Thread: Need help~~~ pc really dying =(
View Single Post
Old 01-19-2008, 10:17 AM   #10 (permalink)
bryanchew
Registered User
 
Join Date: Jan 2008
Posts: 11
OS: window xp home edition


Re: Need help~~~ pc really dying =(
ComboFix 08-01-17.5 - Owner 2008-01-19 19:23:59.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.77 [GMT 8:00]
Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Owner\Desktop\cfscript.txt
* Created a new restore point

FILE
C:\WINDOWS\imGiant.dll
C:\WINDOWS\system32\iifdddd.dll
C:\WINDOWS\system32\iiffcca.dll
C:\WINDOWS\system32\iiffded.dll
C:\WINDOWS\system32\JD363RLT.exe
C:\WINDOWS\system32\khffcyw.dll
C:\WINDOWS\system32\ljjgfgg.dll
C:\WINDOWS\system32\ljjkhfc.dll
C:\WINDOWS\system32\nnnljhh.dll
C:\WINDOWS\system32\pmnonnn.dll
C:\WINDOWS\system32\qommnom.dll
C:\WINDOWS\system32\urqqqqp.dll
C:\WINDOWS\system32\xxyvspp.dll
C:\WINDOWS\system32\yayxuss.dll
C:\WINDOWS\Tasks\AC2996A4918A12AC.job
C:\WINDOWS\Tasks\At1.job
C:\WINDOWS\Tasks\At10.job
C:\WINDOWS\Tasks\At11.job
C:\WINDOWS\Tasks\At12.job
C:\WINDOWS\Tasks\At13.job
C:\WINDOWS\Tasks\At14.job
C:\WINDOWS\Tasks\At15.job
C:\WINDOWS\Tasks\At16.job
C:\WINDOWS\Tasks\At17.job
C:\WINDOWS\Tasks\At18.job
C:\WINDOWS\Tasks\At19.job
C:\WINDOWS\Tasks\At2.job
C:\WINDOWS\Tasks\At20.job
C:\WINDOWS\Tasks\At21.job
C:\WINDOWS\Tasks\At22.job
C:\WINDOWS\Tasks\At24.job
C:\WINDOWS\Tasks\At4.job
C:\WINDOWS\Tasks\At5.job
C:\WINDOWS\Tasks\At6.job
C:\WINDOWS\Tasks\At7.job
C:\WINDOWS\Tasks\At8.job
C:\WINDOWS\Tasks\At9.job
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\owner\applic~1\rdrfun~1
c:\docume~1\owner\applic~1\rdrfun~1\0
C:\Program Files\Power Scan
C:\Program Files\Power Scan\powerscan.ex_
C:\Program Files\Power Scan\powerscan.exe
C:\WINDOWS\imGiant.dll
C:\WINDOWS\system32\iifdddd.dll
C:\WINDOWS\system32\iiffcca.dll
C:\WINDOWS\system32\iiffded.dll
C:\WINDOWS\system32\khffcyw.dll
C:\WINDOWS\system32\ljjgfgg.dll
C:\WINDOWS\system32\ljjkhfc.dll
C:\WINDOWS\system32\nnnljhh.dll
C:\WINDOWS\system32\pmnonnn.dll
C:\WINDOWS\system32\qommnom.dll
C:\WINDOWS\system32\urqqqqp.dll
C:\WINDOWS\system32\xxyvspp.dll
C:\WINDOWS\system32\yayxuss.dll
C:\WINDOWS\Tasks\AC2996A4918A12AC.job
C:\WINDOWS\Tasks\At1.job
C:\WINDOWS\Tasks\At10.job
C:\WINDOWS\Tasks\At11.job
C:\WINDOWS\Tasks\At12.job
C:\WINDOWS\Tasks\At13.job
C:\WINDOWS\Tasks\At14.job
C:\WINDOWS\Tasks\At15.job
C:\WINDOWS\Tasks\At16.job
C:\WINDOWS\Tasks\At17.job
C:\WINDOWS\Tasks\At18.job
C:\WINDOWS\Tasks\At19.job
C:\WINDOWS\Tasks\At2.job
C:\WINDOWS\Tasks\At20.job
C:\WINDOWS\Tasks\At21.job
C:\WINDOWS\Tasks\At22.job
C:\WINDOWS\Tasks\At24.job
C:\WINDOWS\Tasks\At4.job
C:\WINDOWS\Tasks\At5.job
C:\WINDOWS\Tasks\At6.job
C:\WINDOWS\Tasks\At7.job
C:\WINDOWS\Tasks\At8.job
C:\WINDOWS\Tasks\At9.job
D:\Autorun.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_SERVICE_MANAGER
-------\Service Manager


((((((((((((((((((((((((( Files Created from 2007-12-19 to 2008-01-19 )))))))))))))))))))))))))))))))
.

