UNSOLVED
Outerinfo virus...hijack this attached
I apperciate the help..I am not very computer savy....
I have tried several things to no avail...Thanks in advance
Logfile of HijackThis v1.99.1
Scan saved at 05:49, on 2007-11-06
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Scan saved at 05:49, on 2007-11-06
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\savedump.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Juniper Networks\Common Files\dsNcService.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\Fonts\svchost.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
C:\Program Files\QdrModule\QdrModule9.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Hijackthis\HijackThis.exe
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\savedump.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Juniper Networks\Common Files\dsNcService.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\Fonts\svchost.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
C:\Program Files\QdrModule\QdrModule9.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Hijackthis\HijackThis.exe
O2 - BHO: (no name) - {0551F35A-205F-41E8-88C4-262EB0E52A0C} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: 0 - {10AD5587-4A22-4BAB-D9B4-F1881F859442} - blank (file missing)
O2 - BHO: (no name) - {25803EC7-3472-481C-3DBD-E346B8430D2A} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: BndShell3 BHO Class - {875A1348-7674-42aa-ADAC-B4F36A004A2D} - C:\Program Files\QdrDrive\QdrDrive8.dll
O2 - BHO: (no name) - {8FD6C5A1-372E-49C0-8C60-88DE7BC6A952} - blank (file missing)
O2 - BHO: (no name) - {A9AA0AE5-3E9D-4C75-B7B9-57513517B6BA} - blank (file missing)
O2 - BHO: (no name) - {B1B708B0-07DB-41E0-9457-9BB72941EB7D} - blank (file missing)
O2 - BHO: (no name) - {BCC73622-F72D-4277-803C-D65565A0947F} - C:\WINDOWS\system32\vtutsqr.dll
O2 - BHO: (no name) - {C001B95C-E38E-44B1-929F-F772022A895A} - (no file)
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O2 - BHO: (no name) - {DA2FD729-65AF-4BD3-8CA7-9936C2B95459} - \
O2 - BHO: {c334cc21-bd10-8d8b-50b4-1da05fa8812e} - {e2188af5-0ad1-4b05-b8d8-01db12cc433c} - C:\WINDOWS\system32\luiblcdf.dll
O3 - Toolbar: (no name) - {11A69AE4-FBED-4832-A2BF-45AF82825583} - (no file)
O4 - HKLM\..\Run: [Host Process] C:\WINDOWS\Fonts\svchost.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
O4 - HKCU\..\Run: [QdrModule9] "C:\Program Files\QdrModule\QdrModule9.exe"
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20061205/qtinstall.info.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: IntelWireless - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll
O20 - Winlogon Notify: vtutsqr - C:\WINDOWS\SYSTEM32\vtutsqr.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Juniper Network Connect Service (dsNcService) - Juniper Networks - C:\Program Files\Juniper Networks\Common Files\dsNcService.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
O23 - Service: MSSQL$MICROSOFTSMLBIZ - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe" -sMICROSOFTSMLBIZ (file missing)
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SQLAgent$MICROSOFTSMLBIZ - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlagent.EXE" -i MICROSOFTSMLBIZ (file missing)
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: 0 - {10AD5587-4A22-4BAB-D9B4-F1881F859442} - blank (file missing)
O2 - BHO: (no name) - {25803EC7-3472-481C-3DBD-E346B8430D2A} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: BndShell3 BHO Class - {875A1348-7674-42aa-ADAC-B4F36A004A2D} - C:\Program Files\QdrDrive\QdrDrive8.dll
O2 - BHO: (no name) - {8FD6C5A1-372E-49C0-8C60-88DE7BC6A952} - blank (file missing)
O2 - BHO: (no name) - {A9AA0AE5-3E9D-4C75-B7B9-57513517B6BA} - blank (file missing)
O2 - BHO: (no name) - {B1B708B0-07DB-41E0-9457-9BB72941EB7D} - blank (file missing)
O2 - BHO: (no name) - {BCC73622-F72D-4277-803C-D65565A0947F} - C:\WINDOWS\system32\vtutsqr.dll
O2 - BHO: (no name) - {C001B95C-E38E-44B1-929F-F772022A895A} - (no file)
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O2 - BHO: (no name) - {DA2FD729-65AF-4BD3-8CA7-9936C2B95459} - \
O2 - BHO: {c334cc21-bd10-8d8b-50b4-1da05fa8812e} - {e2188af5-0ad1-4b05-b8d8-01db12cc433c} - C:\WINDOWS\system32\luiblcdf.dll
O3 - Toolbar: (no name) - {11A69AE4-FBED-4832-A2BF-45AF82825583} - (no file)
O4 - HKLM\..\Run: [Host Process] C:\WINDOWS\Fonts\svchost.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
O4 - HKCU\..\Run: [QdrModule9] "C:\Program Files\QdrModule\QdrModule9.exe"
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20061205/qtinstall.info.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: IntelWireless - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll
O20 - Winlogon Notify: vtutsqr - C:\WINDOWS\SYSTEM32\vtutsqr.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Juniper Network Connect Service (dsNcService) - Juniper Networks - C:\Program Files\Juniper Networks\Common Files\dsNcService.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
O23 - Service: MSSQL$MICROSOFTSMLBIZ - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe" -sMICROSOFTSMLBIZ (file missing)
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SQLAgent$MICROSOFTSMLBIZ - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlagent.EXE" -i MICROSOFTSMLBIZ (file missing)
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
443
0
Posted November 7th, 2007 13:00
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0551F35A-205F-41E8-88C4-262EB0E52A0C}][HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{10AD5587-4A22-4BAB-D9B4-F1881F859442}][HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25803EC7-3472-481C-3DBD-E346B8430D2A}][HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{875A1348-7674-42aa-ADAC-B4F36A004A2D}]
2007-10-27 13:37 192512 --a------ C:\Program Files\QdrDrive\QdrDrive8.dll[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8FD6C5A1-372E-49C0-8C60-88DE7BC6A952}][HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A9AA0AE5-3E9D-4C75-B7B9-57513517B6BA}][HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B1B708B0-07DB-41E0-9457-9BB72941EB7D}][HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BCC73622-F72D-4277-803C-D65565A0947F}]
2007-11-04 08:22 35328 --a------ C:\WINDOWS\system32\vtutsqr.dll[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C001B95C-E38E-44B1-929F-F772022A895A}][HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DA2FD729-65AF-4BD3-8CA7-9936C2B95459}][HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e2188af5-0ad1-4b05-b8d8-01db12cc433c}]
2007-11-04 10:06 78912 --a------ C:\WINDOWS\system32\luiblcdf.dll[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{eaa1b4fe-6875-4c88-b8b9-32166a6efe13}]
2007-11-06 22:15 171520 --a------ C:\WINDOWS\system32\vefhsmj.dll[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Host Process"="C:\WINDOWS\Fonts\svchost.exe" [2007-11-04 08:20]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-08 17:48]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2004-10-30 13:59]
"SigmatelSysTrayApp"="stsystra.exe" [2006-03-24 22:30 C:\WINDOWS\stsystra.exe]
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2006-04-06 13:58]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 15:19]
"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 09:44]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 09:44]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-10-14 19:49]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-10-14 19:46]
"MSKDetectorExe"="C:\Program Files\McAfee\SpamKiller\MSKDetct.exe" [2005-08-12 15:16]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-12-18 13:45]
"NeroCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-06-12 08:36]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 03:25]
"runner1"="C:\WINDOWS\mrofinu1000106.exe" [2007-11-06 22:15][HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 04:00]
"CTSyncU.exe"="C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe" [2006-08-07 09:06]
"QdrModule9"="C:\Program Files\QdrModule\QdrModule9.exe" [2007-11-01 13:51]
"WebBuying"="C:\Program Files\Web Buying\v1.8.5\webbuying.exe" [2007-11-06 22:14][HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{BCC73622-F72D-4277-803C-D65565A0947F}"= C:\WINDOWS\system32\vtutsqr.dll [2007-11-04 08:22 35328][HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
C:\Program Files\Intel\Wireless\Bin\LgNotify.dll 2004-09-07 15:08 110592 C:\Program Files\Intel\Wireless\Bin\LgNotify.dll[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\vtutsqr]
vtutsqr.dll 2007-11-04 08:22 35328 C:\WINDOWS\system32\vtutsqr.dll[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\gebyx.dll[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^DataViz Inc Messenger.lnk]
backup=C:\WINDOWS\pss\DataViz Inc Messenger.lnkCommon Startup[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
backup=C:\WINDOWS\pss\Digital Line Detect.lnkCommon Startup[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HOTSYNCSHORTCUTNAME.lnk]
backup=C:\WINDOWS\pss\HOTSYNCSHORTCUTNAME.lnkCommon Startup[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
backup=C:\WINDOWS\pss\Kodak EasyShare software.lnkCommon Startup[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Service Manager.lnk]
backup=C:\WINDOWS\pss\Service Manager.lnkCommon Startup[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Army browse cdrom vga][HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTSyncU.exe]
"C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell QuickSet]
C:\Program Files\Dell\QuickSet\quickset.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
"C:\Program Files\DellSupport\DSAgnt.exe" /startup[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
"C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hid_start]
C:\WINDOWS\System32\Rundll32.exe "C:\WINDOWS\system32\gzmrotate.dll" DllVerify[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Host Process]
C:\WINDOWS\Fonts\svchost.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
C:\WINDOWS\system32\hkcmd.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]
C:\WINDOWS\system32\igfxpers.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]
C:\WINDOWS\system32\igfxtray.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelWireless]
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
"C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
"C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]
c:\quickenw\BILLMNDW.EXE[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Long bend][HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\McAfeeUpdaterUI]
"C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKDetectorExe]
C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Network Associates Error Reporting Service]
"C:\Program Files\Common Files\Network Associates\TalkBack\tbmon.exe"[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ShStatEXE]
"C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]
stsystra.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer][HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt hpqcxs08[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{02e02a9e-39ea-11db-b076-00038a000015}]
\Shell\AutoRun\command - E:\setupSNK.exe*Newly Created Service* - CMDSERVICE
*Newly Created Service* - CORE
*Newly Created Service* - NETWORK_MONITOR
.
