Hello kind helpers of the malware afflicted. Thank you for reading my post and providing assistance.
This shouldn't take too long as I have done most of the clean-up myself but need assistance with a final review to catch what I've missed.
My girlfriends laptop had become severely afflicted, to the point it would not stay running, and it was auto rebooting every minute or so.
Browsers would no longer stay open; Even Mozilla Fire Fox finally stopped working.
At boot, we'd receive a pop-up stating " Error loading C:\Windows\system32\osqznsmOkZ.dll."
When opening a browser, we'd also see a cmd prompt box with C:\...\Locals-1\Temp\22.exe along the top.
This would be followed by a window pop-up stating "NTVDMCPU Has encountered an illegal instruction". Then 22.exe would be mentioned again.
In safe mode, I have run Adaware SE Personal, CWShredder, Ewido AVG scan, A couple Smitfraud cleaners, Spybot Search and destroy, and ComboFix. I had to run them in Safe Mode because they wouldn't run in normal Windows. I've run them each several times and in different orders.
This has restored stability, but I still occasionally see "osqznsmOkZ.dll" and "22.exe" errors pop-up.
I will reinstall McAfee and enable my firewall when the cleanup is done.
Please review my ComboFix and HJT logs and advise on what I should clean up next.
Also, If we can clean this up, I can assure you, I will donate to your organisation.
Thanks in advance
Jim
HJT Log
Logfile of HijackThis v1.98.2
Scan saved at 1:01:05 AM, on 4/3/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Margaret McNutt\Desktop\CleanUp\hijak this\HijackThis.exe
C:\WINDOWS\system32\notepad.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843
O1 - Hosts file is located at: C:\WINDOWS\System32\drivers\etc\hosts
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [StatusClient] C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe /auto
O4 - HKLM\..\Run: [TomcatStartup] C:\Program Files\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1135963028\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl04g\BrStDvPt.exe
O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun
O4 - HKLM\..\Run: [PPort9reminder] "C:\Program Files\ScanSoft\PaperPort\WebEreg\Ereg.exe" -r "C:\Program Files\ScanSoft\PaperPort\WebEreg\ereg.ini"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [SansaDispatch] C:\Program Files\SanDisk\Sansa Updater\SansaDispatch.exe
O4 - HKLM\..\Run: [braviax] braviax.exe
O4 - HKLM\..\Run: [WinIFixer] C:\Program Files\WinIFixer\WinIFixer.exe
O4 - HKLM\..\Run: [bvllyuvo] C:\Program Files\Hkruemqx\bvllyuvo.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Palm Registration.lnk = ?
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: DataViz Inc Messenger.lnk = C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe
O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Program Files\Sony Handheld\Hotsync.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O17 - HKLM\System\CCS\Services\Tcpip\..\{281DB1B5-1487-4E57-A65E-937A61AA2C87}: NameServer = 4.2.2.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{40F703AA-D707-4D5F-90B5-43C3D68ACAB2}: NameServer = 4.2.2.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{51A53BAD-6DD3-49D3-B015-F301730F93FE}: NameServer = 4.2.2.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{5D370A47-30E6-4958-83AA-FB09E378C7FD}: NameServer = 4.2.2.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{D81AAE4F-0C54-4FBE-B182-26A593FB2684}: NameServer = 4.2.2.1
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O21 - SSODL: TZvHyIBqxYtFR - {4A873377-E02D-99DD-4809-259E6ED99C8D} - (no file)
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
COMBOFIX Log
ComboFix 08-04-01.2 - Margaret McNutt 2008-04-03 0:51:10.7 - NTFSx86 NETWORK
Running from: C:\Documents and Settings\Margaret McNutt\Desktop\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2008-03-03 to 2008-04-03 )))))))))))))))))))))))))))))))
.