2008-01-19 18:20 . 2008-01-19 18:39 <DIR> d-------- C:\Program Files\StaRO
2008-01-17 17:40 . 2008-01-17 17:40 <DIR> d-------- C:\Program Files\Trend Micro
2008-01-17 16:55 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-12 18:14 . 2008-01-12 18:14 <DIR> d-------- C:\Deckard
2007-12-30 13:55 . 2007-12-30 13:55 268 --ah----- C:\sqmdata19.sqm
2007-12-30 13:55 . 2007-12-30 13:55 244 --ah----- C:\sqmnoopt19.sqm
2007-12-21 23:56 . 2007-12-22 00:19 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\WinZip
2007-12-21 23:48 . 2007-12-22 09:28 <DIR> d-------- C:\Program Files\Google

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-19 10:58 --------- d-----w C:\Program Files\MSN Messenger
2008-01-19 05:19 --------- d-----w C:\Program Files\ZNRO Server
2008-01-19 03:43 --------- d-----w C:\Program Files\Gravity
2008-01-19 03:15 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg7
2008-01-12 16:33 --------- d-----w C:\Documents and Settings\Owner\Application Data\Hamachi
2008-01-03 07:19 --------- d-----w C:\Documents and Settings\Owner\Application Data\AVG7
2007-11-30 19:05 --------- d-----w C:\Program Files\Windows Live Toolbar
2004-07-27 00:17 32 --sha-w C:\WINDOWS\{2A9D1721-1D2A-4DFA-BA52-EDBEDC8EEDBD}.dat
2004-12-03 02:39 32 --sha-w C:\WINDOWS\{8F7469FB-3F8A-4C82-892C-44218CCE49AA}.dat
.

((((((((((((((((((((((((((((( snapshot@2008-01-17_17.33.54.73 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-01-17 08:57:21 237,568 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000001\NTUSER.DAT
+ 2008-01-19 11:23:30 237,568 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000001\NTUSER.DAT
- 2008-01-17 08:57:22 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000002\UsrClass.dat
+ 2008-01-19 11:23:31 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000002\UsrClass.dat
- 2008-01-17 08:57:22 237,568 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000003\NTUSER.DAT
+ 2008-01-19 11:23:31 237,568 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000003\NTUSER.DAT
- 2008-01-17 08:57:23 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000004\UsrClass.dat
+ 2008-01-19 11:23:31 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000004\UsrClass.dat
- 2008-01-17 08:57:24 4,722,688 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000005\ntuser.dat
+ 2008-01-19 11:23:31 4,870,144 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000005\ntuser.dat
- 2008-01-17 08:57:25 331,776 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000006\UsrClass.dat
+ 2008-01-19 11:23:31 331,776 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000006\UsrClass.dat
- 2003-03-19 04:20:00 1,060,864 ----a-w C:\WINDOWS\mfc71.dll
+ 2003-03-18 13:20:00 1,060,864 ----a-w C:\WINDOWS\mfc71.dll
- 2004-01-12 07:00:00 348,160 ----a-w C:\WINDOWS\msvcr71.dll
+ 2004-01-11 16:00:00 348,160 ----a-w C:\WINDOWS\msvcr71.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54 5674352]
"Free Download Manager"="C:\Program Files\Free Download Manager\fdm.exe" [ ]
"Acme.PCHButton"="C:\PROGRA~1\PRESAR~1\Presario\XPHWWRP4\plugin\bin\PCHButton.exe" [2003-10-16 21:49 159744]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15:56 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2007-12-21 23:49 171448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-04 13:31 208952]
"MSPY2002"="C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe" [2003-08-17 00:24 59392]
"PHIME2002ASync"="C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.exe" [2003-08-17 00:25 455168]
"PHIME2002A"="C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.exe" [2003-08-17 00:25 455168]
"HPHUPD05"="c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" [ ]
"AlcxMonitor"="ALCXMNTR.EXE" [2004-09-07 13:47 57344 C:\WINDOWS\ALCXMNTR.EXE]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-12-21 03:10 579072]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-10-23 03:10 219136]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:54 5674352]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Compaq Connections.lnk - C:\Program Files\Compaq Connections\1940576\Program\BackWeb-1940576.exe~ [2003-10-16 21:46:08]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2003-07-07 15:20:40]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-18 04:05:56]

S3 AmeAtmPc;AmeAtmPc;C:\WINDOWS\system32\DRIVERS\AmeAtmPc.sys []
S3 AtmElan;ATM Emulated LAN;C:\WINDOWS\system32\DRIVERS\atmlane.sys [2004-08-04 13:58]
S3 AtmLane;ATM LAN Emulation;C:\WINDOWS\system32\DRIVERS\atmlane.sys [2004-08-04 13:58]
S3 Dua1;Dua1;C:\Documents and Settings\Owner\Desktop\DualEngine2\DualEngi.sys []

.
Contents of the 'Scheduled Tasks' folder
"2007-12-31 14:00:00 C:\WINDOWS\Tasks\At23.job"
- C:\WINDOWS\system32\JD363RLT.exe
"2008-01-12 18:00:05 C:\WINDOWS\Tasks\At3.job"
- C:\WINDOWS\system32\JD363RLT.exe
"2008-01-19 11:24:08 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
"2008-01-19 09:29:16 C:\WINDOWS\Tasks\Symantec NetDetect.job"
- C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-19 19:35:02
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-19 19:44:46 - machine was rebooted [Owner]
ComboFix-quarantined-files.txt 2008-01-19 11:44:42
ComboFix2.txt 2008-01-17 09:34:41
.
2008-01-12 09:22:57 --- E O F ---
bryanchew is offline