Advertisement

There's no such thing as a stupid question, but they're the easiest to answer.
Login
Search

Advertisement

Virus & Other Malware Removal Virus & Other Malware Removal
Search Search
Search for:
Tech Support Guy > > >

winflyer32.dll trojan..please help

(New)
(!)

o.a's Avatar
o.a o.a is offline
Junior Member with 2 posts.
THREAD STARTER
 
Join Date: Jun 2007
Experience: Intermediate
23-Jun-2007, 01:25 AM #1
winflyer32.dll trojan..please help
hi i've been havin this problem for weeks.its a winflyer virus or something..it causes all these pop ups and sometimes corrupts my registry.i saw it the name in my add/remove program..winflyer32,i tried uninstalling it but its says"file cannot be found".please help sometimes i hear music playing iin the background.thanks, this is my hijack this log.....

Logfile of HijackThis v1.99.1
Scan saved at 11:55:10 PM, on 6/22/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\HPAware.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\DOCUME~1\user\LOCALS~1\Temp\tmp1.tmp.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: (no name) - {8A4E1972-8F42-4B50-AA71-29DCA9F336BC} - (no file)
O1 - Hosts: 66.98.148.65 auto.search.msn.es
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: XBTB06829 - {1D09A743-00ED-4713-BCC4-32D590D1087A} - (no file)
O2 - BHO: (no name) - {6B690ACD-9479-4C41-8A2D-D6083F650E81} - C:\WINDOWS\system32\HPDirecter.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: (no name) - {afe29f09-c367-4c24-a713-29ab4d30e3c3} - C:\WINDOWS\system32\dssadp.dll
O2 - BHO: (no name) - {DEBEB52F-CFA6-4647-971F-3EDB75B63AFA} - C:\WINDOWS\system32\tmp60B.tmp.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [winehq.org] rundll32.exe "C:\WINDOWS\opoppp.dll",realset
O4 - HKLM\..\Run: [HP Update Assistant] C:\WINDOWS\system32\HPAware.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1154049358906
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: c:\windows\system32\pmnljii.dll
O20 - Winlogon Notify: bjgbjhfb - C:\WINDOWS\
O20 - Winlogon Notify: diacact - diacact.dll (file missing)
O20 - Winlogon Notify: dssadp - C:\WINDOWS\SYSTEM32\dssadp.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: DomainService - - C:\DOCUME~1\user\LOCALS~1\Temp\tmp1.tmp.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
cybertech's Avatar
Moderator with 69,360 posts.
 
Join Date: Apr 2002
Location: USA
23-Jun-2007, 09:58 AM #2
Download ComboFix from Here or Here to your Desktop.
  • Double click combofix.exe and follow the prompts.
  • When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply
Note: Do not mouseclick combofix's window while its running. That may cause it to stall
o.a's Avatar
o.a o.a is offline
Junior Member with 2 posts.
THREAD STARTER
 
Join Date: Jun 2007
Experience: Intermediate
23-Jun-2007, 11:46 PM #3
this is the combo fix log......

ComboFix 07-06-18.2 - C:\Documents and Settings\user\Desktop\ComboFix.exe
"user" - 2007-06-23 22:34:30 - Service Pack 2 NTFS


(((((((((((((((((((((((((((((((((((((((((((( V Log )))))))))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\system32\ddayaaw.dll
C:\WINDOWS\system32\vtstspn.dll
C:\WINDOWS\awwxyy.dll
C:\WINDOWS\ddbaxu.dll
C:\WINDOWS\fcbyvs.dll
C:\WINDOWS\gebxus.dll
C:\WINDOWS\hgdeec.dll
C:\WINDOWS\hgfgfg.dll
C:\WINDOWS\hggfcd.dll
C:\WINDOWS\khebbb.dll
C:\WINDOWS\khghhi.dll
C:\WINDOWS\ljijgg.dll
C:\WINDOWS\nnmmlk.dll
C:\WINDOWS\opmkjj.dll
C:\WINDOWS\qommji.dll
C:\WINDOWS\qoponk.dll
C:\WINDOWS\rqomkj.dll
C:\WINDOWS\rqrqpn.dll
C:\WINDOWS\tuvsqp.dll
C:\WINDOWS\xxvusr.dll
C:\WINDOWS\yaawuv.dll
C:\WINDOWS\yyxwwa.ini
C:\WINDOWS\uxabdd.ini
C:\WINDOWS\svybcf.ini
C:\WINDOWS\suxbeg.ini
C:\WINDOWS\ceedgh.ini
C:\WINDOWS\gfgfgh.ini
C:\WINDOWS\dcfggh.ini
C:\WINDOWS\bbbehk.ini
C:\WINDOWS\bbbehk.tmp
C:\WINDOWS\ihhghk.ini
C:\WINDOWS\klmmnn.ini
C:\WINDOWS\jjkmpo.ini
C:\WINDOWS\ijmmoq.ini
C:\WINDOWS\knopoq.ini
C:\WINDOWS\jkmoqr.ini
C:\WINDOWS\npqrqr.ini
C:\WINDOWS\pqsvut.ini
C:\WINDOWS\rsuvxx.ini
C:\WINDOWS\vuwaay.ini
C:\WINDOWS\system32\dssadp.dll


* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *



((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\DOCUME~1\LOCALS~1\APPLIC~1\netmon
C:\DOCUME~1\LOCALS~1\APPLIC~1\netmon\domains.txt
C:\DOCUME~1\LOCALS~1\APPLIC~1\netmon\log.txt
C:\DOCUME~1\user\APPLIC~1.\macromedia\Flash Player\#SharedObjects\5AUKNXCU\www.broadcaster.com
C:\DOCUME~1\user\APPLIC~1.\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com
C:\DOCUME~1\user\APPLIC~1.\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol
C:\Program Files\Common Files\Yazzle1122OinUninstaller.exe
C:\Program Files\inetget2
C:\Program Files\network monitor
C:\WINDOWS\system32\tmp1.tmp.dll
C:\WINDOWS\system32\tmp104.tmp.dll
C:\WINDOWS\system32\tmp111C.tmp.dll
C:\WINDOWS\system32\tmp14.tmp.dll
C:\WINDOWS\system32\tmp1609.tmp.dll
C:\WINDOWS\system32\tmp160C.tmp.dll
C:\WINDOWS\system32\tmp160F.tmp.dll
C:\WINDOWS\system32\tmp1612.tmp.dll
C:\WINDOWS\system32\tmp1615.tmp.dll
C:\WINDOWS\system32\tmp1738.tmp.dll
C:\WINDOWS\system32\tmp1747.tmp.dll
C:\WINDOWS\system32\tmp181.tmp.dll
C:\WINDOWS\system32\tmp286.tmp.dll
C:\WINDOWS\system32\tmp2C.tmp.dll
C:\WINDOWS\system32\tmp2F.tmp.dll
C:\WINDOWS\system32\tmp32C.tmp.dll
C:\WINDOWS\system32\tmp35.tmp.dll
C:\WINDOWS\system32\tmp370.tmp.dll
C:\WINDOWS\system32\tmp3711.tmp.dll
C:\WINDOWS\system32\tmp3714.tmp.dll
C:\WINDOWS\system32\tmp371B.tmp.dll
C:\WINDOWS\system32\tmp3722.tmp.dll
C:\WINDOWS\system32\tmp3725.tmp.dll
C:\WINDOWS\system32\tmp3728.tmp.dll
C:\WINDOWS\system32\tmp374.tmp.dll
C:\WINDOWS\system32\tmp39.tmp.dll
C:\WINDOWS\system32\tmp40.tmp.dll
C:\WINDOWS\system32\tmp44.tmp.dll
C:\WINDOWS\system32\tmp49.tmp.dll
C:\WINDOWS\system32\tmp4D.tmp.dll
C:\WINDOWS\system32\tmp527.tmp.dll
C:\WINDOWS\system32\tmp53.tmp.dll
C:\WINDOWS\system32\tmp60C.tmp.dll
C:\WINDOWS\system32\tmp6C.tmp.dll
C:\WINDOWS\system32\tmp6CA.tmp.dll
C:\WINDOWS\system32\tmp6D4.tmp.dll
C:\WINDOWS\system32\tmp72.tmp.dll
C:\WINDOWS\system32\tmp74.tmp.dll
C:\WINDOWS\system32\tmp79.tmp.dll
C:\WINDOWS\system32\tmp7C6.tmp.dll
C:\WINDOWS\system32\tmp87.tmp.dll
C:\WINDOWS\system32\tmp92.tmp.dll
C:\WINDOWS\system32\tmp9E.tmp.dll
C:\WINDOWS\system32\tmpA.tmp.dll
C:\WINDOWS\system32\tmpC5.tmp.dll
C:\WINDOWS\system32\tmpDCE.tmp.dll
C:\WINDOWS\system32\tmpE87.tmp.dll
C:\WINDOWS\system32\tmpF6.tmp.dll
C:\WINDOWS\uninstall_nmon.vbs


