Tech Support Forum - View Single Post - HijackThis log plus NTRecycler folder too big

pyanna7 · 01-10-2008, 02:12 PM

haha this is getting bigger and bigger! well... here goes! overall perfomance is very good right from the start (before posting here) and remains good.

ComboFix 08-01-10.2 - Administrator 2008-01-10 20:42:27.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1253.1.1032.18.294 [GMT 2:00]
Running from: C:\Documents and Settings\Administrator\Επιφάνεια εργασίας\ComboFix.exe
Command switches used :: C:\Documents and Settings\Administrator\Επιφάνεια εργασίας\CFScript.txt
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Administrator\Application Data\Spyware Terminator
C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\BIN_RSDATA.SPT
C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\info.htm
C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\appguard0.rtf
C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\appguard1.rtf
C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\appguard2.rtf
C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\appguard3.rtf
C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\appguard4.rtf
C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\bg01.gif
C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\bg02.gif
C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\bg07.gif
C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\clamguard0.rtf
C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\clamguard1.rtf
C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\intguard0.rtf
C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\intguard1.rtf
C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\intguard2.rtf
C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\intguard3.rtf
C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\intguard4.rtf
C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\intguard5.rtf
C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\language.changes.txt
C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\language.inf
C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\language.txt
C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\language.txt.changes
C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\li.gif
C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\li2.gif
C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\offlinehelp.html
C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\scancustom.rtf
C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\scanfast.rtf
C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\scanfull.rtf
C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\sysguard0.rtf
C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\sysguard1.rtf
C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\sysguard2.rtf
C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\sysguard3.rtf
C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\top.gif
C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\util01.rtf
C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\util02.rtf
C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\util03.rtf
C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\util04.rtf
C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\Reports\reports.dat
C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\Reports\scan_0001.dat
C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\Reports\scan_0002.dat
C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\scanConfig.xml
C:\Documents and Settings\All Users\Application Data\Spyware Terminator
C:\Documents and Settings\All Users\Application Data\Spyware Terminator\fileobjinfo.sys
C:\Documents and Settings\All Users\Application Data\Spyware Terminator\sp_rsdel.exe
C:\Program Files\Spyware Terminator
C:\Program Files\Spyware Terminator\BIN_RSCSDA.SPF
C:\Program Files\Spyware Terminator\BIN_STDATA.SPT
C:\Program Files\Spyware Terminator\BIN_STDATA_DIF.SPT
C:\Program Files\Spyware Terminator\BIN_STUIUS.SPT
C:\Program Files\Spyware Terminator\history.txt
C:\Program Files\Spyware Terminator\languages\brazilians.cab
C:\Program Files\Spyware Terminator\languages\brazilians.inf
C:\Program Files\Spyware Terminator\languages\czech.cab
C:\Program Files\Spyware Terminator\languages\czech.inf
C:\Program Files\Spyware Terminator\languages\english.cab
C:\Program Files\Spyware Terminator\languages\english.inf
C:\Program Files\Spyware Terminator\languages\french.cab
C:\Program Files\Spyware Terminator\languages\french.inf
C:\Program Files\Spyware Terminator\languages\german.cab
C:\Program Files\Spyware Terminator\languages\german.inf
C:\Program Files\Spyware Terminator\languages\hungarian.cab
C:\Program Files\Spyware Terminator\languages\hungarian.inf
C:\Program Files\Spyware Terminator\languages\italiano.cab
C:\Program Files\Spyware Terminator\languages\italiano.inf
C:\Program Files\Spyware Terminator\languages\korean.cab
C:\Program Files\Spyware Terminator\languages\korean.inf
C:\Program Files\Spyware Terminator\languages\polish.cab
C:\Program Files\Spyware Terminator\languages\polish.inf
C:\Program Files\Spyware Terminator\languages\portuguese.cab
C:\Program Files\Spyware Terminator\languages\portuguese.inf
C:\Program Files\Spyware Terminator\languages\russian.cab
C:\Program Files\Spyware Terminator\languages\russian.inf
C:\Program Files\Spyware Terminator\languages\serbian.cab
C:\Program Files\Spyware Terminator\languages\serbian.inf
C:\Program Files\Spyware Terminator\languages\spanish.cab
C:\Program Files\Spyware Terminator\languages\spanish.inf
C:\Program Files\Spyware Terminator\languages\swedish.cab
C:\Program Files\Spyware Terminator\languages\swedish.inf
C:\Program Files\Spyware Terminator\languages\turkish.cab
C:\Program Files\Spyware Terminator\languages\turkish.inf
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\Program Files\Spyware Terminator\sptcontmenu.dll
C:\Program Files\Spyware Terminator\SpywareTerminator.exe
C:\Program Files\Spyware Terminator\Spywareterminatorshield.Exe
C:\Program Files\Spyware Terminator\STServer.Exe
C:\Program Files\Spyware Terminator\unins000.dat
C:\Program Files\Spyware Terminator\unins000.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_RDRIV

