1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Micro virus AV

Discussion in 'Virus & Other Malware Removal' started by Swampbat, Sep 23, 2008.

Thread Status:
Not open for further replies.
  1. Swampbat

    Swampbat Thread Starter

    Joined:
    Sep 23, 2008
    Messages:
    1
    Hi,
    Yesterday I became infected with something Called Micro Virus AV.
    There were a large number of pop ups telling me to buy their software to clean my PC, and shortcuts for dodgy sites kept appearing on the desktop!

    I have tried running Combofix and this removed a number of files but i am still getting my Virus scanner comming up with popups tekking me that something is trying to alter the registry.

    Here is the combofix log. I have also done a HJT log But it told me the post was too long. I can post this later if you want.

    I hope you can help, thankyou in advance.

    matt.



    ComboFix 08-09-22.03 - Matt 2008-09-23 18:42:56.3 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1357 [GMT 1:00]
    Running from: F:\Documents and Settings\Matt\Desktop\ComboFix.exe
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    F:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
    F:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
    F:\Documents and Settings\Matt\Application Data\Adobe\crc.dat
    F:\Program Files\MicroAV
    F:\Program Files\MicroAV\MicroAV.cpl
    F:\Program Files\MicroAV\MicroAV.exe
    F:\Program Files\MicroAV\MicroAV.ooo
    F:\Program Files\MicroAV\MicroAV0.dat
    F:\Program Files\MicroAV\MicroAV1.dat
    F:\Program Files\PCHealthCenter\0.exe
    F:\Program Files\PCHealthCenter\0.gif
    F:\Program Files\PCHealthCenter\1.exe
    F:\Program Files\PCHealthCenter\1.gif
    F:\Program Files\PCHealthCenter\1.ico
    F:\Program Files\PCHealthCenter\2.exe
    F:\Program Files\PCHealthCenter\2.gif
    F:\Program Files\PCHealthCenter\2.ico
    F:\Program Files\PCHealthCenter\3.exe
    F:\Program Files\PCHealthCenter\3.gif
    F:\Program Files\PCHealthCenter\4.exe
    F:\Program Files\PCHealthCenter\5.exe
    F:\Program Files\PCHealthCenter\7.exe
    F:\Program Files\PCHealthCenter\e
    F:\Program Files\PCHealthCenter\sc.html
    F:\WINDOWS\system32\_003590_.tmp.dll
    F:\WINDOWS\system32\_003598_.tmp.dll
    F:\WINDOWS\system32\_003622_.tmp.dll
    F:\WINDOWS\system32\_003630_.tmp.dll
    F:\WINDOWS\system32\_003638_.tmp.dll
    F:\WINDOWS\system32\_003646_.tmp.dll
    F:\WINDOWS\system32\_003654_.tmp.dll
    F:\WINDOWS\system32\_003662_.tmp.dll
    F:\WINDOWS\system32\_003678_.tmp.dll
    F:\WINDOWS\system32\_003694_.tmp.dll
    F:\WINDOWS\system32\_003710_.tmp.dll
    F:\WINDOWS\system32\_003718_.tmp.dll
    F:\WINDOWS\system32\_003734_.tmp.dll
    F:\WINDOWS\system32\_003742_.tmp.dll
    F:\WINDOWS\system32\_003750_.tmp.dll
    F:\WINDOWS\system32\_003758_.tmp.dll
    F:\WINDOWS\system32\_003769_.tmp.dll
    F:\WINDOWS\system32\_003770_.tmp.dll
    F:\WINDOWS\system32\_003771_.tmp.dll
