Login  Malware Removal & HijackThis Logs |
| |
| |
| | Thread Tools |
08-Jul-2008, 09:13 AM
#1 | |||||
| Solved: Virtumonde amongst other things... Hi, I began having pop-up warnings from Avast saying that certain files (sorry didn't take note of them) should be put into the chest. These are the files that I have in the chest atm: mlxlqwnl.dll nbcoaray.dll rkwfscug.exe The first 2 Avast says are Win32:VunDrop [Drp] and the last one Win32:AgentZXU[Trj] Then after trying to run SpybotSD, it got rid of about 10 things and then kept popping up with files that I kept denying changes to, saying that they were global registry changes etc one was rundll.exe (it wouldn't give me information whether to allow or not, so I'm hoping that I did the right thing by not allowing the changes!  )Computer started running slower and not loading up certain webpages tonight, especially Google and Yahoo pages. I uninstalled Google Updater just before I did the Hijackthis logfile. And also Virtumonde came up in Spybot as well on the second scan. I deleted these 3 files: virtumonde; virtumonde.dll and virtumonde.prx....but get the feeling that nothing has been solved by doing this...it will take much more...  My pc runs Windows XP with SP 2. And has Avast, ZoneAlarm, SpybotSD. Hopefully ZoneAlarm Spy has been uninstalled properly. Many thanks for any help, I appreciate it! Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:37:43 PM, on 8/07/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe C:\Program Files\CyberLink\Shared Files\RichVideo.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\MOZILL~1\FIREFOX.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:81 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: (no name) - {049595B7-86E0-4698-8E49-C9D8B81B4C94} - C:\WINDOWS\system32\ddcAPIYQ.dll (file missing) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {2F55A1E9-EE3D-4B19-8B5F-378DEB2F893C} - C:\WINDOWS\system32\iifdbxvV.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: (no name) - {584C816C-7478-42CF-B3E6-6B8A55124459} - C:\WINDOWS\system32\qoMDwtTJ.dll (file missing) O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: (no name) - {CB0987A4-587A-4F3C-9B56-741320030A65} - C:\WINDOWS\system32\byXNeFXN.dll (file missing) O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [BM07b154dd] Rundll32.exe "C:\WINDOWS\system32\jvobdxgf.dll",s O4 - HKLM\..\Run: [04826741] rundll32.exe "C:\WINDOWS\system32\ngwsxebl.dll",b O4 - HKLM\..\RunOnce: [Spybot - Search & Destroy] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck O4 - HKLM\..\RunOnce: [SpybotDeletingA5741] command /c del "C:\WINDOWS\system32\byXNeFXN.dll_old" O4 - HKLM\..\RunOnce: [SpybotDeletingC1865] cmd /c del "C:\WINDOWS\system32\byXNeFXN.dll_old" O4 - HKLM\..\RunOnce: [SpybotDeletingA1407] command /c del "C:\WINDOWS\system32\ddcAPIYQ.dll_old" O4 - HKLM\..\RunOnce: [SpybotDeletingC3074] cmd /c del "C:\WINDOWS\system32\ddcAPIYQ.dll_old" O4 - HKUS\S-1-5-18\..\Run: [] (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [] (User 'Default user') O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by101fd.bay101.hotmail.msn.co...s/MsnPUpld.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1152857979387 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{7C0A2E62-0E69-4A55-8177-0BE8C82681C8}: NameServer = 192.168.1.1 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: iifdbxvV - C:\WINDOWS\SYSTEM32\iifdbxvV.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Kodak Camera Connection Software (KodakCCS) - Unknown owner - C:\WINDOWS\system32\drivers\KodakCCS.exe (file missing) O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe O23 - Service: WD Drive Manager Service (WDBtnMgrSvc.exe) - WDC - C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe O24 - Desktop Component 0: (no name) - file:///C:/DOCUME~1/Admin/LOCALS~1/Temp/msoclip1/01/clip_image002.gif -- End of file - 10329 bytes Last edited by tesugu : 08-Jul-2008 10:06 AM. Reason: Also forgot to mention that Windows Automatic Updates keeps turning off, even after I apply Automatic Updates several times. |
| |
12-Jul-2008, 10:21 AM
#4 | |||||