((((((((((((((((((((((((( Files Created from 2007-12-10 to 2008-01-10 )))))))))))))))))))))))))))))))
.

2008-01-10 16:58 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-09 23:51 . 2008-01-09 23:52 <DIR> d-------- C:\WINDOWS\system32\el-gr
2008-01-09 23:43 . 2007-08-13 18:54 33,792 --a--c--- C:\WINDOWS\system32\dllcache\custsat.dll
2008-01-09 23:16 . 2008-01-09 23:16 <DIR> d-------- C:\Program Files\uTorrent
2008-01-09 23:16 . 2008-01-09 23:25 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\uTorrent
2008-01-09 22:44 . 2007-07-09 15:19 582,656 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2008-01-09 22:21 . 2008-01-10 00:43 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2008-01-09 22:06 . 2008-01-09 22:06 <DIR> d-------- C:\Program Files\SAGEM
2008-01-09 19:46 . 2008-01-09 23:51 3,352 --a------ C:\WINDOWS\system32\spupdsvc.inf
2008-01-09 19:44 . 2004-09-04 06:45 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2008-01-09 19:33 . 2008-01-09 19:33 <DIR> d-------- C:\WINDOWS\provisioning
2008-01-09 19:27 . 2008-01-09 19:27 <DIR> d-------- C:\WINDOWS\ServicePackFiles
2008-01-09 19:18 . 2004-07-17 11:40 19,528 --a------ C:\WINDOWS\002181_.tmp
2008-01-09 19:17 . 2005-06-28 10:21 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-01-09 19:12 . 2008-01-09 19:34 <DIR> d-------- C:\WINDOWS\EHome
2008-01-08 20:04 . 2008-01-08 20:04 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Grisoft
2008-01-08 19:12 . 2008-01-08 19:12 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-01-08 19:12 . 2007-05-30 14:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-01-08 17:10 . 2007-12-04 15:04 837,496 --a------ C:\WINDOWS\system32\aswBoot.exe
2008-01-08 17:10 . 2004-01-09 11:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx
2008-01-08 17:10 . 2007-12-04 14:54 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr
2008-01-08 17:10 . 2007-12-04 16:55 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2008-01-08 17:10 . 2007-12-04 16:56 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2008-01-08 17:10 . 2007-12-04 16:51 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2008-01-08 17:10 . 2007-12-04 16:49 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2008-01-08 17:10 . 2007-12-04 16:53 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2008-01-07 22:58 . 1999-11-07 05:34 40,960 --a------ C:\WINDOWS\_detmp.2
2008-01-07 22:58 . 2006-10-06 16:07 6,823 --a------ C:\WINDOWS\_detmp.1
2008-01-07 22:19 . 2008-01-07 22:19 <DIR> d-------- C:\Program Files\ToniArts
2007-12-21 20:17 . 2007-12-21 20:17 <DIR> d-------- C:\WINDOWS\LogFiles

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-09 21:03 --------- d-----w C:\Program Files\MSN Messenger
2008-01-09 20:07 31 ----a-w C:\WINDOWS\system32\drivers\adidsl.cfg
2008-01-09 20:07 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-08 19:27 --------- d-----w C:\Program Files\mangeta
2008-01-08 19:27 --------- d-----w C:\Program Files\AtomixMP3
2008-01-08 16:53 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Simple Sudoku
2008-01-08 16:53 --------- d-----w C:\Documents and Settings\Administrator\Application Data\LimeWire
2008-01-07 21:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\WildTangent
2008-01-07 21:05 --------- d-----w C:\Program Files\Canon
2008-01-07 20:59 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Lavasoft
2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
.