    F:\WINDOWS\system32\_003772_.tmp.dll
    F:\WINDOWS\system32\_003779_.tmp.dll
    F:\WINDOWS\system32\_003780_.tmp.dll
    F:\WINDOWS\system32\_003781_.tmp.dll
    F:\WINDOWS\system32\_003783_.tmp.dll
    F:\WINDOWS\system32\_003784_.tmp.dll
    F:\WINDOWS\system32\_003785_.tmp.dll
    F:\WINDOWS\system32\_003786_.tmp.dll
    F:\WINDOWS\system32\_003787_.tmp.dll
    F:\WINDOWS\system32\_003788_.tmp.dll
    F:\WINDOWS\system32\_003791_.tmp.dll
    F:\WINDOWS\system32\_003792_.tmp.dll
    F:\WINDOWS\system32\_003793_.tmp.dll
    F:\WINDOWS\system32\_003794_.tmp.dll
    F:\WINDOWS\system32\_003795_.tmp.dll
    F:\WINDOWS\system32\_003796_.tmp.dll
    F:\WINDOWS\system32\_003798_.tmp.dll
    F:\WINDOWS\system32\_003799_.tmp.dll
    F:\WINDOWS\system32\_003800_.tmp.dll
    F:\WINDOWS\system32\_003801_.tmp.dll
    F:\WINDOWS\system32\_003802_.tmp.dll
    F:\WINDOWS\system32\_003803_.tmp.dll
    F:\WINDOWS\system32\_003804_.tmp.dll
    F:\WINDOWS\system32\_003806_.tmp.dll
    F:\WINDOWS\system32\_003809_.tmp.dll
    F:\WINDOWS\system32\_003810_.tmp.dll
    F:\WINDOWS\system32\_003811_.tmp.dll
    F:\WINDOWS\system32\_003812_.tmp.dll
    F:\WINDOWS\system32\_003813_.tmp.dll
    F:\WINDOWS\system32\_003814_.tmp.dll
    F:\WINDOWS\system32\_003817_.tmp.dll
    F:\WINDOWS\system32\_003818_.tmp.dll
    F:\WINDOWS\system32\_003819_.tmp.dll
    F:\WINDOWS\system32\_003820_.tmp.dll
    F:\WINDOWS\system32\_003822_.tmp.dll
    F:\WINDOWS\system32\_003823_.tmp.dll
    F:\WINDOWS\system32\_003825_.tmp.dll
    F:\WINDOWS\system32\_003826_.tmp.dll
    F:\WINDOWS\system32\_003827_.tmp.dll
    F:\WINDOWS\system32\_003828_.tmp.dll
    F:\WINDOWS\system32\_003829_.tmp.dll
    F:\WINDOWS\system32\_003832_.tmp.dll
    F:\WINDOWS\system32\_003833_.tmp.dll
    F:\WINDOWS\system32\_003834_.tmp.dll
    F:\WINDOWS\system32\_003835_.tmp.dll
    F:\WINDOWS\system32\_003836_.tmp.dll
    F:\WINDOWS\system32\_003838_.tmp.dll
    F:\WINDOWS\system32\_003839_.tmp.dll
    F:\WINDOWS\system32\_003840_.tmp.dll
    F:\WINDOWS\system32\_003841_.tmp.dll
    F:\WINDOWS\system32\_003842_.tmp.dll
    F:\WINDOWS\system32\_003843_.tmp.dll
    F:\WINDOWS\system32\_003844_.tmp.dll
    F:\WINDOWS\system32\_003845_.tmp.dll
    F:\WINDOWS\system32\_003848_.tmp.dll
    F:\WINDOWS\system32\_003849_.tmp.dll
    F:\WINDOWS\system32\_003850_.tmp.dll
    F:\WINDOWS\system32\_003851_.tmp.dll
    F:\WINDOWS\system32\_003852_.tmp.dll
    F:\WINDOWS\system32\_003853_.tmp.dll
    F:\WINDOWS\system32\_003854_.tmp.dll
    F:\WINDOWS\system32\_003855_.tmp.dll
    F:\WINDOWS\system32\_003856_.tmp.dll
    F:\WINDOWS\system32\_003857_.tmp.dll
    F:\WINDOWS\system32\_003858_.tmp.dll
    F:\WINDOWS\system32\_003859_.tmp.dll
    F:\WINDOWS\system32\_003860_.tmp.dll
    F:\WINDOWS\system32\_003865_.tmp.dll
    F:\WINDOWS\system32\_003866_.tmp.dll
    F:\WINDOWS\system32\_003867_.tmp.dll
    F:\WINDOWS\system32\_003868_.tmp.dll
    F:\WINDOWS\system32\_003869_.tmp.dll
    F:\WINDOWS\system32\_003871_.tmp.dll