| Hi, thank you so much for getting back to me and helping me out!!!   (I could not do the "Window Recovery" of ComboFix as Firefox wouldn't allow the bleepingcomputer site to load up so I had to d/load Combofix on another pc and bring it to my pc with a flash!) Combofix Log: ComboFix 08-07-11.1 - Admin 2008-07-12 23:41:52.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.233 [GMT 10:00] Running from: C:\Documents and Settings\Admin\Desktop\ComboFix.exe WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\BM07b154dd.xml . ---- Previous Run ------- . C:\setup.exe C:\WINDOWS\pskt.ini C:\WINDOWS\system32\mcrh.tmp C:\WINDOWS\system32\MSINET.oca C:\WINDOWS\winhelp.ini . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_npf ((((((((((((((((((((((((( Files Created from 2008-06-12 to 2008-07-12 ))))))))))))))))))))))))))))))) . 2008-07-09 20:03 . 2008-07-09 20:03 318,976 --a------ C:\WINDOWS\system32\xxyWqOFU.dll_old 2008-07-08 17:23 . 2008-07-10 10:16 732 --a------ C:\WINDOWS\wininit.ini 2008-07-08 15:21 . 2008-07-08 15:21 91,648 --------- C:\WINDOWS\system32\ccwidhnj.dll_old 2008-07-07 12:07 . 2008-07-12 23:48 1,640,480 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2008-07-07 12:07 . 2008-07-12 23:48 20,108 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx 2008-07-07 12:02 . 2007-11-14 16:05 75,248 --a------ C:\WINDOWS\zllsputility.exe 2008-07-07 12:01 . 2008-07-07 12:01 <DIR> d-------- C:\Program Files\Zone Labs 2008-07-04 12:30 . 2008-07-04 12:30 <DIR> d-------- C:\Program Files\TreePadLite 2008-07-04 10:27 . 2008-07-04 10:27 <DIR> d-------- C:\Program Files\ASIO4ALL v2 2008-07-04 10:26 . 2002-07-08 08:14 1,294,336 --a------ C:\WINDOWS\system32\vorbis.acm 2008-07-04 10:26 . 2006-06-20 18:56 225,280 --a------ C:\WINDOWS\system32\rewire.dll 2008-07-04 10:23 . 2008-07-04 10:28 <DIR> d-------- C:\Program Files\Image-Line 2008-07-02 17:28 . 2008-07-02 17:28 <DIR> d-------- C:\Program Files\Smilebox 2008-07-02 17:25 . 2008-07-02 18:23 <DIR> d-------- C:\Documents and Settings\Admin\Application Data\Smilebox 2008-06-25 14:10 . 2008-06-25 14:10 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Trymedia 2008-06-23 20:29 . 2008-06-23 20:29 <DIR> d-------- C:\Documents and Settings\Admin\Application Data\Talkback 2008-06-23 20:28 . 2008-06-23 20:32 <DIR> d-------- C:\Program Files\Mozilla Thunderbird 2008-06-23 20:28 . 2008-06-23 20:28 <DIR> d-------- C:\Documents and Settings\Admin\Application Data\Thunderbird 2008-06-19 09:11 . 2008-06-19 09:11 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Memeo 2008-06-18 15:59 . 2008-06-18 15:59 <DIR> d-------- C:\Program Files\Common Files\eSellerate 2008-06-18 15:58 . 2008-06-18 15:58 <DIR> d-------- C:\Program Files\WD 2008-06-18 15:58 . 2008-06-18 15:58 <DIR> d---s---- C:\Documents and Settings\All Users\Application Data\WD 2008-06-18 15:56 . 2008-06-18 15:56 <DIR> d-------- C:\Program Files\Western Digital Technologies 2008-06-18 15:56 . 2008-06-18 15:59 <DIR> d-------- C:\Program Files\Western Digital 2008-06-12 06:43 . 2008-06-13 23:10 272,128 --a------ C:\WINDOWS\system32\drivers\bthport.sys 2008-06-12 06:43 . 2008-06-13 23:10 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-11 05:10 --------- d-----w C:\Program Files\Yahoo! 2008-07-09 08:57 --------- d-----w C:\Program Files\Google 2008-07-08 12:22 --------- d-----w C:\Program Files\Trend Micro 2008-07-08 10:16 --------- d-----w C:\Documents and Settings\Admin\Application Data\dvdcss 2008-07-08 09:33 --------- d-----w C:\Documents and Settings\Admin\Application Data\Yahoo! 2008-07-08 07:05 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-07-08 06:05 --------- d-----w C:\Program Files\Spybot - Search & Destroy 2008-07-04 22:11 --------- d-----w C:\Documents and Settings\Admin\Application Data\Lavasoft 2008-07-04 00:28 --------- d-----w C:\Program Files\Vstplugins 2008-06-26 12:24 --------- d-----w C:\Program Files\Hidden Relics 2008-06-26 11:36 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP 2008-06-26 03:47 --------- d-----w C:\Program Files\OpenOffice.org 2.0 2008-06-26 03:23 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-06-10 13:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help 2008-06-10 10:53 --------- d-----w C:\Program Files\Aglare Video to 3GP Converter 2008-06-10 10:45 --------- d-----w C:\Program Files\Aglare FLV to MP4 WMV iPod 3GP AVI Zune