2008-04-02 21:32 . 2008-04-02 21:32 <DIR> d-------- C:\Documents and Settings\Margaret McNutt\Application Data\Grisoft
2008-04-02 21:32 . 2007-05-30 08:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-04-02 15:38 . 2008-04-02 15:38 <DIR> d-------- C:\WINDOWS\system32\bfubackups
2008-04-01 18:34 . 2008-04-01 18:34 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-04-01 16:01 . 2008-04-01 16:00 691,545 --a------ C:\WINDOWS\unins000.exe
2008-04-01 16:01 . 2008-04-01 16:01 2,559 --a------ C:\WINDOWS\unins000.dat
2008-03-30 18:07 . 2008-03-30 19:18 7,484 --a------ C:\WINDOWS\system32\tmp.reg
2008-03-30 18:06 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-03-30 18:06 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-03-30 18:06 . 2008-03-01 23:12 86,016 --a------ C:\WINDOWS\system32\VACFix.exe
2008-03-30 18:06 . 2008-02-29 23:48 82,432 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-03-30 18:06 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-03-30 18:06 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-03-24 13:13 . 2008-03-24 13:13 2 --a------ C:\E.tmp
2008-03-23 23:03 . 2008-03-23 23:03 2 --a------ C:\B.tmp
2008-03-22 15:50 . 2008-03-22 15:50 10,001 --a------ C:\WINDOWS\lxqu.exe
2008-03-12 21:56 . 2008-03-12 21:56 978 --a------ C:\WINDOWS\system32\MRT.INI
2008-03-11 22:47 . 2008-03-20 22:17 0 --a------ C:\WINDOWS\system32\lich.dat
2008-03-11 22:45 . 2008-03-11 22:46 31,272 --a------ C:\F.tmp
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-01 22:36 --------- d-----w C:\Program Files\ewido anti-malware
2008-04-01 20:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-04-01 19:50 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-04-01 07:49 --------- d-----w C:\Program Files\McAfee
2008-04-01 07:49 --------- d-----w C:\Documents and Settings\All Users\Application Data\McAfee
2008-04-01 07:39 --------- d-----w C:\Documents and Settings\All Users\Application Data\SiteAdvisor
2008-04-01 01:43 --------- d-----w C:\Program Files\Info Select
2008-03-13 01:55 --------- d-----w C:\Program Files\Xyjiycqd
2008-03-13 01:55 --------- d-----w C:\Program Files\urgloxsn
2008-03-12 02:44 14,336 ----a-w C:\WINDOWS\system32\svchost.exe
2008-03-12 02:44 14,336 ----a-w C:\WINDOWS\system32\dllcache\svchost.exe
2008-03-10 03:04 --------- d-----w C:\Program Files\Sony Handheld
2008-03-03 02:30 --------- d-----w C:\Program Files\Google
2008-03-02 18:35 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-02 18:34 --------- d-----w C:\Program Files\Quicken
2008-03-02 18:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\Napster
2008-03-02 06:03 --------- d-----w C:\Program Files\InfeStop
2008-03-02 06:03 --------- d-----w C:\Program Files\EasySpywareCleaner
2008-03-02 06:02 --------- d-----w C:\Program Files\Spy-Rid
2008-03-02 05:33 126 ----a-w C:\Documents and Settings\Margaret McNutt\c200.bat
2008-03-02 05:31 112,640 ----a-w C:\Documents and Settings\Margaret McNutt\tmp.exe
2008-03-02 05:31 --------- d-----w C:\Documents and Settings\Margaret McNutt\Application Data\InfeStop.com
2008-03-02 04:54 --------- d-----w C:\Program Files\McAfee virus protection
2008-03-02 03:57 --------- d-----w C:\Documents and Settings\Margaret McNutt\Application Data\spy-rid.com
2008-03-01 00:35 --------- d-----w C:\Documents and Settings\Margaret McNutt\Application Data\EasySpywareCleaner.com
2008-02-29 01:26 --------- d-----w C:\Program Files\Hkruemqx
2008-02-29 01:25 --------- d-----w C:\Documents and Settings\Margaret McNutt\Application Data\WinIFixer.com
2008-02-29 01:21 17,872 ----a-w C:\WINDOWS\sakbz.exe
2008-02-25 00:05 18,886 ----a-w C:\Program Files\Common Files\urequqilu.bat
2008-02-25 00:05 17,821 ----a-w C:\Program Files\Common Files\jegelo.vbs
2008-02-25 00:05 17,551 ----a-w C:\WINDOWS\system32\nysin.pif
2008-02-25 00:05 15,402 ----a-w C:\WINDOWS\maliniwadi.bin
2008-02-25 00:05 14,972 ----a-w C:\Program Files\Common Files\aqokijys._dl
2008-02-25 00:05 14,360 ----a-w C:\WINDOWS\hiku.scr
2008-02-25 00:05 11,913 ----a-w C:\Program Files\Common Files\egykavyje.sys
2008-02-25 00:05 11,890 ----a-w C:\WINDOWS\system32\ojawubiq.bin
2008-02-25 00:05 11,061 ----a-w C:\WINDOWS\miqobapal.exe
2008-02-25 00:05 10,247 ----a-w C:\Documents and Settings\All Users\Application Data\uquha.scr
2008-02-22 16:39 --------- d-----w C:\Program Files\CKBrowser
2008-02-17 17:58 1,333,680 ----a-w C:\Program Files\bjourn31p.zip
2008-02-17 17:57 1,435,577 ----a-w C:\Program Files\SplashNotesInstaller.exe
2008-02-17 17:55 --------- d-----w C:\Program Files\SplashData
2008-02-17 17:23 --------- d-----w C:\Documents and Settings\Margaret McNutt\Application Data\Arcsoft
2008-02-11 05:25 61,185 ----a-w C:\WINDOWS\trashicon.exe
2008-02-06 02:16 --------- d-----w C:\Program Files\Kidspiration 3
2008-02-06 02:16 --------- d-----w C:\Documents and Settings\Margaret McNutt\Application Data\Inspiration Software
2008-02-06 02:12 --------- d-----w C:\Program Files\Kidspiration 3 Trial
2008-02-06 02:01 164,411,392 ----a-w C:\Program Files\Kidspiration3_win.exe
2008-01-11 05:53 44,544 ------w C:\WINDOWS\system32\dllcache\pngfilt.dll
2007-10-21 23:39 3,359 ----a-w C:\Program Files\uninstal.log