((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


-------\LEGACY_CMDSERVICE
-------\LEGACY_NETWORK_MONITOR
-------\cmdService
-------\Network Monitor


((((((((((((((((((((((((( Files Created from 2007-05-24 to 2007-06-24 )))))))))))))))))))))))))))))))


2007-06-23 22:34 49,152 --a------ C:\WINDOWS\nircmd.exe
2007-06-21 09:02 134,834 --a------ C:\WINDOWS\opoppp.dll
2007-06-20 19:42 455,680 --a------ C:\WINDOWS\system32\HPDirecter.dll
2007-06-20 17:31 46,336 --a------ C:\WINDOWS\system32\tmp60B.tmp.dll
2007-06-20 11:42 46,336 --a------ C:\WINDOWS\system32\tmp608.tmp.dll
2007-06-19 22:39 128,029 --a------ C:\tmp1.tmp.exe
2007-06-17 15:50 46,336 --a------ C:\WINDOWS\system32\tmpEB.tmp.dll
2007-06-17 11:31 <DIR> d-------- C:\DOCUME~1\user\Incomplete
2007-06-17 11:30 <DIR> d-------- C:\Program Files\LimeWire
2007-06-17 11:30 <DIR> d-------- C:\DOCUME~1\user\APPLIC~1\LimeWire
2007-06-17 02:43 46,336 --a------ C:\WINDOWS\system32\tmp132.tmp.dll
2007-06-17 00:04 46,336 --a------ C:\WINDOWS\system32\tmpF8.tmp.dll
2007-06-16 21:47 46,336 --a------ C:\WINDOWS\system32\tmpC3.tmp.dll
2007-06-16 19:05 46,336 --a------ C:\WINDOWS\system32\tmp6B.tmp.dll
2007-06-16 17:42 46,336 --a------ C:\WINDOWS\system32\tmp4B.tmp.dll
2007-06-15 22:18 46,336 --a------ C:\WINDOWS\system32\tmp10.tmp.dll
2007-06-15 17:20 46,336 --a------ C:\WINDOWS\system32\tmpC.tmp.dll
2007-06-15 14:29 46,336 --a------ C:\WINDOWS\system32\tmp9.tmp.dll
2007-06-07 15:23 <DIR> d-------- C:\WINDOWS\system32\hpff4
2007-06-04 02:59 46,336 --a------ C:\WINDOWS\system32\tmpF.tmp.dll
2007-06-03 00:35 <DIR> d-------- C:\Program Files\RegSupreme
2007-06-02 08:42 46,336 --a------ C:\WINDOWS\system32\tmp4.tmp.dll
2007-06-02 07:18 <DIR> d-------- C:\Program Files\ScanSpyware v3.8.0.4
2007-05-31 22:30 46,336 --a------ C:\WINDOWS\system32\tmp5.tmp.dll
2007-05-29 22:56 <DIR> d-------- C:\DOCUME~1\user\APPLIC~1\vlc
2007-05-29 15:37 88,464 --a------ C:\WINDOWS\system32\decvw_32.dll
2007-05-29 15:37 79,360 --a------ C:\WINDOWS\system32\vdodec32.dll
2007-05-29 15:37 78,064 --a------ C:\WINDOWS\vidtoasf.exe
2007-05-29 15:37 69,120 --a------ C:\WINDOWS\system32\vdoenc32.dll
2007-05-29 15:37 67,856 --a------ C:\WINDOWS\asfcheck.exe
2007-05-29 15:37 66,560 --a------ C:\WINDOWS\system32\tr2032.dll
2007-05-29 15:37 63,808 --a------ C:\WINDOWS\system32\NSCMPS.dll
2007-05-29 15:37 416,304 --a------ C:\WINDOWS\system32\MPG4C32.dll
2007-05-29 15:37 34,240 --a------ C:\WINDOWS\system32\nserror.dll
2007-05-29 15:37 278,016 --a------ C:\WINDOWS\system32\VCT3216.dll
2007-05-29 15:37 261,632 --a------ C:\WINDOWS\system32\accuimr5.dll
2007-05-29 15:37 23,824 --a------ C:\WINDOWS\asx3test.exe
2007-05-29 15:37 206,336 --a------ C:\WINDOWS\system32\ivvideo.dll
2007-05-29 15:37 17,792 --a------ C:\WINDOWS\asfchop.exe
2007-05-29 15:37 140,800 --a------ C:\WINDOWS\system32\encvw_32.dll
2007-05-29 15:37 104,832 --a------ C:\WINDOWS\wavtoasf.exe
2007-05-29 15:37 <DIR> d-------- C:\Program Files\Windows Media Components
2007-05-29 14:39 <DIR> d-------- C:\DOCUME~1\user\APPLIC~1\Help
2007-05-29 14:18 <DIR> d-------- C:\Program Files\Intelore
2007-05-28 09:08 205,824 --a------ C:\WINDOWS\system32\iehelper3.dll
2007-05-26 12:41 176,128 --a------ C:\WINDOWS\system32\C1CW3.exe
2007-05-26 07:56 <DIR> d-------- C:\Program Files\XoftSpySE
2007-05-24 07:31 34,723 --a------ C:\WINDOWS\system32\ssqro.exe


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-06-20 14:21:56 -------- d-----w C:\Program Files\Image-Line
2007-06-20 14:03:03 -------- d-----w C:\Program Files\VstPlugins
2007-06-20 12:47:10 46,336 ----a-w C:\WINDOWS\system32\tmp2.tmp.dll
2007-06-01 12:03:37 -------- d-----w C:\Program Files\Windows Live Toolbar
2007-05-26 13:00:15 -------- d-----w C:\Program Files\BearShare
2007-05-21 16:11:05 187,412 ----a-w C:\WINDOWS\system32\HPAware.exe
2007-05-17 03:24:02 -------- d-----w C:\Program Files\Alwil Software
2007-05-16 15:12:02 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-05-11 12:32:14 -------- d-----w C:\Program Files\Common Files\Ahead
2007-04-30 15:46:10 745,600 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-04-30 15:41:55 85,952 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-04-30 15:41:42 94,552 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-04-30 15:39:41 23,416 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-04-30 15:38:51 43,176 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-04-30 15:37:23 26,888 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-04-30 15:35:28 95,872 ----a-w C:\WINDOWS\system32\AVASTSS.scr
2007-04-28 21:49:43 -------- d-----w C:\DOCUME~1\user\APPLIC~1\Google
2007-04-28 02:35:09 -------- d-----w C:\DOCUME~1\user\APPLIC~1\Steinberg
2007-04-28 02:23:16 -------- d-----w C:\Program Files\Steinberg
2007-04-28 02:17:51 -------- d-----w C:\Program Files\Syncrosoft
2007-04-28 01:44:12 -------- d-----w C:\Program Files\Google
2007-04-25 14:21:15 144,896 ----a-w C:\WINDOWS\system32\schannel.dll
2007-04-24 19:28:51 -------- d-----w C:\Program Files\Common Files\Adobe Systems Shared
2007-04-24 12:34:07 -------- d-----w C:\Program Files\MSN Messenger
2007-04-23 21:34:00 28 ----a-w C:\WINDOWS\system32\srss.dat
2007-04-22 00:42:36 26,830 ----a-w C:\WINDOWS\system32\ddaya.exe
2007-04-18 16:12:23 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll
2007-04-17 03:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll
2007-04-17 03:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll
2007-04-17 03:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
2007-04-17 03:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
2007-04-17 03:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
2007-04-17 03:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
2007-04-17 03:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
2007-04-17 03:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
2007-04-17 03:44:20 271,224 ----a-w C:\WINDOWS\system32\mucltui.dll
2007-04-17 03:44:18 208,248 ----a-w C:\WINDOWS\system32\muweb.dll
2005-07-29 21:24:26 472 --sha-r C:\WINDOWS\dXNlcg\xrh5w0.vbs