Converter 2008-06-07 11:05 --------- d-----w C:\Program Files\Realtek Sound Manager 2008-06-07 11:05 --------- d-----w C:\Program Files\Realtek AC97 2008-06-07 11:05 --------- d-----w C:\Program Files\Realtek 2008-06-07 11:05 --------- d-----w C:\Program Files\AvRack 2008-06-07 10:33 --------- d-----w C:\Documents and Settings\Admin\Application Data\Uniblue 2008-06-07 10:32 --------- d-----w C:\Program Files\Uniblue 2008-06-06 03:19 --------- d-----w C:\Program Files\PCStitch 7 2008-05-24 03:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\BVRP Software 2008-05-24 03:20 --------- d-----w C:\Program Files\Motorola Phone Tools 2008-05-24 03:17 92,064 ----a-w C:\Documents and Settings\Admin\mqdmmdm.sys 2008-05-24 03:17 9,232 ----a-w C:\Documents and Settings\Admin\mqdmmdfl.sys 2008-05-24 03:17 79,328 ----a-w C:\Documents and Settings\Admin\mqdmserd.sys 2008-05-24 03:17 66,656 ----a-w C:\Documents and Settings\Admin\mqdmbus.sys 2008-05-24 03:17 6,208 ----a-w C:\Documents and Settings\Admin\mqdmcmnt.sys 2008-05-24 03:17 5,936 ----a-w C:\Documents and Settings\Admin\mqdmwhnt.sys 2008-05-24 03:17 4,048 ----a-w C:\Documents and Settings\Admin\mqdmcr.sys 2008-05-24 03:17 25,600 ----a-w C:\WINDOWS\system32\drivers\usbsermptxp.sys 2008-05-24 03:17 25,600 ----a-w C:\Documents and Settings\Admin\usbsermptxp.sys 2008-05-24 03:17 22,768 ----a-w C:\Documents and Settings\Admin\usbsermpt.sys 2008-05-22 22:22 --------- d-----w C:\Program Files\Skype 2008-05-20 12:12 --------- d-----w C:\Documents and Settings\Admin\Application Data\Skype 2008-05-20 12:03 --------- d-----w C:\Documents and Settings\Admin\Application Data\skypePM 2008-05-20 12:01 --------- d-----w C:\Program Files\Common Files\Skype 2008-05-20 12:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype 2008-05-19 10:27 --------- d-----w C:\Program Files\LiveUpdate 2008-05-14 04:12 --------- d-----w C:\Program Files\UnH Solutions 2008-05-14 02:43 --------- d-----w C:\Program Files\Replay Media Catcher 2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll 2008-04-23 04:16 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2007-09-10 07:57 1,664 -c--a-w C:\Documents and Settings\Admin\Application Data\ViewerApp.dat 2004-10-01 05:00 40,960 -c--a-w C:\Program Files\Uninstall_CDS.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-11-14 16:05 919016] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2004-11-25 00:27 32768] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.SP54"= SP5X_32.DLL "VIDC.SP55"= SP5X_32.DLL "VIDC.SP56"= SP5X_32.DLL "VIDC.SP57"= SP5X_32.DLL "VIDC.SP58"= SP5X_32.DLL "msacm.dvacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\Vio\Dvacm.acm "msacm.MPEGacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\MPEG\MPEGacm.acm "msacm.ulmp3acm"= C:\PROGRA~1\COMMON~1\ULEADS~1\MPEG\ulmp3acm.acm [HKLM\~\startupfolder\C:^Documents and Settings^Admin^Start Menu^Programs^Startup^Adobe Gamma.lnk] path=C:\Documents and Settings\Admin\Start Menu\Programs\Startup\Adobe Gamma.lnk backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^Admin^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk] path=C:\Documents and Settings\Admin\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk backup=C:\WINDOWS\pss\OneNote 2007 Screen Clipper and Launcher.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^Admin^Start Menu^Programs^Startup^OpenOffice.org 2.0.lnk] path=C:\Documents and Settings\Admin\Start Menu\Programs\Startup\OpenOffice.org 2.0.lnk backup=C:\WINDOWS\pss\OpenOffice.org 2.0.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^Admin^Start Menu^Programs^Startup^PowerReg Scheduler V3.exe] path=C:\Documents and Settings\Admin\Start Menu\Programs\Startup\PowerReg Scheduler V3.exe backup=C:\WINDOWS\pss\PowerReg Scheduler V3.exeStartup [HKLM\~\startupfolder\C:^Documents and Settings^Admin^Start Menu^Programs^Startup^Ubisoft register.lnk] path=C:\Documents and Settings\Admin\Start Menu\Programs\Startup\Ubisoft register.lnk backup=C:\WINDOWS\pss\Ubisoft register.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^Admin^Start Menu^Programs^Startup^WD Anywhere Backup Launcher.lnk] path=C:\Documents and Settings\Admin\Start Menu\Programs\Startup\WD Anywhere Backup Launcher.lnk backup=C:\WINDOWS\pss\WD Anywhere Backup Launcher.