Login  Malware Removal & HijackThis Logs |
| |
| |
| | Thread Tools |
10-Jun-2008, 02:34 PM
#1 | |||||
| Locked out of System Restore, Task Manager, Windows Security update, etc. Hi, I downloaded file from an unreliable source and gave my system some big problems. It immediately put "Error Cleaner" and "Privacy Protector" shortcuts on my desktop and gave it a url-linked gif background. All my system dates now display with "VIRUS ALERT!" appended, and alert dialog boxes appear at frequent intervals (although not now, running in safe mode). It has hidden many tools and files (Start menu has no Start, Programs, Control Panel; no hard drives visible when I explore "My Computer') and has disabled the Windows Security auto-update (which I can't change). I cannot use the System Restore, and when I look at the System Volume Information\_restore directory, each folder has its rp.log and RestorePointSize files modified. I actually began to follow the advice of another thread and downloaded Kaspersky, but I could not install it. Thanks for any help. My HJT log below: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 14:06: VIRUS ALERT!, on 6/10/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Acer\eManager\anbmServ.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\WINDOWS\system32\fxssvc.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Outlook Express\msimn.exe C:\Program Files\AIM\aim.exe C:\downloads\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php...MjI6Ojg5&lid=2 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://global.acer.com/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll R3 - URLSearchHook: (no name) - _{EA756889-2338-43DB-8F07-D1CA6FB9C90D} - (no file) O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll O3 - Toolbar: rtsplgob - {0939FF27-A717-4F67-96B5-555F9510F17F} - C:\WINDOWS\rtsplgob.dll O4 - HKLM\..\Run: [LaunchApp] Alaunch O4 - HKLM\..\Run: [SynTPLpr] "C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" O4 - HKLM\..\Run: [SynTPEnh] "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Aspire Arcade\PCMService.exe" O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [MSPY2002] "C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe" /SYNC O4 - HKLM\..\Run: [PHIME2002ASync] "C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE" /SYNC O4 - HKLM\..\Run: [PHIME2002A] "C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE" /IMEName O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" O4 - HKLM\..\Run: [LManager] "C:\Program Files\Launch Manager\QtZgAcer.EXE" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [apiuv.exe] C:\WINDOWS\apiuv.exe O4 - HKLM\..\Run: [e0Xf] C:\WINDOWS\iovkidek.exe O4 - HKLM\..\Run: [Akknvwf] C:\Program Files\Fxkbmh\Lbeaysy.exe O4 - HKLM\..\Run: [VerizonServicepoint.exe] "C:\Program Files\Verizon\Servicepoint\VerizonServicepoint.exe" O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [NoteBurner] C:\Program Files\NoteBurner\VTBurnerGUI.exe /silence O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [advap32] C:\DOCUME~1\ACERUS~1\LOCALS~1\Temp\printsrv.exe/r O4 - HKLM\..\Run: [2629165f] rundll32.exe "C:\WINDOWS\system32\qmoffujt.dll",b O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [EasyLinkAdvisor] "C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - S-1-5-18 Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (User 'SYSTEM') O4 - .DEFAULT Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (User 'Default user') O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 O8 - Extra context menu item: &AOL Toolbar Search - res://c:\program files\aol\aol toolbar 2.0\aoltbhtml.dll/search.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: *.frame.crazywinnings.com O15 - Trusted Zone: *.static.topconverting.com O15 - Trusted Zone: *.05p.com (HKLM) O15 - Trusted Zone: *.awmdabest.com (HKLM) O15 - Trusted Zone: *.blazefind.com (HKLM) O15 - Trusted Zone: *.clickspring.net (HKLM) O15 - Trusted Zone: *.flingstone.com (HKLM) O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM) O15 - Trusted Zone: *.mt-download.com (HKLM) O15 - Trusted Zone: *.my-internet.info (HKLM) O15 - Trusted Zone: *.scoobidoo.com (HKLM) O15 - Trusted Zone: *.searchbarcash.com (HKLM) O15 - Trusted Zone: *.searchmiracle.com (HKLM) O15 - Trusted Zone: *.slotch.com (HKLM) O15 - Trusted Zone: *.static.topconverting.com (HKLM) O15 - Trusted Zone: *.xxxtoolbar.com (HKLM) O15 - Trusted IP range: 206.161.125.149 (HKLM) O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/noc...1.0.0.15-3.cab O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1213095264416 O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://share.adoramapix.com/componen...eUploader4.cab O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://sdlc-esd.sun.com/ESD39/JSCDL/...ws-i586-jc.cab O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://www.adoramapix.com/components/ImageUploader3.cab O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/.../installer.exe O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O21 - SSODL: xkefqtgs - {AC858574-3F5C-4736-BA9D-0B2C4594843F} - C:\WINDOWS\xkefqtgs.dll O21 - SSODL: rnopbfgt - {705D4667-8154-4B4E-B7A7-6867F63A0930} - C:\WINDOWS\rnopbfgt.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe O24 - Desktop Component 1: Privacy Protection - file:///C:\WINDOWS\privacy_danger\index.htm -- End of file - 12767 bytes |
| |
13-Jun-2008, 01:41 PM
#2 | |||||
| Hi and welcome to TSG, Close/disable all anti-virus and anti-malware programs so they do not interfere with the running of SDFix and make sure you are disconnected from the Internet after downloading the program but before extracting the files.
Download SDFix and save it to your Desktop. Double click SDFix.exe and it will extract the files to %systemdrive% (Drive that contains the Windows Directory, typically C:\SDFix) Please then reboot your computer in Safe Mode by doing the following :
Note: During this process, it would help a great deal and be very much appreciated if you would refrain from installing any new software or hardware on this machine, unless absolutely necessary, until the clean up process is finished as it makes our job more tedious, with additional new files that may have to be researched, which is very time consuming. Also, please do not run any security programs or fixes on your own as doing so may compromise what we will be doing. It is important that you wait for instructions.
