Tech Support Forum - View Single Post

HoAfCr · 08-07-2007, 02:10 AM

1. hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:08:33 AM, on 8/7/2007
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\hidserv.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\mcshield.exe
C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINNT\system32\HPZipm12.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\SOUNDMAN.EXE
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINNT\CTHELPER.EXE
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
D:\Program Files\Winamp\winampa.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINNT\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [WinampAgent] D:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [AWMON] "C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe"
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\Wcescomm.exe"
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - D:\Program Files\Bodog Poker\BPGame.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1175971104859
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1175972679609
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINNT\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\HPZipm12.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe
O24 - Desktop Component 1: Google Advanced Search - http://www.google.com/advanced_search?hl=en

--
End of file - 8581 bytes

2. Online

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Tuesday, August 07, 2007 12:57:38 AM
Operating System: Microsoft Windows 2000 Professional, Service Pack 4 (Build 2195)
Kaspersky Online Scanner version: 5.0.93.0
Kaspersky Anti-Virus database last update: 7/08/2007
Kaspersky Anti-Virus database records: 376348
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\

Scan Statistics:
Total number of scanned objects: 114618
Number of viruses found: 16
Number of infected objects: 54
Number of suspicious objects: 16
Duration of the scan process: 01:46:47

Infected Object Name / Virus Name / Last Action
C:\Deckard\System Scanner\backup\DOCUME~1\Kevin\LOCALS~1\Temp\laf1.exe Infected: Trojan-Downloader.Win32.Agent.bkd skipped
C:\Deckard\System Scanner\backup\DOCUME~1\Kevin\LOCALS~1\Temp\lyqudotp.exe Infected: Trojan-Dropper.Win32.Agent.bmk skipped
C:\Deckard\System Scanner\backup\DOCUME~1\Kevin\LOCALS~1\Temp\NeroDemo12550\Toolbar.exe Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped
C:\Deckard\System Scanner\backup\DOCUME~1\Kevin\LOCALS~1\Temp\vwcfxaum.exe Infected: Trojan-Dropper.Win32.Agent.bmk skipped
C:\Deckard\System Scanner\backup\DOCUME~1\Kevin\LOCALS~1\Temp\yidovrlb.exe Infected: Trojan-Dropper.Win32.Agent.bmk skipped
C:\Documents and Settings\All Users\Application Data\Network Associates\Common Framework\Db\Agent_ROLLEAZY.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Network Associates\Common Framework\Db\PrdMgr_ROLLEAZY.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Network Associates\VirusScan\OnAccessScanLog.txt Object is locked skipped
C:\Documents and Settings\Default User\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Default User\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Kevin\Application Data\Lavasoft\Ad-Aware\Logs\AWEVLOG.txt Object is locked skipped
C:\Documents and Settings\Kevin\Application Data\Mozilla\Firefox\Profiles\ml9dbb1z.default\cert8.db Object is locked skipped
C:\Documents and Settings\Kevin\Application Data\Mozilla\Firefox\Profiles\ml9dbb1z.default\formhistory.dat Object is locked skipped
C:\Documents and Settings\Kevin\Application Data\Mozilla\Firefox\Profiles\ml9dbb1z.default\history.dat Object is locked skipped
C:\Documents and Settings\Kevin\Application Data\Mozilla\Firefox\Profiles\ml9dbb1z.default\key3.db Object is locked skipped
C:\Documents and Settings\Kevin\Application Data\Mozilla\Firefox\Profiles\ml9dbb1z.default\parent.lock Object is locked skipped
C:\Documents and Settings\Kevin\Application Data\Mozilla\Firefox\Profiles\ml9dbb1z.default\search.sqlite Object is locked skipped
C:\Documents and Settings\Kevin\Application Data\Mozilla\Firefox\Profiles\ml9dbb1z.default\urlclassifier2.sqlite Object is locked skipped
C:\Documents and Settings\Kevin\Application Data\Mozilla\Firefox\Profiles\ml9dbb1z.default\webappsstore.sqlite Object is locked skipped
C:\Documents and Settings\Kevin\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Kevin\Local Settings\Application Data\Ahead\Nero Home\bl.db Object is locked skipped
C:\Documents and Settings\Kevin\Local Settings\Application Data\Ahead\Nero Home\is2.db Object is locked skipped
C:\Documents and Settings\Kevin\Local Settings\Application Data\AOL OCP\AIM\Storage\All Users\localStorage\common.cls Object is locked skipped
C:\Documents and Settings\Kevin\Local Settings\Application Data\AOL OCP\AIM\Storage\data\iicanibusxthcii\localStorage\common.cls Object is locked skipped
C:\Documents and Settings\Kevin\Local Settings\Application Data\ATI\ACE\Log\MOM-0.log Object is locked skipped
C:\Documents and Settings\Kevin\Local Settings\Application Data\Identities\{D60BFC08-63F6-4915-94EC-FB44C27FA1DC}\Microsoft\Outlook Express\cleanup.log Object is locked skipped
C:\Documents and Settings\Kevin\Local Settings\Application Data\Identities\{D60BFC08-63F6-4915-94EC-FB44C27FA1DC}\Microsoft\Outlook Express\Folders.dbx Object is locked skipped
C:\Documents and Settings\Kevin\Local Settings\Application Data\Identities\{D60BFC08-63F6-4915-94EC-FB44C27FA1DC}\Microsoft\Outlook Express\Offline.dbx Object is locked skipped
C:\Documents and Settings\Kevin\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Kevin\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Kevin\Local Settings\Application Data\Mozilla\Firefox\Profiles\ml9dbb1z.default\Cache\_CACHE_001_ Object is locked skipped
C:\Documents and Settings\Kevin\Local Settings\Application Data\Mozilla\Firefox\Profiles\ml9dbb1z.default\Cache\_CACHE_002_ Object is locked skipped
C:\Documents and Settings\Kevin\Local Settings\Application Data\Mozilla\Firefox\Profiles\ml9dbb1z.default\Cache\_CACHE_003_ Object is locked skipped
C:\Documents and Settings\Kevin\Local Settings\Application Data\Mozilla\Firefox\Profiles\ml9dbb1z.default\Cache\_CACHE_MAP_ Object is locked skipped
C:\Documents and Settings\Kevin\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Kevin\Local Settings\History\History.IE5\MSHist012007080620070807\index.dat Object is locked skipped