2005-08-28 17:09 4,675,472 ----a-w C:\Program Files\AveryWizardforWord2003-English.exe
2005-05-12 04:36 12,288 -c--a-w C:\WINDOWS\Fonts\RandFont.dll
2004-09-07 23:26 2,421,920 ----a-w C:\Program Files\winzip90.exe
2004-08-04 23:36 22,823,424 ----a-w C:\Program Files\Inspiration.exe
2004-07-15 02:19 3,520,880 -c--a-w C:\Program Files\AmplifyToolbar.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 12:24 1694208]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45 313472]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 21:05 204288]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\Program Files\Apoint2K\Apoint.exe" [2003-10-07 23:40 159744]
"ATIModeChange"="Ati2mdxx.exe" [2003-10-07 23:41 28672 C:\WINDOWS\system32\Ati2mdxx.exe]
"Cpqset"="C:\Program Files\HPQ\Default Settings\cpqset.exe" [2003-07-17 14:50 184412]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-09-11 22:10 335872]
"CamMonitor"="C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe" [2002-10-07 04:23 90112]
"RoxioEngineUtility"="C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe" [2003-05-01 22:44 65536]
"RoxioDragToDisc"="C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe" [2003-07-18 21:23 868352]
"HPHUPD05"="C:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" [2003-05-23 00:03 49152]
"HPHmon05"="C:\WINDOWS\System32\hphmon05.exe" [2003-05-22 23:55 483328]
"StatusClient"="C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe" [2002-12-16 17:51 36864]
"TomcatStartup"="C:\Program Files\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe" [2003-03-31 20:28 155648]
"HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2005-05-12 00:12 49152]
"HostManager"="C:\Program Files\Common Files\AOL\1135963028\ee\AOLSoftware.exe" [2006-09-25 20:52 50736]
"AOLDialer"="C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" [2006-10-23 08:50 71216]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-12-30 13:19 98304]
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2006-05-07 19:15 26112]
"SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 10:22 155648]
"PaperPort PTD"="C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe" [2004-04-14 14:46 57393]
"IndexSearch"="C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe" [2004-04-14 15:04 40960]
"SetDefPrt"="C:\Program Files\Brother\Brmfl04g\BrStDvPt.exe" [2004-11-11 17:14 49152]
"ControlCenter2.0"="C:\Program Files\Brother\ControlCenter2\brctrcen.exe" [2004-11-11 22:00 864256]
"PPort9reminder"="C:\Program Files\ScanSoft\PaperPort\WebEreg\Ereg.exe" [2003-07-07 10:29 729088]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 23:46 57344]
"AGRSMMSG"="AGRSMMSG.exe" [2003-09-30 14:31 88363 C:\WINDOWS\AGRSMMSG.exe]
"eabconfg.cpl"="C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe" [2003-09-26 10:04 237568]
"SansaDispatch"="C:\Program Files\SanDisk\Sansa Updater\SansaDispatch.exe" [2007-05-02 19:00 55368]
"braviax"="braviax.exe" []
"WinIFixer"="C:\Program Files\WinIFixer\WinIFixer.exe" [ ]
"bvllyuvo"="C:\Program Files\Hkruemqx\bvllyuvo.exe" [2008-02-28 21:26 48128]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-07-28 11:38:43 113664]
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696]
BTTray.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2003-09-12 12:42:00 503869]
DataViz Inc Messenger.lnk - C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe [2007-08-27 22:34:09 28672]
HOTSYNCSHORTCUTNAME.lnk - C:\Program Files\Sony Handheld\Hotsync.exe [2004-06-09 14:27:34 471040]
HP Image Zone Fast Start.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe [2005-05-12 01:49:24 73728]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]
"fSHjKVHYCU"= rundll32.exe "C:\WINDOWS\system32\osqznsmOkZ.dll",DllCleanServer
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Nqi00.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\America Online 9.0a\\waol.exe"=
"C:\\Program Files\\Hewlett-Packard\\Toolbox2.0\\Javasoft\\JRE\\1.3.1\\bin\\javaw.exe"=
"C:\\Program Files\\Info Select\\is.exe"=
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Common Files\\AOL\\1135963028\\EE\\aolsoftware.exe"=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"C:\\Program Files\\Common Files\\AOL\\1135963028\\EE\\AOLServiceHost.exe"=
"C:\\Program Files\\Rhapsody\\rhapsody.exe"=
"C:\\Documents and Settings\\Margaret McNutt\\tmp.exe"=
S1 kcp;kcp;C:\WINDOWS\system32\drivers\kcp.sys []
S2 wmpisvrs32k;wmpisvrs32k;C:\Program Files\Common Files\System\wmpisvrs32.exe [2008-03-11 22:46]
S3 BrScnUsb;Brother USB Still Image driver;C:\WINDOWS\system32\Drivers\BrScnUsb.sys [2004-10-15 12:50]
S3 FANTOM;LEGO MINDSTORMS NXT Driver;C:\WINDOWS\system32\DRIVERS\fantom.sys [2006-03-10 16:55]
S3 msloop;Microsoft Loopback Adapter Driver;C:\WINDOWS\system32\DRIVERS\loop.sys [2001-08-17 13:53]
S3 wmpisvrs32;wmpisvrs32;C:\Program Files\Common Files\System\wmpisvrs32.dll []
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-03 00:56:01
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = C:\Program Files\HPQ\Default Settings\cpqset.exe????????6?5?5?7??????? ?deB???????????????B? ??????