__________________ Microsoft MVP - Consumer Security Alliance of Security Analysis Professionals |
16-Jun-2008, 12:20 AM
#3 | |||||
| after running SDFix.exe Hi and thanks for replying to my post. I had run ComboFix before your reply (I hope that was not bad--was desperate to use the computer in the intervening days). After running ComboFix in safe mode, my date/clock settings were restored, the warning desktop image and shortcuts were deleted, and I was able to access the task manager. But when I restarted the computer normally, the original problems returned, complete with the frequent virus alert dialog boxes. I went back to running in safe mode, ran ComboFix again, and stayed in safe mode until I got your reply. Then I followed your instructions. Below is the SDFix report followed by the latest HJT log. (looking at the log-if you have time, how do I get rid of bogus trusted Internet zones? when I remove them via the Security tab of the Internet Options panel, it doesn't take.) Thank you again! ----------------- SDFix: Version 1.192 Run by ACER USER on Sat 06/14/2008 at 14:31 Microsoft Windows XP [Version 5.1.2600] Running From: C:\SDFix Checking Services : Restoring Windows Registry Values Restoring Windows Default Hosts File Restoring Default HomePage Value Restoring Default Desktop Components Value Rebooting Checking Files : Trojan Files Found: C:\WINDOWS\pebgkxwq.exe - Deleted C:\WINDOWS\rnopbfgt.dll - Deleted C:\WINDOWS\xkefqtgs.dll - Deleted Removing Temp Files ADS Check : Final Check : catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-14 14:42:47 Windows 5.1.2600 Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden services ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services : Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameter s\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enable d:@xpsp2res.dll,-22019" "C:\\Program Files\\Messenger\\MSMSGS.EXE"="C:\\Program Files\\Messenger\\MSMSGS.EXE:*:Enabled:Windows Messenger" "C:\\Program Files\\eMule\\EMULE.EXE"="C:\\Program Files\\eMule\\EMULE.EXE:*:Enabled:eMule" "C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour" "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameter s\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enable d:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" Remaining Files : File Backups: - C:\SDFix\backups\backups.zip Files with Hidden Attributes : Mon 5 Jul 2004 1,024 ...HR --- "C:\WINDOWS\system32\NTIMPEG2.dll" Mon 5 Jul 2004 1,024 ...HR --- "C:\WINDOWS\system32\NTICDMK32.dll" Mon 5 Jul 2004 1,024 ...HR --- "C:\WINDOWS\system32\ntiembed.dll" Wed 17 Aug 2005 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Sat 6 Aug 2005 24,576 ...H. --- "C:\Documents and Settings\ACER USER\My Documents\~WRL0001.tmp" Sun 11 Nov 2007 25,088 ...H. --- "C:\Documents and Settings\ACER USER\My Documents\~WRL3623.tmp" Sun 16 Mar 2008 24,064 ...H. --- "C:\Documents and Settings\ACER USER\My Documents\~WRL1945.tmp" Sun 16 Mar 2008 24,064 ...H. --- "C:\Documents and Settings\ACER USER\My Documents\~WRL0141.tmp" Sun 16 Mar 2008 24,064 ...H. --- "C:\Documents and Settings\ACER USER\My Documents\~WRL0983.tmp" Sun 16 Mar 2008 24,576 ...H. --- "C:\Documents and Settings\ACER USER\My Documents\~WRL2670.tmp" Thu 8 May 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\385cb67dda0ffd4dea8c0d990dc65796\ BIT3A.tmp" Thu 14 Dec 2006 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp" Mon 12 Nov 2007 20,992 ...H. --- "C:\Documents and Settings\ACER USER\Application Data\Microsoft\Word\~WRL1772.tmp" Mon 12 Feb 2007 3,096,576 A..H. --- "C:\Documents and Settings\ACER USER\Application Data\U3\temp\Launchpad Removal.exe" Thu 5 Jun 2008 8 A..H. --- "C:\Documents and Settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch1\lock.tmp" Thu 5 Jun 2008 8 A..H. --- "C:\Documents and Settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch2\lock.tmp" Thu 5 Jun 2008 8 A..H. --- "C:\Documents and Settings\ACER USER\Application Data\GTek\GTUpdate\AUpdate\Channels\ch_u1\lock.tmp" Thu 5 Jun 2008 8 A..H. --- "C:\Documents and Settings\ACER USER\Application Data\GTek\GTUpdate\AUpdate\Channels\ch_u2\lock.tmp" Finished! ------------------------ Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 00:14, on 6/16/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\WINDOWS\system32\spoolsv.exe C:\Acer\eManager\anbmServ.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Aspire Arcade\PCMService.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Launch Manager\QtZgAcer.EXE C:\Program Files\QuickTime\qttask.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Verizon\Servicepoint\VerizonServicepoint.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\AIM\aim.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe C:\Program Files\WinZip\WZQKPICK.EXE C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe C:\Program Files\Outlook Express\msimn.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\downloads\HiJackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://global.acer.com/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R3 - URLSearchHook: (no name) - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - (no file) R3 - URLSearchHook: (no name) - _{EA756889-2338-43DB-8F07-D1CA6FB9C90D} - (no file) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file) O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file) O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll O4 - HKLM\..\Run: [LaunchApp] Alaunch O4 - HKLM\..\Run: [SynTPLpr] "C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" O4 - HKLM\..