Contents of the 'Scheduled Tasks' folder
"2007-11-07 04:00:01 C:\WINDOWS\Tasks\A5B044919113FF91.job"
.
**************************************************************************catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-06 22:13:38
Windows 5.1.2600 Service Pack 2 NTFSscanning hidden processes ...scanning hidden autostart entries ...scanning hidden files ...C:\WINDOWS\system32\jkkhffg.dll 35328 bytes executable
C:\WINDOWS\system32\v8
C:\WINDOWS\system32\a1
C:\WINDOWS\system32\g2
C:\WINDOWS\system32\h1
C:\WINDOWS\system32\r2scan completed successfully
hidden files: 6**************************************************************************
.
Completion time: 2007-11-06 22:22:35 - machine was rebooted
.
--- E O F ---443
0
Posted November 7th, 2007 13:00
ComboFix 07-11-07.3 - Desiree Weaver 2007-11-06 22:00:56.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.108 [GMT -6:00]
Running from: C:\Documents and Settings\Desiree Weaver\Desktop\ComboFix.exe
* Created a new restore point
.Unable to gain System Privileges((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.C:\Documents and Settings\All Users\Start Menu\Live Safety Center.lnk
C:\Documents and Settings\All Users\Start Menu\Online Security Guide.lnk
C:\Documents and Settings\Desiree Weaver\Desktop\Live Safety Center.lnk
C:\Documents and Settings\Desiree Weaver\Desktop\Online Security Guide.lnk
C:\Documents and Settings\Desiree Weaver\Favorites\Online Security Guide.lnk
C:\Program Files\Messenger\prohdyhde.html
C:\svchost.exe
C:\Temp\1cb
C:\Temp\1cb\syscheck.log
C:\temp\tn3
C:\WINDOWS\b147.exe
C:\WINDOWS\system32\a1
C:\WINDOWS\system32\drivers\core.cache.dsk
C:\WINDOWS\system32\drivers\core.sys
C:\WINDOWS\system32\g2
C:\WINDOWS\system32\gebyx.dll
C:\WINDOWS\system32\kjllm.bak1
C:\WINDOWS\system32\kjllm.bak2
C:\WINDOWS\system32\kjllm.ini
C:\WINDOWS\system32\kjllm.ini2
C:\WINDOWS\system32\kjllm.tmp
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\r2
C:\WINDOWS\system32\r2\wr31drs.exe
C:\WINDOWS\system32\sembly~1
C:\WINDOWS\system32\sembly~1\??sembly\
C:\WINDOWS\system32\v8
C:\WINDOWS\system32\wsaicrkt.dllbox
C:\WINDOWS\system32\xybeg.bak1
C:\WINDOWS\system32\xybeg.ini
C:\z.exe
.
---- Previous Run -------
.
C:\7.tmp
C:\8.tmp
C:\9.tmp
C:\D.tmp
C:\Documents and Settings\All Users.\documents\setup.exe
C:\E.tmp
C:\F.tmp
C:\Program Files\ISM
C:\Program Files\ISM\ism.exe
C:\Program Files\ISM\Uninstall.exe
C:\Program Files\Messenger\laxusi.dll
C:\Program Files\Messenger\laxusi256.dll
C:\Program Files\Messenger\laxusi593.dll
C:\Program Files\Messenger\laxusi641.dll
C:\Program Files\Messenger\laxusi704.dll
C:\Program Files\Messenger\laxusi762.dll
C:\Program Files\Messenger\laxusi829.dll
C:\Program Files\Messenger\prohdyhde.html
C:\svchost.exe
C:\Temp\1cb
C:\Temp\1cb\syscheck.log
C:\temp\tn3
C:\WINDOWS\b122.exe
C:\WINDOWS\RGVzaXJlZSBXZWF2ZXI\asappsrv.dll
C:\WINDOWS\RGVzaXJlZSBXZWF2ZXI\command.exe
C:\WINDOWS\system32\a1
C:\WINDOWS\system32\a1\rarndrll2.exe
C:\WINDOWS\system32\adeeg.bak1
C:\WINDOWS\system32\adeeg.ini
C:\WINDOWS\system32\atmtd.dll.tmp
C:\WINDOWS\system32\AutoRun.inf
C:\WINDOWS\system32\drivers\core.cache.dsk
C:\WINDOWS\system32\drivers\core.sys
C:\WINDOWS\system32\g2
C:\WINDOWS\system32\g2\caws83122.exe
C:\WINDOWS\system32\geeda.dll
C:\WINDOWS\system32\h1
C:\WINDOWS\system32\h1\wdb51en.exe
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\r2
C:\WINDOWS\system32\r2\wr31drs.exe
C:\WINDOWS\system32\v8
C:\WINDOWS\system32\v8\taldrvr11.exe
C:\WINDOWS\tk58.exe
C:\WINDOWS\TTC-4444.exe
C:\z.exe.
((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))).
-------\LEGACY_CMDSERVICE
-------\LEGACY_CORE
-------\LEGACY_NETWORK_MONITOR
-------\cmdService
-------\core
-------\LEGACY_CMDSERVICE
-------\LEGACY_CORE
-------\LEGACY_DOMAINSERVICE
-------\LEGACY_NETWORK_MONITOR
-------\core
((((((((((((((((((((((((( Files Created from 2007-10-07 to 2007-11-07 )))))))))))))))))))))))))))))))
.2007-11-06 22:14 111,727 --a------ C:\a.exe
2007-11-06 22:13 32,768 --a------ C:\svchost.exe
2007-11-04 20:08 786 --a------ C:\4484.bat
2007-11-04 19:58 35,328 --a------ C:\WINDOWS\system32\jkkhebx.dll
2007-11-04 19:57d-------- C:\Documents and Settings\Desiree Weaver\Application Data\Grisoft
2007-11-04 19:57 786 --a------ C:\1490.bat
2007-11-04 19:48d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2007-11-04 19:48 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-11-04 19:41 12,413,440 --a------ C:\avgas-setup-7.5.1.43.exe
2007-11-04 19:33 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-11-04 19:02 786 --a------ C:\7975.bat
2007-11-04 18:52d-------- C:\Program Files\ahead
2007-11-04 18:16 786 --a------ C:\4644.bat
2007-11-04 17:21 14,291,508 --a------ C:\dat-5155.zip
2007-11-04 16:56 786 --a------ C:\1545.bat
2007-11-04 16:47d-------- C:\Program Files\QdrModule
2007-11-04 16:47d-------- C:\Program Files\QdrDrive
2007-11-04 15:24d-------- C:\hijack
2007-11-04 12:33d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-04 10:59 786 --a------ C:\1527.bat
2007-11-04 10:58 786 --a------ C:\4851.bat
2007-11-04 10:39 786 --a------ C:\7402.bat
2007-11-04 10:09d-------- C:\QUARANTINE
2007-11-04 10:06 78,912 --a------ C:\WINDOWS\system32\luiblcdf.dll
2007-11-04 10:03 86,080 --a------ C:\WINDOWS\system32\rxlhrejy.dll
2007-11-04 09:57 786 --a------ C:\5017.bat
2007-11-04 09:51 23,211,238 --a------ C:\sdat5155.exe
2007-11-04 09:12 786 --a------ C:\1516.bat
2007-11-04 08:32d-------- C:\Documents and Settings\Desiree Weaver\Application Data\Adssite Advanced Toolbar
2007-11-04 08:28d-------- C:\WINDOWS\system32\config\systemprofile\Application Data\HPAppData
2007-11-04 08:25 147,456 --a------ C:\WINDOWS\system32\vbzip10.dll
2007-11-04 08:23 82 --a------ C:\n.bat
2007-11-04 08:23 0 --a------ C:\z.dat
2007-11-04 08:22 35,328 --a------ C:\WINDOWS\system32\vtutsqr.dll
2007-11-04 08:22 786 --a------ C:\5691.bat
2007-11-04 08:21d-------- C:\WINDOWS\system32\Mz18r
2007-11-04 08:21d-------- C:\Temp\mZOr
2007-11-04 08:21d-------- C:\Temp
2007-11-04 08:21 786 --a------ C:\9806.bat
2007-11-04 08:18 78,912 --a------ C:\WINDOWS\system32\stbmprpu.dll
2007-11-03 16:48d-------- C:\Documents and Settings\Desiree Weaver\Application Data\FIRST THE POKE
2007-11-03 16:48d-------- C:\Documents and Settings\All Users\Application Data\Mfcd upload army browse
2007-11-02 09:30d-------- C:\Program Files\mIRC
2007-11-02 09:30d-------- C:\Documents and Settings\Desiree Weaver\Application Data\mIRC
2007-11-02 08:19d-------- C:\Documents and Settings\Desiree Weaver\Application Data\Arcsoft
2007-11-02 05:20 14,115,766 --a------ C:\scan.dat
2007-11-02 05:20 1,296,499 --a------ C:\clean.dat
2007-11-02 05:20 810,192 --a------ C:\names.dat
2007-11-02 05:20 51,200 --a------ C:\validate.exe
2007-11-01 19:53d-------- C:\Program Files\Ultrasoft
2007-11-01 19:53 122,880 --a------ C:\WINDOWS\ctpu.exe
2007-11-01 19:53 57,344 --a------ C:\WINDOWS\ResENU.dll
2007-11-01 18:30d-------- C:\Program Files\Documents To Go
2007-11-01 18:30d-------- C:\Program Files\Common Files\DataViz
2007-11-01 18:30d-------- C:\Documents and Settings\All Users\Application Data\DataViz
2007-11-01 18:28d-------- C:\Documents and Settings\All Users\Application Data\HotSync
2007-11-01 18:28 53,248 --a------ C:\WINDOWS\PalmDevC.dll
2007-11-01 18:27d-------- C:\Program Files\Palm
2007-11-01 18:25d-------- C:\Documents and Settings\Desiree Weaver\Application Data\HotSync
2007-10-21 10:24d-------- C:\Documents and Settings\All Users\Application Data\WEBREG
2007-10-21 10:22d-------- C:\Documents and Settings\All Users\Application Data\Hewlett-Packard
2007-10-21 10:22 267,864 -ra------ C:\WINDOWS\system32\hpzids01.dll
2007-10-21 10:22 267,864 -ra------ C:\hpzids01.dll
2007-10-21 10:20 954,368 -ra------ C:\WINDOWS\system32\hpotiop5.dll
2007-10-21 10:20 675,840 -ra------ C:\WINDOWS\system32\hpowiax5.dll
2007-10-21 10:20 364,544 -ra------ C:\WINDOWS\system32\hppldcoi.dll
2007-10-21 10:20 309,760 -ra------ C:\WINDOWS\system32\difxapi.dll
2007-10-21 10:20 303,104 -ra------ C:\WINDOWS\system32\hpovst12.dll
2007-10-21 10:20 6,784 --a------ C:\WINDOWS\system32\drivers\serscan.sys