((((((((((((((((((((((((((((( snapshot@2008-01-10_17.11.51.13 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-01-10 14:59:16 237,568 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT
+ 2008-01-10 18:42:14 237,568 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT
- 2008-01-10 14:59:16 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
+ 2008-01-10 18:42:14 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
- 2008-01-10 14:59:16 237,568 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\NTUSER.DAT
+ 2008-01-10 18:42:14 237,568 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\NTUSER.DAT
- 2008-01-10 14:59:16 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
+ 2008-01-10 18:42:14 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
- 2008-01-10 14:59:16 4,050,944 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\NTUSER.DAT
+ 2008-01-10 18:42:15 4,050,944 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\NTUSER.DAT
- 2008-01-10 14:59:17 12,288 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
+ 2008-01-10 18:42:15 12,288 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
+ 2008-01-10 18:49:40 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_4e4.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-04 06:45 15360]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 11:55 5674352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIModeChange"="Ati2mdxx.exe" [2001-09-04 10:24 28672 C:\WINDOWS\system32\Ati2mdxx.exe]
"CnxDslTaskBar"="C:\Program Files\Crypto SA\AccessRunner ADSL USB\CnxDslTb.exe" [2004-06-16 07:55 233472]
"avast!"="C:\PROGRA~2\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 15:00 79224]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-09-04 06:45 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KAVPersonal50]
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-01-19 11:55 5674352 C:\Program Files\MSN Messenger\MsnMsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NWEReboot]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2005-04-13 02:48 36975 C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TClock.exe]
C:\Program Files\TClock\tclock_install.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WildTangent CDA]
C:\Program Files\WildTangent\Apps\CDA\GameDrvr.exe

S2 IKANLOADER2;General Purpose USB Driver (e4ldr.sys);C:\WINDOWS\system32\Drivers\e4ldr.sys [2006-03-02 19:25]
S3 CnxEtP;Crypto F200 USB ADSL Adapter Filter Driver;C:\WINDOWS\system32\DRIVERS\CnxEtP.sys [2004-06-16 07:51]
S3 CnxEtU;Crypto F200 USB ADSL Interface Device Driver;C:\WINDOWS\system32\DRIVERS\CnxEtU.sys [2004-06-16 07:51]
S3 CnxTgNW;Crypto F200 USB ADSL WAN PPPoA Adapter Driver;C:\WINDOWS\system32\DRIVERS\CnxTgNW.sys [2004-06-16 07:51]
S3 e4usbaw;USB ADSL2 WAN Adapter;C:\WINDOWS\system32\DRIVERS\e4usbaw.sys [2006-05-04 18:50]

.
Contents of the 'Scheduled Tasks' folder
"2006-12-06 14:33:20 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-10 20:50:40
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-10 20:55:57 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-10 18:55:54
ComboFix2.txt 2008-01-10 15:12:19
.
2008-01-09 22:44:10 --- E O F ---

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Thursday, January 10, 2008 10:59:08 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 10/01/2008
Kaspersky Anti-Virus database records: 506695
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: false

Scan Target - My Computer:
C:\
D:\

Scan Statistics:
Total number of scanned objects: 95000
Number of viruses found: 4
Number of infected objects: 9
Number of suspicious objects: 0
Duration of the scan process: 01:43:59