C:\Documents and Settings\Kevin\Local Settings\Temp\~DFA48A.tmp Object is locked skipped
C:\Documents and Settings\Kevin\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Kevin\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Kevin\ntuser.dat.LOG Object is locked skipped
C:\QooBox\Quarantine\C\WINNT\system32\atfvoghd.exe.vir Infected: Trojan-Downloader.Win32.Tiny.id skipped
C:\QooBox\Quarantine\C\WINNT\system32\bvenrovp.exe.vir Infected: Trojan-Downloader.Win32.Tiny.id skipped
C:\QooBox\Quarantine\C\WINNT\system32\ciqpkbux.exe.vir Infected: Trojan-Dropper.Win32.Agent.bmk skipped
C:\QooBox\Quarantine\C\WINNT\system32\ckcrhbuc.exe.vir Infected: Trojan-Downloader.Win32.Tiny.id skipped
C:\QooBox\Quarantine\C\WINNT\system32\ckeuccal.exe.vir Infected: Trojan-Downloader.Win32.Tiny.id skipped
C:\QooBox\Quarantine\C\WINNT\system32\eyaldsjf.exe.vir Infected: Trojan-Downloader.Win32.Tiny.id skipped
C:\QooBox\Quarantine\C\WINNT\system32\ksvcgjwn.exe.vir Infected: Trojan-Downloader.Win32.Tiny.id skipped
C:\QooBox\Quarantine\C\WINNT\system32\nwnhuqgr.exe.vir Infected: Trojan-Downloader.Win32.Tiny.id skipped
C:\QooBox\Quarantine\C\WINNT\system32\qkydqqjm.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.la skipped
C:\QooBox\Quarantine\C\WINNT\system32\sjngxyve.exe.vir Infected: Trojan-Downloader.Win32.Tiny.id skipped
C:\QooBox\Quarantine\C\WINNT\system32\sluclkqk.exe.vir Infected: Trojan-Downloader.Win32.Tiny.id skipped
C:\QooBox\Quarantine\C\WINNT\system32\xjhuautm.exe.vir Infected: Trojan-Downloader.Win32.Tiny.id skipped
C:\QooBox\Quarantine\catchme2007-08-06_214305.43.zip/efcccdd.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
C:\QooBox\Quarantine\catchme2007-08-06_214305.43.zip/gebcd.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.kr skipped
C:\QooBox\Quarantine\catchme2007-08-06_214305.43.zip ZIP: infected - 2 skipped
C:\WINNT\CSC\00000001 Object is locked skipped
C:\WINNT\Debug\ipsecpa.log Object is locked skipped
C:\WINNT\Debug\oakley.log Object is locked skipped
C:\WINNT\Debug\PASSWD.LOG Object is locked skipped
C:\WINNT\Internet Logs\fwdbglog.txt Object is locked skipped
C:\WINNT\Internet Logs\fwpktlog.txt Object is locked skipped
C:\WINNT\Internet Logs\IAMDB.RDB Object is locked skipped
C:\WINNT\Internet Logs\ROLLEAZY.ldb Object is locked skipped
C:\WINNT\Internet Logs\tvDebug.log Object is locked skipped
C:\WINNT\SchedLgU.Txt Object is locked skipped
C:\WINNT\security\edb.log Object is locked skipped
C:\WINNT\security\tmp.edb Object is locked skipped
C:\WINNT\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINNT\Sti_Trace.log Object is locked skipped
C:\WINNT\system32\config\ACEEvent.evt Object is locked skipped
C:\WINNT\system32\config\AppEvent.Evt Object is locked skipped
C:\WINNT\system32\config\default Object is locked skipped
C:\WINNT\system32\config\default.LOG Object is locked skipped
C:\WINNT\system32\config\SAM Object is locked skipped
C:\WINNT\system32\config\SAM.LOG Object is locked skipped
C:\WINNT\system32\config\SecEvent.Evt Object is locked skipped
C:\WINNT\system32\config\SECURITY Object is locked skipped
C:\WINNT\system32\config\SECURITY.LOG Object is locked skipped
C:\WINNT\system32\config\software Object is locked skipped
C:\WINNT\system32\config\software.LOG Object is locked skipped
C:\WINNT\system32\config\SysEvent.Evt Object is locked skipped
C:\WINNT\system32\config\system Object is locked skipped
C:\WINNT\system32\config\SYSTEM.ALT Object is locked skipped
C:\WINNT\system32\Perflib_Perfdata_420.dat Object is locked skipped
C:\WINNT\system32\wbem\Repository\CIM.REP Object is locked skipped
C:\WINNT\Temp\ZLT00313.TMP Object is locked skipped
C:\WINNT\Temp\ZLT0366f.TMP Object is locked skipped
C:\WINNT\WindowsUpdate.log Object is locked skipped
C:\WINNT\{00000002-00000000-00000007-00001102-00000004-10021102}.CDF Object is locked skipped
D:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\DSS\MachineKeys\73899a3abc976d1d25befdc7e2840681_1340d0cf-cae5-4cdc-a300-b4ab4e07db2a Object is locked skipped
D:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\19b92f83a328096f8ea3ee9a33062681_1340d0cf-cae5-4cdc-a300-b4ab4e07db2a Object is locked skipped
D:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3e68df68444fac068cc6511a63797e07_1340d0cf-cae5-4cdc-a300-b4ab4e07db2a Object is locked skipped
D:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\74dc1d68a57cd554b1477e01a5cd765e_1340d0cf-cae5-4cdc-a300-b4ab4e07db2a Object is locked skipped
D:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\bf14ae3203f2262309f5cf8a8f7ea256_1340d0cf-cae5-4cdc-a300-b4ab4e07db2a Object is locked skipped
D:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp Object is locked skipped
D:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy1.zip/msexreg.exe Suspicious: Password-protected-EXE skipped
D:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy1.zip ZIP: suspicious - 1 skipped
D:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy20.zip/msexreg.exe Suspicious: Password-protected-EXE skipped
D:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy20.zip ZIP: suspicious - 1 skipped
D:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy24.zip/msexreg.exe Suspicious: Password-protected-EXE skipped
D:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy24.zip ZIP: suspicious - 1 skipped
D:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy28.zip/msexreg.exe Suspicious: Password-protected-EXE skipped
D:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy28.zip ZIP: suspicious - 1 skipped
D:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy32.zip/msexreg.exe Suspicious: Password-protected-EXE skipped
D:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy32.zip ZIP: suspicious - 1 skipped
D:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy36.zip/msexreg.exe Suspicious: Password-protected-EXE skipped
D:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy36.zip ZIP: suspicious - 1 skipped
D:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy40.zip/msexreg.exe Suspicious: Password-protected-EXE skipped
D:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy40.zip ZIP: suspicious - 1 skipped
D:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\PWStealerModule.zip/module32.exe Suspicious: Password-protected-EXE skipped
D:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\PWStealerModule.zip ZIP: suspicious - 1 skipped