2007-10-21 10:20 6,784 --a------ C:\WINDOWS\system32\dllcache\serscan.sys
2007-10-21 09:42d-------- C:\Documents and Settings\Desiree Weaver\Application Data\HP
2007-10-21 09:29d-------- C:\Documents and Settings\All Users\Application Data\HP
2007-10-21 09:28d-------- C:\Program Files\Common Files\HP
2007-10-21 09:26d-------- C:\Program Files\Common Files\Hewlett-Packard
2007-10-21 09:22d-------- C:\Program Files\HP
2007-10-21 09:22 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2007-10-21 09:22 31,616 --a------ C:\WINDOWS\system32\dllcache\usbccgp.sys
2007-10-21 09:22 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2007-10-21 09:22 25,856 --a------ C:\WINDOWS\system32\dllcache\usbprint.sys
2007-10-11 14:31 582,656 --------- C:\WINDOWS\system32\dllcache\rpcrt4.dll.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-07 04:15 932 ----a-w C:\WINDOWS\system32\drivers\core.cache.dsk
2007-11-07 04:15 72,960 ----a-w C:\WINDOWS\system32\drivers\core.sys
2007-11-07 04:14 9,808 ----a-w C:\b.exe
2007-11-07 04:14 --------- d-----w C:\Program Files\Web Buying
2007-11-07 03:52 --------- d-----w C:\Documents and Settings\Desiree Weaver\Application Data\LimeWire
2007-11-06 11:48 --------- d-----w C:\Program Files\Paint Shop Pro 5
2007-11-04 15:17 --------- d-----w C:\Program Files\McAfee
2007-11-04 14:25 278,536 ----a-w C:\WINDOWS\Fonts\Setup.exe
2007-11-04 14:20 278,535 --sh--w C:\WINDOWS\Fonts\svchost.exe
2007-11-02 00:24 16,694 ----a-w C:\WINDOWS\system32\drivers\PalmUSBD.sys
2007-08-21 06:15 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-08-21 06:15 683,520 ------w C:\WINDOWS\system32\dllcache\inetcomm.dll
2007-08-20 10:04 824,832 ----a-w C:\WINDOWS\system32\dllcache\wininet.dll
2007-08-20 10:04 671,232 ----a-w C:\WINDOWS\system32\dllcache\mstime.dll
2007-08-20 10:04 63,488 ------w C:\WINDOWS\system32\dllcache\icardie.dll
2007-08-20 10:04 6,058,496 ------w C:\WINDOWS\system32\dllcache\ieframe.dll
2007-08-20 10:04 52,224 ------w C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2007-08-20 10:04 477,696 ----a-w C:\WINDOWS\system32\dllcache\mshtmled.dll
2007-08-20 10:04 459,264 ------w C:\WINDOWS\system32\dllcache\msfeeds.dll
2007-08-20 10:04 44,544 ------w C:\WINDOWS\system32\dllcache\iernonce.dll
2007-08-20 10:04 384,512 ------w C:\WINDOWS\system32\dllcache\iedkcs32.dll
2007-08-20 10:04 383,488 ------w C:\WINDOWS\system32\dllcache\ieapfltr.dll
2007-08-20 10:04 3,584,512 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2007-08-20 10:04 27,648 ----a-w C:\WINDOWS\system32\dllcache\jsproxy.dll
2007-08-20 10:04 267,776 ------w C:\WINDOWS\system32\dllcache\iertutil.dll
2007-08-20 10:04 232,960 ------w C:\WINDOWS\system32\dllcache\webcheck.dll
2007-08-20 10:04 230,400 ------w C:\WINDOWS\system32\dllcache\ieaksie.dll
2007-08-20 10:04 214,528 ----a-w C:\WINDOWS\system32\dllcache\dxtrans.dll
2007-08-20 10:04 193,024 ----a-w C:\WINDOWS\system32\dllcache\msrating.dll
2007-08-20 10:04 153,088 ------w C:\WINDOWS\system32\dllcache\ieakeng.dll
2007-08-20 10:04 132,608 ----a-w C:\WINDOWS\system32\dllcache\extmgr.dll
2007-08-20 10:04 124,928 ------w C:\WINDOWS\system32\dllcache\advpack.dll
2007-08-20 10:04 105,984 ------w C:\WINDOWS\system32\dllcache\url.dll
2007-08-20 10:04 102,400 ------w C:\WINDOWS\system32\dllcache\occache.dll
2007-08-20 10:04 1,152,000 ----a-w C:\WINDOWS\system32\dllcache\urlmon.dll
2007-08-17 10:21 625,152 ------w C:\WINDOWS\system32\dllcache\iexplore.exe
2007-08-17 10:20 63,488 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2007-08-17 10:20 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
2007-08-17 07:34 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll
2007-08-02 13:43 282,624 ----a-w C:\Program Files\TTC.dll
2007-06-14 09:22 2,231 ----a-w C:\Program Files\folder.js
2006-06-08 22:36 124 ----a-w C:\Program Files\ZEN V Series Media Explorer.lnk
.((((((((((((((((((((((((((((( snapshot@2007-11-04_19.58.29.76 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-04-02 20:21:27 139,776 ----a-w C:\WINDOWS\system32\swreg.exe
+ 2007-07-23 00:39:27 279,552 ----a-w C:\WINDOWS\system32\swreg.exe
+ 2007-11-07 04:11:20 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_784.dat
.
443
0
Posted November 8th, 2007 11:00
dlerdw
That's quite an infection. It will take a couple fo runs at this to completely remove it so please be patient
1. Open NotePad (not wordpad). Copy and paste the following into Notepad
File::
C:\a.exe
C:\svchost.exe
C:\WINDOWS\system32\jkkhebx.dll
C:\WINDOWS\system32\luiblcdf.dll
C:\WINDOWS\system32\rxlhrejy.dll
C:\WINDOWS\system32\vbzip10.dll
C:\n.bat
C:\z.dat
C:\WINDOWS\system32\vtutsqr.dll
C:\WINDOWS\system32\Mz18r
C:\WINDOWS\system32\stbmprpu.dll
C:\WINDOWS\system32\drivers\core.cache.dsk
C:\WINDOWS\system32\drivers\core.sys
C:\b.exe
C:\WINDOWS\Fonts\svchost.exe
C:\WINDOWS\system32\luiblcdf.dll
C:\WINDOWS\system32\vefhsmj.dll
C:\WINDOWS\mrofinu1000106.exe
C:\Program Files\Web Buying\v1.8.5\webbuying.exe
C:\WINDOWS\system32\gzmrotate.dll
C:\WINDOWS\system32\jkkhffg.dll
C:\WINDOWS\system32\v8
C:\WINDOWS\system32\a1
C:\WINDOWS\system32\g2
C:\WINDOWS\system32\h1
C:\WINDOWS\system32\r2
Folder::
C:\Documents and Settings\Desiree Weaver\Application Data\Adssite Advanced Toolbar
C:\Program Files\Web Buying
Catch::
C:\WINDOWS\system32\drivers\core.cache.dsk
C:\WINDOWS\system32\drivers\core.sys
Save the File as CFScript(exactly as shown no spaces) ->> Save it to your Desktop
Using the Image as a reference, drag CFScript into ComboFix.exe
- You will be prompted to run Combofix again, Do so
Following the same rules as indicated in my first post
Then post the contents of the C:\ComboFix.txt log in your reply
- You will be prompted to run Combofix again, Do so
442
0
Posted November 8th, 2007 16:00
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"xmlprov"=3 (0x3)
"WZCSVC"=2 (0x2)
"wuauserv"=2 (0x2)
"wscsvc"=2 (0x2)
"WmiApSrv"=3 (0x3)
"WmdmPmSN"=3 (0x3)
"WLANKEEPER"=2 (0x2)
"winmgmt"=2 (0x2)
"WebClient"=2 (0x2)
"VSS"=3 (0x3)
"usnjsvc"=3 (0x3)
"UPS"=3 (0x3)
"upnphost"=3 (0x3)
"UMWdf"=2 (0x2)
"TrkWks"=2 (0x2)
"Themes"=2 (0x2)
"TermService"=3 (0x3)
"TapiSrv"=3 (0x3)
"SysmonLog"=3 (0x3)
"SwPrv"=3 (0x3)
"stisvc"=2 (0x2)
"SSDPSRV"=3 (0x3)
"srservice"=2 (0x2)
"SQLAgent$MICROSOFTSMLBIZ"=3 (0x3)
"Spooler"=2 (0x2)
"ShellHWDetection"=2 (0x2)
"SharedAccess"=2 (0x2)
"SENS"=2 (0x2)
"seclogon"=2 (0x2)
"Schedule"=2 (0x2)
"SCardSvr"=3 (0x3)
"SamSs"=2 (0x2)
"S24EventMonitor"=2 (0x2)
"RSVP"=3 (0x3)
"RegSrvc"=2 (0x2)
"RDSessMgr"=3 (0x3)
"RasMan"=3 (0x3)
"RasAuto"=3 (0x3)
"ProtectedStorage"=2 (0x2)
"PolicyAgent"=2 (0x2)
"Pml Driver HPZ12"=2 (0x2)
"PlugPlay"=2 (0x2)
"ose"=3 (0x3)
"NtmsSvc"=3 (0x3)
"NtLmSsp"=3 (0x3)
"Nla"=3 (0x3)
"NICCONFIGSVC"=2 (0x2)
"Netman"=3 (0x3)
"Netlogon"=3 (0x3)
"Net Driver HPZ12"=2 (0x2)
"MSSQLServerADHelper"=3 (0x3)
"MSSQL$MICROSOFTSMLBIZ"=2 (0x2)
"MSIServer"=3 (0x3)
"MSDTC"=3 (0x3)
"mnmsrvc"=3 (0x3)
"MDM"=2 (0x2)
"McTaskManager"=2 (0x2)
"McAfeeFramework"=2 (0x2)
"LmHosts"=2 (0x2)
"lanmanworkstation"=2 (0x2)
"lanmanserver"=2 (0x2)
"ImapiService"=3 (0x3)
"IDriverT"=3 (0x3)
"HTTPFilter"=3 (0x3)
"hpqcxs08"=3 (0x3)
"HidServ"=2 (0x2)
"helpsvc"=2 (0x2)
"Fax"=2 (0x2)
"FastUserSwitchingCompatibility"=3 (0x3)
"EvtEng"=2 (0x2)
"EventSystem"=3 (0x3)
"Eventlog"=2 (0x2)
"ERSvc"=2 (0x2)
"dsNcService"=2 (0x2)
"DSBrokerService"=3 (0x3)
"Dnscache"=2 (0x2)
"dmserver"=3 (0x3)
"dmadmin"=3 (0x3)
"Dhcp"=2 (0x2)
"CryptSvc"=3 (0x3)
"Creative Service for CDROM Access"=2 (0x2)
"COMSysApp"=3 (0x3)
"clr_optimization_v2.0.50727_32"=3 (0x3)
"CiSvc"=3 (0x3)
"Browser"=2 (0x2)
"BITS"=3 (0x3)
"AudioSrv"=2 (0x2)
"aspnet_state"=3 (0x3)
"AppMgmt"=3 (0x3)
"ALG"=3 (0x3)
R1 NaiAvTdi1;NaiAvTdi1;C:\WINDOWS\system32\drivers\mvstdi5x.sys
R3 dsNcAdpt;Juniper Network Connect
Adapter;C:\WINDOWS\system32\DRIVERS\dsNcAdpt.sys
R3 NeroCd2k;NeroCd2k;C:\WINDOWS\system32\drivers\NeroCd2k.sys
[HKEY_LOCAL_MACHINE\software\microsoft\windows
nt\currentversion\svchost]
HPZ12 Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt hpqcxs08
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{02e02a9e-39ea-11db-b076-00038a000015}]
\Shell\AutoRun\command - E:\setupSNK.exe
.