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\Administrator\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Administrator\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Administrator\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Administrator\Επιφάνεια εργασίας\keyfinder.exe/data.rar/officekey.exe Infected: not-a-virus:PSWTool.Win32.RAS.a skipped
C:\Documents and Settings\Administrator\Επιφάνεια εργασίας\keyfinder.exe/data.rar Infected: not-a-virus:PSWTool.Win32.RAS.a skipped
C:\Documents and Settings\Administrator\Επιφάνεια εργασίας\keyfinder.exe RarSFX: infected - 2 skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\NTRECYCLER\S-1-5-18\DC10359 Infected: Trojan-Downloader.BAT.Ftp.ab skipped
C:\Program Files\Alwil Software\Avast4\DATA\aswResp.dat Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\Avast4.db Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\integ\avast.int Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\log\AshWebSv.ws Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\log\aswMaiSv.log Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\log\nshield.log Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\report\Resident protection.txt Object is locked skipped
C:\Program Files\MSN Messenger\msimg32.dll Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped
C:\QooBox\Quarantine\C\Program Files\Internet Explorer\msimg32.dll.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\f3PSSavr.scr.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{D3E16888-F6EE-40AB-A584-A03E9974056A}\RP2\A0000005.dll Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped
C:\System Volume Information\_restore{D3E16888-F6EE-40AB-A584-A03E9974056A}\RP2\A0000006.scr Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped
C:\System Volume Information\_restore{D3E16888-F6EE-40AB-A584-A03E9974056A}\RP3\change.log Object is locked skipped
C:\WINDOWS\comsetup.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\FaxSetup.log Object is locked skipped
C:\WINDOWS\iis6.log Object is locked skipped
C:\WINDOWS\ntdtcsetup.log Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\setupact.log Object is locked skipped
C:\WINDOWS\setuperr.log Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{206081F2-8ECC-4EA2-924C-6AE1A437A6A3}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\spupdsvc.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_4e4.dat Object is locked skipped
C:\WINDOWS\Temp\_avast4_\Webshlock.txt Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:00:43 μμ, on 10/1/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\spupdsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spnpinst.exe
C:\WINDOWS\system32\Sysocmgr.exe
C:\Program Files\Crypto SA\AccessRunner ADSL USB\CnxDslTb.exe
C:\PROGRA~2\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\Administrator\Επιφάνεια εργασίας\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Συνδέσεις
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Program Files\Crypto SA\AccessRunner ADSL USB\CnxDslTb.exe" "Crypto SA\AccessRunner ADSL USB"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~2\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: DSLMON.lnk = ?
O8 - Extra context menu item: Ε&ξαγωγή στο Microsoft Excel - res://C:\PROGRA~2\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Έρευνα - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/noc...1.0.0.15-3.cab
O16 - DPF: {1E3F1348-4370-4BBE-A67A-CC7ED824CA85} (Microsoft Genuine Advantage Self Support Tool) - http://go.microsoft.com/fwlink/?LinkId=82580
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