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-04-03 0:57:47
ComboFix-quarantined-files.txt 2008-04-03 04:57:29
ComboFix2.txt 2008-04-02 22:53:50
ComboFix3.txt 2008-04-02 18:04:32
ComboFix4.txt 2008-04-02 07:30:06
Pre-Run: 19,987,881,984 bytes free
Post-Run: 19,973,304,320 bytes free
.
2008-04-02 07:10:40 --- E O F ---
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
I have also included a start up log generated by HJT
StartupList report, 4/3/2008, 12:58:57 AM
StartupList version: 1.52.2
Started from : C:\Documents and Settings\Margaret McNutt\Desktop\CleanUp\hijak this\HijackThis.EXE
Detected: Windows XP SP2 (WinNT 5.01.2600)
Detected: Internet Explorer v7.00 (7.00.6000.16608)
* Using default options
==================================================
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Margaret McNutt\Desktop\CleanUp\hijak this\HijackThis.exe
--------------------------------------------------
Listing of startup folders:
Shell folders Startup:
[C:\Documents and Settings\Margaret McNutt\Start Menu\Programs\Startup]
Palm Registration.lnk = ?
Shell folders Common Startup:
[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
Adobe Gamma Loader.lnk = ?
Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
BTTray.lnk = ?
DataViz Inc Messenger.lnk = C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe
HOTSYNCSHORTCUTNAME.lnk = C:\Program Files\Sony Handheld\Hotsync.exe
HP Image Zone Fast Start.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe
--------------------------------------------------
Checking Windows NT UserInit:
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Apoint = C:\Program Files\Apoint2K\Apoint.exe
ATIModeChange = Ati2mdxx.exe
Cpqset = C:\Program Files\HPQ\Default Settings\cpqset.exe
ATIPTA = C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
CamMonitor = C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
RoxioEngineUtility = "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
RoxioDragToDisc = "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
HPHUPD05 = C:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
HPHmon05 = C:\WINDOWS\System32\hphmon05.exe
StatusClient = C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe /auto
TomcatStartup = C:\Program Files\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe
HP Software Update = C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
HostManager = C:\Program Files\Common Files\AOL\1135963028\ee\AOLSoftware.exe
AOLDialer = C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
QuickTime Task = "C:\Program Files\QuickTime\qttask.exe" -atboottime
RealTray = C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
SSBkgdUpdate = "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
PaperPort PTD = C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
IndexSearch = C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
SetDefPrt = C:\Program Files\Brother\Brmfl04g\BrStDvPt.exe
ControlCenter2.0 = C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun
PPort9reminder = "C:\Program Files\ScanSoft\PaperPort\WebEreg\Ereg.exe" -r "C:\Program Files\ScanSoft\PaperPort\WebEreg\ereg.ini"
Adobe Photo Downloader = "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
AGRSMMSG = AGRSMMSG.exe
eabconfg.cpl = C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
SansaDispatch = C:\Program Files\SanDisk\Sansa Updater\SansaDispatch.exe
braviax = braviax.exe
WinIFixer = C:\Program Files\WinIFixer\WinIFixer.exe
bvllyuvo = C:\Program Files\Hkruemqx\bvllyuvo.exe
--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
MSMSGS = "C:\Program Files\Messenger\msmsgs.exe" /background
updateMgr = "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
WMPNSCFG = C:\Program Files\Windows Media Player\WMPNSCFG.exe
ctfmon.exe = C:\WINDOWS\system32\ctfmon.exe
--------------------------------------------------
Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:
Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*
Shell & screensaver key from Registry:
Shell=Explorer.exe
SCRNSAVE.EXE=*Registry value not found*
drivers=*Registry value not found*
Policies Shell key:
HKCU\..\Policies: Shell=*Registry value not found*
HKLM\..\Policies: Shell=*Registry value not found*
--------------------------------------------------
Enumerating Download Program Files:
[Shockwave ActiveX Control]
InProcServer32 = C:\WINDOWS\system32\Macromed\Director\SwDir.dll
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
[{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}]
CODEBASE = http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
--------------------------------------------------
Enumerating Windows NT logon/logoff scripts:
*No scripts set to run*
Windows NT checkdisk command:
BootExecute = autocheck autochk *
Windows NT 'Wininit.ini':
PendingFileRenameOperations: C:\test0123 => C:\Qoobox\Quarantine\C\test0123.vir||x
--------------------------------------------------
Enumerating ShellServiceObjectDelayLoad items:
PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\system32\webcheck.dll
SysTray: C:\WINDOWS\System32\stobject.dll
WPDShServiceObj: C:\WINDOWS\system32\WPDShServiceObj.dll
TZvHyIBqxYtFR: *Registry key not found*
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
fSHjKVHYCU = rundll32.exe "C:\WINDOWS\system32\osqznsmOkZ.dll",DllCleanServer
--------------------------------------------------
End of report, 6,951 bytes
Report generated in 0.062 seconds
Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only
Thanks for taking the time to assist me
Jim
This shouldn't take too long as I have done most of the clean-up myself but need assistance with a final review to catch what I've missed.