D:\Documents and Settings\xxx\Local Settings\Temp\hsperfdata_xxx\2176 Object is locked skipped
D:\Documents and Settings\xxx\Local Settings\Temp\mma.chm/alien.cab/amm06.ocx Infected: not-a-virus:AdWare.Win32.MediaMotor.p skipped
D:\Documents and Settings\xxx\Local Settings\Temp\mma.chm/alien.cab Infected: not-a-virus:AdWare.Win32.MediaMotor.p skipped
D:\Documents and Settings\xxx\Local Settings\Temp\mma.chm/joysavsht.cab/amm06.ocx Infected: not-a-virus:AdWare.Win32.MediaMotor.p skipped
D:\Documents and Settings\xxx\Local Settings\Temp\mma.chm/joysavsht.cab Infected: not-a-virus:AdWare.Win32.MediaMotor.p skipped
D:\Documents and Settings\xxx\Local Settings\Temp\mma.chm/page.htm Infected: not-a-virus:AdWare.Win32.MediaMotor.p skipped
D:\Documents and Settings\xxx\Local Settings\Temp\mma.chm CHM: infected - 5 skipped
D:\Documents and Settings\xxx\Local Settings\Temp\stdrun6.exe/data0002 Infected: Trojan.Win32.VB.tg skipped
D:\Documents and Settings\xxx\Local Settings\Temp\stdrun6.exe/data0005 Infected: Trojan.Win32.VB.tg skipped
D:\Documents and Settings\xxx\Local Settings\Temp\stdrun6.exe/data0006 Infected: Trojan.Win32.VB.tg skipped
D:\Documents and Settings\xxx\Local Settings\Temp\stdrun6.exe NSIS: infected - 3 skipped
D:\Documents and Settings\xxx\Local Settings\Temp\winfix.chm/page.htm Infected: not-a-virus:AdWare.Win32.MediaMotor.p skipped
D:\Documents and Settings\xxx\Local Settings\Temp\winfix.chm/SystemDoctor2006FreeInstall.cab/USDR6_0001_D08M0404NetInstaller.exe Infected: not-a-virus:Downloader.Win32.WinFixer.l skipped
D:\Documents and Settings\xxx\Local Settings\Temp\winfix.chm/SystemDoctor2006FreeInstall.cab Infected: not-a-virus:Downloader.Win32.WinFixer.l skipped
D:\Documents and Settings\xxx\Local Settings\Temp\winfix.chm CHM: infected - 3 skipped
D:\System Volume Information\_restore{196A5EC6-C7FF-4F62-BE48-2CA846D93A3F}\RP537\A0396711.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped
D:\System Volume Information\_restore{196A5EC6-C7FF-4F62-BE48-2CA846D93A3F}\RP537\A0396726.dll Infected: not-a-virus:AdWare.Win32.WebHancer skipped
D:\System Volume Information\_restore{196A5EC6-C7FF-4F62-BE48-2CA846D93A3F}\RP537\A0396754.exe Infected: not-a-virus:AdWare.Win32.WebHancer skipped
D:\System Volume Information\_restore{196A5EC6-C7FF-4F62-BE48-2CA846D93A3F}\RP537\A0396758.exe Infected: not-a-virus:AdWare.Win32.WebHancer skipped
D:\System Volume Information\_restore{196A5EC6-C7FF-4F62-BE48-2CA846D93A3F}\RP537\A0396766.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped
D:\WINDOWS\$NtServicePackUninstall$\wmipdskq.dll Infected: not-a-virus:AdWare.Win32.Hmt skipped
D:\WINDOWS\$NtUninstallKB828741$\catsrv.dll Object is locked skipped
D:\WINDOWS\$NtUninstallKB828741$\catsrvut.dll Object is locked skipped
D:\WINDOWS\$NtUninstallKB828741$\clbcatex.dll Object is locked skipped
D:\WINDOWS\$NtUninstallKB828741$\clbcatq.dll Object is locked skipped
D:\WINDOWS\$NtUninstallKB828741$\colbact.dll Object is locked skipped
D:\WINDOWS\$NtUninstallKB828741$\comadmin.dll Object is locked skipped
D:\WINDOWS\$NtUninstallKB828741$\comrepl.exe Object is locked skipped
D:\WINDOWS\$NtUninstallKB828741$\comsvcs.dll Object is locked skipped
D:\WINDOWS\$NtUninstallKB828741$\comuid.dll Object is locked skipped
D:\WINDOWS\$NtUninstallKB828741$\es.dll Object is locked skipped
D:\WINDOWS\$NtUninstallKB828741$\migregdb.exe Object is locked skipped
D:\WINDOWS\$NtUninstallKB828741$\msdtcprx.dll Object is locked skipped
D:\WINDOWS\$NtUninstallKB828741$\msdtctm.dll Object is locked skipped
D:\WINDOWS\$NtUninstallKB828741$\msdtcuiu.dll Object is locked skipped
D:\WINDOWS\$NtUninstallKB828741$\mtxclu.dll Object is locked skipped
D:\WINDOWS\$NtUninstallKB828741$\mtxoci.dll Object is locked skipped
D:\WINDOWS\$NtUninstallKB828741$\ole32.dll Object is locked skipped
D:\WINDOWS\$NtUninstallKB828741$\rpcrt4.dll Object is locked skipped
D:\WINDOWS\$NtUninstallKB828741$\rpcss.dll Object is locked skipped
D:\WINDOWS\$NtUninstallKB828741$\txflog.dll Object is locked skipped
D:\WINDOWS\$NtUninstallKB835732$\browser.dll Object is locked skipped
D:\WINDOWS\$NtUninstallKB835732$\callcont.dll Object is locked skipped
D:\WINDOWS\$NtUninstallKB835732$\cmdevtgprov.dll Object is locked skipped
D:\WINDOWS\$NtUninstallKB835732$\evtgprov.dll Object is locked skipped
D:\WINDOWS\$NtUninstallKB835732$\gdi32.dll Object is locked skipped
D:\WINDOWS\$NtUninstallKB835732$\h323.tsp Object is locked skipped
D:\WINDOWS\$NtUninstallKB835732$\h323msp.dll Object is locked skipped
D:\WINDOWS\$NtUninstallKB835732$\helpctr.exe Object is locked skipped
D:\WINDOWS\$NtUninstallKB835732$\ipnathlp.dll Object is locked skipped
D:\WINDOWS\$NtUninstallKB835732$\lsasrv.dll Object is locked skipped
D:\WINDOWS\$NtUninstallKB835732$\mf3216.dll Object is locked skipped
D:\WINDOWS\$NtUninstallKB835732$\msasn1.dll Object is locked skipped
D:\WINDOWS\$NtUninstallKB835732$\msgina.dll Object is locked skipped
D:\WINDOWS\$NtUninstallKB835732$\mst120.dll Object is locked skipped
D:\WINDOWS\$NtUninstallKB835732$\netapi32.dll Object is locked skipped
D:\WINDOWS\$NtUninstallKB835732$\nmcom.dll Object is locked skipped
D:\WINDOWS\$NtUninstallKB835732$\rtcdll.dll Object is locked skipped
D:\WINDOWS\$NtUninstallKB835732$\schannel.dll Object is locked skipped
D:\WINDOWS\srvnzeikrw.exe/data0002 Infected: Trojan.Win32.VB.tg skipped
D:\WINDOWS\srvnzeikrw.exe/data0005 Infected: Trojan.Win32.VB.tg skipped
D:\WINDOWS\srvnzeikrw.exe/data0006 Infected: Trojan.Win32.VB.tg skipped
D:\WINDOWS\srvnzeikrw.exe NSIS: infected - 3 skipped
D:\WINDOWS\system32\crunner\cupdater.exe Infected: Trojan-Downloader.MSIL.Agent.c skipped
D:\WINDOWS\system32\h82o0if3e82.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped
D:\WINDOWS\system32\ir0ml5d11.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped
D:\WINDOWS\system32\jtjs0717e.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped
D:\WINDOWS\system32\jtl4073qe.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped
D:\WINDOWS\system32\ktr2l79o1.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped
D:\WINDOWS\system32\mv64l9jq1.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped
D:\WINDOWS\system32\uplmon.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped
D:\WINDOWS\YazzleBundle-1264.exe/data0002 Infected: Trojan-Downloader.Win32.PurityScan.dc skipped
D:\WINDOWS\YazzleBundle-1264.exe NSIS: infected - 1 skipped