Contents of the 'Scheduled Tasks' folder
"2007-05-08 03:00:00 C:\WINDOWS\Tasks\A5B044919113FF91.job"
.
**************************************************************************
catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by
Gmer, http://www.gmer.net
Rootkit scan 2007-11-08 23:16:16
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2007-11-08 23:17:44 - machine was rebooted
C:\ComboFix2.txt ... 2007-11-06 22:22
.
--- E O F ---
442
0
Posted November 8th, 2007 16:00
ComboFix 07-11-08.1 - Desiree Weaver 2007-05-07 23:05:28.3 - NTFSx86
Running from: C:\Documents and Settings\Desiree
Weaver\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Desiree
Weaver\Desktop\CFScript
FILE
C:\a.exe
C:\b.exe
C:\n.bat
C:\Program Files\Web Buying\v1.8.5\webbuying.exe
C:\svchost.exe
C:\WINDOWS\Fonts\svchost.exe
C:\WINDOWS\mrofinu1000106.exe
C:\WINDOWS\system32\a1
C:\WINDOWS\system32\drivers\core.cache.dsk
C:\WINDOWS\system32\drivers\core.sys
C:\WINDOWS\system32\g2
C:\WINDOWS\system32\gzmrotate.dll
C:\WINDOWS\system32\h1
C:\WINDOWS\system32\jkkhebx.dll
C:\WINDOWS\system32\jkkhffg.dll
C:\WINDOWS\system32\luiblcdf.dll
C:\WINDOWS\system32\Mz18r
C:\WINDOWS\system32\r2
C:\WINDOWS\system32\rxlhrejy.dll
C:\WINDOWS\system32\stbmprpu.dll
C:\WINDOWS\system32\v8
C:\WINDOWS\system32\vbzip10.dll
C:\WINDOWS\system32\vefhsmj.dll
C:\WINDOWS\system32\vtutsqr.dll
C:\z.dat
.
Unable to gain System Privileges
((((((((((((((((((((((((((((((((((((((( Other Deletions
)))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\a.exe
C:\Documents and Settings\Desiree Weaver\Application Data\Adssite
Advanced Toolbar
C:\Documents and Settings\Desiree Weaver\Application Data\Adssite
Advanced Toolbar\selected.xml
C:\Documents and Settings\Desiree Weaver\Start Menu\Programs\Internet
Speed Monitor
C:\n.bat
C:\Temp\1cb
C:\Temp\1cb\syscheck.log
C:\temp\tn3
C:\WINDOWS\b104.exe
C:\WINDOWS\b138.exe
C:\WINDOWS\Fonts\svchost.exe
C:\WINDOWS\mrofinu1000106.exe
C:\WINDOWS\mrofinu1188.exe
C:\WINDOWS\system32\a1
C:\WINDOWS\system32\a1\rarndrll2.exe
C:\WINDOWS\system32\drivers\core.cache.dsk
C:\WINDOWS\system32\drivers\core.sys
C:\WINDOWS\system32\fhkmp.bak2
C:\WINDOWS\system32\fhkmp.ini
C:\WINDOWS\system32\g2
C:\WINDOWS\system32\g2\caws83122.exe
C:\WINDOWS\system32\h1
C:\WINDOWS\system32\jkkhebx.dll
C:\WINDOWS\system32\jkkhffg.dll
C:\WINDOWS\system32\luiblcdf.dll
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\pmkhf.dll
C:\WINDOWS\system32\r2
C:\WINDOWS\system32\r2\wr31drs.exe
C:\WINDOWS\system32\rxlhrejy.dll
C:\WINDOWS\system32\stbmprpu.dll
C:\WINDOWS\system32\v8
C:\WINDOWS\system32\v8\taldrvr11.exe
C:\WINDOWS\system32\vbzip10.dll
C:\WINDOWS\system32\vefhsmj.dll
C:\WINDOWS\system32\vtutsqr.dll
C:\WINDOWS\tk58.exe
C:\WINDOWS\TTC-4444.exe
C:\z.dat
C:\z.exe
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services
)))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\LEGACY_CMDSERVICE
-------\LEGACY_CORE
-------\LEGACY_DOMAINSERVICE
-------\LEGACY_NETWORK_MONITOR
-------\core
-------\DomainService
((((((((((((((((((((((((( Files Created from 2007-10-09 to 2007-11-09
)))))))))))))))))))))))))))))))
.