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^BlueSoleil.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\BlueSoleil.lnk backup=C:\WINDOWS\pss\BlueSoleil.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^DVD@ccess.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\DVD@ccess.lnk backup=C:\WINDOWS\pss\DVD@ccess.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk backup=C:\WINDOWS\pss\Kodak EasyShare software.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Picture Package Menu.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Picture Package Menu.lnk backup=C:\WINDOWS\pss\Picture Package Menu.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^PowerCam 2.0 Megapixel Monitor.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\PowerCam 2.0 Megapixel Monitor.lnk backup=C:\WINDOWS\pss\PowerCam 2.0 Megapixel Monitor.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a--c--- 2008-01-11 22:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC] --a------ 2004-11-25 00:27 32768 C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA] --a--c--- 2004-11-24 21:10 344064 C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] --a------ 2007-06-27 19:03 152872 C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] --a------ 2004-08-04 22:00 15360 C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] --a--c--- 2007-04-04 08:29 165784 C:\Program Files\DAEMON Tools\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dvd43] --a--c--- 2006-05-22 13:26 694272 C:\Program Files\dvd43\DVD43_Tray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus C67 Series] --a--c--- 2005-01-25 14:00 98304 C:\WINDOWS\system32\spool\drivers\w32x86\3\E_FATIAAP.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor] --a--c--- 2006-10-27 00:47 31016 C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IncrediMail] --a------ 2007-03-25 19:16 208946 C:\Program Files\IncrediMail\bin\IncMail.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LGODDFU] --a--c--- 2006-09-29 23:58 249856 C:\Program Files\lg_fwupdate\fwupdate.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr] --a------ 2007-10-18 11:34 5724184 C:\Program Files\Windows Live\Messenger\msnmsgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NCLaunch] --a--c--- 2007-01-27 16:37 40960 C:\WINDOWS\NCLAUNCH.EXe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a--c--- 2007-03-01 15:57 153136 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PowerBar] -----c--- 2004-04-21 10:26 86016 C:\Program Files\CyberLink DVD Solution\Multimedia Launcher\PowerBar.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a--c--- 2006-09-01 15:57 282624 C:\Program Files\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] -ra------ 2008-04-23 17:45 22058792 C:\Program Files\Skype\Phone\Skype.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmileboxTray] --a------ 2008-06-20 10:19 205448 C:\Documents and Settings\Admin\Application Data\Smilebox\SmileboxTray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer] -rahs---- 2008-01-28 11:43 2097488 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a--c--- 2007-09-25 01:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UVS10 Preload] -----c--- 2006-03-07 00:52 36864 C:\Program Files\Ulead Systems\Ulead VideoStudio 10\uvPL.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WD Drive Manager] --a------ 2008-01-30 04:50 438272 C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrUI.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG] --------- 2006-10-18 20:05 204288 C:\Program Files\Windows Media Player\wmpnscfg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\atwtusb] --a------ 2007-03-20 17:43 315392 C:\WINDOWS\system32\ATWTUSB.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan] -ra------ 2006-02-20 19:00 86016 C:\WINDOWS\SoundMan.