.dll
2007-11-22 19:01 267,776 --------- C:\WINDOWS\system32\dllcache\iertutil.dll
2007-11-22 19:01 63,488 --------- C:\WINDOWS\system32\dllcache\icardie.dll
2007-11-22 19:01 52,224 --------- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2007-11-22 19:01 13,824 --------- C:\WINDOWS\system32\dllcache\ieudinit.exe
2007-11-22 16:15 d-------- C:\Program Files\RegistryFix
2007-11-18 10:37 118 --a------ C:\WINDOWS\system32\MRT.INI
2007-11-18 10:35 d-------- C:\Program Files\MSXML 4.0
2007-11-18 10:35 129,400 --a------ C:\WINDOWS\system32\TZLog.log
2007-11-18 10:30 128,896 --------- C:\WINDOWS\system32\dllcache\fltmgr.sys
2007-11-18 10:30 23,040 --------- C:\WINDOWS\system32\dllcache\fltmc.exe
2007-11-18 10:30 16,896 --------- C:\WINDOWS\system32\dllcache\fltlib.dll
2007-11-18 10:18 582,656 --------- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2007-11-18 10:01 25,944 --a------ C:\WINDOWS\system32\wuapi.dll.mui
2007-10-31 13:03 245,408 --a------ C:\WINDOWS\system32\unicows.dll

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-25 19:33 --------- d-----w C:\Program Files\QuickTime
2007-11-25 19:33 --------- d-----w C:\Program Files\iTunes
2007-11-25 19:33 --------- d-----w C:\Program Files\Dell Support
2007-11-25 19:33 --------- d-----w C:\Program Files\Apoint
2007-11-25 19:31 --------- d-----w C:\Documents and Settings\kerry\Application Data\ComcastToolbar
2007-11-23 02:02 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2007-11-17 14:09 --------- d-----w C:\Program Files\NetJet
2007-10-26 03:34 8,460,288 ----a-w C:\WINDOWS\system32\dllcache\shell32.dll
2007-10-20 12:49 39,504 ----a-w C:\Documents and Settings\kerry\Application Data\GDIPFONTCACHEV1.DAT
2007-10-12 17:36 --------- d-----w C:\Program Files\Disney
2007-10-02 01:32 --------- d-----w C:\Documents and Settings\kerry\Application Data\Comcast
2007-09-29 12:41 --------- d-----w C:\Program Files\Microsoft ActiveSync
2007-09-26 23:34 --------- d-----w C:\Program Files\ComcastToolbar
.

(((((((((((((((((((((((((((((   snapshot@2007-11-24_ 7.11.40.06   )))))))))))))))))))))))))))))))))))))))))
.
+ 2004-12-06 06:05:00 127,035 ----a-w C:\WINDOWS\system32\dla\tfswctrl.exe
+ 2006-01-13 07:14:58 188,416 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PhotoShow Deluxe Media Manager"="C:\PROGRA~1\Comcast\COMCAS~1\data\Xtras\bak\mssysmgr.exe" []
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 04:00]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\bak\bak\quickset.exe" [2005-03-04 10:26]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-06-01 15:51]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2005-06-20 20:23:58]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 00:01:04]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
C:\Program Files\Intel\Wireless\Bin\LgNotify.dll 2004-09-07 15:08 110592 C:\Program Files\Intel\Wireless\Bin\LgNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QBReminderFlash]
2004-11-11 09:26 26112 --a------ C:\Program Files\Intuit\QuickBooks 2005\Atom\QBReminder.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1cc71e06-5eed-11dc-8512-0012f09828b8}]
\Shell\AutoRun\command - E:\autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2918a028-6251-11dc-8521-0012f09828b8}]
\Shell\AutoRun\command - E:\autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ef835d06-5e65-11dc-850e-0012f09828b8}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL http://www.mgae.com/keylauncher/?code=3654335140462756

.
Contents of the 'Scheduled Tasks' folder
"2007-10-20 21:23:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-25 13:47:35
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-25 13:48:14
C:\ComboFix2.txt ... 2007-11-25 11:11
C:\ComboFix3.txt ... 2007-11-25 11:08
.
--- E O F ---