Scan process completed.

3. combo

ComboFix 07-08-07.5 - "Kevin" 08/07/2007 1:03:53.3 - NTFSx86
Microsoft Windows 2000 Professional 5.0.2195.4.1252.1.1033.18.415 [GMT -7:00]
Command switches used :: D:\Program Files\$$$$$$$$$$$$$$$$\DSS LOG\CFScript.txt

FILE::
C:\Winnt\system32\morjysmf.dll

((((((((((((((((((((((((( Files Created from 2007-07-07 to 2007-08-07 )))))))))))))))))))))))))))))))

2007-08-06 22:10 <DIR> d-------- C:\WINNT\system32\Kaspersky Lab
2007-08-06 22:10 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab
2007-08-06 22:05 16,384 --a----t- C:\WINNT\system32\Perflib_Perfdata_420.dat
2007-08-06 21:38 51,200 --a------ C:\WINNT\nircmd.exe
2007-08-06 21:29 <DIR> d-------- C:\Deckard
2007-08-06 21:11 <DIR> d-a------ C:\WINNT\system32\ActiveScan
2007-08-06 15:25 <DIR> d-------- C:\Program Files\Trend Micro
2007-08-05 16:08 <DIR> d-------- C:\Program Files\SopCast
2007-08-05 16:08 <DIR> d-------- C:\DOCUME~1\Kevin\APPLIC~1\SopCast
2007-08-05 12:33 <DIR> d-------- C:\DOCUME~1\Kevin\.housecall6.6
2007-08-05 11:56 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-07-26 13:38 <DIR> d-------- C:\DOCUME~1\Kevin\APPLIC~1\Stamps.com Internet Postage
2007-07-26 13:36 <DIR> d-a------ C:\Program Files\Stamps.com Internet Postage
2007-07-19 03:38 <DIR> d-a------ C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
2007-07-10 15:00 <DIR> d-------- C:\Program Files\iPod

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

12/07/99 05:00a 32528 --a------ C:\WINNT\inf\wbfirdma.sys
07/29/07 08:31p --------- d-------- C:\DOCUME~1\Kevin\APPLIC~1\LimeWire
07/26/07 12:38a --------- d-------- C:\DOCUME~1\Kevin\APPLIC~1\Yahoo!
07/26/07 01:41p --------- d-------- C:\Program Files\MySpace
07/10/07 02:57p --------- d-------- C:\Program Files\Apple Software Update
07/05/07 05:05a --------- d-------- C:\DOCUME~1\Kevin\APPLIC~1\ZoomBrowser EX
07/04/07 09:20p --------- d-------- C:\DOCUME~1\Kevin\APPLIC~1\MySpace
07/04/07 04:44p --------- d--h----- C:\Program Files\InstallShield Installation Information
07/04/07 04:44p --------- d-------- C:\Program Files\Canon
07/04/07 04:35p --------- d-------- C:\Program Files\Common Files\Canon
06/22/07 06:53p 109753 --a------ C:\WINNT\hpoins11.dat
06/22/07 06:52p --------- d-------- C:\Program Files\HP
06/22/07 06:52p --------- d-------- C:\Program Files\Hewlett-Packard
06/22/07 06:52p --------- d-------- C:\Program Files\Common Files\Hewlett-Packard
06/11/07 11:32p --------- d-------- C:\Program Files\Common Files\InstallShield
06/10/07 05:57p --------- d-------- C:\Program Files\AIM6
06/07/07 10:32p --------- d-------- C:\DOCUME~1\Kevin\APPLIC~1\Apple Computer
06/07/07 10:31p --------- d-------- C:\Program Files\QuickTime
06/07/07 04:08a 2914 --a------ C:\WINNT\mozver.dat
05/29/07 06:19p 50176 --a------ C:\WINNT\system32\reg.exe
04/07/07 10:47a 271 ---h----- C:\Program Files\desktop.ini
04/07/07 10:47a 21952 ---h----- C:\Program Files\folder.htt

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"="mobsync.exe" [06/19/03 12:05p C:\WINNT\system32\mobsync.exe]
"SoundMan"="SOUNDMAN.EXE" [11/17/06 05:42a C:\WINNT\soundman.exe]
"ShStatEXE"="C:\Program Files\Network Associates\VirusScan\SHSTAT.exe" [09/29/03 07:10a]
"McAfeeUpdaterUI"="C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" [09/10/03 03:11a]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [03/09/07 01:02a]
"CTHelper"="CTHELPER.EXE" [08/11/06 02:56p C:\WINNT\CTHELPER.EXE]
"CTxfiHlp"="CTXFIHLP.EXE" [08/11/06 02:56p C:\WINNT\system32\CTXFIHLP.EXE]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [03/14/07 03:43a]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [03/09/07 06:53p]
"WinampAgent"="D:\Program Files\Winamp\winampa.exe" [04/25/07 08:44a]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [04/27/07 09:41a]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="ctfmon.exe" [02/20/01 01:09p C:\WINNT\system32\CTFMON.EXE]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [07/13/07 04:38p]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [11/10/06 12:35p]
"Aim6"="" []
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [03/12/07 01:49p]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [03/27/07 03:22p]
"AWMON"="C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe" [05/25/05 12:12p]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\Wcescomm.exe" []

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"=C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sglfb.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tga.sys]
@="Driver"

R1 StarOpen;StarOpen;C:\WINNT\system32\drivers\StarOpen.sys
R3 ctgame;Game Port;C:\WINNT\system32\DRIVERS\ctgame.sys
R3 openhci;Microsoft USB Open Host Controller Driver;C:\WINNT\system32\DRIVERS\openhci.sys
S3 hap17v2k;Creative P17V HAL Driver;C:\WINNT\system32\drivers\hap17v2k.sys
S3 MPE;BDA MPE Filter;C:\WINNT\system32\DRIVERS\MPE.sys
S3 ssm_bus;SAMSUNG Mobile USB Device II 1.0 driver (WDM);C:\WINNT\system32\DRIVERS\ssm_bus.sys
S3 ssm_mdfl;SAMSUNG Mobile USB Modem II 1.0 Filter;C:\WINNT\system32\DRIVERS\ssm_mdfl.sys
S3 ssm_mdm;SAMSUNG Mobile USB Modem II 1.0 Drivers;C:\WINNT\system32\DRIVERS\ssm_mdm.sys
S3 usb_rndisy;USB RNDIS Adapter;C:\WINNT\system32\DRIVERS\usb8023y.sys
S3 XDva004;XDva004;\??\C:\WINNT\system32\XDva004.sys

Contents of the 'Scheduled Tasks' folder
2007-08-01 23:18:01 C:\WINNT\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-07 01:04:56
Windows 5.0.2195 Service Pack 4 NTFS

scanning hidden processes ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 08/07/2007 1

14
C:\ComboFix-quarantined-files.txt ... 08/07/07 01:05a
C:\ComboFix2.txt ... 08/06/07 10:06p
C:\ComboFix3.txt ... 08/06/07 09:45p