My girlfriends laptop had become severely afflicted, to the point it would not stay running, and it was auto rebooting every minute or so.
Browsers would no longer stay open; Even Mozilla Fire Fox finally stopped working.
At boot, we'd receive a pop-up stating " Error loading C:\Windows\system32\osqznsmOkZ.dll."
When opening a browser, we'd also see a cmd prompt box with C:\...\Locals-1\Temp\22.exe along the top.
This would be followed by a window pop-up stating "NTVDMCPU Has encountered an illegal instruction". Then 22.exe would be mentioned again.
In safe mode, I have run Adaware SE Personal, CWShredder, Ewido AVG scan, A couple Smitfraud cleaners, Spybot Search and destroy, and ComboFix. I had to run them in Safe Mode because they wouldn't run in normal Windows. I've run them each several times and in different orders.
This has restored stability, but I still occasionally see "osqznsmOkZ.dll" and "22.exe" errors pop-up.
I will reinstall McAfee and enable my firewall when the cleanup is done.
Please review my ComboFix and HJT logs and advise on what I should clean up next.
Also, If we can clean this up, I can assure you, I will donate to your organisation.
Thanks in advance
Jim
HJT Log
Logfile of HijackThis v1.98.2
Scan saved at 1:01:05 AM, on 4/3/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Margaret McNutt\Desktop\CleanUp\hijak this\HijackThis.exe
C:\WINDOWS\system32\notepad.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843
O1 - Hosts file is located at: C:\WINDOWS\System32\drivers\etc\hosts
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [StatusClient] C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe /auto
O4 - HKLM\..\Run: [TomcatStartup] C:\Program Files\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1135963028\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl04g\BrStDvPt.exe
O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun
O4 - HKLM\..\Run: [PPort9reminder] "C:\Program Files\ScanSoft\PaperPort\WebEreg\Ereg.exe" -r "C:\Program Files\ScanSoft\PaperPort\WebEreg\ereg.ini"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [SansaDispatch] C:\Program Files\SanDisk\Sansa Updater\SansaDispatch.exe
O4 - HKLM\..\Run: [braviax] braviax.exe
O4 - HKLM\..\Run: [WinIFixer] C:\Program Files\WinIFixer\WinIFixer.exe
O4 - HKLM\..\Run: [bvllyuvo] C:\Program Files\Hkruemqx\bvllyuvo.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Palm Registration.lnk = ?
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: DataViz Inc Messenger.lnk = C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe
O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Program Files\Sony Handheld\Hotsync.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O17 - HKLM\System\CCS\Services\Tcpip\..\{281DB1B5-1487-4E57-A65E-937A61AA2C87}: NameServer = 4.2.2.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{40F703AA-D707-4D5F-90B5-43C3D68ACAB2}: NameServer = 4.2.2.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{51A53BAD-6DD3-49D3-B015-F301730F93FE}: NameServer = 4.2.2.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{5D370A47-30E6-4958-83AA-FB09E378C7FD}: NameServer = 4.2.2.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{D81AAE4F-0C54-4FBE-B182-26A593FB2684}: NameServer = 4.2.2.1
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O21 - SSODL: TZvHyIBqxYtFR - {4A873377-E02D-99DD-4809-259E6ED99C8D} - (no file)
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
COMBOFIX Log
ComboFix 08-04-01.2 - Margaret McNutt 2008-04-03 0:51:10.7 - NTFSx86 NETWORK
Running from: C:\Documents and Settings\Margaret McNutt\Desktop\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2008-03-03 to 2008-04-03 )))))))))))))))))))))))))))))))
.
2008-04-02 21:32 . 2008-04-02 21:32 <DIR> d-------- C:\Documents and Settings\Margaret McNutt\Application Data\Grisoft
2008-04-02 21:32 . 2007-05-30 08:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-04-02 15:38 . 2008-04-02 15:38 <DIR> d-------- C:\WINDOWS\system32\bfubackups
2008-04-01 18:34 . 2008-04-01 18:34 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-04-01 16:01 . 2008-04-01 16:00 691,545 --a------ C:\WINDOWS\unins000.exe
2008-04-01 16:01 . 2008-04-01 16:01 2,559 --a------ C:\WINDOWS\unins000.dat
2008-03-30 18:07 . 2008-03-30 19:18 7,484 --a------ C:\WINDOWS\system32\tmp.reg
2008-03-30 18:06 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-03-30 18:06 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-03-30 18:06 . 2008-03-01 23:12 86,016 --a------ C:\WINDOWS\system32\VACFix.exe
2008-03-30 18:06 . 2008-02-29 23:48 82,432 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-03-30 18:06 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-03-30 18:06 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-03-24 13:13 . 2008-03-24 13:13 2 --a------ C:\E.tmp
2008-03-23 23:03 . 2008-03-23 23:03 2 --a------ C:\B.tmp
2008-03-22 15:50 . 2008-03-22 15:50 10,001 --a------ C:\WINDOWS\lxqu.exe
2008-03-12 21:56 . 2008-03-12 21:56 978 --a------ C:\WINDOWS\system32\MRT.INI
2008-03-11 22:47 . 2008-03-20 22:17 0 --a------ C:\WINDOWS\system32\lich.dat
2008-03-11 22:45 . 2008-03-11 22:46 31,272 --a------ C:\F.tmp
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-01 22:36 --------- d-----w C:\Program Files\ewido anti-malware
2008-04-01 20:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-04-01 19:50 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-04-01 07:49 --------- d-----w C:\Program Files\McAfee
2008-04-01 07:49 --------- d-----w C:\Documents and Settings\All Users\Application Data\McAfee
2008-04-01 07:39 --------- d-----w C:\Documents and Settings\All Users\Application Data\SiteAdvisor
2008-04-01 01:43 --------- d-----w C:\Program Files\Info Select
2008-03-13 01:55 --------- d-----w C:\Program Files\Xyjiycqd
2008-03-13 01:55 --------- d-----w C:\Program Files\urgloxsn
2008-03-12 02:44 14,336 ----a-w C:\WINDOWS\system32\svchost.exe
2008-03-12 02:44 14,336 ----a-w C:\WINDOWS\system32\dllcache\svchost.exe
2008-03-10 03:04 --------- d-----w C:\Program Files\Sony Handheld
2008-03-03 02:30 --------- d-----w C:\Program Files\Google
2008-03-02 18:35 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-02 18:34 --------- d-----w C:\Program Files\Quicken
2008-03-02 18:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\Napster
2008-03-02 06:03 --------- d-----w C:\Program Files\InfeStop
2008-03-02 06:03 --------- d-----w C:\Program Files\EasySpywareCleaner
2008-03-02 06:02 --------- d-----w C:\Program Files\Spy-Rid
2008-03-02 05:33 126 ----a-w C:\Documents and Settings\Margaret McNutt\c200.bat
2008-03-02 05:31 112,640 ----a-w C:\Documents and Settings\Margaret McNutt\tmp.exe
2008-03-02 05:31 --------- d-----w C:\Documents and Settings\Margaret McNutt\Application Data\InfeStop.com
2008-03-02 04:54 --------- d-----w C:\Program Files\McAfee virus protection
2008-03-02 03:57 --------- d-----w C:\Documents and Settings\Margaret McNutt\Application Data\spy-rid.com
2008-03-01 00:35 --------- d-----w C:\Documents and Settings\Margaret McNutt\Application Data\EasySpywareCleaner.com
2008-02-29 01:26 --------- d-----w C:\Program Files\Hkruemqx
2008-02-29 01:25 --------- d-----w C:\Documents and Settings\Margaret McNutt\Application Data\WinIFixer.com
2008-02-29 01:21 17,872 ----a-w C:\WINDOWS\sakbz.exe
2008-02-25 00:05 18,886 ----a-w C:\Program Files\Common Files\urequqilu.bat
2008-02-25 00:05 17,821 ----a-w C:\Program Files\Common Files\jegelo.vbs
2008-02-25 00:05 17,551 ----a-w C:\WINDOWS\system32\nysin.pif
2008-02-25 00:05 15,402 ----a-w C:\WINDOWS\maliniwadi.bin
2008-02-25 00:05 14,972 ----a-w C:\Program Files\Common Files\aqokijys._dl
2008-02-25 00:05 14,360 ----a-w C:\WINDOWS\hiku.scr
2008-02-25 00:05 11,913 ----a-w C:\Program Files\Common Files\egykavyje.sys
2008-02-25 00:05 11,890 ----a-w C:\WINDOWS\system32\ojawubiq.bin
2008-02-25 00:05 11,061 ----a-w C:\WINDOWS\miqobapal.exe
2008-02-25 00:05 10,247 ----a-w C:\Documents and Settings\All Users\Application Data\uquha.scr
2008-02-22 16:39 --------- d-----w C:\Program Files\CKBrowser
2008-02-17 17:58 1,333,680 ----a-w C:\Program Files\bjourn31p.zip
2008-02-17 17:57 1,435,577 ----a-w C:\Program Files\SplashNotesInstaller.exe
2008-02-17 17:55 --------- d-----w C:\Program Files\SplashData
2008-02-17 17:23 --------- d-----w C:\Documents and Settings\Margaret McNutt\Application Data\Arcsoft
2008-02-11 05:25 61,185 ----a-w C:\WINDOWS\trashicon.exe
2008-02-06 02:16 --------- d-----w C:\Program Files\Kidspiration 3
2008-02-06 02:16 --------- d-----w C:\Documents and Settings\Margaret McNutt\Application Data\Inspiration Software
2008-02-06 02:12 --------- d-----w C:\Program Files\Kidspiration 3 Trial
2008-02-06 02:01 164,411,392 ----a-w C:\Program Files\Kidspiration3_win.exe
2008-01-11 05:53 44,544 ------w C:\WINDOWS\system32\dllcache\pngfilt.dll
2007-10-21 23:39 3,359 ----a-w C:\Program Files\uninstal.log