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Brows er Helper Objects]
{6B690ACD-9479-4C41-8A2D-D6083F650E81}=C:\WINDOWS\system32\HPDirecter.dll [2007-06-20 19:42]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 03:43]
{9030D464-4C02-4ABF-8ECC-5164760863C6}=C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2006-08-31 20:33]
{AA58ED58-01DD-4d91-8333-CF10577473F7}=c:\program files\google\googletoolbar2.dll [2007-04-26 10:46]
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}=C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll [2007-06-18 18:26]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2006-03-01 18:22 C:\WINDOWS\soundman.exe]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 04:56]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [2005-10-28 16:25]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-18 18:26]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\bjgbjhfb]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\diacact]
diacact.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=c:\windows\system32\pmnljii.dll


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountp oints2\{b15ca03f-402c-11db-8492-001921802779}]
AutoRun\command- F:\setupSNK.exe


Contents of the 'Scheduled Tasks' folder
2007-06-24 03:38:09 C:\WINDOWS\tasks\XoftSpySE 2.job
2007-06-19 08:00:00 C:\WINDOWS\tasks\XoftSpySE.job

**************************************************************************

catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-06-23 22:38:13
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-06-23 22:38:59 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-06-23 22:38

--- E O F ---

this is the hijack this log......

Logfile of HijackThis v1.99.1
Scan saved at 10:45:26 PM, on 6/23/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\DOCUME~1\user\LOCALS~1\Temp\tmp1.tmp.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\LimeWire\LimeWire.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: (no name) - {8A4E1972-8F42-4B50-AA71-29DCA9F336BC} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: XBTB06829 - {1D09A743-00ED-4713-BCC4-32D590D1087A} - (no file)
O2 - BHO: (no name) - {6B690ACD-9479-4C41-8A2D-D6083F650E81} - C:\WINDOWS\system32\HPDirecter.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1154049358906
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: c:\windows\system32\pmnljii.dll
O20 - Winlogon Notify: bjgbjhfb - C:\WINDOWS\
O20 - Winlogon Notify: diacact - diacact.dll (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: DomainService - - C:\DOCUME~1\user\LOCALS~1\Temp\tmp1.tmp.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
cybertech's Avatar
Moderator with 69,360 posts.
 
Join Date: Apr 2002
Location: USA
24-Jun-2007, 12:35 PM #4
Please download ATF Cleaner by Atribune.
This program is for XP and Windows 2000 only
  • Double-click ATF-Cleaner.exe to run the program.
    Under Main choose: Select All
    Click the Empty Selected button.


Click Exit on the Main menu to close the program.



Download and scan with SUPERAntiSpyware Free for Home Users
  • Double-click SUPERAntiSpyware.exe and use the default settings for installation.
  • An icon will be created on your desktop. Double-click that icon to launch the program.
  • If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download and unzip them from here.)
  • Under "Configuration and Preferences", click the Preferences button.
  • Click the Scanning Control tab.
  • Under Scanner Options make sure the following are checked (leave all others unchecked):
    • Close browsers before scanning.
    • Scan for tracking cookies.
    • Terminate memory threats before quarantining.
  • Click the "Close" button to leave the control center screen.
  • Back on the main screen, under "Scan for Harmful Software" click Scan your computer.
  • On the left, make sure you check C:\Fixed Drive.
  • On the right, under "Complete Scan", choose Perform Complete Scan.
  • Click "Next" to start the scan. Please be patient while it scans your computer.
  • After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
  • Make sure everything has a checkmark next to it and click "Next".
  • A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
  • If asked if you want to reboot, click "Yes".
  • To retrieve the removal information after reboot, launch SUPERAntispyware again.
    • Click Preferences, then click the Statistics/Logs tab.
    • Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
    • If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
    • Please copy and paste the Scan Log results in your next reply with a new hijackthis log.
  • Click Close to exit the program.
As Seen On

BBC, Reader's Digest, PC Magazine, Today Show, Money Magazine
WELCOME TO TECH SUPPORT GUY!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.


(clock)
THIS THREAD HAS EXPIRED.
Are you having the same problem? We have volunteers ready to answer your question, but first you'll have to join for free. Need help getting started? Check out our Welcome Guide.

Search Tech Support Guy

Find the solution to your
computer problem!




Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools


WELCOME
You Are Using: Server ID
Trusted Website Back to the Top ↑