\Run: [SynTPEnh] "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Aspire Arcade\PCMService.exe" O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [MSPY2002] "C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe" /SYNC O4 - HKLM\..\Run: [PHIME2002ASync] "C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE" /SYNC O4 - HKLM\..\Run: [PHIME2002A] "C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE" /IMEName O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" O4 - HKLM\..\Run: [LManager] "C:\Program Files\Launch Manager\QtZgAcer.EXE" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [apiuv.exe] C:\WINDOWS\apiuv.exe O4 - HKLM\..\Run: [e0Xf] C:\WINDOWS\iovkidek.exe O4 - HKLM\..\Run: [Akknvwf] C:\Program Files\Fxkbmh\Lbeaysy.exe O4 - HKLM\..\Run: [VerizonServicepoint.exe] "C:\Program Files\Verizon\Servicepoint\VerizonServicepoint.exe" O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [NoteBurner] C:\Program Files\NoteBurner\VTBurnerGUI.exe /silence O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [EasyLinkAdvisor] "C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - S-1-5-18 Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (User 'SYSTEM') O4 - .DEFAULT Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (User 'Default user') O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE O8 - Extra context menu item: &AOL Toolbar Search - res://c:\program files\aol\aol toolbar 2.0\aoltbhtml.dll/search.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: *.frame.crazywinnings.com O15 - Trusted Zone: *.static.topconverting.com O15 - Trusted Zone: *.05p.com (HKLM) O15 - Trusted Zone: *.awmdabest.com (HKLM) O15 - Trusted Zone: *.blazefind.com (HKLM) O15 - Trusted Zone: *.clickspring.net (HKLM) O15 - Trusted Zone: *.flingstone.com (HKLM) O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM) O15 - Trusted Zone: *.mt-download.com (HKLM) O15 - Trusted Zone: *.my-internet.info (HKLM) O15 - Trusted Zone: *.scoobidoo.com (HKLM) O15 - Trusted Zone: *.searchbarcash.com (HKLM) O15 - Trusted Zone: *.searchmiracle.com (HKLM) O15 - Trusted Zone: *.slotch.com (HKLM) O15 - Trusted Zone: *.static.topconverting.com (HKLM) O15 - Trusted Zone: *.xxxtoolbar.com (HKLM) O15 - Trusted IP range: 206.161.125.149 (HKLM) O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/noc...1.0.0.15-3.cab O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1213095264416 O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://share.adoramapix.com/componen...eUploader4.cab O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://sdlc-esd.sun.com/ESD39/JSCDL/...ws-i586-jc.cab O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://www.adoramapix.com/components/ImageUploader3.cab O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/.../installer.exe O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe -- End of file - 13571 bytes |
16-Jun-2008, 12:33 PM
#4 | |||||
| You should never run ComboFix on your own as it's a very powerful tool and you could seriously damage your system. Since you have run it, I would like to see the logs from each of the scans you did so please post them. |
17-Jun-2008, 07:33 AM
#5 | |||||
| Sorry, I didn't know or think about what damage I could do with ComboFix (was following the first step in a similar thread before this one received a reply). I looked for the logs and realized I ran it four times (there's desperation for you). Below are the first and last log files: ------------------ ComboFix 08-06-10.5 - ACER USER 2008-06-11 22:59:53.1 - FAT32x86 DSREPAIR Running from: C:\downloads\ComboFix.exe WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\ACER USER\Desktop\Error Cleaner.url C:\Documents and Settings\ACER USER\Desktop\Privacy Protector.url C:\Documents and Settings\ACER USER\Desktop\Spyware&Malware Protection.url C:\Documents and Settings\ACER USER\Favorites\Error Cleaner.url C:\Documents and Settings\ACER USER\Favorites\Privacy Protector.url C:\Documents and Settings\ACER USER\Favorites\Spyware&Malware Protection.url C:\WINDOWS\cookies.ini C:\WINDOWS\kvsdpfeaxpf.dll C:\WINDOWS\privacy_danger C:\WINDOWS\privacy_danger\images\capt.gif C:\WINDOWS\privacy_danger\images\danger.jpg C:\WINDOWS\privacy_danger\images\down.gif C:\WINDOWS\privacy_danger\images\spacer.gif C:\WINDOWS\privacy_danger\index.htm C:\WINDOWS\rtsplgob.dll C:\WINDOWS\smdat32a.sys C:\WINDOWS\smdat32m.sys C:\WINDOWS\system32\ftoemhku.ini C:\WINDOWS\system32\jowitluj.ini C:\WINDOWS\system32\JRCJRqru.ini C:\WINDOWS\system32\JRCJRqru.ini2 C:\WINDOWS\system32\ljJBsRHB.dll C:\WINDOWS\system32\mcrh.tmp C:\WINDOWS\system32\qmoffujt.dll C:\WINDOWS\system32\tjuffomq.ini C:\WINDOWS\system32\ukhmeotf.dll C:\WINDOWS\system32\urqRJCRJ.dll . ((((((((((((((((((((((((( Files Created from 2008-05-12 to 2008-06-12 ))))))))))))))))))))))))))))))) . 2008-06-10 22:09 . 2008-06-10 22:09 <DIR> d-------- C:\Program Files\RegCure 2008-06-10 22:00 . 2008-06-10 22:00 93,056 --a------ C:\WINDOWS\system32\jultiwoj.dll 2008-06-10 14:02 . 2008-06-10 14:02 <DIR> d-------- C:\kav 2008-06-10 06:08 . 2008-06-09 21:28 253,952 --a------ C:\WINDOWS\rnopbfgt.dll 2008-06-10 06:08 . 2008-06-09 21:28 225,280 --a------ C:\WINDOWS\xkefqtgs.dll 2008-06-10 06:08 . 2008-06-09 21:28 163,840 --a------ C:\WINDOWS\pebgkxwq.exe 2008-06-10 06:08 . 2008-06-09 21:28 139,264 --a------ C:\WINDOWS\esrt.exe 2008-06-05 22:43 . 2008-06-05 22:43 47,180 --a------ C:\WINDOWS\system32\OEMINFO.PNF 2008-06-05 22:41 . 2008-06-05 22:41 <DIR> d--h----- C:\Documents and Settings\ACER USER\Application Data\GTek 2008-06-05 22:36 . 2008-06-05 22:36 <DIR> d-------- C:\Program Files\Linksys EasyLink Advisor 2008-06-05 22:36 . 2008-06-05 22:37 <DIR> d-ah----- C:\Documents and Settings\All Users\Application Data\GTek 2008-06-05 22:34 . 