2005-08-28 17:09 4,675,472 ----a-w C:\Program Files\AveryWizardforWord2003-English.exe
2005-05-12 04:36 12,288 -c--a-w C:\WINDOWS\Fonts\RandFont.dll
2004-09-07 23:26 2,421,920 ----a-w C:\Program Files\winzip90.exe
2004-08-04 23:36 22,823,424 ----a-w C:\Program Files\Inspiration.exe
2004-07-15 02:19 3,520,880 -c--a-w C:\Program Files\AmplifyToolbar.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 12:24 1694208]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45 313472]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 21:05 204288]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\Program Files\Apoint2K\Apoint.exe" [2003-10-07 23:40 159744]
"ATIModeChange"="Ati2mdxx.exe" [2003-10-07 23:41 28672 C:\WINDOWS\system32\Ati2mdxx.exe]
"Cpqset"="C:\Program Files\HPQ\Default Settings\cpqset.exe" [2003-07-17 14:50 184412]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-09-11 22:10 335872]
"CamMonitor"="C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe" [2002-10-07 04:23 90112]
"RoxioEngineUtility"="C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe" [2003-05-01 22:44 65536]
"RoxioDragToDisc"="C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe" [2003-07-18 21:23 868352]
"HPHUPD05"="C:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" [2003-05-23 00:03 49152]
"HPHmon05"="C:\WINDOWS\System32\hphmon05.exe" [2003-05-22 23:55 483328]
"StatusClient"="C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe" [2002-12-16 17:51 36864]
"TomcatStartup"="C:\Program Files\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe" [2003-03-31 20:28 155648]
"HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2005-05-12 00:12 49152]
"HostManager"="C:\Program Files\Common Files\AOL\1135963028\ee\AOLSoftware.exe" [2006-09-25 20:52 50736]
"AOLDialer"="C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" [2006-10-23 08:50 71216]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-12-30 13:19 98304]
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2006-05-07 19:15 26112]
"SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 10:22 155648]
"PaperPort PTD"="C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe" [2004-04-14 14:46 57393]
"IndexSearch"="C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe" [2004-04-14 15:04 40960]
"SetDefPrt"="C:\Program Files\Brother\Brmfl04g\BrStDvPt.exe" [2004-11-11 17:14 49152]
"ControlCenter2.0"="C:\Program Files\Brother\ControlCenter2\brctrcen.exe" [2004-11-11 22:00 864256]
"PPort9reminder"="C:\Program Files\ScanSoft\PaperPort\WebEreg\Ereg.exe" [2003-07-07 10:29 729088]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 23:46 57344]
"AGRSMMSG"="AGRSMMSG.exe" [2003-09-30 14:31 88363 C:\WINDOWS\AGRSMMSG.exe]
"eabconfg.cpl"="C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe" [2003-09-26 10:04 237568]
"SansaDispatch"="C:\Program Files\SanDisk\Sansa Updater\SansaDispatch.exe" [2007-05-02 19:00 55368]
"braviax"="braviax.exe" []
"WinIFixer"="C:\Program Files\WinIFixer\WinIFixer.exe" [ ]
"bvllyuvo"="C:\Program Files\Hkruemqx\bvllyuvo.exe" [2008-02-28 21:26 48128]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-07-28 11:38:43 113664]
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696]
BTTray.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2003-09-12 12:42:00 503869]
DataViz Inc Messenger.lnk - C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe [2007-08-27 22:34:09 28672]
HOTSYNCSHORTCUTNAME.lnk - C:\Program Files\Sony Handheld\Hotsync.exe [2004-06-09 14:27:34 471040]
HP Image Zone Fast Start.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe [2005-05-12 01:49:24 73728]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]
"fSHjKVHYCU"= rundll32.exe "C:\WINDOWS\system32\osqznsmOkZ.dll",DllCleanServer
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Nqi00.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\America Online 9.0a\\waol.exe"=
"C:\\Program Files\\Hewlett-Packard\\Toolbox2.0\\Javasoft\\JRE\\1.3.1\\bin\\javaw.exe"=
"C:\\Program Files\\Info Select\\is.exe"=
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Common Files\\AOL\\1135963028\\EE\\aolsoftware.exe"=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"C:\\Program Files\\Common Files\\AOL\\1135963028\\EE\\AOLServiceHost.exe"=
"C:\\Program Files\\Rhapsody\\rhapsody.exe"=
"C:\\Documents and Settings\\Margaret McNutt\\tmp.exe"=
S1 kcp;kcp;C:\WINDOWS\system32\drivers\kcp.sys []
S2 wmpisvrs32k;wmpisvrs32k;C:\Program Files\Common Files\System\wmpisvrs32.exe [2008-03-11 22:46]
S3 BrScnUsb;Brother USB Still Image driver;C:\WINDOWS\system32\Drivers\BrScnUsb.sys [2004-10-15 12:50]
S3 FANTOM;LEGO MINDSTORMS NXT Driver;C:\WINDOWS\system32\DRIVERS\fantom.sys [2006-03-10 16:55]
S3 msloop;Microsoft Loopback Adapter Driver;C:\WINDOWS\system32\DRIVERS\loop.sys [2001-08-17 13:53]
S3 wmpisvrs32;wmpisvrs32;C:\Program Files\Common Files\System\wmpisvrs32.dll []
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-03 00:56:01
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = C:\Program Files\HPQ\Default Settings\cpqset.exe????????6?5?5?7??????? ?deB???????????????B? ??????