2007-11-08 23:08 71,232 --a------ C:\WINDOWS\system32\cvlqknld.exe
2007-11-08 23:05 71,232 --a------ C:\WINDOWS\system32\koodgebe.exe
2007-11-07 06:57d-------- C:\~ErdUserProfile.$$$
2007-11-06 22:15d--hs---- C:\WINDOWS\RGVzaXJlZSBXZWF2ZXI
2007-11-06 22:15d-------- C:\Program Files\bb
2007-11-04 20:08 786 --a------ C:\4484.bat
2007-11-04 19:57 786 --a------ C:\1490.bat
2007-11-04 19:48d-------- C:\Documents and Settings\All
Users\Application Data\Grisoft
2007-11-04 19:41 12,413,440 --a------ C:\avgas-setup-7.5.1.43.exe
2007-11-04 19:33 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-11-04 19:02 786 --a------ C:\7975.bat
2007-11-04 18:52d-------- C:\Program Files\ahead
2007-11-04 18:16 786 --a------ C:\4644.bat
2007-11-04 17:21 14,291,508 --a------ C:\dat-5155.zip
2007-11-04 16:56 786 --a------ C:\1545.bat
2007-11-04 16:47d-------- C:\Program Files\QdrModule
2007-11-04 16:47d-------- C:\Program Files\QdrDrive
2007-11-04 15:24d-------- C:\hijack
2007-11-04 10:59 786 --a------ C:\1527.bat
2007-11-04 10:58 786 --a------ C:\4851.bat
2007-11-04 10:39 786 --a------ C:\7402.bat
2007-11-04 10:09d-------- C:\QUARANTINE
2007-11-04 09:57 786 --a------ C:\5017.bat
2007-11-04 09:51 23,211,238 --a------ C:\sdat5155.exe
2007-11-04 09:12 786 --a------ C:\1516.bat
2007-11-04 08:22 786 --a------ C:\5691.bat
2007-11-04 08:21d-------- C:\WINDOWS\system32\Mz18r
2007-11-04 08:21d-------- C:\Temp\mZOr
2007-11-04 08:21d-------- C:\Temp
2007-11-04 08:21 786 --a------ C:\9806.bat
2007-11-03 16:48d-------- C:\Documents and Settings\Desiree
Weaver\Application Data\FIRST THE POKE
2007-11-03 16:48d-------- C:\Documents and Settings\All
Users\Application Data\Mfcd upload army browse
2007-11-02 09:30d-------- C:\Program Files\mIRC
2007-11-02 09:30d-------- C:\Documents and Settings\Desiree
Weaver\Application Data\mIRC
2007-11-02 08:19d-------- C:\Documents and Settings\Desiree
Weaver\Application Data\Arcsoft
2007-11-02 05:20 14,115,766 --a------ C:\scan.dat
2007-11-02 05:20 1,296,499 --a------ C:\clean.dat
2007-11-02 05:20 810,192 --a------ C:\names.dat
2007-11-02 05:20 51,200 --a------ C:\validate.exe
2007-11-01 19:53d-------- C:\Program Files\Ultrasoft
2007-11-01 19:53 122,880 --a------ C:\WINDOWS\ctpu.exe
2007-11-01 19:53 57,344 --a------ C:\WINDOWS\ResENU.dll
2007-11-01 18:30d-------- C:\Program Files\Documents To Go
2007-11-01 18:30d-------- C:\Program Files\Common Files\DataViz
2007-11-01 18:30d-------- C:\Documents and Settings\All
Users\Application Data\DataViz
2007-11-01 18:28d-------- C:\Documents and Settings\All
Users\Application Data\HotSync
2007-11-01 18:28 53,248 --a------ C:\WINDOWS\PalmDevC.dll
2007-11-01 18:27d-------- C:\Program Files\Palm
2007-11-01 18:25d-------- C:\Documents and Settings\Desiree
Weaver\Application Data\HotSync
2007-10-21 10:24d-------- C:\Documents and Settings\All
Users\Application Data\WEBREG
2007-10-21 10:22d-------- C:\Documents and Settings\All
Users\Application Data\Hewlett-Packard
2007-10-21 10:22 267,864 -ra------ C:\WINDOWS\system32\hpzids01.dll
2007-10-21 10:22 267,864 -ra------ C:\hpzids01.dll
2007-10-21 10:20 954,368 -ra------ C:\WINDOWS\system32\hpotiop5.dll
2007-10-21 10:20 675,840 -ra------ C:\WINDOWS\system32\hpowiax5.dll
2007-10-21 10:20 364,544 -ra------ C:\WINDOWS\system32\hppldcoi.dll
2007-10-21 10:20 309,760 -ra------ C:\WINDOWS\system32\difxapi.dll
2007-10-21 10:20 303,104 -ra------ C:\WINDOWS\system32\hpovst12.dll
2007-10-21 10:20 6,784 --a------
C:\WINDOWS\system32\drivers\serscan.sys
2007-10-21 10:20 6,784 --a------
C:\WINDOWS\system32\dllcache\serscan.sys
2007-10-21 09:42d-------- C:\Documents and Settings\Desiree
Weaver\Application Data\HP
2007-10-21 09:29d-------- C:\Documents and Settings\All
Users\Application Data\HP
2007-10-21 09:28d-------- C:\Program Files\Common Files\HP
2007-10-21 09:26d-------- C:\Program Files\Common
Files\Hewlett-Packard
2007-10-21 09:22d-------- C:\Program Files\HP
2007-10-21 09:22 31,616 --a------
C:\WINDOWS\system32\drivers\usbccgp.sys
2007-10-21 09:22 31,616 --a------
C:\WINDOWS\system32\dllcache\usbccgp.sys
2007-10-21 09:22 25,856 --a------
C:\WINDOWS\system32\drivers\usbprint.sys
2007-10-21 09:22 25,856 --a------
C:\WINDOWS\system32\dllcache\usbprint.sys
2007-10-11 14:31 582,656 ---------
C:\WINDOWS\system32\dllcache\rpcrt4.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report
))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-06 11:48 --------- d-----w C:\Program Files\Paint Shop Pro 5
2007-11-04 15:17 --------- d-----w C:\Program Files\McAfee
2007-11-02 00:24 16,694 ----a-w
C:\WINDOWS\system32\drivers\PalmUSBD.sys
2006-06-08 22:36 124 ----a-w C:\Program Files\ZEN V Series Media
Explorer.lnk
2005-08-02 22:46:54 187,904 --sha-r
C:\WINDOWS\RGVzaXJlZSBXZWF2ZXI\asappsrv.dll
2005-08-02 22:58:38 293,888 --sha-r
C:\WINDOWS\RGVzaXJlZSBXZWF2ZXI\command.exe
2005-07-29 22:24:26 472 --sha-r
C:\WINDOWS\RGVzaXJlZSBXZWF2ZXI\l3pWurL5tm1rtqIZtrK.vbs
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points
))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\~\Browser Helper
Objects\{0551F35A-205F-41E8-88C4-262EB0E52A0C}]
[HKEY_LOCAL_MACHINE\~\Browser Helper
Objects\{10AD5587-4A22-4BAB-D9B4-F1881F859442}]
[HKEY_LOCAL_MACHINE\~\Browser Helper
Objects\{25803EC7-3472-481C-3DBD-E346B8430D2A}]
[HKEY_LOCAL_MACHINE\~\Browser Helper
Objects\{746753e0-05f1-4fbd-80c7-43837fef3ad5}]
2007-05-07 11:52 79936 --a------ C:\WINDOWS\system32\baoljcqn.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper
Objects\{875A1348-7674-42aa-ADAC-B4F36A004A2D}]
2007-10-27 13:37 192512 --a------ C:\Program
Files\QdrDrive\QdrDrive8.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper
Objects\{8E525879-E7B1-4EAF-4F83-40500BB4ABD9}]
[HKEY_LOCAL_MACHINE\~\Browser Helper
Objects\{8FD6C5A1-372E-49C0-8C60-88DE7BC6A952}]
[HKEY_LOCAL_MACHINE\~\Browser Helper
Objects\{A9AA0AE5-3E9D-4C75-B7B9-57513517B6BA}]
[HKEY_LOCAL_MACHINE\~\Browser Helper
Objects\{B1B708B0-07DB-41E0-9457-9BB72941EB7D}]
[HKEY_LOCAL_MACHINE\~\Browser Helper
Objects\{C001B95C-E38E-44B1-929F-F772022A895A}]
[HKEY_LOCAL_MACHINE\~\Browser Helper
Objects\{CED74E95-F5C8-4781-9E5E-C9625FA2F0D8}]
2007-08-02 07:43 282624 --a------ C:\Program Files\Online
Services\home4444.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper
Objects\{DA2FD729-65AF-4BD3-8CA7-9936C2B95459}]
[HKEY_LOCAL_MACHINE\~\Browser Helper
Objects\{EA9CBA94-1C70-491D-82EB-25FA7B11A0D5}]
2007-08-02 07:43 282624 --a------ C:\Program Files\Online
Services\home83122.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe"
[2005-09-26 18:34]
"Host Process"="C:\WINDOWS\Fonts\svchost.exe" []
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Uniblue RegistryBooster 2"="C:\Program Files\Uniblue\RegistryBooster
2\RegistryBooster.exe" [2007-10-22 09:12]
[HKEY_LOCAL_MACHINE\software\microsoft\windows
nt\currentversion\winlogon\notify\IntelWireless]
C:\Program Files\Intel\Wireless\Bin\LgNotify.dll 2004-09-07 15:08
110592 C:\Program Files\Intel\Wireless\Bin\LgNotify.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows
nt\currentversion\winlogon\notify\vtutsqr]
vtutsqr.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\pmkhf.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start
Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start
Menu^Programs^Startup^DataViz Inc Messenger.lnk]
backup=C:\WINDOWS\pss\DataViz Inc Messenger.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start
Menu^Programs^Startup^Digital Line Detect.lnk]
backup=C:\WINDOWS\pss\Digital Line Detect.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start
Menu^Programs^Startup^HOTSYNCSHORTCUTNAME.lnk]
backup=C:\WINDOWS\pss\HOTSYNCSHORTCUTNAME.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start
Menu^Programs^Startup^Kodak EasyShare software.lnk]
backup=C:\WINDOWS\pss\Kodak EasyShare software.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start
Menu^Programs^Startup^Service Manager.lnk]
backup=C:\WINDOWS\pss\Service Manager.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\!AVG Anti-Spyware]
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\Army browse cdrom vga]
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\CTSyncU.exe]
"C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\Dell QuickSet]
C:\Program Files\Dell\QuickSet\quickset.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\DellSupport]
"C:\Program Files\DellSupport\DSAgnt.exe" /startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\DVDLauncher]
"C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\e8adf764]
rundll32.exe "C:\WINDOWS\system32\kereabay.dll",b
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\hid_start]
C:\WINDOWS\System32\Rundll32.exe "C:\WINDOWS\system32\gzmrotate.dll"
DllVerify
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\Host Process]
C:\WINDOWS\Fonts\svchost.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\HP Software Update]
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\igfxhkcmd]
C:\WINDOWS\system32\hkcmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\igfxpers]
C:\WINDOWS\system32\igfxpers.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\igfxtray]
C:\WINDOWS\system32\igfxtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\IntelWireless]
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel
PROSet/Wireless
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\ISUSPM Startup]
"C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe"
-startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\ISUSScheduler]
"C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe"
-start
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\Load]
c:\quickenw\BILLMNDW.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\Long bend]
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\McAfeeUpdaterUI]
"C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe"
/StartedFromRunKey
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\MSKDetectorExe]
C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\NeroCheck]
C:\WINDOWS\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\Network Associates Error Reporting Service]
"C:\Program Files\Common Files\Network Associates\TalkBack\tbmon.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\QdrModule9]
"C:\Program Files\QdrModule\QdrModule9.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\QuickTime Task]
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\RegistryMechanic]
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\ShStatEXE]
"C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\SigmatelSysTrayApp]
stsystra.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\SpybotSD TeaTimer]
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\SynTPEnh]
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\Uniblue RegistryBooster 2]
C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S
442
0
Posted November 9th, 2007 11:00
dlerdw
Making progress. Rt click and delete the CFScript file we made because we are going to make another one.