--
End of file - 4714 bytes

01-10-2008, 02:12 PM	#6 (permalink)
pyanna7 Registered User Join Date: Jan 2008 Posts: 7 OS: XP SP2	Re: HijackThis log plus NTRecycler folder too big haha this is getting bigger and bigger! well... here goes! overall perfomance is very good right from the start (before posting here) and remains good. ComboFix 08-01-10.2 - Administrator 2008-01-10 20:42:27.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1253.1.1032.18.294 [GMT 2:00] Running from: C:\Documents and Settings\Administrator\Επιφάνεια εργασίας\ComboFix.exe Command switches used :: C:\Documents and Settings\Administrator\Επιφάνεια εργασίας\CFScript.txt * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Administrator\Application Data\Spyware Terminator C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\BIN_RSDATA.SPT C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\info.htm C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\appguard0.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\appguard1.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\appguard2.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\appguard3.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\appguard4.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\bg01.gif C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\bg02.gif C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\bg07.gif C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\clamguard0.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\clamguard1.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\intguard0.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\intguard1.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\intguard2.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\intguard3.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\intguard4.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\intguard5.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\language.changes.txt C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\language.inf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\language.txt C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\language.txt.changes C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\li.gif C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\li2.gif C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\offlinehelp.html C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\scancustom.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\scanfast.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\scanfull.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\sysguard0.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\sysguard1.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\sysguard2.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\sysguard3.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\top.gif C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\util01.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\util02.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\util03.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\util04.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\Reports\reports.dat C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\Reports\scan_0001.dat C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\Reports\scan_0002.dat C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\scanConfig.xml C:\Documents and Settings\All Users\Application Data\Spyware Terminator C:\Documents and Settings\All Users\Application Data\Spyware Terminator\fileobjinfo.sys C:\Documents and Settings\All Users\Application Data\Spyware Terminator\sp_rsdel.exe C:\Program Files\Spyware Terminator C:\Program Files\Spyware Terminator\BIN_RSCSDA.SPF C:\Program Files\Spyware Terminator\BIN_STDATA.SPT C:\Program Files\Spyware Terminator\BIN_STDATA_DIF.SPT C:\Program Files\Spyware Terminator\BIN_STUIUS.SPT C:\Program Files\Spyware Terminator\history.txt C:\Program Files\Spyware Terminator\languages\brazilians.cab C:\Program Files\Spyware Terminator\languages\brazilians.inf C:\Program Files\Spyware Terminator\languages\czech.cab C:\Program Files\Spyware Terminator\languages\czech.inf C:\Program Files\Spyware Terminator\languages\english.cab C:\Program Files\Spyware Terminator\languages\english.inf C:\Program Files\Spyware Terminator\languages\french.cab C:\Program Files\Spyware Terminator\languages\french.inf C:\Program Files\Spyware Terminator\languages\german.cab C:\Program Files\Spyware Terminator\languages\german.inf C:\Program Files\Spyware Terminator\languages\hungarian.cab C:\Program Files\Spyware Terminator\languages\hungarian.inf C:\Program Files\Spyware Terminator\languages\italiano.cab C:\Program Files\Spyware Terminator\languages\italiano.inf C:\Program Files\Spyware Terminator\languages\korean.cab C:\Program Files\Spyware Terminator\languages\korean.inf C:\Program Files\Spyware Terminator\languages\polish.cab C:\Program Files\Spyware Terminator\languages\polish.inf C:\Program Files\Spyware Terminator\languages\portuguese.cab C:\Program Files\Spyware Terminator\languages\portuguese.inf C:\Program Files\Spyware Terminator\languages\russian.cab C:\Program Files\Spyware Terminator\languages\russian.inf C:\Program Files\Spyware Terminator\languages\serbian.cab C:\Program Files\Spyware Terminator\languages\serbian.inf C:\Program Files\Spyware Terminator\languages\spanish.cab C:\Program Files\Spyware Terminator\languages\spanish.inf C:\Program Files\Spyware Terminator\languages\swedish.cab C:\Program Files\Spyware Terminator\languages\swedish.inf C:\Program Files\Spyware Terminator\languages\turkish.cab C:\Program Files\Spyware Terminator\languages\turkish.inf C:\Program Files\Spyware Terminator\sp_rsser.exe C:\Program Files\Spyware Terminator\sptcontmenu.dll C:\Program Files\Spyware Terminator\SpywareTerminator.exe C:\Program Files\Spyware Terminator\Spywareterminatorshield.Exe C:\Program Files\Spyware Terminator\STServer.Exe C:\Program Files\Spyware Terminator\unins000.dat C:\Program Files\Spyware Terminator\unins000.exe . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\LEGACY_RDRIV ((((((((((((((((((((((((( Files Created from 2007-12-10 to 2008-01-10 ))))))))))))))))))))))))))))))) . 2008-01-10 16:58 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe 2008-01-09 23:51 . 2008-01-09 23:52 <DIR> d-------- C:\WINDOWS\system32\el-gr 2008-01-09 23:43 . 2007-08-13 18:54 33,792 --a--c--- C:\WINDOWS\system32\dllcache\custsat.dll 2008-01-09 23:16 . 2008-01-09 23:16 <DIR> d-------- C:\Program Files\uTorrent 2008-01-09 23:16 . 2008-01-09 23:25 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\uTorrent 2008-01-09 22:44 . 2007-07-09 15:19 582,656 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll 2008-01-09 22:21 . 2008-01-10 00:43 <DIR> d--h----- C:\WINDOWS\$hf_mig$ 2008-01-09 22:06 . 2008-01-09 22:06 <DIR> d-------- C:\Program Files\SAGEM 2008-01-09 19:46 . 2008-01-09 23:51 3,352 --a------ C:\WINDOWS\system32\spupdsvc.inf 2008-01-09 19:44 . 2004-09-04 06:45 221,184 --a------ C:\WINDOWS\system32\wmpns.dll 2008-01-09 19:33 . 2008-01-09 19:33 <DIR> d-------- C:\WINDOWS\provisioning 2008-01-09 19:27 . 2008-01-09 19:27 <DIR> d-------- C:\WINDOWS\ServicePackFiles 2008-01-09 19:18 . 2004-07-17 11:40 19,528 --a------ C:\WINDOWS\002181_.tmp 2008-01-09 19:17 . 2005-06-28 10:21 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe 2008-01-09 19:12 . 2008-01-09 19:34 <DIR> d-------- C:\WINDOWS\EHome 2008-01-08 20:04 . 2008-01-08 20:04 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Grisoft 2008-01-08 19:12 . 2008-01-08 19:12 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2008-01-08 19:12 . 2007-05-30 14:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2008-01-08 17:10 . 2007-12-04 15:04 837,496 --a------ C:\WINDOWS\system32\aswBoot.exe 2008-01-08 17:10 . 2004-01-09 11:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx 2008-01-08 17:10 . 2007-12-04 14:54 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr 2008-01-08 17:10 . 2007-12-04 16:55 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2008-01-08 17:10 . 2007-12-04 16:56 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2008-01-08 17:10 . 2007-12-04 16:51 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2008-01-08 17:10 . 2007-12-04 16:49 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2008-01-08 17:10 . 2007-12-04 16:53 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2008-01-07 22:58 . 1999-11-07 05:34 40,960 --a------ C:\WINDOWS\_detmp.2 2008-01-07 22:58 . 2006-10-06 16:07 6,823 --a------ C:\WINDOWS\_detmp.1 2008-01-07 22:19 . 2008-01-07 22:19 <DIR> d-------- C:\Program Files\ToniArts 2007-12-21 20:17 . 2007-12-21 20:17 <DIR> d-------- C:\WINDOWS\LogFiles . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-01-09 21:03 --------- d-----w C:\Program Files\MSN Messenger 2008-01-09 20:07 31 ----a-w C:\WINDOWS\system32\drivers\adidsl.cfg 2008-01-09 20:07 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-01-08 19:27 --------- d-----w C:\Program Files\mangeta 2008-01-08 19:27 --------- d-----w C:\Program Files\AtomixMP3 2008-01-08 16:53 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Simple Sudoku 2008-01-08 16:53 --------- d-----w C:\Documents and Settings\Administrator\Application Data\LimeWire 2008-01-07 21:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\WildTangent 2008-01-07 21:05 --------- d-----w C:\Program Files\Canon 2008-01-07 20:59 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Lavasoft 2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys . ((((((((((((((((((((((((((((( snapshot@2008-01-10_17.11.51.13 ))))))))))))))))))))))))))))))))))))))))) . - 2008-01-10 14:59:16 237,568 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT + 2008-01-10 18:42:14 237,568 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT - 2008-01-10 14:59:16 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat + 2008-01-10 18:42:14 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat - 2008-01-10 14:59:16 237,568 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\NTUSER.DAT + 2008-01-10 18:42:14 237,568 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\NTUSER.DAT - 2008-01-10 14:59:16 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat + 2008-01-10 18:42:14 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat - 2008-01-10 14:59:16 4,050,944 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\NTUSER.DAT + 2008-01-10 18:42:15 4,050,944 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\NTUSER.DAT - 2008-01-10 14:59:17 12,288 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat + 2008-01-10 18:42:15 12,288 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat + 2008-01-10 18:49:40 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_4e4.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-04 06:45 15360] "msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 11:55 5674352] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATIModeChange"="Ati2mdxx.exe" [2001-09-04 10:24 28672 C:\WINDOWS\system32\Ati2mdxx.exe] "CnxDslTaskBar"="C:\Program Files\Crypto SA\AccessRunner ADSL USB\CnxDslTb.exe" [2004-06-16 07:55 233472] "avast!"="C:\PROGRA~2\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 15:00 79224] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-09-04 06:45 15360] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KAVPersonal50] C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr] --a------ 2007-01-19 11:55 5674352 C:\Program Files\MSN Messenger\MsnMsgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NWEReboot] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2005-04-13 02:48 36975 C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TClock.exe] C:\Program Files\TClock\tclock_install.