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-04-03 0:57:47
ComboFix-quarantined-files.txt 2008-04-03 04:57:29
ComboFix2.txt 2008-04-02 22:53:50
ComboFix3.txt 2008-04-02 18:04:32
ComboFix4.txt 2008-04-02 07:30:06
Pre-Run: 19,987,881,984 bytes free
Post-Run: 19,973,304,320 bytes free
.
2008-04-02 07:10:40 --- E O F ---
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
I have also included a start up log generated by HJT
StartupList report, 4/3/2008, 12:58:57 AM
StartupList version: 1.52.2
Started from : C:\Documents and Settings\Margaret McNutt\Desktop\CleanUp\hijak this\HijackThis.EXE
Detected: Windows XP SP2 (WinNT 5.01.2600)
Detected: Internet Explorer v7.00 (7.00.6000.16608)
* Using default options
==================================================
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Margaret McNutt\Desktop\CleanUp\hijak this\HijackThis.exe
--------------------------------------------------
Listing of startup folders:
Shell folders Startup:
[C:\Documents and Settings\Margaret McNutt\Start Menu\Programs\Startup]
Palm Registration.lnk = ?
Shell folders Common Startup:
[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
Adobe Gamma Loader.lnk = ?
Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
BTTray.lnk = ?
DataViz Inc Messenger.lnk = C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe
HOTSYNCSHORTCUTNAME.lnk = C:\Program Files\Sony Handheld\Hotsync.exe
HP Image Zone Fast Start.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe
--------------------------------------------------
Checking Windows NT UserInit:
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Apoint = C:\Program Files\Apoint2K\Apoint.exe
ATIModeChange = Ati2mdxx.exe
Cpqset = C:\Program Files\HPQ\Default Settings\cpqset.exe
ATIPTA = C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
CamMonitor = C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
RoxioEngineUtility = "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
RoxioDragToDisc = "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
HPHUPD05 = C:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
HPHmon05 = C:\WINDOWS\System32\hphmon05.exe
StatusClient = C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe /auto
TomcatStartup = C:\Program Files\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe
HP Software Update = C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
HostManager = C:\Program Files\Common Files\AOL\1135963028\ee\AOLSoftware.exe
AOLDialer = C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
QuickTime Task = "C:\Program Files\QuickTime\qttask.exe" -atboottime
RealTray = C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
SSBkgdUpdate = "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
PaperPort PTD = C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
IndexSearch = C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
SetDefPrt = C:\Program Files\Brother\Brmfl04g\BrStDvPt.exe
ControlCenter2.0 = C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun
PPort9reminder = "C:\Program Files\ScanSoft\PaperPort\WebEreg\Ereg.exe" -r "C:\Program Files\ScanSoft\PaperPort\WebEreg\ereg.ini"
Adobe Photo Downloader = "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
AGRSMMSG = AGRSMMSG.exe
eabconfg.cpl = C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
SansaDispatch = C:\Program Files\SanDisk\Sansa Updater\SansaDispatch.exe
braviax = braviax.exe
WinIFixer = C:\Program Files\WinIFixer\WinIFixer.exe
bvllyuvo = C:\Program Files\Hkruemqx\bvllyuvo.exe
--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
MSMSGS = "C:\Program Files\Messenger\msmsgs.exe" /background
updateMgr = "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
WMPNSCFG = C:\Program Files\Windows Media Player\WMPNSCFG.exe
ctfmon.exe = C:\WINDOWS\system32\ctfmon.exe
--------------------------------------------------
Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:
Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*
Shell & screensaver key from Registry:
Shell=Explorer.exe
SCRNSAVE.EXE=*Registry value not found*
drivers=*Registry value not found*
Policies Shell key:
HKCU\..\Policies: Shell=*Registry value not found*
HKLM\..\Policies: Shell=*Registry value not found*
--------------------------------------------------
Enumerating Download Program Files:
[Shockwave ActiveX Control]
InProcServer32 = C:\WINDOWS\system32\Macromed\Director\SwDir.dll
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
[{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}]
CODEBASE = http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
--------------------------------------------------
Enumerating Windows NT logon/logoff scripts:
*No scripts set to run*
Windows NT checkdisk command:
BootExecute = autocheck autochk *
Windows NT 'Wininit.ini':
PendingFileRenameOperations: C:\test0123 => C:\Qoobox\Quarantine\C\test0123.vir||x
--------------------------------------------------
Enumerating ShellServiceObjectDelayLoad items:
PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\system32\webcheck.dll
SysTray: C:\WINDOWS\System32\stobject.dll
WPDShServiceObj: C:\WINDOWS\system32\WPDShServiceObj.dll
TZvHyIBqxYtFR: *Registry key not found*
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
fSHjKVHYCU = rundll32.exe "C:\WINDOWS\system32\osqznsmOkZ.dll",DllCleanServer
--------------------------------------------------
End of report, 6,951 bytes
Report generated in 0.062 seconds
Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only
Thanks for taking the time to assist me
Jim