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\Auth orizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\LimeWire\\LimeWire.exe"= "C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\IncrediMail\\bin\\ImApp.exe"= "C:\\Program Files\\IncrediMail\\bin\\IncMail.exe"= "C:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"= "C:\\Program Files\\IncrediMail\\bin\\ImLc.exe"= "C:\\Program Files\\BitLord\\BitLord.exe"= "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= R0 sonypvl3;sonypvl3;C:\WINDOWS\system32\drivers\sonypvl3.sys [2004-09-22 11:55] R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 09:20] R1 sonypvf3;sonypvf3;C:\WINDOWS\system32\drivers\sonypvf3.sys [2004-11-15 13:55] R1 sonypvt3;sonypvt3;C:\WINDOWS\system32\drivers\sonypvt3.sys [2004-12-06 14:26] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 09:16] R2 DVDAccss;DVDAccss;C:\WINDOWS\system32\drivers\DVDAccss.sys [2003-11-21 16:15] R2 WDBtnMgrSvc.exe;WD Drive Manager Service;C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe [2008-01-30 04:52] S1 aiptektp;Pen Pad;C:\WINDOWS\system32\DRIVERS\aiptektp.sys [2006-06-06 09:51] S1 sonypvd3;Sony DVD Handycam;C:\WINDOWS\system32\DRIVERS\sonypvd3.sys [2004-12-07 15:00] S2 Ca533av;PocketCam 3Mega, WDM Video Capture;C:\WINDOWS\system32\Drivers\Ca533av.sys [2002-07-31 17:48] S3 USBCamera;DSC Still Image Capture (CA100);C:\WINDOWS\system32\Drivers\Bulk533.sys [2002-11-06 09:42] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountp oints2\{82c48597-3cae-11dd-bd26-00300a465deb}] \Shell\AutoRun\command - F:\wd_windows_tools\WDEULA.exe . - - - - ORPHANS REMOVED - - - - BHO-{049595B7-86E0-4698-8E49-C9D8B81B4C94} - C:\WINDOWS\system32\ddcAPIYQ.dll BHO-{0508B69D-36A5-4231-A4C7-6B31D5428742} - C:\WINDOWS\system32\yayaWNfg.dll BHO-{2F55A1E9-EE3D-4B19-8B5F-378DEB2F893C} - C:\WINDOWS\system32\iifdbxvV.dll BHO-{584C816C-7478-42CF-B3E6-6B8A55124459} - C:\WINDOWS\system32\qoMDwtTJ.dll BHO-{CB0987A4-587A-4F3C-9B56-741320030A65} - C:\WINDOWS\system32\byXNeFXN.dll HKLM-Run-04826741 - C:\WINDOWS\system32\ftpmojwo.dll HKLM-Run-BM07b154dd - C:\WINDOWS\system32\vumqhmbd.dll ShellExecuteHooks-{2F55A1E9-EE3D-4B19-8B5F-378DEB2F893C} - C:\WINDOWS\system32\iifdbxvV.dll Notify-iifdbxvV - iifdbxvV.dll MSConfigStartUp-04826741 - C:\WINDOWS\system32\gxprxexv.dll MSConfigStartUp-BitTorrent DNA - C:\Program Files\DNA\btdna.exe MSConfigStartUp-BM07b154dd - C:\WINDOWS\system32\wjpgoefg.dll MSConfigStartUp-fssui - C:\Program Files\Windows Live\Family Safety\fssui.exe MSConfigStartUp-InCD - C:\Program Files\Ahead\InCD\InCD.exe MSConfigStartUp-ProxyWay - C:\Program Files\ProxyWay\proxyway.exe MSConfigStartUp-RemoteControl - C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe MSConfigStartUp-updateMgr - C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe MSConfigStartUp-Microsoft Update - service.exe ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-07-12 23:50:23 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\system32\ati2evxx.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\system32\ati2evxx.exe C:\WINDOWS\system32\cmd.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\CyberLink\Shared Files\RichVideo.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\verclsid.exe . ************************************************************************** . Completion time: 2008-07-13 0:05:23 - machine was rebooted [Admin] ComboFix-quarantined-files.txt 2008-07-12 14:05:08 Pre-Run: 60,866,162,688 bytes free Post-Run: 60,774,690,816 bytes free 304 --- E O F --- 2008-07-12 12:49:50 |
12-Jul-2008, 02:42 PM
#6 | ||||||
| Run HJT again and put a check in the following: O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file) O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) Close all applications and browser windows before you click "fix checked". Open Notepad and copy and paste the text in the quote box below into it: Quote:
Save the file to you desktop and name it CFScript.txt Then drag the CFScript.txt into the ComboFix.exe as shown in the screenshot below.  This will start ComboFix again. It may ask to reboot. Post the contents of Combofix.txt in your next reply. Please download Malwarebytes Anti-Malware and save it to your desktop. alternate download link 1 alternate download link 2
Please do an online scan with Kaspersky WebScanner Kaspersky online scanner uses JAVA tecnology to perform the scan. If you do not have the latest JAVA version, follow the instrutions below under Upgrading Java, to download and install the latest vesion.
Upgrading Java:
__________________ Microsoft MVP/Windows - Consumer Security If we have helped you, please consider making a donation to TSG! |