--- E O F ---

08-07-2007, 02:10 AM	#12 (permalink)
HoAfCr Registered User Join Date: Jun 2006 Posts: 30 OS: XP	Re: HJT help! 1. hijackthis Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 1:08:33 AM, on 8/7/2007 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Boot mode: Normal Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\Ati2evxx.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\ZoneLabs\vsmon.exe C:\WINNT\system32\spoolsv.exe C:\WINNT\System32\svchost.exe C:\WINNT\system32\hidserv.exe C:\Program Files\Network Associates\Common Framework\FrameworkService.exe C:\Program Files\Network Associates\VirusScan\mcshield.exe C:\Program Files\Network Associates\VirusScan\vstskmgr.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINNT\system32\HPZipm12.exe C:\WINNT\system32\regsvc.exe C:\WINNT\system32\MSTask.exe C:\WINNT\system32\stisvc.exe C:\WINNT\system32\Ati2evxx.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\system32\svchost.exe C:\WINNT\SOUNDMAN.EXE C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\WINNT\CTHELPER.EXE C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe D:\Program Files\Winamp\winampa.exe C:\WINNT\system32\ctfmon.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\AIM6\aim6.exe C:\Program Files\AIM6\aolsoftware.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINNT\explorer.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [WinampAgent] D:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet O4 - HKCU\..\Run: [AWMON] "C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe" O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\Wcescomm.exe" O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user') O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - D:\Program Files\Bodog Poker\BPGame.exe O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1175971104859 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1175972679609 O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINNT\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\mcshield.exe O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\vstskmgr.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\HPZipm12.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe O24 - Desktop Component 1: Google Advanced Search - http://www.google.com/advanced_search?hl=en -- End of file - 8581 bytes 2. Online ------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT Tuesday, August 07, 2007 12:57:38 AM Operating System: Microsoft Windows 2000 Professional, Service Pack 4 (Build 2195) Kaspersky Online Scanner version: 5.0.93.0 Kaspersky Anti-Virus database last update: 7/08/2007 Kaspersky Anti-Virus database records: 376348 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ E:\ F:\ Scan Statistics: Total number of scanned objects: 114618 Number of viruses found: 16 Number of infected objects: 54 Number of suspicious objects: 16 Duration of the scan process: 01:46:47 Infected Object Name / Virus Name / Last Action C:\Deckard\System Scanner\backup\DOCUME~1\Kevin\LOCALS~1\Temp\laf1.exe Infected: Trojan-Downloader.Win32.Agent.bkd skipped C:\Deckard\System Scanner\backup\DOCUME~1\Kevin\LOCALS~1\Temp\lyqudotp.exe Infected: Trojan-Dropper.Win32.Agent.bmk skipped C:\Deckard\System Scanner\backup\DOCUME~1\Kevin\LOCALS~1\Temp\NeroDemo12550\Toolbar.exe Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped C:\Deckard\System Scanner\backup\DOCUME~1\Kevin\LOCALS~1\Temp\vwcfxaum.exe Infected: Trojan-Dropper.Win32.Agent.bmk skipped C:\Deckard\System Scanner\backup\DOCUME~1\Kevin\LOCALS~1\Temp\yidovrlb.exe Infected: Trojan-Dropper.Win32.Agent.bmk skipped C:\Documents and Settings\All Users\Application Data\Network Associates\Common Framework\Db\Agent_ROLLEAZY.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Network Associates\Common Framework\Db\PrdMgr_ROLLEAZY.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Network Associates\VirusScan\OnAccessScanLog.txt Object is locked skipped C:\Documents and Settings\Default User\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Default User\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Kevin\Application Data\Lavasoft\Ad-Aware\Logs\AWEVLOG.txt Object is locked skipped C:\Documents and Settings\Kevin\Application Data\Mozilla\Firefox\Profiles\ml9dbb1z.default\cert8.db Object is locked skipped C:\Documents and Settings\Kevin\Application Data\Mozilla\Firefox\Profiles\ml9dbb1z.default\formhistory.dat Object is locked skipped C:\Documents and Settings\Kevin\Application Data\Mozilla\Firefox\Profiles\ml9dbb1z.default\history.dat Object is locked skipped C:\Documents and Settings\Kevin\Application Data\Mozilla\Firefox\Profiles\ml9dbb1z.default\key3.db Object is locked skipped C:\Documents and Settings\Kevin\Application Data\Mozilla\Firefox\Profiles\ml9dbb1z.default\parent.lock Object is locked skipped C:\Documents and Settings\Kevin\Application Data\Mozilla\Firefox\Profiles\ml9dbb1z.default\search.sqlite Object is locked skipped C:\Documents and Settings\Kevin\Application Data\Mozilla\Firefox\Profiles\ml9dbb1z.default\urlclassifier2.sqlite Object is locked skipped C:\Documents and Settings\Kevin\Application Data\Mozilla\Firefox\Profiles\ml9dbb1z.default\webappsstore.sqlite Object is locked skipped C:\Documents and Settings\Kevin\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Kevin\Local Settings\Application Data\Ahead\Nero Home\bl.db Object is locked skipped C:\Documents and Settings\Kevin\Local Settings\Application Data\Ahead\Nero Home\is2.db Object is locked skipped C:\Documents and Settings\Kevin\Local Settings\Application Data\AOL OCP\AIM\Storage\All Users\localStorage\common.cls Object is locked skipped C:\Documents and Settings\Kevin\Local Settings\Application Data\AOL OCP\AIM\Storage\data\iicanibusxthcii\localStorage\common.cls Object is locked skipped C:\Documents and Settings\Kevin\Local Settings\Application Data\ATI\ACE\Log\MOM-0.log Object is locked skipped C:\Documents and Settings\Kevin\Local Settings\Application Data\Identities\{D60BFC08-63F6-4915-94EC-FB44C27FA1DC}\Microsoft\Outlook Express\cleanup.log Object is locked skipped C:\Documents and Settings\Kevin\Local Settings\Application Data\Identities\{D60BFC08-63F6-4915-94EC-FB44C27FA1DC}\Microsoft\Outlook Express\Folders.dbx Object is locked skipped C:\Documents and Settings\Kevin\Local Settings\Application Data\Identities\{D60BFC08-63F6-4915-94EC-FB44C27FA1DC}\Microsoft\Outlook Express\Offline.dbx Object is locked skipped C:\Documents and