1. Open NotePad (not wordpad). Copy and paste the following into Notepad
File::
C:\WINDOWS\system32\cvlqknld.exe
C:\WINDOWS\system32\koodgebe.exe
C:\WINDOWS\system32\Mz18r
C:\Temp\mZOr
C:\WINDOWS\RGVzaXJlZSBXZWF2ZXI\asappsrv.dll
C:\WINDOWS\RGVzaXJlZSBXZWF2ZXI\command.exe
C:\WINDOWS\RGVzaXJlZSBXZWF2ZXI\l3pWurL5tm1rtqIZtrK.vbs
C:\WINDOWS\system32\baoljcqn.dll
C:\Program Files\Online Services\home4444.dll
C:\Program Files\Online Services\home83122.dll
Folder::
C:\Documents and Settings\Desiree Weaver\Application Data\FIRST THE POKE
C:\WINDOWS\RGVzaXJlZSBXZWF2ZXI
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0551F35A-205F-41E8-88C4-262EB0E52A0C}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{10AD5587-4A22-4BAB-D9B4-F1881F859442}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25803EC7-3472-481C-3DBD-E346B8430D2A}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{746753e0-05f1-4fbd-80c7-43837fef3ad5}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8E525879-E7B1-4EAF-4F83-40500BB4ABD9}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8FD6C5A1-372E-49C0-8C60-88DE7BC6A952}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A9AA0AE5-3E9D-4C75-B7B9-57513517B6BA}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B1B708B0-07DB-41E0-9457-9BB72941EB7D}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C001B95C-E38E-44B1-929F-F772022A895A}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CED74E95-F5C8-4781-9E5E-C9625FA2F0D8}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DA2FD729-65AF-4BD3-8CA7-9936C2B95459}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EA9CBA94-1C70-491D-82EB-25FA7B11A0D5}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Host Process"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\vtutsqr]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\e8adf764]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hid_start]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Host Process]
Save the File as CFScript(exactly as shown no spaces) ->> Save it to your Desktop
Using the Image as a reference, drag CFScript into ComboFix.exe
- You will be prompted to run Combofix again, Do so
Following the same rules as indicated in my first post
Then post the contents of the C:\ComboFix.txt log in your reply
- You will be prompted to run Combofix again, Do so
442
0
Posted November 9th, 2007 23:00
ComboFix 07-11-08.3 - Desiree Weaver 2007-11-10 20:13:21.4 - NTFSx86
Running from: C:\Documents and Settings\Desiree Weaver\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Desiree Weaver\Desktop\CFScript.txt
* Created a new restore pointFILE
C:\Program Files\Online Services\home4444.dll
C:\Program Files\Online Services\home83122.dll
C:\Temp\mZOr
C:\WINDOWS\RGVzaXJlZSBXZWF2ZXI\asappsrv.dll
C:\WINDOWS\RGVzaXJlZSBXZWF2ZXI\command.exe
C:\WINDOWS\RGVzaXJlZSBXZWF2ZXI\l3pWurL5tm1rtqIZtrK.vbs
C:\WINDOWS\system32\baoljcqn.dll
C:\WINDOWS\system32\cvlqknld.exe
C:\WINDOWS\system32\koodgebe.exe
C:\WINDOWS\system32\Mz18r
.((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.C:\Documents and Settings\Desiree Weaver\Application Data\FIRST THE POKE
C:\Documents and Settings\Desiree Weaver\Application Data\FIRST THE POKE\ 0
C:\Program Files\Online Services\home4444.dll
C:\Program Files\Online Services\home83122.dll
C:\WINDOWS\RGVzaXJlZSBXZWF2ZXI
C:\WINDOWS\RGVzaXJlZSBXZWF2ZXI\asappsrv.dll
C:\WINDOWS\RGVzaXJlZSBXZWF2ZXI\command.exe
C:\WINDOWS\RGVzaXJlZSBXZWF2ZXI\l3pWurL5tm1rtqIZtrK.vbs
C:\WINDOWS\system32\AutoRun.inf
C:\WINDOWS\system32\baoljcqn.dll
C:\WINDOWS\system32\cvlqknld.exe
C:\WINDOWS\system32\koodgebe.exe.
((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))).
-------\LEGACY_FAD
((((((((((((((((((((((((( Files Created from 2007-10-11 to 2007-11-11 )))))))))))))))))))))))))))))))
.2007-11-09 19:49d-------- C:\Program Files\Hewlett-Packard
2007-11-09 19:47 130,463 --a------ C:\WINDOWS\hpoins21.dat
2007-11-09 19:47 8,138 --------- C:\WINDOWS\hpomdl21.dat
2007-11-09 02:11d-------- C:\Program Files\Broadcom
2007-11-09 01:24d-------- C:\~ErdUserProfile.$$$
2007-11-06 22:15d-------- C:\Program Files\bb
2007-11-04 20:08 786 --a------ C:\4484.bat
2007-11-04 19:57 786 --a------ C:\1490.bat
2007-11-04 19:48d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2007-11-04 19:41 12,413,440 --a------ C:\avgas-setup-7.5.1.43.exe
2007-11-04 19:33 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-11-04 19:02 786 --a------ C:\7975.bat
2007-11-04 18:52d-------- C:\Program Files\ahead
2007-11-04 18:16 786 --a------ C:\4644.bat
2007-11-04 17:21 14,291,508 --a------ C:\dat-5155.zip
2007-11-04 16:56 786 --a------ C:\1545.bat
2007-11-04 16:47d-------- C:\Program Files\QdrModule
2007-11-04 16:47d-------- C:\Program Files\QdrDrive
2007-11-04 15:24d-------- C:\hijack
2007-11-04 10:59 786 --a------ C:\1527.bat
2007-11-04 10:58 786 --a------ C:\4851.bat
2007-11-04 10:39 786 --a------ C:\7402.bat
2007-11-04 10:09d-------- C:\QUARANTINE
2007-11-04 09:57 786 --a------ C:\5017.bat
2007-11-04 09:51 23,211,238 --a------ C:\sdat5155.exe
2007-11-04 09:12 786 --a------ C:\1516.bat
2007-11-04 08:28d-------- C:\WINDOWS\system32\config\systemprofile\Application Data\HPAppData
2007-11-04 08:22 786 --a------ C:\5691.bat
2007-11-04 08:21d-------- C:\WINDOWS\system32\Mz18r
2007-11-04 08:21d-------- C:\Temp\mZOr
2007-11-04 08:21d-------- C:\Temp
2007-11-04 08:21 786 --a------ C:\9806.bat
2007-11-03 16:48d-------- C:\Documents and Settings\All Users\Application Data\Mfcd upload army browse
2007-11-02 09:30d-------- C:\Program Files\mIRC
2007-11-02 09:30d-------- C:\Documents and Settings\Desiree Weaver\Application Data\mIRC
2007-11-02 08:19d-------- C:\Documents and Settings\Desiree Weaver\Application Data\Arcsoft
2007-11-02 05:20 14,115,766 --a------ C:\scan.dat
2007-11-02 05:20 1,296,499 --a------ C:\clean.dat
2007-11-02 05:20 810,192 --a------ C:\names.dat
2007-11-02 05:20 51,200 --a------ C:\validate.exe
2007-11-01 19:53d-------- C:\Program Files\Ultrasoft
2007-11-01 19:53 122,880 --a------ C:\WINDOWS\ctpu.exe
2007-11-01 19:53 57,344 --a------ C:\WINDOWS\ResENU.dll
2007-11-01 18:30d-------- C:\Program Files\Documents To Go
2007-11-01 18:30d-------- C:\Program Files\Common Files\DataViz
2007-11-01 18:30d-------- C:\Documents and Settings\All Users\Application Data\DataViz
2007-11-01 18:28d-------- C:\Documents and Settings\All Users\Application Data\HotSync
2007-11-01 18:28 53,248 --a------ C:\WINDOWS\PalmDevC.dll
2007-11-01 18:27d-------- C:\Program Files\Palm
2007-11-01 18:25d-------- C:\Documents and Settings\Desiree Weaver\Application Data\HotSync
2007-10-21 10:24d-------- C:\Documents and Settings\All Users\Application Data\WEBREG
2007-10-21 10:22d-------- C:\Documents and Settings\All Users\Application Data\Hewlett-Packard
2007-10-21 10:22 267,864 -ra------ C:\WINDOWS\system32\hpzids01.dll
2007-10-21 10:22 267,864 -ra------ C:\hpzids01.dll
2007-10-21 10:20 954,368 -ra------ C:\WINDOWS\system32\hpotiop5.dll
2007-10-21 10:20 675,840 -ra------ C:\WINDOWS\system32\hpowiax5.dll
2007-10-21 10:20 364,544 -ra------ C:\WINDOWS\system32\hppldcoi.dll
2007-10-21 10:20 309,760 -ra------ C:\WINDOWS\system32\difxapi.dll
2007-10-21 10:20 303,104 -ra------ C:\WINDOWS\system32\hpovst12.dll
2007-10-21 10:20 6,784 --a------ C:\WINDOWS\system32\drivers\serscan.sys
2007-10-21 10:20 6,784 --a------ C:\WINDOWS\system32\dllcache\serscan.sys
2007-10-21 09:42d-------- C:\Documents and Settings\Desiree Weaver\Application Data\HP
2007-10-21 09:29d-------- C:\Documents and Settings\All Users\Application Data\HP
2007-10-21 09:28d-------- C:\Program Files\Common Files\HP
2007-10-21 09:26d-------- C:\Program Files\Common Files\Hewlett-Packard
2007-10-21 09:22d-------- C:\Program Files\HP
2007-10-21 09:22 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2007-10-21 09:22 31,616 --a------ C:\WINDOWS\system32\dllcache\usbccgp.sys
2007-10-21 09:22 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2007-10-21 09:22 25,856 --a------ C:\WINDOWS\system32\dllcache\usbprint.sys
2007-10-11 14:31 582,656 --------- C:\WINDOWS\system32\dllcache\rpcrt4.dll.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-09 08:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-09 07:04 --------- d-----w C:\Program Files\Dell