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WildTangent CDA] C:\Program Files\WildTangent\Apps\CDA\GameDrvr.exe S2 IKANLOADER2;General Purpose USB Driver (e4ldr.sys);C:\WINDOWS\system32\Drivers\e4ldr.sys [2006-03-02 19:25] S3 CnxEtP;Crypto F200 USB ADSL Adapter Filter Driver;C:\WINDOWS\system32\DRIVERS\CnxEtP.sys [2004-06-16 07:51] S3 CnxEtU;Crypto F200 USB ADSL Interface Device Driver;C:\WINDOWS\system32\DRIVERS\CnxEtU.sys [2004-06-16 07:51] S3 CnxTgNW;Crypto F200 USB ADSL WAN PPPoA Adapter Driver;C:\WINDOWS\system32\DRIVERS\CnxTgNW.sys [2004-06-16 07:51] S3 e4usbaw;USB ADSL2 WAN Adapter;C:\WINDOWS\system32\DRIVERS\e4usbaw.sys [2006-05-04 18:50] . Contents of the 'Scheduled Tasks' folder "2006-12-06 14:33:20 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************ catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-01-10 20:50:40 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************ . Completion time: 2008-01-10 20:55:57 - machine was rebooted ComboFix-quarantined-files.txt 2008-01-10 18:55:54 ComboFix2.txt 2008-01-10 15:12:19 . 2008-01-09 22:44:10 --- E O F --- ------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT Thursday, January 10, 2008 10:59:08 PM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 10/01/2008 Kaspersky Anti-Virus database records: 506695 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: false Scan Target - My Computer: C:\ D:\ Scan Statistics: Total number of scanned objects: 95000 Number of viruses found: 4 Number of infected objects: 9 Number of suspicious objects: 0 Duration of the scan process: 01:43:59 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\Administrator\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Administrator\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Administrator\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Administrator\Επιφάνεια εργασίας\keyfinder.exe/data.rar/officekey.exe Infected: not-a-virus:PSWTool.Win32.RAS.a skipped C:\Documents and Settings\Administrator\Επιφάνεια εργασίας\keyfinder.exe/data.rar Infected: not-a-virus:PSWTool.Win32.RAS.a skipped C:\Documents and Settings\Administrator\Επιφάνεια εργασίας\keyfinder.exe RarSFX: infected - 2 skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\NTRECYCLER\S-1-5-18\DC10359 Infected: Trojan-Downloader.BAT.Ftp.ab skipped C:\Program Files\Alwil Software\Avast4\DATA\aswResp.dat Object is locked skipped C:\Program Files\Alwil Software\Avast4\DATA\Avast4.db Object is locked skipped C:\Program Files\Alwil Software\Avast4\DATA\integ\avast.int Object is locked skipped C:\Program Files\Alwil Software\Avast4\DATA\log\AshWebSv.ws Object is locked skipped C:\Program Files\Alwil Software\Avast4\DATA\log\aswMaiSv.log Object is locked skipped C:\Program Files\Alwil Software\Avast4\DATA\log\nshield.log Object is locked skipped C:\Program Files\Alwil Software\Avast4\DATA\report\Resident protection.txt Object is locked skipped C:\Program Files\MSN Messenger\msimg32.dll Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped C:\QooBox\Quarantine\C\Program Files\Internet Explorer\msimg32.dll.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped C:\QooBox\Quarantine\C\WINDOWS\system32\f3PSSavr.scr.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{D3E16888-F6EE-40AB-A584-A03E9974056A}\RP2\A0000005.dll Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped C:\System Volume Information\_restore{D3E16888-F6EE-40AB-A584-A03E9974056A}\RP2\A0000006.scr Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped C:\System Volume Information\_restore{D3E16888-F6EE-40AB-A584-A03E9974056A}\RP3\change.log Object is locked skipped C:\WINDOWS\comsetup.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\FaxSetup.log Object is locked skipped C:\WINDOWS\iis6.log Object is locked skipped C:\WINDOWS\ntdtcsetup.log Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\setupact.log Object is locked skipped C:\WINDOWS\setuperr.log Object is locked skipped C:\WINDOWS\SoftwareDistribution\EventCache\{206081F2-8ECC-4EA2-924C-6AE1A437A6A3}.bin Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\spupdsvc.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\Temp\Perflib_Perfdata_4e4.dat Object is locked skipped C:\WINDOWS\Temp\_avast4_\Webshlock.txt Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:00:43 μμ, on 10/1/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16574) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\Ati2evxx.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\system32\spupdsvc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spnpinst.exe C:\WINDOWS\system32\Sysocmgr.exe C:\Program Files\Crypto SA\AccessRunner ADSL USB\CnxDslTb.exe C:\PROGRA~2\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\Documents and Settings\Administrator\Επιφάνεια εργασίας\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Συνδέσεις O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Program Files\Crypto SA\AccessRunner ADSL USB\CnxDslTb.exe" "Crypto SA\AccessRunner ADSL USB" O4 - HKLM\..\Run: [avast!] C:\PROGRA~2\ALWILS~1\Avast4\ashDisp.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: DSLMON.lnk = ? O8 - Extra context menu item: Ε&ξαγωγή στο Microsoft Excel - res://C:\PROGRA~2\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Έρευνα - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813 O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/noc...1.0.0.15-3.cab O16 - DPF: {1E3F1348-4370-4BBE-A67A-CC7ED824CA85} (Microsoft Genuine Advantage Self Support Tool) - http://go.microsoft.com/fwlink/?LinkId=82580 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe -- End of file - 4714 bytes