Settings\Kevin\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Kevin\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Kevin\Local Settings\Application Data\Mozilla\Firefox\Profiles\ml9dbb1z.default\Cache\_CACHE_001_ Object is locked skipped C:\Documents and Settings\Kevin\Local Settings\Application Data\Mozilla\Firefox\Profiles\ml9dbb1z.default\Cache\_CACHE_002_ Object is locked skipped C:\Documents and Settings\Kevin\Local Settings\Application Data\Mozilla\Firefox\Profiles\ml9dbb1z.default\Cache\_CACHE_003_ Object is locked skipped C:\Documents and Settings\Kevin\Local Settings\Application Data\Mozilla\Firefox\Profiles\ml9dbb1z.default\Cache\_CACHE_MAP_ Object is locked skipped C:\Documents and Settings\Kevin\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Kevin\Local Settings\History\History.IE5\MSHist012007080620070807\index.dat Object is locked skipped C:\Documents and Settings\Kevin\Local Settings\Temp\~DFA48A.tmp Object is locked skipped C:\Documents and Settings\Kevin\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Kevin\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Kevin\ntuser.dat.LOG Object is locked skipped C:\QooBox\Quarantine\C\WINNT\system32\atfvoghd.exe.vir Infected: Trojan-Downloader.Win32.Tiny.id skipped C:\QooBox\Quarantine\C\WINNT\system32\bvenrovp.exe.vir Infected: Trojan-Downloader.Win32.Tiny.id skipped C:\QooBox\Quarantine\C\WINNT\system32\ciqpkbux.exe.vir Infected: Trojan-Dropper.Win32.Agent.bmk skipped C:\QooBox\Quarantine\C\WINNT\system32\ckcrhbuc.exe.vir Infected: Trojan-Downloader.Win32.Tiny.id skipped C:\QooBox\Quarantine\C\WINNT\system32\ckeuccal.exe.vir Infected: Trojan-Downloader.Win32.Tiny.id skipped C:\QooBox\Quarantine\C\WINNT\system32\eyaldsjf.exe.vir Infected: Trojan-Downloader.Win32.Tiny.id skipped C:\QooBox\Quarantine\C\WINNT\system32\ksvcgjwn.exe.vir Infected: Trojan-Downloader.Win32.Tiny.id skipped C:\QooBox\Quarantine\C\WINNT\system32\nwnhuqgr.exe.vir Infected: Trojan-Downloader.Win32.Tiny.id skipped C:\QooBox\Quarantine\C\WINNT\system32\qkydqqjm.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.la skipped C:\QooBox\Quarantine\C\WINNT\system32\sjngxyve.exe.vir Infected: Trojan-Downloader.Win32.Tiny.id skipped C:\QooBox\Quarantine\C\WINNT\system32\sluclkqk.exe.vir Infected: Trojan-Downloader.Win32.Tiny.id skipped C:\QooBox\Quarantine\C\WINNT\system32\xjhuautm.exe.vir Infected: Trojan-Downloader.Win32.Tiny.id skipped C:\QooBox\Quarantine\catchme2007-08-06_214305.43.zip/efcccdd.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped C:\QooBox\Quarantine\catchme2007-08-06_214305.43.zip/gebcd.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.kr skipped C:\QooBox\Quarantine\catchme2007-08-06_214305.43.zip ZIP: infected - 2 skipped C:\WINNT\CSC\00000001 Object is locked skipped C:\WINNT\Debug\ipsecpa.log Object is locked skipped C:\WINNT\Debug\oakley.log Object is locked skipped C:\WINNT\Debug\PASSWD.LOG Object is locked skipped C:\WINNT\Internet Logs\fwdbglog.txt Object is locked skipped C:\WINNT\Internet Logs\fwpktlog.txt Object is locked skipped C:\WINNT\Internet Logs\IAMDB.RDB Object is locked skipped C:\WINNT\Internet Logs\ROLLEAZY.ldb Object is locked skipped C:\WINNT\Internet Logs\tvDebug.log Object is locked skipped C:\WINNT\SchedLgU.Txt Object is locked skipped C:\WINNT\security\edb.log Object is locked skipped C:\WINNT\security\tmp.edb Object is locked skipped C:\WINNT\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINNT\Sti_Trace.log Object is locked skipped C:\WINNT\system32\config\ACEEvent.evt Object is locked skipped C:\WINNT\system32\config\AppEvent.Evt Object is locked skipped C:\WINNT\system32\config\default Object is locked skipped C:\WINNT\system32\config\default.LOG Object is locked skipped C:\WINNT\system32\config\SAM Object is locked skipped C:\WINNT\system32\config\SAM.LOG Object is locked skipped C:\WINNT\system32\config\SecEvent.Evt Object is locked skipped C:\WINNT\system32\config\SECURITY Object is locked skipped C:\WINNT\system32\config\SECURITY.LOG Object is locked skipped C:\WINNT\system32\config\software Object is locked skipped C:\WINNT\system32\config\software.LOG Object is locked skipped C:\WINNT\system32\config\SysEvent.Evt Object is locked skipped C:\WINNT\system32\config\system Object is locked skipped C:\WINNT\system32\config\SYSTEM.ALT Object is locked skipped C:\WINNT\system32\Perflib_Perfdata_420.dat Object is locked skipped C:\WINNT\system32\wbem\Repository\CIM.REP Object is locked skipped C:\WINNT\Temp\ZLT00313.TMP Object is locked skipped C:\WINNT\Temp\ZLT0366f.TMP Object is locked skipped C:\WINNT\WindowsUpdate.log Object is locked skipped C:\WINNT\{00000002-00000000-00000007-00001102-00000004-10021102}.CDF Object is locked skipped D:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\DSS\MachineKeys\73899a3abc976d1d25befdc7e2840681_1340d0cf-cae5-4cdc-a300-b4ab4e07db2a Object is locked skipped D:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\19b92f83a328096f8ea3ee9a33062681_1340d0cf-cae5-4cdc-a300-b4ab4e07db2a Object is locked skipped D:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3e68df68444fac068cc6511a63797e07_1340d0cf-cae5-4cdc-a300-b4ab4e07db2a Object is locked skipped D:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\74dc1d68a57cd554b1477e01a5cd765e_1340d0cf-cae5-4cdc-a300-b4ab4e07db2a Object is locked skipped D:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\bf14ae3203f2262309f5cf8a8f7ea256_1340d0cf-cae5-4cdc-a300-b4ab4e07db2a Object is locked skipped D:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp Object is locked skipped D:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy1.zip/msexreg.exe Suspicious: Password-protected-EXE skipped D:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy1.zip ZIP: suspicious - 1 skipped D:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy20.zip/msexreg.exe Suspicious: Password-protected-EXE skipped D:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy20.zip ZIP: suspicious - 1 skipped D:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy24.zip/msexreg.exe Suspicious: Password-protected-EXE skipped D:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy24.zip ZIP: suspicious - 1 skipped D:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy28.zip/msexreg.exe Suspicious: Password-protected-EXE skipped D:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy28.zip ZIP: suspicious - 1 skipped D:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy32.zip/msexreg.exe Suspicious: Password-protected-EXE skipped D:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy32.zip