2007-11-06 11:48 --------- d-----w C:\Program Files\Paint Shop Pro 5
2007-11-04 15:17 --------- d-----w C:\Program Files\McAfee
2007-11-02 00:24 16,694 ----a-w C:\WINDOWS\system32\drivers\PalmUSBD.sys
2006-06-08 22:36 124 ----a-w C:\Program Files\ZEN V Series Media Explorer.lnk
.((((((((((((((((((((((((((((( snapshot@2007-11-08_23.17.06.59 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-10-29 23:56:19 136,192 ----a-w C:\WINDOWS\catchme.exe
+ 2007-11-08 22:59:01 136,704 ----a-w C:\WINDOWS\catchme.exe
- 2007-03-13 15:57:10 163,328 ----a-w C:\WINDOWS\erdnt\subs\ERDNT.EXE
+ 2007-03-13 16:57:10 163,328 ----a-w C:\WINDOWS\erdnt\subs\ERDNT.EXE
+ 2007-05-09 10:17:23 4,608 ----a-r C:\WINDOWS\Installer\{86BF5788-CC6C-49CD-B0D0-199C02AD4CEE}\IconFB6D64D0.exe
+ 2007-11-09 08:11:32 3,262 ----a-r C:\WINDOWS\Installer\{C99C0593-3B48-41D9-B42F-6E035B320449}\ARPPRODUCTICON.exe
+ 2007-11-09 08:11:32 40,960 ----a-r C:\WINDOWS\Installer\{C99C0593-3B48-41D9-B42F-6E035B320449}\NewShortcut1.FCA9991C_BA96_4189_B2BE_13852649CA68.exe
- 2005-09-09 00:20:04 89,088 ----a-w C:\WINDOWS\system32\atl71.dll
+ 2007-03-17 00:10:48 89,088 ----a-w C:\WINDOWS\system32\ATL71.DLL
+ 2007-03-17 00:10:48 757,760 ----a-w C:\WINDOWS\system32\bcm1xsup.dll
+ 2007-03-17 00:10:48 770,048 ----a-w C:\WINDOWS\system32\BCMLogon.dll
+ 2007-03-17 00:10:52 69,632 ----a-w C:\WINDOWS\system32\bcmwlpkt.dll
+ 2007-03-17 00:10:52 1,253,376 ----a-w C:\WINDOWS\system32\BCMWLTRY.EXE
+ 2007-03-17 00:10:54 253,952 ----a-w C:\WINDOWS\system32\bcmwlu00.exe
- 2007-08-13 23:54:10 765,952 ----a-w C:\WINDOWS\system32\dllcache\VGX.dll
+ 2007-07-12 23:31:54 765,952 ----a-w C:\WINDOWS\system32\dllcache\vgx.dll
+ 2007-03-17 00:10:52 33,664 ----a-w C:\WINDOWS\system32\drivers\BCMWLNPF.SYS
+ 2004-10-12 14:16:16 60,496 ----a-w C:\WINDOWS\system32\drivers\Teefer.sys
+ 2004-10-12 14:32:28 14,320 ----a-w C:\WINDOWS\system32\drivers\wg3n.sys
+ 2004-10-12 14:32:30 14,320 ----a-w C:\WINDOWS\system32\drivers\wg4n.sys
+ 2004-10-12 14:32:32 14,320 ----a-w C:\WINDOWS\system32\drivers\wg5n.sys
+ 2004-10-12 14:32:36 14,320 ----a-w C:\WINDOWS\system32\drivers\wg6n.sys
+ 2004-10-12 14:17:58 21,075 ----a-w C:\WINDOWS\system32\drivers\wpsdrvnt.sys
+ 2004-10-12 14:31:34 99,480 ----a-w C:\WINDOWS\system32\FwsVpn.dll
- 2004-09-01 16:56:46 1,060,864 ----a-w C:\WINDOWS\system32\mfc71.dll
+ 2007-03-17 00:10:54 1,060,864 ----a-w C:\WINDOWS\system32\MFC71.DLL
- 2007-05-07 16:04:51 72,014 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2007-11-11 02:07:45 72,014 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2007-05-07 16:04:51 423,708 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2007-11-11 02:07:45 423,708 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2007-03-17 00:10:54 86,016 ----a-w C:\WINDOWS\system32\preflib.dll
+ 2004-10-12 14:31:30 218,264 ----a-w C:\WINDOWS\system32\SetAid.dll
+ 2004-10-12 14:31:48 83,096 ----a-w C:\WINDOWS\system32\SSSensor.dll
- 2007-07-22 23:39:27 279,552 ----a-w C:\WINDOWS\system32\swreg.exe
+ 2007-07-23 00:39:27 279,552 ----a-w C:\WINDOWS\system32\swreg.exe
+ 2007-03-17 00:10:54 2,129,920 ----a-w C:\WINDOWS\system32\WLBCGCBPRO731.DLL
+ 2007-03-17 00:10:54 1,392,640 ----a-w C:\WINDOWS\system32\WLTRAY.EXE
+ 2007-03-17 00:10:54 44,032 ----a-w C:\WINDOWS\system32\wltrynt.dll
+ 2007-03-17 00:10:54 20,480 ----a-w C:\WINDOWS\system32\WLTRYSVC.EXE
+ 2007-11-10 01:49:16 1,230,336 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.1.0.0_x-ww_b319d8da\msxml4.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{875A1348-7674-42aa-ADAC-B4F36A004A2D}]
2007-10-27 13:37 192512 --a------ C:\Program Files\QdrDrive\QdrDrive8.dll[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"e8adf764"="C:\WINDOWS\system32\kereabay.dll" [2007-05-07 11:49]
"Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY.exe" [2007-03-16 18:10]
"ShStatEXE"="C:\Program Files\Network Associates\VirusScan\SHSTAT.exe" [2004-08-18 07:00]
"McAfeeUpdaterUI"="C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" [2004-08-06 02:50]
"Network Associates Error Reporting Service"="C:\Program Files\Common Files\Network Associates\TalkBack\tbmon.exe" [2003-10-07 08:48]
"SmcService"="C:\PROGRA~1\Sygate\SSA\smc.exe" [2004-10-12 08:32][HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Uniblue RegistryBooster 2"="C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe" [2007-10-22 09:12]
"QdrModule9"="C:\Program Files\QdrModule\QdrModule9.exe" [2007-11-01 13:51]
"DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 10:09]
"CTSyncU.exe"="C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe" [2006-08-07 09:06]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 04:00][HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
C:\Program Files\Intel\Wireless\Bin\LgNotify.dll 2004-09-07 15:08 110592 C:\Program Files\Intel\Wireless\Bin\LgNotify.dll[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^DataViz Inc Messenger.lnk]
backup=C:\WINDOWS\pss\DataViz Inc Messenger.lnkCommon Startup[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
backup=C:\WINDOWS\pss\Digital Line Detect.lnkCommon Startup[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HOTSYNCSHORTCUTNAME.lnk]
backup=C:\WINDOWS\pss\HOTSYNCSHORTCUTNAME.lnkCommon Startup[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
backup=C:\WINDOWS\pss\Kodak EasyShare software.lnkCommon Startup[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Service Manager.lnk]
backup=C:\WINDOWS\pss\Service Manager.lnkCommon Startup[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!AVG Anti-Spyware][HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Army browse cdrom vga][HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]
c:\quickenw\BILLMNDW.EXE[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Long bend][HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]R1 NaiAvTdi1;NaiAvTdi1;C:\WINDOWS\system32\drivers\mvstdi5x.sys
R2 HPSLPSVC;HP Network Devices Support;C:\WINDOWS\system32\svchost.exe -k HPService
R3 dsNcAdpt;Juniper Network Connect Adapter;C:\WINDOWS\system32\DRIVERS\dsNcAdpt.sys
R3 NeroCd2k;NeroCd2k;C:\WINDOWS\system32\drivers\NeroCd2k.sys
S3 magaService;Lan Discover Agent;C:\Program Files\Sygate\SSA\maga\maga.exe[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt hpqcxs08
HPService HPSLPSVC[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{02e02a9e-39ea-11db-b076-00038a000015}]
\Shell\AutoRun\command - E:\setupSNK.exe*Newly Created Service* - ENTDRV51
.
Contents of the 'Scheduled Tasks' folder
"2007-05-09 11:00:00 C:\WINDOWS\Tasks\A5B044919113FF91.job"
.
**************************************************************************catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-10 20:19:08
Windows 5.1.2600 Service Pack 2 NTFSscanning hidden processes ...scanning hidden autostart entries ...scanning hidden files ...scan completed successfully
hidden files: 0**************************************************************************
.
Completion time: 2007-11-10 20:20:56 - machine was rebooted
C:\ComboFix2.txt ... 2007-11-08 23:17
C:\ComboFix3.txt ... 2007-11-06 22:22
.
--- E O F ---442
0
Posted November 11th, 2007 11:00
dlerdw
Run an online virus scan called Kaspersky from HERE.
- 1. Click on " Kaspersky Online Scanner"
2. A new smaller window will pop up. Press on " Accept". After reading the contents.
3. Now Kaspersky will update the anti-virus database. Let it run.
4. Click on " Next"->>" Scan Settings", and make sure the database is set to " extended". And check both the scan options. Then click OK.
5. Then click on " My Computer". And the scan will start.
6. When the scan is complete Select "Save error report as"
Then in the file name just type in kaspersky
Under "save as type" select text .txt
Save it to your Desktop.
Copy and post the results of the Kaspersky Online scan
==========
Note: For IE7 uers. You may get returned to a window without the Accept/Decline buttons after allowing the ActiveX control. The buttons are there - you just can't see them! Click on the zoom button (bottom, right of the window) and change it from 100% to 75%. You should now see the buttons. Reset to 100% once the license has been accepted.
- 1. Click on " Kaspersky Online Scanner"
360
0
Posted November 11th, 2007 14:00
-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Monday, November 12, 2007 11:43:29 AM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 11/11/2007
Kaspersky Anti-Virus database records: 456397
-------------------------------------------------------------------------------Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: trueScan Target - My Computer:
C:\
D:\Scan Statistics:
Total number of scanned objects: 48322
Number of viruses found: 22
Number of infected objects: 50
Number of suspicious objects: 2
Duration of the scan process: 01:22:57Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Network Associates\BOPDATA\_Date-20071112_Time-093631390_EnterceptExceptions.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Network Associates\BOPDATA\_Date-20071112_Time-093631390_EnterceptRules.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Network Associates\Common Framework\Db\Agent_DESIREE.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Network Associates\Common Framework\Db\PrdMgr_DESIREE.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Network Associates\VirusScan\AccessProtectionLog.txt Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Network Associates\VirusScan\BufferOverflowProtectionLog.txt Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Network Associates\VirusScan\OnAccessScanLog.txt Object is locked skipped
C:\Documents and Settings\All Users\Application Data\QSLLPSVCShare Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WebBuyingAssistant.zip/v1.8.5/wbuninst.exe Suspicious: Password-protected-EXE skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WebBuyingAssistant.zip ZIP: suspicious - 1 skipped
C:\Documents and Settings\Desiree Weaver\Application Data\Gtek\GTUpdate\AUpdate\DellSupport\DSAgnt.log Object is locked skipped
C:\Documents and Settings\Desiree Weaver\Application Data\Gtek\GTUpdate\AUpdate\DellSupport\DSAgnt_GTActions.log Object is locked skipped
C:\Documents and Settings\Desiree Weaver\Application Data\Gtek\GTUpdate\AUpdate\DellSupport\gdql_d_DSAgnt.log Object is locked skipped
C:\Documents and Settings\Desiree Weaver\Application Data\Gtek\GTUpdate\AUpdate\DellSupport\glog.log Object is locked skipped
C:\Documents and Settings\Desiree Weaver\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Desiree Weaver\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped
C:\Documents and Settings\Desiree Weaver\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Desiree Weaver\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Desiree Weaver\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Desiree Weaver\Local Settings\History\History.IE5\MSHist012007111220071113\index.dat Object is locked skipped
C:\Documents and Settings\Desiree Weaver\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\Desiree Weaver\Local Settings\Temporary Internet Files\Content.IE5\4RKB45FG\main_banner_v2b[1].swf Object is locked skipped
C:\Documents and Settings\Desiree Weaver\Local Settings\Temporary Internet Files\Content.IE5\H8E5BHD8\main_banner_v2b[1].swf Object is locked skipped
C:\Documents and Settings\Desiree Weaver\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Desiree Weaver\Local Settings\Temporary Internet Files\Content.IE5\V2TD7DZZ\main_banner_v2b[1].swf Object is locked skipped
C:\Documents and Settings\Desiree Weaver\Local Settings\Temporary Internet Files\Content.IE5\V2TD7DZZ\main_banner_v2b[2].swf Object is locked skipped
C:\Documents and Settings\Desiree Weaver\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Desiree Weaver\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Desiree Weaver\Shared\[Full] apollo mpeg to dvd burner with Bonus.zip/setup.exe/data0006/stream/data0004 Infected: not-a-virus:AdWare.Win32.BHO.ha skipped
C:\Documents and Settings\Desiree Weaver\Shared\[Full] apollo mpeg to dvd burner with Bonus.zip/setup.exe/data0006/stream Infected: not-a-virus:AdWare.Win32.BHO.ha skipped
C:\Documents and Settings\Desiree Weaver\Shared\[Full] apollo mpeg to dvd burner with Bonus.zip/setup.exe/data0006 Infected: not-a-virus:AdWare.Win32.BHO.ha skipped
C:\Documents and Settings\Desiree Weaver\Shared\[Full] apollo mpeg to dvd burner with Bonus.zip/setup.exe Infected: not-a-virus:AdWare.Win32.BHO.ha skipped
C:\Documents and Settings\Desiree Weaver\Shared\[Full] apollo mpeg to dvd burner with Bonus.zip ZIP: infected - 4 skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Juniper Networks\Common Files\NCService.log Object is locked skipped
C:\Program Files\Messenger\prohdyhde.html Infected: Trojan-Clicker.HTML.IFrame.dn skipped
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Data\master.mdf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Data\mastlog.ldf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Data\model.mdf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Data\modellog.ldf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Data\tempdb.mdf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Data\templog.ldf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\LOG\ERRORLOG Object is locked skipped
C:\Program Files\mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.631 skipped
C:\Program Files\Sygate\SSA\debug.log Object is locked skipped
C:\Program Files\Sygate\SSA\rawlog.log Object is locked skipped
C:\Program Files\Sygate\SSA\seclog.log Object is locked skipped
C:\Program Files\Sygate\SSA\syslog.log Object is locked skipped
C:\Program Files\Sygate\SSA\tralog.log Object is locked skipped
C:\qoobox\Quarantine\C\a.exe.vir/data0006 Infected: Trojan-Downloader.Win32.VB.bqc skipped
C:\qoobox\Quarantine\C\a.exe.vir NSIS: infected - 1 skipped
C:\qoobox\Quarantine\C\Program Files\Online Services\home4444.dll.vir Infected: not-a-virus:AdWare.Win32.TTC.a skipped
C:\qoobox\Quarantine\C\Program Files\Online Services\home83122.dll.vir Infected: not-a-virus:AdWare.Win32.TTC.a skipped
C:\qoobox\Quarantine\C\WINDOWS\b104.exe.vir/stream/data0002 Infected: Trojan-Downloader.Win32.Small.buy skipped
C:\qoobox\Quarantine\C\WINDOWS\b104.exe.vir/stream/data0004 Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\qoobox\Quarantine\C\WINDOWS\b104.exe.vir/stream Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\qoobox\Quarantine\C\WINDOWS\b104.exe.vir NSIS: infected - 3 skipped
C:\qoobox\Quarantine\C\WINDOWS\b138.exe.vir Infected: Trojan-Downloader.Win32.Agent.cbx skipped
C:\qoobox\Quarantine\C\WINDOWS\mrofinu1000106.exe.vir Infected: Trojan-Downloader.Win32.Agent.emo skipped
C:\qoobox\Quarantine\C\WINDOWS\mrofinu1188.exe.vir Infected: Trojan-Downloader.Win32.Agent.emo skipped
C:\qoobox\Quarantine\C\WINDOWS\RGVzaXJlZSBXZWF2ZXI\asappsrv.dll.vir Infected: not-a-virus:AdWare.Win32.CommAd.a skipped
C:\qoobox\Quarantine\C\WINDOWS\RGVzaXJlZSBXZWF2ZXI\command.exe.vir Infected: not-a-virus:AdWare.Win32.CommAd.a skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\a1\rarndrll2.exe.vir Infected: Trojan-Downloader.Win32.Small.buy skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\cvlqknld.exe.vir Infected: Trojan.Win32.Obfuscated.kp skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\g2\caws83122.exe.vir/data0002 Infected: not-a-virus:AdWare.Win32.TTC.a skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\g2\caws83122.exe.vir NSIS: infected - 1 skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\jkkhebx.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.ahq skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\jkkhffg.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.ahr skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\koodgebe.exe.vir Infected: Trojan.Win32.Obfuscated.kp skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\luiblcdf.dll.vir Infected: Trojan.Win32.BHO.rg skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\r2\wr31drs.exe.vir Infected: Trojan-Downloader.Win32.Small.gll skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\rxlhrejy.dll.vir Infected: Trojan.Win32.BHO.rf skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\stbmprpu.dll.vir Infected: Trojan.Win32.BHO.rg skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\vefhsmj.dll.vir Infected: not-a-virus:AdWare.Win32.Agent.ta skipped
C:\qoobox\Quarantine\C\WINDOWS\tk58.exe.vir Infected: Trojan.Win32.BHO.ab skipped
C:\qoobox\Quarantine\C\WINDOWS\TTC-4444.exe.vir/data0002 Infected: not-a-virus:AdWare.Win32.TTC.a skipped
C:\qoobox\Quarantine\C\WINDOWS\TTC-4444.exe.vir NSIS: infected - 1 skipped
C:\qoobox\Quarantine\C\z.exe.vir Infected: not-a-virus:PSWTool.Win32.ProtectStorage.b skipped
C:\qoobox\Quarantine\catchme2007-11-08_231557.45.zip/core.sys Infected: Rootkit.Win32.Agent.mb skipped
C:\qoobox\Quarantine\catchme2007-11-08_231557.45.zip/vtutsqr.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ahq skipped
C:\qoobox\Quarantine\catchme2007-11-08_231557.45.zip ZIP: infected - 2 skipped
C:\QUARANTINE\index[2].htm.Vir Infected: Trojan-Downloader.JS.Agent.zz skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP11\A0002576.dll Infected: not-a-virus:AdWare.Win32.CommAd.a skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP11\A0002577.exe Infected: not-a-virus:AdWare.Win32.CommAd.a skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP11\A0002580.dll Infected: not-a-virus:AdWare.Win32.TTC.a skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP11\A0002581.dll Infected: not-a-virus:AdWare.Win32.TTC.a skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP11\A0002583.exe Infected: Trojan.Win32.Obfuscated.kp skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP11\A0002584.exe Infected: Trojan.Win32.Obfuscated.kp skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP11\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\mrofinu1188.exe.tmp Infected: Trojan-Downloader.Win32.Agent.emo skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\DEFAULT Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SYSTEM Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\Mz18r\Mz18r2328.exe Infected: Trojan-Downloader.Win32.VB.bqc skipped
C:\WINDOWS\system32\opnnnmn.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ahq skipped
C:\WINDOWS\system32\pfxvnvsl.exe Infected: Trojan.Win32.Obfuscated.kp skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\TEMP\HPSLPS006.log Object is locked skipped
C:\WINDOWS\TEMP\Perflib_Perfdata_42c.dat Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skippedScan process completed.
bamajim
10376 Posts
443
0
Posted November 7th, 2007 11:00
Please download Combofix and save to your desktop:
Close any open browsers.
Double click on combofix.exe and follow the prompts.
When it's finished it will produce a log.
Post the contents of the C:\ComboFix.txt into your next reply.
Note: Do not mouseclick combofix's window whilst it's running.
That may cause the program to freeze/hang.
"The world is what you make of it"