    F:\WINDOWS\system32\_003872_.tmp.dll
    F:\WINDOWS\system32\_003873_.tmp.dll
    F:\WINDOWS\system32\_003874_.tmp.dll
    F:\WINDOWS\system32\_003875_.tmp.dll
    F:\WINDOWS\system32\_003876_.tmp.dll
    F:\WINDOWS\system32\_003881_.tmp.dll
    F:\WINDOWS\system32\_003882_.tmp.dll
    F:\WINDOWS\system32\_003883_.tmp.dll
    F:\WINDOWS\system32\_003884_.tmp.dll
    F:\WINDOWS\system32\_003889_.tmp.dll
    F:\WINDOWS\system32\_003890_.tmp.dll
    F:\WINDOWS\system32\_003891_.tmp.dll
    F:\WINDOWS\system32\_003892_.tmp.dll
    F:\WINDOWS\system32\_003897_.tmp.dll
    F:\WINDOWS\system32\_003898_.tmp.dll
    F:\WINDOWS\system32\_003899_.tmp.dll
    F:\WINDOWS\system32\_003900_.tmp.dll
    F:\WINDOWS\system32\_003905_.tmp.dll
    F:\WINDOWS\system32\_003906_.tmp.dll
    F:\WINDOWS\system32\_003907_.tmp.dll
    F:\WINDOWS\system32\_003908_.tmp.dll
    F:\WINDOWS\system32\_003913_.tmp.dll
    F:\WINDOWS\system32\_003914_.tmp.dll
    F:\WINDOWS\system32\_003915_.tmp.dll
    F:\WINDOWS\system32\_003916_.tmp.dll
    F:\WINDOWS\system32\_003921_.tmp.dll
    F:\WINDOWS\system32\_003922_.tmp.dll
    F:\WINDOWS\system32\_003923_.tmp.dll
    F:\WINDOWS\system32\_003924_.tmp.dll
    F:\WINDOWS\system32\_003929_.tmp.dll
    F:\WINDOWS\system32\_003930_.tmp.dll
    F:\WINDOWS\system32\_003931_.tmp.dll
    F:\WINDOWS\system32\_003932_.tmp.dll
    F:\WINDOWS\system32\_006136_.tmp.dll
    F:\WINDOWS\system32\_006137_.tmp.dll
    F:\WINDOWS\system32\_006138_.tmp.dll
    F:\WINDOWS\system32\_006139_.tmp.dll
    F:\WINDOWS\system32\_006146_.tmp.dll
    F:\WINDOWS\system32\_006147_.tmp.dll
    F:\WINDOWS\system32\_006148_.tmp.dll
    F:\WINDOWS\system32\_006149_.tmp.dll
    F:\WINDOWS\system32\_006151_.tmp.dll
    F:\WINDOWS\system32\_006152_.tmp.dll
    F:\WINDOWS\system32\_006155_.tmp.dll
    F:\WINDOWS\system32\_006156_.tmp.dll
    F:\WINDOWS\system32\_006158_.tmp.dll
    F:\WINDOWS\system32\_006159_.tmp.dll
    F:\WINDOWS\system32\_006160_.tmp.dll
    F:\WINDOWS\system32\_006162_.tmp.dll
    F:\WINDOWS\system32\_006165_.tmp.dll
    F:\WINDOWS\system32\_006166_.tmp.dll
    F:\WINDOWS\system32\_006170_.tmp.dll
    F:\WINDOWS\system32\_006171_.tmp.dll
    F:\WINDOWS\system32\_006173_.tmp.dll
    F:\WINDOWS\system32\_006176_.tmp.dll
    F:\WINDOWS\system32\_006178_.tmp.dll
    F:\WINDOWS\system32\_006179_.tmp.dll
    F:\WINDOWS\system32\_006180_.tmp.dll
    F:\WINDOWS\system32\_006181_.tmp.dll
    F:\WINDOWS\system32\_006182_.tmp.dll
    F:\WINDOWS\system32\_006185_.tmp.dll
    F:\WINDOWS\system32\_006186_.tmp.dll
    F:\WINDOWS\system32\_006187_.tmp.dll
    F:\WINDOWS\system32\_006188_.tmp.dll
    F:\WINDOWS\system32\_006189_.tmp.dll
    F:\WINDOWS\system32\_006194_.tmp.dll
    F:\WINDOWS\system32\_006196_.tmp.dll
    F:\WINDOWS\system32\_006197_.tmp.dll
    F:\WINDOWS\system32\1.ico
    F:\WINDOWS\system32\2.ico
    F:\WINDOWS\system32\mlJAsPfd.dll
    F:\WINDOWS\system32\mlJdccAr.dll
    F:\WINDOWS\system32\rtl60.bpl