ZIP: suspicious - 1 skipped D:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy36.zip/msexreg.exe Suspicious: Password-protected-EXE skipped D:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy36.zip ZIP: suspicious - 1 skipped D:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy40.zip/msexreg.exe Suspicious: Password-protected-EXE skipped D:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy40.zip ZIP: suspicious - 1 skipped D:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\PWStealerModule.zip/module32.exe Suspicious: Password-protected-EXE skipped D:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\PWStealerModule.zip ZIP: suspicious - 1 skipped D:\Documents and Settings\xxx\Local Settings\Temp\hsperfdata_xxx\2176 Object is locked skipped D:\Documents and Settings\xxx\Local Settings\Temp\mma.chm/alien.cab/amm06.ocx Infected: not-a-virus:AdWare.Win32.MediaMotor.p skipped D:\Documents and Settings\xxx\Local Settings\Temp\mma.chm/alien.cab Infected: not-a-virus:AdWare.Win32.MediaMotor.p skipped D:\Documents and Settings\xxx\Local Settings\Temp\mma.chm/joysavsht.cab/amm06.ocx Infected: not-a-virus:AdWare.Win32.MediaMotor.p skipped D:\Documents and Settings\xxx\Local Settings\Temp\mma.chm/joysavsht.cab Infected: not-a-virus:AdWare.Win32.MediaMotor.p skipped D:\Documents and Settings\xxx\Local Settings\Temp\mma.chm/page.htm Infected: not-a-virus:AdWare.Win32.MediaMotor.p skipped D:\Documents and Settings\xxx\Local Settings\Temp\mma.chm CHM: infected - 5 skipped D:\Documents and Settings\xxx\Local Settings\Temp\stdrun6.exe/data0002 Infected: Trojan.Win32.VB.tg skipped D:\Documents and Settings\xxx\Local Settings\Temp\stdrun6.exe/data0005 Infected: Trojan.Win32.VB.tg skipped D:\Documents and Settings\xxx\Local Settings\Temp\stdrun6.exe/data0006 Infected: Trojan.Win32.VB.tg skipped D:\Documents and Settings\xxx\Local Settings\Temp\stdrun6.exe NSIS: infected - 3 skipped D:\Documents and Settings\xxx\Local Settings\Temp\winfix.chm/page.htm Infected: not-a-virus:AdWare.Win32.MediaMotor.p skipped D:\Documents and Settings\xxx\Local Settings\Temp\winfix.chm/SystemDoctor2006FreeInstall.cab/USDR6_0001_D08M0404NetInstaller.exe Infected: not-a-virus:Downloader.Win32.WinFixer.l skipped D:\Documents and Settings\xxx\Local Settings\Temp\winfix.chm/SystemDoctor2006FreeInstall.cab Infected: not-a-virus:Downloader.Win32.WinFixer.l skipped D:\Documents and Settings\xxx\Local Settings\Temp\winfix.chm CHM: infected - 3 skipped D:\System Volume Information\_restore{196A5EC6-C7FF-4F62-BE48-2CA846D93A3F}\RP537\A0396711.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped D:\System Volume Information\_restore{196A5EC6-C7FF-4F62-BE48-2CA846D93A3F}\RP537\A0396726.dll Infected: not-a-virus:AdWare.Win32.WebHancer skipped D:\System Volume Information\_restore{196A5EC6-C7FF-4F62-BE48-2CA846D93A3F}\RP537\A0396754.exe Infected: not-a-virus:AdWare.Win32.WebHancer skipped D:\System Volume Information\_restore{196A5EC6-C7FF-4F62-BE48-2CA846D93A3F}\RP537\A0396758.exe Infected: not-a-virus:AdWare.Win32.WebHancer skipped D:\System Volume Information\_restore{196A5EC6-C7FF-4F62-BE48-2CA846D93A3F}\RP537\A0396766.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped D:\WINDOWS\$NtServicePackUninstall$\wmipdskq.dll Infected: not-a-virus:AdWare.Win32.Hmt skipped D:\WINDOWS\$NtUninstallKB828741$\catsrv.dll Object is locked skipped D:\WINDOWS\$NtUninstallKB828741$\catsrvut.dll Object is locked skipped D:\WINDOWS\$NtUninstallKB828741$\clbcatex.dll Object is locked skipped D:\WINDOWS\$NtUninstallKB828741$\clbcatq.dll Object is locked skipped D:\WINDOWS\$NtUninstallKB828741$\colbact.dll Object is locked skipped D:\WINDOWS\$NtUninstallKB828741$\comadmin.dll Object is locked skipped D:\WINDOWS\$NtUninstallKB828741$\comrepl.exe Object is locked skipped D:\WINDOWS\$NtUninstallKB828741$\comsvcs.dll Object is locked skipped D:\WINDOWS\$NtUninstallKB828741$\comuid.dll Object is locked skipped D:\WINDOWS\$NtUninstallKB828741$\es.dll Object is locked skipped D:\WINDOWS\$NtUninstallKB828741$\migregdb.exe Object is locked skipped D:\WINDOWS\$NtUninstallKB828741$\msdtcprx.dll Object is locked skipped D:\WINDOWS\$NtUninstallKB828741$\msdtctm.dll Object is locked skipped D:\WINDOWS\$NtUninstallKB828741$\msdtcuiu.dll Object is locked skipped D:\WINDOWS\$NtUninstallKB828741$\mtxclu.dll Object is locked skipped D:\WINDOWS\$NtUninstallKB828741$\mtxoci.dll Object is locked skipped D:\WINDOWS\$NtUninstallKB828741$\ole32.dll Object is locked skipped D:\WINDOWS\$NtUninstallKB828741$\rpcrt4.dll Object is locked skipped D:\WINDOWS\$NtUninstallKB828741$\rpcss.dll Object is locked skipped D:\WINDOWS\$NtUninstallKB828741$\txflog.dll Object is locked skipped D:\WINDOWS\$NtUninstallKB835732$\browser.dll Object is locked skipped D:\WINDOWS\$NtUninstallKB835732$\callcont.dll Object is locked skipped D:\WINDOWS\$NtUninstallKB835732$\cmdevtgprov.dll Object is locked skipped D:\WINDOWS\$NtUninstallKB835732$\evtgprov.dll Object is locked skipped D:\WINDOWS\$NtUninstallKB835732$\gdi32.dll Object is locked skipped D:\WINDOWS\$NtUninstallKB835732$\h323.tsp Object is locked skipped D:\WINDOWS\$NtUninstallKB835732$\h323msp.dll Object is locked skipped D:\WINDOWS\$NtUninstallKB835732$\helpctr.exe Object is locked skipped D:\WINDOWS\$NtUninstallKB835732$\ipnathlp.dll Object is locked skipped D:\WINDOWS\$NtUninstallKB835732$\lsasrv.dll Object is locked skipped D:\WINDOWS\$NtUninstallKB835732$\mf3216.dll Object is locked skipped D:\WINDOWS\$NtUninstallKB835732$\msasn1.dll Object is locked skipped D:\WINDOWS\$NtUninstallKB835732$\msgina.dll Object is locked skipped D:\WINDOWS\$NtUninstallKB835732$\mst120.dll Object is locked skipped D:\WINDOWS\$NtUninstallKB835732$\netapi32.dll Object is locked skipped D:\WINDOWS\$NtUninstallKB835732$\nmcom.dll Object is locked skipped D:\WINDOWS\$NtUninstallKB835732$\rtcdll.dll Object is locked skipped D:\WINDOWS\$NtUninstallKB835732$\schannel.dll Object is locked skipped D:\WINDOWS\srvnzeikrw.exe/data0002 Infected: Trojan.Win32.VB.tg skipped D:\WINDOWS\srvnzeikrw.exe/data0005 Infected: Trojan.Win32.VB.tg skipped D:\WINDOWS\srvnzeikrw.exe/data0006 Infected: Trojan.Win32.VB.tg skipped D:\WINDOWS\srvnzeikrw.exe NSIS: infected - 3 skipped D:\WINDOWS\system32\crunner\cupdater.exe Infected: Trojan-Downloader.MSIL.Agent.c skipped D:\WINDOWS\system32\h82o0if3e82.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped D:\WINDOWS\system32\ir0ml5d11.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped D:\WINDOWS\system32\jtjs0717e.