2008-06-05 22:34 <DIR> d-------- C:\Linksys WRT54G (E) 2008-06-04 12:14 . 2008-06-04 12:14 <DIR> d-------- C:\actionscriptstuff 2008-06-03 11:05 . 2008-06-03 11:05 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\FLEXnet 2008-06-03 09:41 . 2008-06-03 09:41 <DIR> d-------- C:\Program Files\Bonjour 2008-06-03 09:32 . 2008-06-03 09:32 <DIR> d-------- C:\Program Files\Common Files\Macrovision Shared 2008-06-01 21:57 . 2008-06-01 21:57 1,160 --a------ C:\WINDOWS\mozver.dat 2008-06-01 21:56 . 2008-06-01 21:56 0 --a------ C:\WINDOWS\nsreg.dat 2008-05-23 11:44 . 2008-05-23 11:44 1,192 --a------ C:\net_save.dna 2008-05-23 11:43 . 2008-05-23 11:43 <DIR> d-------- C:\Program Files\support.com 2008-05-23 11:43 . 2008-05-23 11:43 <DIR> d-------- C:\Program Files\Common Files\SupportSoft 2008-05-20 14:29 . 2008-05-20 14:29 <DIR> d-------- C:\Program Files\Starship Creator 2008-05-17 01:12 . 2008-05-17 01:12 1,409 --a------ C:\WINDOWS\system32\tmp1DB9D.FOT 2008-05-14 12:21 . 2008-05-14 12:21 1,409 --a------ C:\WINDOWS\system32\tmp1A59E.FOT 2008-05-14 11:08 . 2008-05-14 11:08 <DIR> d-------- C:\Program Files\IcoFX 1.6 2008-05-14 11:08 . 2008-05-14 11:08 <DIR> d-------- C:\Documents and Settings\ACER USER\Application Data\IcoFX 2008-05-13 11:13 . 2008-05-13 11:13 1,409 --a------ C:\WINDOWS\system32\tmpF5BA0.FOT 2008-05-13 11:13 . 2008-05-13 11:13 1,409 --a------ C:\WINDOWS\system32\tmp33AA0.FOT . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-03-23 00:45 89,600 ----a-w C:\WINDOWS\system32\atl71.dll 2008-05-31 01:35 805 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF 2008-05-31 01:35 60,800 ----a-w C:\WINDOWS\system32\S32EVNT1.DLL 2008-05-31 01:35 123,952 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS 2008-05-31 01:35 10,671 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT 2008-04-13 04:47 --------- d-----w C:\Program Files\Speed Video Converter 2008-04-13 04:41 --------- d-----w C:\Program Files\Speed Video Splitter 2008-04-02 15:29 94,320 ----a-w C:\Documents and Settings\ACER USER\Application Data\GDIPFONTCACHEV1.DAT 2008-03-27 08:12 151,583 ----a-w C:\WINDOWS\system32\msjint40.dll 2008-03-27 08:12 151,583 ------w C:\WINDOWS\system32\dllcache\msjint40.dll 2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys 2008-03-19 09:47 1,845,248 ------w C:\WINDOWS\system32\dllcache\win32k.sys 2003-01-21 07:00 13,942,408 ----a-r C:\WINDOWS\system32\config\systemprofile\MpSetup.exe 2003-01-21 07:00 13,942,408 ----a-r C:\Documents and Settings\Default User\MpSetup.exe 2003-01-21 07:00 13,942,408 ----a-r C:\Documents and Settings\ACER USER\MpSetup.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{0939FF27-A717-4F67-96B5-555F9510F17F}"= "C:\WINDOWS\rtsplgob.dll" [ ] [HKEY_CLASSES_ROOT\clsid\{0939ff27-a717-4f67-96b5-555f9510f17f}] [HKEY_CLASSES_ROOT\rtsplgob.1] [HKEY_CLASSES_ROOT\TypeLib\{84AEEED9-D8B2-494D-99D3-6DE8BD940ADC}] [HKEY_CLASSES_ROOT\rtsplgob] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56: VIRUS ALERT! 15360] "AIM"="C:\Program Files\AIM\aim.exe" [2005-06-02 01:34: VIRUS ALERT! 67160] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-22 12:19: VIRUS ALERT! 68856] "EasyLinkAdvisor"="C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" [2007-03-15 18:16: VIRUS ALERT! 454784] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "LaunchApp"="Alaunch" [] "SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-05-20 19:57: VIRUS ALERT! 98304] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-05-20 19:57: VIRUS ALERT! 532480] "PCMService"="C:\Program Files\Aspire Arcade\PCMService.exe" [2004-03-25 18:41: VIRUS ALERT! 81920] "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-04 01:32: VIRUS ALERT! 208952] "MSPY2002"="C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe" [2003-03-31 12:00: VIRUS ALERT! 59392] "PHIME2002ASync"="C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.exe" [2003-03-31 12:00: VIRUS ALERT! 455168] "PHIME2002A"="C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.exe" [2003-03-31 12:00: VIRUS ALERT! 455168] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-05-15 21:10: VIRUS ALERT! 339968] "LManager"="C:\Program Files\Launch Manager\QtZgAcer.EXE" [2004-07-05 18:52: VIRUS ALERT! 315392] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24: VIRUS ALERT! 286720] "apiuv.exe"="C:\WINDOWS\apiuv.exe" [ ] "e0Xf"="C:\WINDOWS\iovkidek.exe" [ ] "Akknvwf"="C:\Program Files\Fxkbmh\Lbeaysy.exe" [ ] "VerizonServicepoint.exe"="C:\Program Files\Verizon\Servicepoint\VerizonServicepoint.exe" [2006-02-01 18:33: VIRUS ALERT! 1880064] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-10 01:59: VIRUS ALERT! 115816] "NoteBurner"="C:\Program Files\NoteBurner\VTBurnerGUI.exe" [ ] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-09-14 10:00: VIRUS ALERT! 267064] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-12-08 17:42: VIRUS ALERT! 185896] "Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 17:38: VIRUS ALERT! 583048] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25: VIRUS ALERT! 144784] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 03:56: VIRUS ALERT! 15360] C:\Documents and Settings\ACER USER\Start Menu\Programs\Startup\ Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-10-08 11:27:06 110592] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360] WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [2004-11-12 04:59:09 118784] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableTaskMgr"= 1 (0x1) "DisableRegistryTools"= 1 (0x1) "NoDispCPL"= 1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explor er] "NoToolbarCustomize"= 1 (0x1) "StartMenuLogoff"= 1 (0x1) "NoStartMenuMorePrograms"= 1 (0x1) "NoSetFolders"= 1 (0x1) [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0] Source= file:///C:\WINDOWS\privacy_danger\index.htm FriendlyName= Privacy Protection [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shell executehooks] "{EDB0E980-90BD-11D4-8599-0008C7D3B6F8}"= C:\Program Files\Qualcomm\Eudora\EuShlExt.dll [ ] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceOb jectDelayLoad] "xkefqtgs"= {AC858574-3F5C-4736-BA9D-0B2C4594843F} - C:\WINDOWS\xkefqtgs.dll [2008-06-09 21:28: VIRUS ALERT! 