    ----- BITS: Possible infected sites -----

    http://78.157.143.163
    .
    ((((((((((((((((((((((((( Files Created from 2008-08-23 to 2008-09-23 )))))))))))))))))))))))))))))))
    .

    2008-09-22 22:42 . 2008-09-22 03:15 166,400 --a------ F:\WINDOWS\system32\MicroAV.cpl
    2008-09-22 22:41 . 2008-09-23 18:55 <DIR> d-------- F:\Program Files\PCHealthCenter
    2008-09-21 18:32 . 2008-09-21 18:32 <DIR> d-------- F:\Program Files\Kontiki
    2008-09-21 18:32 . 2008-09-23 18:59 <DIR> d-------- F:\Documents and Settings\All Users\Application Data\Kontiki
    2008-09-20 20:19 . 2008-09-20 20:19 <DIR> d-------- F:\Program Files\Projity Inc
    2008-09-19 22:00 . 2008-09-19 22:00 <DIR> d-------- F:\Program Files\Microsoft Silverlight
    2008-09-03 21:29 . 2008-09-03 21:29 <DIR> d-------- F:\Program Files\Microsoft ActiveSync
    2008-08-26 21:03 . 2008-08-26 21:07 10,752 --a------ F:\WINDOWS\DCEBoot.exe