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped D:\WINDOWS\system32\jtl4073qe.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped D:\WINDOWS\system32\ktr2l79o1.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped D:\WINDOWS\system32\mv64l9jq1.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped D:\WINDOWS\system32\uplmon.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped D:\WINDOWS\YazzleBundle-1264.exe/data0002 Infected: Trojan-Downloader.Win32.PurityScan.dc skipped D:\WINDOWS\YazzleBundle-1264.exe NSIS: infected - 1 skipped Scan process completed. 3. combo ComboFix 07-08-07.5 - "Kevin" 08/07/2007 1:03:53.3 - NTFSx86 Microsoft Windows 2000 Professional 5.0.2195.4.1252.1.1033.18.415 [GMT -7:00] Command switches used :: D:\Program Files\$$$$$$$$$$$$$$$$\DSS LOG\CFScript.txt FILE:: C:\Winnt\system32\morjysmf.dll ((((((((((((((((((((((((( Files Created from 2007-07-07 to 2007-08-07 ))))))))))))))))))))))))))))))) 2007-08-06 22:10 <DIR> d-------- C:\WINNT\system32\Kaspersky Lab 2007-08-06 22:10 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab 2007-08-06 22:05 16,384 --a----t- C:\WINNT\system32\Perflib_Perfdata_420.dat 2007-08-06 21:38 51,200 --a------ C:\WINNT\nircmd.exe 2007-08-06 21:29 <DIR> d-------- C:\Deckard 2007-08-06 21:11 <DIR> d-a------ C:\WINNT\system32\ActiveScan 2007-08-06 15:25 <DIR> d-------- C:\Program Files\Trend Micro 2007-08-05 16:08 <DIR> d-------- C:\Program Files\SopCast 2007-08-05 16:08 <DIR> d-------- C:\DOCUME~1\Kevin\APPLIC~1\SopCast 2007-08-05 12:33 <DIR> d-------- C:\DOCUME~1\Kevin\.housecall6.6 2007-08-05 11:56 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy 2007-07-26 13:38 <DIR> d-------- C:\DOCUME~1\Kevin\APPLIC~1\Stamps.com Internet Postage 2007-07-26 13:36 <DIR> d-a------ C:\Program Files\Stamps.com Internet Postage 2007-07-19 03:38 <DIR> d-a------ C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP 2007-07-10 15:00 <DIR> d-------- C:\Program Files\iPod (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 12/07/99 05:00a 32528 --a------ C:\WINNT\inf\wbfirdma.sys 07/29/07 08:31p --------- d-------- C:\DOCUME~1\Kevin\APPLIC~1\LimeWire 07/26/07 12:38a --------- d-------- C:\DOCUME~1\Kevin\APPLIC~1\Yahoo! 07/26/07 01:41p --------- d-------- C:\Program Files\MySpace 07/10/07 02:57p --------- d-------- C:\Program Files\Apple Software Update 07/05/07 05:05a --------- d-------- C:\DOCUME~1\Kevin\APPLIC~1\ZoomBrowser EX 07/04/07 09:20p --------- d-------- C:\DOCUME~1\Kevin\APPLIC~1\MySpace 07/04/07 04:44p --------- d--h----- C:\Program Files\InstallShield Installation Information 07/04/07 04:44p --------- d-------- C:\Program Files\Canon 07/04/07 04:35p --------- d-------- C:\Program Files\Common Files\Canon 06/22/07 06:53p 109753 --a------ C:\WINNT\hpoins11.dat 06/22/07 06:52p --------- d-------- C:\Program Files\HP 06/22/07 06:52p --------- d-------- C:\Program Files\Hewlett-Packard 06/22/07 06:52p --------- d-------- C:\Program Files\Common Files\Hewlett-Packard 06/11/07 11:32p --------- d-------- C:\Program Files\Common Files\InstallShield 06/10/07 05:57p --------- d-------- C:\Program Files\AIM6 06/07/07 10:32p --------- d-------- C:\DOCUME~1\Kevin\APPLIC~1\Apple Computer 06/07/07 10:31p --------- d-------- C:\Program Files\QuickTime 06/07/07 04:08a 2914 --a------ C:\WINNT\mozver.dat 05/29/07 06:19p 50176 --a------ C:\WINNT\system32\reg.exe 04/07/07 10:47a 271 ---h----- C:\Program Files\desktop.ini 04/07/07 10:47a 21952 ---h----- C:\Program Files\folder.htt ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) Note empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Synchronization Manager"="mobsync.exe" [06/19/03 12:05p C:\WINNT\system32\mobsync.exe] "SoundMan"="SOUNDMAN.EXE" [11/17/06 05:42a C:\WINNT\soundman.exe] "ShStatEXE"="C:\Program Files\Network Associates\VirusScan\SHSTAT.exe" [09/29/03 07:10a] "McAfeeUpdaterUI"="C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" [09/10/03 03:11a] "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [03/09/07 01:02a] "CTHelper"="CTHELPER.EXE" [08/11/06 02:56p C:\WINNT\CTHELPER.EXE] "CTxfiHlp"="CTXFIHLP.EXE" [08/11/06 02:56p C:\WINNT\system32\CTXFIHLP.EXE] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [03/14/07 03:43a] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [03/09/07 06:53p] "WinampAgent"="D:\Program Files\Winamp\winampa.exe" [04/25/07 08:44a] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [04/27/07 09:41a] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="ctfmon.exe" [02/20/01 01:09p C:\WINNT\system32\CTFMON.EXE] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [07/13/07 04:38p] "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [11/10/06 12:35p] "Aim6"="" [] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [03/12/07 01:49p] "Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [03/27/07 03:22p] "AWMON"="C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe" [05/25/05 12:12p] "H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\Wcescomm.exe" [] [HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce] "^SetupICWDesktop"=C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sglfb.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tga.sys] @="Driver" R1 StarOpen;StarOpen;C:\WINNT\system32\drivers\StarOpen.sys R3 ctgame;Game Port;C:\WINNT\system32\DRIVERS\ctgame.sys R3 openhci;Microsoft USB Open Host Controller Driver;C:\WINNT\system32\DRIVERS\openhci.sys S3 hap17v2k;Creative P17V HAL Driver;C:\WINNT\system32\drivers\hap17v2k.sys S3 MPE;BDA MPE Filter;C:\WINNT\system32\DRIVERS\MPE.sys S3 ssm_bus;SAMSUNG Mobile USB Device II 1.0 driver (WDM);C:\WINNT\system32\DRIVERS\ssm_bus.sys S3 ssm_mdfl;SAMSUNG Mobile USB Modem II 1.0 Filter;C:\WINNT\system32\DRIVERS\ssm_mdfl.sys S3 ssm_mdm;SAMSUNG Mobile USB Modem II 1.0 Drivers;C:\WINNT\system32\DRIVERS\ssm_mdm.sys S3 usb_rndisy;USB RNDIS Adapter;C:\WINNT\system32\DRIVERS\usb8023y.sys S3 XDva004;XDva004;\??\C:\WINNT\system32\XDva004.sys Contents of the 'Scheduled Tasks' folder 2007-08-01 23:18:01 C:\WINNT\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe ************************************************************************ catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-08-07 01:04:56 Windows 5.0.2195 Service Pack 4 NTFS scanning hidden processes ... scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************ Completion time: 08/07/2007 114 C:\ComboFix-quarantined-files.txt ... 08/07/07 01:05a C:\ComboFix2.txt ... 08/06/07 10:06p C:\ComboFix3.txt ... 08/06/07 09:45p --- E O F ---