225280] "rnopbfgt"= {705D4667-8154-4B4E-B7A7-6867F63A0930} - C:\WINDOWS\rnopbfgt.dll [2008-06-09 21:28: VIRUS ALERT! 253952] [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\Auth orizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Messenger\\MSMSGS.EXE"= "C:\\Program Files\\eMule\\EMULE.EXE"= "C:\\Program Files\\iTunes\\iTunes.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\Bonjour\\mDNSResponder.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\Glob allyOpenPorts\List] "4662:TCP"= 4662:TCP:eMule "4672:UDP"= 4672:UDP:eMule R1 SMBHC;Microsoft SM Bus Host Controller Driver;C:\WINDOWS\system32\DRIVERS\SMBHC.sys [2001-08-17 13:57: VIRUS ALERT!] R2 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" [2007-01-04 16:38: VIRUS ALERT!] R3 SMBBATT;Microsoft Smart Battery Driver;C:\WINDOWS\system32\DRIVERS\SMBBATT.sys [2004-08-04 02:07: VIRUS ALERT!] S0 ntcdrdrv;ntcdrdrv;C:\WINDOWS\system32\DRIVERS\ntcdrdrv.sys [] S3 hamachi_oem;PlayLinc Adapter;C:\WINDOWS\system32\DRIVERS\gan_adapter.sys [2006-09-27 16:12: VIRUS ALERT!] S3 SndTDriverV32;SndTDriverV32;C:\WINDOWS\system32\drivers\SndTDriverV32.sys [2006-08-11 16:56: VIRUS ALERT!] *Newly Created Service* - COMHOST . Contents of the 'Scheduled Tasks' folder "2008-06-11 02:09:38 C:\WINDOWS\Tasks\RegCure.job" - C:\Program Files\RegCure\RegCure.exe "2008-06-12 03:08:36 C:\WINDOWS\Tasks\RegCure Program Check.job" - C:\Program Files\RegCure\RegCure.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-11 23:09:30 Windows 5.1.2600 Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\SYSTEM32\ATI2EVXX.EXE C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSVCHST.EXE C:\ACER\EMANAGER\ANBMSERV.EXE C:\PROGRAM FILES\COMMON FILES\APPLE\MOBILE DEVICE SUPPORT\BIN\APPLEMOBILEDEVICESERVICE.EXE C:\PROGRAM FILES\SYMANTEC\LIVEUPDATE\ALUSCHEDULERSVC.EXE C:\PROGRAM FILES\BONJOUR\MDNSRESPONDER.EXE C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\VS7DEBUG\MDM.EXE C:\PROGRAM FILES\VIEWPOINT\VIEWPOINT MANAGER\VIEWMGR.EXE C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE C:\Program Files\Symantec\LiveUpdate\AUPDATE.EXE C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe C:\WINDOWS\SoftwareDistribution\Download\88dd3723266703a72c4d03c1c055e665\u pdate\update.exe . ************************************************************************** . Completion time: 2008-06-11 23:18:23 - machine was rebooted ComboFix-quarantined-files.txt 2008-06-12 03:18:16 Pre-Run: 848,560,128 bytes free Post-Run: 750,387,200 bytes free 222 --- E O F --- 2008-06-03 07:00:49 ---------------- ComboFix 08-06-10.5 - ACER USER 2008-06-12 23:20:45.4 - FAT32x86 DSREPAIR Running from: C:\downloads\ComboFix.exe WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\ACER USER\Desktop\Error Cleaner.url C:\Documents and Settings\ACER USER\Desktop\Privacy Protector.url C:\Documents and Settings\ACER USER\Desktop\Spyware&Malware Protection.url C:\Documents and Settings\ACER USER\Favorites\Error Cleaner.url C:\Documents and Settings\ACER USER\Favorites\Privacy Protector.url C:\Documents and Settings\ACER USER\Favorites\Spyware&Malware Protection.url . ((((((((((((((((((((((((( Files Created from 2008-05-13 to 2008-06-13 ))))))))))))))))))))))))))))))) . 2008-06-12 00:46 . 2008-06-12 00:46 <DIR> d--hs---- C:\FOUND.000 2008-06-11 23:14 . 2008-04-14 07:01 272,128 --------- C:\WINDOWS\system32\dllcache\bthport.sys 2008-06-11 23:12 . 2008-06-12 14:58 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-06-11 23:12 . 2008-06-11 23:12 1,409 --a------ C:\WINDOWS\QTFont.for 2008-06-10 22:09 . 2008-06-10 22:09 <DIR> d-------- C:\Program Files\RegCure 2008-06-10 14:02 . 2008-06-10 14:02 <DIR> d-------- C:\kav 2008-06-10 06:08 . 2008-06-09 21:28 253,952 --a------ C:\WINDOWS\rnopbfgt.dll 2008-06-10 06:08 . 2008-06-09 21:28 225,280 --a------ C:\WINDOWS\xkefqtgs.dll 2008-06-10 06:08 . 2008-06-09 21:28 163,840 --a------ C:\WINDOWS\pebgkxwq.exe 2008-06-10 06:08 . 2008-06-09 21:28 139,264 --a------ C:\WINDOWS\esrt.exe 2008-06-05 22:43 . 2008-06-05 22:43 47,180 --a------ C:\WINDOWS\system32\OEMINFO.PNF 2008-06-05 22:41 . 2008-06-05 22:41 <DIR> d--h----- C:\Documents and Settings\ACER USER\Application Data\GTek 2008-06-05 22:36 . 2008-06-05 22:36 <DIR> d-------- C:\Program Files\Linksys EasyLink Advisor 2008-06-05 22:36 . 2008-06-05 22:37 <DIR> d-ah----- C:\Documents and Settings\All Users\Application Data\GTek 2008-06-05 22:34 . 2008-06-05 22:34 <DIR> d-------- C:\Linksys WRT54G (E) 2008-06-04 12:14 . 2008-06-04 12:14 <DIR> d-------- C:\actionscriptstuff 2008-06-03 11:05 . 2008-06-03 11:05 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\FLEXnet 2008-06-03 09:41 . 2008-06-03 09:41 <DIR> d-------- C:\Program Files\Bonjour 2008-06-03 09:32 . 2008-06-03 09:32 <DIR> d-------- C:\Program Files\Common Files\Macrovision Shared 2008-06-01 21:57 . 2008-06-01 21:57 1,160 --a------ C:\WINDOWS\mozver.dat 2008-06-01 21:56 . 2008-06-01 21:56 0 --a------ C:\WINDOWS\nsreg.dat 2008-05-23 11:44 . 2008-05-23 11:44 1,192 --a------ C:\net_save.dna 2008-05-23 11:43 . 2008-05-23 11:43 <DIR> d-------- C:\Program Files\support.com 2008-05-23 11:43 . 2008-05-23 11:43 <DIR> d-------- C:\Program Files\Common Files\SupportSoft 2008-05-20 14:29 . 2008-05-20 14:29 <DIR> d-------- C:\Program Files\Starship Creator 2008-05-17 01:12 . 2008-05-17 01:12 1,409 --a------ C:\WINDOWS\system32\tmp1DB9D.FOT 2008-05-14 12:21 . 2008-05-14 12:21 1,409 --a------ C:\WINDOWS\system32\tmp1A59E.FOT 2008-05-14 11:08 . 2008-05-14 11:08 <DIR> d-------- C:\Program Files\IcoFX 1.6 2008-05-14 11:08 . 2008-05-14 11:08 <DIR> d-------- C:\Documents and Settings\ACER USER\Application Data\IcoFX 2008-05-13 11:13 . 2008-05-13 11:13 1,409 --a------ C:\WINDOWS\system32\tmpF5BA0.FOT 2008-05-13 11:13 . 2008-05-13 11:13 1,409 --a------ C:\WINDOWS\system32\tmp33AA0.FOT . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-03-23 00:45 89,600 ----a-w C:\WINDOWS\system32\atl71.dll 2008-05-31 01:35 805 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF 2008-05-31 01:35 60,800 ----a-w C:\WINDOWS\system32\S32EVNT1.DLL 2008-05-31 01:35 123,952 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS 2008-05-31 01:35 10,671 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT 2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\RMCast.sys 2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\dllcache\rmcast.sys 2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll 2008-05-07 05:18 1,287,680 ------w C:\WINDOWS\system32\dllcache\quartz.dll 2008-04-24 02:16 3,591,680 ------w C:\WINDOWS\system32\dllcache\mshtml.dll 2008-04-22 07:40 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe 2008-04-22 07:39 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe 2008-04-22 07:39 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe 2008-04-20 05:07 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll 2008-04-14 11:01 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys 2008-04-13 04:47 --------- d-----w C:\Program Files\Speed Video Converter 2008-04-13 04:41 --------- d-----w C:\Program Files\Speed Video Splitter 2008-04-02 15:29 94,320 ----a-w C:\Documents and Settings\ACER USER\Application Data\GDIPFONTCACHEV1.DAT 2008-03-27 08:12 151,583 ----a-w C:\WINDOWS\system32\msjint40.dll 2008-03-27 08:12 151,583 ------w C:\WINDOWS\system32\dllcache\msjint40.dll 2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys 2008-03-19 09:47 1,845,248 ------w C:\WINDOWS\system32\dllcache\win32k.sys 2003-01-21 07:00 13,942,408 ----a-r C:\WINDOWS\system32\config\systemprofile\MpSetup.exe 2003-01-21 07:00 13,942,408 ----a-r C:\Documents and Settings\Default User\MpSetup.exe 2003-01-21 07:00 13,942,408 ----a-r C:\Documents and Settings\ACER USER\MpSetup.exe . ((((((((((((((((((((((((((((( snapshot_2008-06-12_11.35.59.89 ))))))))))))))))))))))))))))))))))))))))) . - 2008-06-12 15:28:14 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2008-06-12 19:14:30 2,048 --s-a-w C:\WINDOWS\bootstat.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{0939FF27-A717-4F67-96B5-555F9510F17F}"= "C:\WINDOWS\rtsplgob.dll" [ ] [HKEY_CLASSES_ROOT\clsid\{0939ff27-a717-4f67-96b5-555f9510f17f}] [HKEY_CLASSES_ROOT\rtsplgob.1] [HKEY_CLASSES_ROOT\TypeLib\{84AEEED9-D8B2-494D-99D3-6DE8BD940ADC}] [HKEY_CLASSES_ROOT\rtsplgob] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56 15360] "AIM"="C:\Program Files\AIM\aim.exe" [2005-06-02 01:34 67160] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-22 12:19 68856] "EasyLinkAdvisor"="C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" [2007-03-15 18:16 454784] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "LaunchApp"="Alaunch" [] "SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-05-20 19:57 98304] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-05-20 19:57 532480] "PCMService"="C:\Program Files\Aspire Arcade\PCMService.exe" [2004-03-25 18:41 81920] "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-04 01:32 208952] "MSPY2002"="C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe" [2003-03-31 12:00 59392] "PHIME2002ASync"="C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.exe" [2003-03-31 12:00 455168] "PHIME2002A"="C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.exe" [2003-03-31 12:00 455168] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-05-15 21:10 339968] "LManager"="C:\Program Files\Launch Manager\QtZgAcer.EXE" [2004-07-05 18:52 315392] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24 286720] "apiuv.exe"="C:\WINDOWS\apiuv.exe" [ ] "e0Xf"="C:\WINDOWS\iovkidek.exe" [ ] "Akknvwf"="C:\Program Files\Fxkbmh\Lbeaysy.exe" [ ] "VerizonServicepoint.exe"="C:\Program Files\Verizon\Servicepoint\VerizonServicepoint.exe" [2006-02-01 18:33 1880064] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-10 01:59 115816] "NoteBurner"="C:\Program Files\NoteBurner\VTBurnerGUI.exe" [ ] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-09-14 10:00 267064] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-12-08 17:42 185896] "Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 17:38 583048] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 03:56 15360] C:\Documents and Settings\ACER USER\Start Menu\Programs\Startup\ Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-10-08 11:27:06 110592] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360] WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [2004-11-12 04:59:09 118784] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shell executehooks] "{EDB0E980-90BD-11D4-8599-0008C7D3B6F8}"= C:\Program Files\Qualcomm\Eudora\EuShlExt.dll [ ] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceOb jectDelayLoad] "xkefqtgs"= {AC858574-3F5C-4736-BA9D-0B2C4594843F} - C:\WINDOWS\xkefqtgs.dll [2008-06-09 21:28 225280] "rnopbfgt"= {705D4667-8154-4B4E-B7A7-6867F63A0930} - C:\WINDOWS\rnopbfgt.dll [2008-06-09 21:28 253952] [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\Auth orizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Messenger\\MSMSGS.EXE"= "C:\\Program Files\\eMule\\EMULE.EXE"= "C:\\Program Files\\iTunes\\iTunes.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\Bonjour\\mDNSResponder.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\Glob allyOpenPorts\List] "4662:TCP"= 4662:TCP:eMule "4672:UDP"= 4672:UDP:eMule R1 SMBHC;Microsoft SM Bus Host Controller Driver;C:\WINDOWS\system32\DRIVERS\SMBHC.sys [2001-08-17 13:57] R2 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" [2007-01-04 16:38] R3 SMBBATT;Microsoft Smart Battery Driver;C:\WINDOWS\system32\DRIVERS\SMBBATT.sys [2004-08-04 02:07] S0 ntcdrdrv;ntcdrdrv;C:\WINDOWS\system32\DRIVERS\ntcdrdrv.sys [] S3 hamachi_oem;PlayLinc Adapter;C:\WINDOWS\system32\DRIVERS\gan_adapter.sys [2006-09-27 16:12] S3 SndTDriverV32;SndTDriverV32;C:\WINDOWS\system32\drivers\SndTDriverV32.sys [2006-08-11 16:56] *Newly Created Service* - COMHOST . Contents of the 'Scheduled Tasks' folder "2008-06-11 02:09:38 C:\WINDOWS\Tasks\RegCure.job" - C:\Program Files\RegCure\RegCure.exe "2008-06-12 19:19:26 C:\WINDOWS\Tasks\RegCure Program Check.job" - C:\Program Files\RegCure\RegCure.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-12 23:24:39 Windows 5.1.2600 Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-06-12 23:25:06 ComboFix-quarantined-files.txt 2008-06-13 03:25:04 ComboFix4.txt 2008-06-12 03:18:26 ComboFix3.txt 2008-06-12 15:36:12 ComboFix2.txt 2008-06-12 19:03:08 Pre-Run: 547,225,600 bytes free Post-Run: 536,002,560 bytes free 183 --- E O F --- 2008-06-12 04:23:17 |
17-Jun-2008, 04:40 PM
#6 | |||||
| Follow these steps to uninstall Combofix and then download the latest version please.
Please visit Combofix Guide & Instructions for instructions for installing the recovery console and downloading and running ComboFix: Post the log from ComboFix when you've accomplished that along with a new HijackThis log.
__________________ Microsoft MVP - Consumer Security Alliance of Security Analysis Professionals |
20-Jun-2008, 12:44 AM
#7 | |||||
| New combofix and HJT logs below. -------- ComboFix 08-06-19.2 - ACER USER 2008-06-20 0:38:00.5 - FAT32x86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.439 [GMT -4:00] Running from: C:\Documents and Settings\ACER USER\Desktop\ComboFix.exe Command switches used :: C:\downloads\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe * Created a new restore point . ((((((((((((((((((((((((( Files Created from 2008-05-20 to 2008-06-20 ))))))))))))))))))))))))))))))) . 2008-06-17 13:00 . 2008-06-17 13:00 <DIR> d-------- C:\WINDOWS\LastGood 2008-06-14 14:27 . 2008-06-14 14:27 <DIR> d-------- C:\WINDOWS\ERUNT 2008-06-12 00:46 . 2008-06-12 00:46 <DIR> d--hs---- C:\FOUND.000 2008-06-11 23:14 . 2008-04-14 07:01 272,128 --------- C:\WINDOWS\system32\dllcache\bthport.sys 2008-06-11 23:12 . 2008-06-14 14:58 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-06-11 23:12 . 2008-06-11 23:12 1,409 --a------ C:\WINDOWS\QTFont.for 2008-06-10 22:09 . 2008-06-10 22:09 <DIR> d-------- C:\Program Files\RegCure 2008-06-10 14:02 . 2008-06-10 14:02 <DIR> d-------- C:\kav 2008-06-10 06:08 . 2008-06-09 21:28 139,264 --a------ C:\WINDOWS\esrt.exe 2008-06-05 22:43 . 2008-06-05 22:43 47,180 --a------ C:\WINDOWS\system32\OEMINFO.PNF 2008-06-05 22:41 . 2008-06-05 22:41 <DIR> d--h----- C:\Documents and Settings\ACER USER\Application Data\GTek 2008-06-05 22:36 . 2008-06-05 22:36 <DIR> d-------- C:\Program Files\Linksys EasyLink Advisor 2008-06-05 22:36 . 2008-06-05 22:37 <DIR> d-ah----- C:\Documents and Settings\All Users\Application Data\GTek 2008-06-05 22:34 . 2008-06-05 22:34 <DIR> d-------- C:\Linksys WRT54G (E) 2008-06-04 12:14 . 2008-06-04 12:14 <DIR> d-------- C:\actionscriptstuff 2008-06-03 11:05 . 2008-06-03 11:05 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\FLEXnet 2008-06-03 09:41 . 2008-06-03 09:41 <DIR> d-------- C:\Program Files\Bonjour 2008-06-03 09:32 . 2008-06-03 09:32 <DIR> d-------- C:\Program Files\Common Files\Macrovision Shared 2008-06-01 21:57 . 2008-06-01 21:57 1,160 --a------ C:\WINDOWS\mozver.dat 2008-06-01 21:56 . 2008-06-01 21:56 0 --a------ C:\WINDOWS\nsreg.dat 2008-05-23 11:44 . 2008-05-23 11:44 1,192 --a------ C:\net_save.dna 2008-05-23 11:43 . 2008-05-23 11:43 <DIR> d-------- C:\Program Files\support.com 2008-05-23 11:43 . 2008-05-23 11:43 <DIR> d-------- C:\Program Files\Common Files\SupportSoft 2008-05-20 14:29 . 2008-05-20 14:29 <DIR> d-------- C:\Program Files\Starship Creator . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-03-23 00:45 89,600 ----a-w C:\WINDOWS\system32\atl71.dll 2008-05-31 01:35 805 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF 2008-05-31 01:35 60,800 ----a-w C:\WINDOWS\system32\S32EVNT1.DLL 2008-05-31 01:35 123,952 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS 2008-05-31 01:35 10,671 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT 2008-05-14 15:08 --------- d-----w C:\Program Files\IcoFX 1.6 2008-05-14 15:08 --------- d-----w C:\Documents and Settings\ACER USER\Application Data\IcoFX 2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\RMCast.sys 2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\dllcache\rmcast.sys 2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll 2008-05-07 05:18 1,287,680 ------w C:\WINDOWS\system32\dllcache\quartz.dll 2008-04-24 02:16 3,591,680 ------w C:\WINDOWS\system32\dllcache\mshtml.dll 2008-04-22 07:40 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe 2008-04-22 07:39 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe 2008-04-22 07:39 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe 2008-04-20 05:07 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll 2008-04-02 15:29 94,320 ----a-w C:\Documents and Settings\ACER USER\Application Data\GDIPFONTCACHEV1.DAT 2008-03-27 08:12 151,583 ----a-w C:\WINDOWS\system32\msjint40.dll 2008-03-27 08:12 151,583 ------w C:\WINDOWS\system32\dllcache\msjint40.dll 2003-01-21 07:00 13,942,408 ----a-r C:\WINDOWS\system32\config\systemprofile\MpSetup.exe 2003-01-21 07:00 13,942,408 ----a-r C:\Documents and Settings\Default User\MpSetup.exe 2003-01-21 07:00 13,942,408 ----a-r C:\Documents and Settings\ACER USER\MpSetup.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56 15360] "AIM"="C:\Program Files\AIM\aim.exe" [2005-06-02 01:34 67160] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-22 12:19 68856] "EasyLinkAdvisor"="C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" [2007-03-15 18:16 454784] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "LaunchApp"="Alaunch" [] "SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-05-20 19:57 98304] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-05-20 19:57 532480] "PCMService"="C:\Program Files\Aspire Arcade\PCMService.exe" [2004-03-25 18:41 81920] "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 01:32 208952] "MSPY2002"="C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe" [2003-03-31 12:00 59392] "PHIME2002ASync"="C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE" [2003-03-31 12:00 455168] "PHIME2002A"="C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE" [2003-03-31 12:00 455168] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-05-15 21:10 339968] "LManager"="C:\Program Files\Launch Manager\QtZgAcer.EXE" [2004-07-05 18:52 315392] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24 286720] "apiuv.exe"="C:\WINDOWS\apiuv.exe" [ ] "e0Xf"="C:\WINDOWS\iovkidek.exe" [ ] "Akknvwf"="C:\Program Files\Fxkbmh\Lbeaysy.exe" [ ] "VerizonServicepoint.exe"="C:\Program Files\Verizon\Servicepoint\VerizonServicepoint.exe" [2006-02-01 18:33 1880064] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-10 01:59 115816] "NoteBurner"="C:\Program Files\NoteBurner\VTBurnerGUI.exe" [ ] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-09-14 10:00 267064] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-12-08 17:42 185896] "Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 17:38 583048] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 03:56 15360] C:\Documents and Settings\ACER USER\Start Menu\Programs\Startup\ Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-10-08 11:27:06 110592] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360] WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [2004-11-12 04:59:09 118784] Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 04:44:06 29696] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shell executehooks] "{EDB0E980-90BD-11D4-8599-0008C7D3B6F8}"= C:\Program Files\Qualcomm\Eudora\EuShlExt.dll [ ] [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\Auth orizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Messenger\\MSMSGS.EXE"= "C:\\Program Files\\eMule\\EMULE.EXE"= "C:\\Program Files\\iTunes\\iTunes.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\Bonjour\\mDNSResponder.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\Glob allyOpenPorts\List] "4662:TCP"= 4662:TCP:eMule "4672:UDP"= 4672:UDP:eMule R1 SMBHC;Microsoft SM Bus Host Controller Driver;C:\WINDOWS\system32\DRIVERS\SMBHC.sys [2001-08-17 13:57] R2 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" [2007-01-04 16:38] R3 SMBBATT;Microsoft Smart Battery Driver;C:\WINDOWS\system32\DRIVERS\SMBBATT.sys [2004-08-04 02:07] S0 ntcdrdrv;ntcdrdrv;C:\WINDOWS\system32\DRIVERS\ntcdrdrv.sys [] S3 hamachi_oem;PlayLinc Adapter;C:\WINDOWS\system32\DRIVERS\gan_adapter.sys [2006-09-27 16:12] S3 SndTDriverV32;SndTDriverV32;C:\WINDOWS\system32\drivers\SndTDriverV32.sys [2006-08-11 16:56] *Newly Created Service* - COMHOST . Contents of the 'Scheduled Tasks' folder "2008-06-11 02:09:38 C:\WINDOWS\Tasks\RegCure.job" - C:\Program Files\RegCure\RegCure.exe "2008-06-19 10:50:36 C:\WINDOWS\Tasks\RegCure Program Check.job" - C:\Program Files\RegCure\RegCure.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-20 00:39:51 Windows 5.1.2600 Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-06-20 0:40:17 ComboFix2.txt 2008-06-13 03:25:08 ComboFix-quarantined-files.txt 2008-06-20 04:40:16 Pre-Run: 559,202,304 bytes free Post-Run: 600,735,744 bytes free WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons 156 --- E O F --- 2008-06-12 04:23:17 ------------------ Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 00:44, on 6/20/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\WINDOWS\system32\spoolsv.exe C:\Acer\eManager\anbmServ.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Aspire Arcade\PCMService.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Launch Manager\QtZgAcer.EXE C:\Program Files\QuickTime\qttask.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Verizon\Servicepoint\VerizonServicepoint.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\AIM\aim.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe C:\Program Files\WinZip\WZQKPICK.EXE C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe C:\Program Files\Outlook Express\msimn.exe C:\Program Files\Outlook Express\msimn.exe C:\Program Files\Outlook Express\msimn.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Outlook Express\msimn.exe C:\WINDOWS\explorer.exe C:\Program Files\Outlook Express\msimn.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\downloads\HiJackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = |