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-09-23 17:39 --------- d---a-w F:\Documents and Settings\All Users\Application Data\TEMP
    2008-09-22 21:46 --------- d-----w F:\Documents and Settings\Matt\Application Data\Azureus
    2008-09-22 20:14 --------- d-----w F:\Program Files\Mozilla Thunderbird
    2008-09-11 20:36 --------- d-----w F:\Documents and Settings\Matt\Application Data\Canon
    2008-09-07 16:20 --------- d-----w F:\Documents and Settings\Matt\Application Data\Shareaza
    2008-09-07 09:28 --------- d--h--w F:\Program Files\InstallShield Installation Information
    2008-09-06 17:45 --------- d-----w F:\Program Files\THQ
    2008-09-05 13:49 --------- d-----w F:\Program Files\Mozilla Sunbird
    2008-09-03 20:29 --------- d-----w F:\Program Files\Common Files\L&H
    2008-08-27 17:00 --------- d-----w F:\Program Files\SpywareBlaster
    2008-08-14 20:42 --------- d-----w F:\Program Files\Microsoft Works
    2008-08-14 20:42 --------- d-----w F:\Documents and Settings\All Users\Application Data\Microsoft Help
    2008-08-10 18:58 --------- d-----w F:\Program Files\Windows Media Connect 2
    2008-08-10 18:54 0 ---ha-w F:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
    2008-08-10 18:54 0 ---ha-w F:\WINDOWS\system32\drivers\Msft_Kernel_NuidFltr_01005.Wdf
    2008-08-10 08:22 --------- d-----w F:\Program Files\Windows Resource Kits
    2008-07-23 18:37 --------- d-----w F:\Program Files\WA-T1
    2008-07-19 19:26 43,520 ----a-w F:\WINDOWS\system32\CmdLineExt03.dll
    2008-07-18 21:10 94,920 ----a-w F:\WINDOWS\system32\cdm.dll
    2008-07-18 21:10 53,448 ----a-w F:\WINDOWS\system32\wuauclt.exe
    2008-07-18 21:10 45,768 ----a-w F:\WINDOWS\system32\wups2.dll
    2008-07-18 21:10 36,552 ----a-w F:\WINDOWS\system32\wups.dll
    2008-07-18 21:09 563,912 ----a-w F:\WINDOWS\system32\wuapi.dll
    2008-07-18 21:09 325,832 ----a-w F:\WINDOWS\system32\wucltui.dll
    2008-07-18 21:09 205,000 ----a-w F:\WINDOWS\system32\wuweb.dll
    2008-07-18 21:09 1,811,656 ----a-w F:\WINDOWS\system32\wuaueng.dll
    2008-07-07 20:26 253,952 ----a-w F:\WINDOWS\system32\es.dll
    2008-06-24 17:12 295,936 ----a-w F:\WINDOWS\system32\wmpeffects.dll
    2008-06-24 16:43 74,240 ----a-w F:\WINDOWS\system32\mscms.dll
    2008-06-23 16:57 826,368 ----a-w F:\WINDOWS\system32\wininet.dll
    2007-06-24 13:57 3,129,344 ----a-w F:\Program Files\disgomykey.exe
    2007-08-12 11:30 56 --sha-r F:\WINDOWS\system32\0D0FA6C844.sys
    2002-04-16 10:27 5 --sha-w F:\WINDOWS\system32\CdI5T.drv
    2007-08-12 21:10 1,890 --sha-w F:\WINDOWS\system32\KGyGaAvL.sys
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888SOFTWARE\Microsoft\Windows\CurrentVersion\Run"="8888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888SOFTWARE\Microsoft\Windows\CurrentVersion\Run" [X]
    "NBJ"="F:\Program Files\Ahead\Nero\Nero BackItUp\NBJ.exe" [2004-08-25 1871872]
    "CTFMON.EXE"="F:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]
    "WMPNSCFG"="F:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 204288]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888SOFTWARE\Microsoft\Windows\CurrentVersion\Run"="8888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888SOFTWARE\Microsoft\Windows\CurrentVersion\Run" [X]
    "SunJavaUpdateSched"="F:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
    "OpwareSE2"="F:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [2003-05-08 49152]
    "IgfxTray"="F:\WINDOWS\system32\igfxtray.exe" [2003-03-11 155648]
    "HotKeysCmds"="F:\WINDOWS\system32\hkcmd.exe" [2003-03-11 114688]
    "CTSysVol"="F:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe" [2003-09-17 57344]
    "ASUS Probe"="f:\AsusProb.exe" [2002-12-06 617984]
    "itype"="F:\Program Files\Microsoft IntelliType Pro\itype.exe" [2006-06-16 555816]
    "IntelliPoint"="F:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2006-06-16 568096]
    "btbb_wcm_McciTrayApp"="F:\Program Files\btbb_wcm\McciTrayApp.exe" [2006-11-30 935936]
    "Motive SmartBridge"="F:\PROGRA~1\BTBROA~2\SMARTB~1\BTHelpNotifier.exe" [2006-05-24 458839]
    "pccguide.exe"="F:\PROGRA~1\TRENDM~1\INTERN~3\pccguide.exe" [2007-03-07 3429904]
    "tsnp2std"="F:\WINDOWS\tsnp2std.exe" [2005-11-14 110592]
    "snp2std"="F:\WINDOWS\vsnp2std.exe" [2005-11-16 344064]
    "Adobe Reader Speed Launcher"="F:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
    "ISUSScheduler"="F:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-08-09 81920]
    "QuickTime Task"="F:\Program Files\QuickTime\QTTask.exe" [2008-05-27 413696]
    "iTunesHelper"="F:\Program Files\iTunes\iTunesHelper.exe" [2008-06-02 267048]
    "StartCCC"="F:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="F:\WINDOWS\System32\CTFMON.EXE" [2008-04-14 15360]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    "tscuninstall"="F:\WINDOWS\system32\tscupgrd.exe" [2004-08-03 44544]

    F:\Documents and Settings\Matt\Start Menu\Programs\Startup\
    Adobe Gamma.lnk - F:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 113664]

    F:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Service Manager.lnk - F:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2002-12-17 74308]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "vidc.ffds"= ffdshow.ax

    [HKLM\~\startupfolder\F:^Documents and Settings^All Users^Start Menu^Programs^Startup^AutoCAD Startup Accelerator.lnk]
    path=F:\Documents and Settings\All Users\Start Menu\Programs\Startup\AutoCAD Startup Accelerator.lnk
    backup=F:\WINDOWS\pss\AutoCAD Startup Accelerator.lnkCommon Startup

    [HKLM\~\startupfolder\F:^Documents and Settings^All Users^Start Menu^Programs^Startup^CONNECTAUTrayApp.lnk]
    path=F:\Documents and Settings\All Users\Start Menu\Programs\Startup\CONNECTAUTrayApp.lnk
    backup=F:\WINDOWS\pss\CONNECTAUTrayApp.lnkCommon Startup

    [HKLM\~\startupfolder\F:^Documents and Settings^Matt^Start Menu^Programs^Startup^OpenOffice.org 2.0.lnk]
    path=F:\Documents and Settings\Matt\Start Menu\Programs\Startup\OpenOffice.org 2.0.lnk
    backup=F:\WINDOWS\pss\OpenOffice.org 2.0.lnkStartup

    [HKLM\~\startupfolder\F:^Documents and Settings^Matt^Start Menu^Programs^Startup^WordWeb.lnk]
    path=F:\Documents and Settings\Matt\Start Menu\Programs\Startup\WordWeb.lnk
    backup=F:\WINDOWS\pss\WordWeb.lnkStartup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
    --a------ 2008-06-02 11:13 267048 F:\Program Files\iTunes\iTunesHelper.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
    --a------ 2001-07-09 12:50 155648 F:\WINDOWS\system32\NeroCheck.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\PandaAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\PandaFirewall]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "F:\\WINDOWS\\system32\\sessmgr.exe"=
    "F:\\Program Files\\Mozilla Firefox\\firefox.exe"=
    "F:\\Program Files\\Messenger\\msmsgs.exe"=
    "F:\\Program Files\\Valve\\Steam\\Steam.exe"=
    "F:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
    "F:\\Program Files\\Java\\jre1.5.0_02\\bin\\javaw.exe"=
    "F:\\Program Files\\Valve\\Steam\\SteamApps\\swampbat\\half-life 2\\hl2.exe"=
    "F:\\Program Files\\Valve\\Steam\\SteamApps\\swampbat\\counter-strike source\\hl2.exe"=
    "F:\\Program Files\\Outlook Express\\msimn.exe"=
    "F:\\Program Files\\Mozilla Thunderbird\\thunderbird.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "F:\\Program Files\\ASUS\\AsusUpdate\\Update.exe"=
    "F:\\Program Files\\Azureus\\Azureus.exe"=
    "F:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "F:\\Program Files\\THQ\\MotoGP URT 3\\motogp.exe"=
    "F:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "F:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
    "F:\\Program Files\\iTunes\\iTunes.exe"=
    "%windir%\\system32\\sessmgr.exe"=
    "F:\\WINDOWS\\system32\\mmc.exe"=
    "F:\\Program Files\\Kontiki\\KService.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "49253:UDP"= 49253:UDP:azureus
    "49253:TCP"= 49253:TCP:azureus

    R1 LUMDriver;LUMDriver;F:\WINDOWS\system32\drivers\LUMDriver.sys [2003-07-11 14912]
    R2 MSSQL$AUTODESKVAULT;SQL Server (AUTODESKVAULT);F:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2008-02-26 29183504]
    S2 ousbehci;OrangeWare USB Enhanced Host Controller Service;F:\WINDOWS\system32\Drivers\ousbehci.sys [2006-03-01 46080]
    S3 ASUSHWIO;ASUSHWIO;F:\WINDOWS\system32\drivers\ASUSHWIO.sys [ ]
    S3 gkmixern;gkmixern;F:\DOCUME~1\MORGAN\LOCALS~1\Temp\gkmixern.sys [ ]
    S3 hdlSrv;hdlSrv;F:\Documents and Settings\Matt\Start Menu\Programs\CleverStuff\Service-for-Non-admin\hdlSrv.exe [ ]
    S3 MRV6X32U;Vista 32-bits Native WiFi Driver - USB;F:\WINDOWS\system32\DRIVERS\MRVW23B.sys [2006-12-22 231040]
    S3 MRVW225;54M Wireless USB Adapter Dirver for Windows XP;F:\WINDOWS\system32\DRIVERS\MRVW225.sys [2005-12-21 299776]
    S3 ousb2hub;OrangeWare USB 2.0 Root Hub Support;F:\WINDOWS\system32\DRIVERS\ousb2hub.sys [2006-03-01 56960]
    S3 SNP2STD;USB2.0 PC Camera (SNP2STD);F:\WINDOWS\system32\DRIVERS\snp2sxp.sys [2005-11-18 10192896]
    .
    Contents of the 'Scheduled Tasks' folder
    .
    - - - - ORPHANS REMOVED - - - -

    BHO-{1F5FDA83-4379-4C6A-94AD-CC7BC688505A} - F:\WINDOWS\system32\mlJAsPfd.dll
    SharedTaskScheduler-{C1A2FDA2-1A5B-2A8F-F3A2-B22DA1A3C41D} - (no file)
    ShellExecuteHooks-{1F5FDA83-4379-4C6A-94AD-CC7BC688505A} - F:\WINDOWS\system32\mlJAsPfd.dll


    .
    ------- Supplementary Scan -------
    .
    FireFox -: Profile - F:\Documents and Settings\Matt\Application Data\Mozilla\Firefox\Profiles\7h3of5h2.default\
    FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.co.uk/
    FF -: plugin - F:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
    FF -: plugin - F:\Program Files\Mozilla Firefox\plugins\npBBCPlugin.dll
    FF -: plugin - F:\Program Files\Mozilla Firefox\plugins\NPMGWRAP.DLL
    FF -: plugin - F:\Program Files\Mozilla Firefox\plugins\npViewpoint.dll
    FF -: plugin - F:\Program Files\OpenOffice.org 2.0\program\npsoplugin.dll
    FF -: plugin - F:\Program Files\Virtual Earth 3D\npVE3D.dll
    .

    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-09-23 18:57:41
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    ------------------------ Other Running Processes ------------------------
    .
    F:\WINDOWS\system32\ati2evxx.exe
    F:\WINDOWS\system32\ati2evxx.exe
    F:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    F:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    F:\Program Files\Autodesk\Data Management Server 2008\Server\Dispatch\Connectivity.WindowsService.JobDispatch.exe
    F:\Program Files\Autodesk\Data Management Server 2008\Server\Webserver\Connectivity.EDMWS.Server.exe
    F:\Program Files\Bonjour\mDNSResponder.exe
    F:\WINDOWS\system32\CTSVCCDA.EXE
    F:\Program Files\Kontiki\KService.exe
    F:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    F:\PROGRA~1\TRENDM~1\INTERN~3\PcCtlCom.exe
    F:\PROGRA~1\TRENDM~1\INTERN~3\PcScnSrv.exe
    F:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    F:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
    F:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
    F:\PROGRA~1\TRENDM~1\INTERN~3\Tmntsrv.exe
    F:\PROGRA~1\TRENDM~1\INTERN~3\TmPfw.exe
    F:\PROGRA~1\TRENDM~1\INTERN~3\tmproxy.exe
    F:\Program Files\Windows Media Player\wmpnetwk.exe
    F:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    F:\Program Files\iPod\bin\iPodService.exe
    F:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
    .
    **************************************************************************
    .
    Completion time: 2008-09-23 19:17:10 - machine was rebooted
    ComboFix-quarantined-files.txt 2008-09-23 18:16:35
    ComboFix2.txt 2008-06-06 21:23:31

    Pre-Run: 18,444,709,888 bytes free
    Post-Run: 18,216,615,936 bytes free

    409 --- E O F --- 2008-09-15 17:44:58





     
As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/752640

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice