Tech Support Forum - View Single Post - Need help with my HJT Log (Hit a dead end)

buddha · 05-02-2007, 10:32 AM

Your instructions were very easy to follow and very appreciated. Here are the logs.

[05/02/2007, 12:05:53] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\nic\Desktop\VirtumundoBeGone.exe" )
[05/02/2007, 12

02] - Detected System Information:
[05/02/2007, 12

02] - Windows Version: 5.1.2600, Service Pack 2
[05/02/2007, 12

02] - Current Username: nic (Admin)
[05/02/2007, 12

02] - Windows is in NORMAL mode.
[05/02/2007, 12

02] - Searching for Browser Helper Objects:
[05/02/2007, 12

02] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
[05/02/2007, 12

02] - BHO 2: {1557B435-8242-4686-9AA3-9265BF7525A4} ()
[05/02/2007, 12

02] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/02/2007, 12

02] - Checking for HKLM\...\Winlogon\Notify\qohvxdvv
[05/02/2007, 12

02] - Key not found: HKLM\...\Winlogon\Notify\qohvxdvv, continuing.
[05/02/2007, 12

02] - BHO 3: {53707962-6F74-2D53-2644-206D7942484F} ()
[05/02/2007, 12

02] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/02/2007, 12

02] - Checking for HKLM\...\Winlogon\Notify\SDHelper
[05/02/2007, 12

02] - Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
[05/02/2007, 12

02] - BHO 4: {5CA3D70E-1895-11CF-8E15-001234567890} (DriveLetterAccess)
[05/02/2007, 12

02] - BHO 5: {93FF1CC5-3BEE-444C-AF93-AD8E1EE28585} ()
[05/02/2007, 12

02] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/02/2007, 12

02] - Checking for HKLM\...\Winlogon\Notify\awtss
[05/02/2007, 12

02] - Key not found: HKLM\...\Winlogon\Notify\awtss, continuing.
[05/02/2007, 12

02] - Finished Searching Browser Helper Objects
[05/02/2007, 12

02] - Finishing up...
[05/02/2007, 12

02] - Nothing found! Exiting...

DllUnregisterServer procedure not found in C:\WINDOWS\system32\uhcmojut.dll
C:\WINDOWS\system32\uhcmojut.dll NOT unregistered.
C:\WINDOWS\system32\uhcmojut.dll moved successfully.
File/Folder C:\WINDOWS\system32\uhcmojut.dll not found.
C:\WINDOWS\b122.exe moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\awvvv.dll
C:\WINDOWS\system32\awvvv.dll NOT unregistered.
C:\WINDOWS\system32\awvvv.dll moved successfully.
C:\Program Files\InetGet2 moved successfully.

Created on 05/02/2007 12:18:28

"nic" - 07-05-02 12:21:42 Service Pack 2
ComboFix 07-04-25.4V - Running from: "C:\Documents and Settings\nic\Desktop\"

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\Program Files\Common Files\Yazzle1281OinUninstaller.exe
C:\Program Files\ipwindows\ipwins.dll
C:\Program Files\ipwindows\UnInstall.exe
C:\WINDOWS\system32\drivers\fad.sys
C:\Program Files\ipwindows

((((((((((((((((((((((((((((((( Files Created from 2007-04-02 to 2007-05-02 ))))))))))))))))))))))))))))))))))

2007-05-01 13:01 <DIR> d-------- C:\Deckard
2007-05-01 12:54 <DIR> d-------- C:\Program Files\SpywareBlaster
2007-05-01 12:50 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2007-04-30 13:19 <DIR> d-------- C:\Program Files\Windows Installer Clean Up
2007-04-30 13:18 <DIR> d-------- C:\Program Files\MSECACHE
2007-04-30 10:53 <DIR> d-------- C:\Program Files\Lavasoft
2007-04-30 10:50 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-04-28 08:50 <DIR> d-------- C:\WINDOWS\LastGood
2007-04-26 12:14 <DIR> d-------- C:\VundoFix Backups
2007-04-24 18:51 <DIR> d-------- C:\Program Files\Windows Defender
2007-04-23 11:22 <DIR> d-------- C:\Program Files\QuickTime
2007-04-10 11:12 <DIR> d-------- C:\WINDOWS\.jagex_cache_32

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-05-02 01:39 152833 --a------ C:\WINDOWS\system32\drivers\dump_wmimmc.sys
2007-05-01 12:42 -------- d-------- C:\Program Files\mozilla thunderbird
2007-05-01 12:10 -------- d-------- C:\Program Files\trillian
2007-04-23 12:01 -------- d-------- C:\Program Files\mirc
2007-04-18 12:16 733824 --a------ C:\WINDOWS\system32\aswboot.exe
2007-04-18 12:12 94552 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2007-04-18 12:12 85952 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2007-04-18 12:10 23416 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2007-04-18 12:09 43176 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2007-04-18 12:07 26888 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2007-04-18 12:06 90112 --a------ C:\WINDOWS\system32\avastss.scr
2007-03-27 23:54 -------- d-------- C:\Program Files\logitech
2007-03-17 09:43 292864 --a------ C:\WINDOWS\system32\winsrv.dll
2007-03-08 11:36 577536 --a------ C:\WINDOWS\system32\user32.dll
2007-03-08 11:36 40960 --a------ C:\WINDOWS\system32\mf3216.dll
2007-03-08 11:36 281600 --a------ C:\WINDOWS\system32\gdi32.dll
2007-03-08 09:47 1843584 --a------ C:\WINDOWS\system32\win32k.sys
2007-02-05 16:17 185344 --a------ C:\WINDOWS\system32\upnphost.dll

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
{53707962-6F74-2D53-2644-206D7942484F} C:\PROGRA~1\SPYBOT~1\SDHelper.dll
{5CA3D70E-1895-11CF-8E15-001234567890} C:\WINDOWS\system32\dla\tfswshx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"SoundMAXPnP"="C:\\Program Files\\Analog Devices\\Core\\smax4pnp.exe"
"IgfxTray"="C:\\WINDOWS\\system32\\igfxtray.exe"
"HotKeysCmds"="C:\\WINDOWS\\system32\\hkcmd.exe"
"SunJavaUpdateSched"="C:\\Program Files\\Java\\j2re1.4.2_03\\bin\\jusched.exe"
"dla"="C:\\WINDOWS\\system32\\dla\\tfswctrl.exe"
"ISUSPM Startup"="C:\\PROGRA~1\\COMMON~1\\INSTAL~1\\UPDATE~1\\ISUSPM.exe -startup"
"ISUSScheduler"="\"C:\\Program Files\\Common Files\\InstallShield\\UpdateService\\issch.exe\" -start"
"DMXLauncher"="C:\\Program Files\\Dell\\Media Experience\\DMXLauncher.exe"
"VirtualCloneDrive"="\"C:\\Program Files\\Elaborate Bytes\\VirtualCloneDrive\\VCDDaemon.exe\" /s"
"avast!"="C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe"
@=""
"Launch LGDCore"="\"C:\\Program Files\\Logitech\\G-series Software\\LGDCore.exe\" /SHOWHIDE"
"Launch LCDMon"="\"C:\\Program Files\\Logitech\\G-series Software\\LCDMon.exe\""
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"Windows Defender"="\"C:\\Program Files\\Windows Defender\\MSASCui.exe\" -hide"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"Startup Manager"="C:\\Documents and Settings\\nic\\Application Data\\Systweak\\ASO 2\\smstartUp manager.exe"
"Gadwin PrintScreen 3.5"="C:\\Program Files\\Gadwin Systems\\PrintScreen\\PrintScreen.exe /nosplash"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"UPnPMonitor"="{e57ce738-33e8-4c51-8354-bb4de9d215d1}"

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
Authentication Packages REG_MULTI_SZ msv1_0\0\0
Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0
Notification Packages REG_MULTI_SZ scecli\0\0

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AutoUpdate]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="s3k_autoupdate"
"hkey"="HKCU"
"command"="C:\\Program Files\\Serials3k\\s3k_autoupdate.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelMeM]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="IntelMEM"
"hkey"="HKLM"
"command"="C:\\Program Files\\Intel\\Modem Event Monitor\\IntelMEM.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="iTunesHelper"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="msmsgs"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="qttask"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dff9d237-d3e9-11db-925b-00123fd55adb}]
Shell\AutoRun\command F:\CA_Install.exe

Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\MP Scheduled Scan.job

********************************************************************

catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-05-02 12:27:13
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

********************************************************************

Completion time: 07-05-02 12:27:38
C:\ComboFix-quarantined-files.txt ... 07-05-02 12:27

05-02-2007, 10:32 AM	#5 (permalink)
buddha Registered User Join Date: Mar 2002 Location: Clearwater, Florida Posts: 16 OS: Win2K/XP/Linux	Re: Need help with my HJT Log (Hit a dead end) Your instructions were very easy to follow and very appreciated. Here are the logs. [05/02/2007, 12:05:53] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\nic\Desktop\VirtumundoBeGone.exe" ) [05/02/2007, 1202] - Detected System Information: [05/02/2007, 1202] - Windows Version: 5.1.2600, Service Pack 2 [05/02/2007, 1202] - Current Username: nic (Admin) [05/02/2007, 1202] - Windows is in NORMAL mode. [05/02/2007, 1202] - Searching for Browser Helper Objects: [05/02/2007, 1202] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class) [05/02/2007, 1202] - BHO 2: {1557B435-8242-4686-9AA3-9265BF7525A4} () [05/02/2007, 1202] - WARNING: BHO has no default name. Checking for Winlogon reference. [05/02/2007, 1202] - Checking for HKLM\...\Winlogon\Notify\qohvxdvv [05/02/2007, 1202] - Key not found: HKLM\...\Winlogon\Notify\qohvxdvv, continuing. [05/02/2007, 1202] - BHO 3: {53707962-6F74-2D53-2644-206D7942484F} () [05/02/2007, 1202] - WARNING: BHO has no default name. Checking for Winlogon reference. [05/02/2007, 1202] - Checking for HKLM\...\Winlogon\Notify\SDHelper [05/02/2007, 1202] - Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing. [05/02/2007, 1202] - BHO 4: {5CA3D70E-1895-11CF-8E15-001234567890} (DriveLetterAccess) [05/02/2007, 1202] - BHO 5: {93FF1CC5-3BEE-444C-AF93-AD8E1EE28585} () [05/02/2007, 1202] - WARNING: BHO has no default name. Checking for Winlogon reference. [05/02/2007, 1202] - Checking for HKLM\...\Winlogon\Notify\awtss [05/02/2007, 1202] - Key not found: HKLM\...\Winlogon\Notify\awtss, continuing. [05/02/2007, 1202] - Finished Searching Browser Helper Objects [05/02/2007, 1202] - Finishing up... [05/02/2007, 1202] - Nothing found! Exiting... DllUnregisterServer procedure not found in C:\WINDOWS\system32\uhcmojut.dll C:\WINDOWS\system32\uhcmojut.dll NOT unregistered. C:\WINDOWS\system32\uhcmojut.dll moved successfully. File/Folder C:\WINDOWS\system32\uhcmojut.dll not found. C:\WINDOWS\b122.exe moved successfully. DllUnregisterServer procedure not found in C:\WINDOWS\system32\awvvv.dll C:\WINDOWS\system32\awvvv.dll NOT unregistered. C:\WINDOWS\system32\awvvv.dll moved successfully. C:\Program Files\InetGet2 moved successfully. Created on 05/02/2007 12:18:28 "nic" - 07-05-02 12:21:42 Service Pack 2 ComboFix 07-04-25.4V - Running from: "C:\Documents and Settings\nic\Desktop\" (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\Program Files\Common Files\Yazzle1281OinUninstaller.exe C:\Program Files\ipwindows\ipwins.dll C:\Program Files\ipwindows\UnInstall.exe C:\WINDOWS\system32\drivers\fad.sys C:\Program Files\ipwindows ((((((((((((((((((((((((((((((( Files Created from 2007-04-02 to 2007-05-02 )))))))))))))))))))))))))))))))))) 2007-05-01 13:01 <DIR> d-------- C:\Deckard 2007-05-01 12:54 <DIR> d-------- C:\Program Files\SpywareBlaster 2007-05-01 12:50 <DIR> d-------- C:\WINDOWS\system32\ActiveScan 2007-04-30 13:19 <DIR> d-------- C:\Program Files\Windows Installer Clean Up 2007-04-30 13:18 <DIR> d-------- C:\Program Files\MSECACHE 2007-04-30 10:53 <DIR> d-------- C:\Program Files\Lavasoft 2007-04-30 10:50 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2007-04-28 08:50 <DIR> d-------- C:\WINDOWS\LastGood 2007-04-26 12:14 <DIR> d-------- C:\VundoFix Backups 2007-04-24 18:51 <DIR> d-------- C:\Program Files\Windows Defender 2007-04-23 11:22 <DIR> d-------- C:\Program Files\QuickTime 2007-04-10 11:12 <DIR> d-------- C:\WINDOWS\.jagex_cache_32 (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-05-02 01:39 152833 --a------ C:\WINDOWS\system32\drivers\dump_wmimmc.sys 2007-05-01 12:42 -------- d-------- C:\Program Files\mozilla thunderbird 2007-05-01 12:10 -------- d-------- C:\Program Files\trillian 2007-04-23 12:01 -------- d-------- C:\Program Files\mirc 2007-04-18 12:16 733824 --a------ C:\WINDOWS\system32\aswboot.exe 2007-04-18 12:12 94552 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2007-04-18 12:12 85952 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2007-04-18 12:10 23416 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-04-18 12:09 43176 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2007-04-18 12:07 26888 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-04-18 12:06 90112 --a------ C:\WINDOWS\system32\avastss.scr 2007-03-27 23:54 -------- d-------- C:\Program Files\logitech 2007-03-17 09:43 292864 --a------ C:\WINDOWS\system32\winsrv.dll 2007-03-08 11:36 577536 --a------ C:\WINDOWS\system32\user32.dll 2007-03-08 11:36 40960 --a------ C:\WINDOWS\system32\mf3216.dll 2007-03-08 11:36 281600 --a------ C:\WINDOWS\system32\gdi32.dll 2007-03-08 09:47 1843584 --a------ C:\WINDOWS\system32\win32k.sys 2007-02-05 16:17 185344 --a------ C:\WINDOWS\system32\upnphost.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) Note empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll {53707962-6F74-2D53-2644-206D7942484F} C:\PROGRA~1\SPYBOT~1\SDHelper.dll {5CA3D70E-1895-11CF-8E15-001234567890} C:\WINDOWS\system32\dla\tfswshx.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "SoundMAXPnP"="C:\\Program Files\\Analog Devices\\Core\\smax4pnp.exe" "IgfxTray"="C:\\WINDOWS\\system32\\igfxtray.exe" "HotKeysCmds"="C:\\WINDOWS\\system32\\hkcmd.exe" "SunJavaUpdateSched"="C:\\Program Files\\Java\\j2re1.4.2_03\\bin\\jusched.exe" "dla"="C:\\WINDOWS\\system32\\dla\\tfswctrl.exe" "ISUSPM Startup"="C:\\PROGRA~1\\COMMON~1\\INSTAL~1\\UPDATE~1\\ISUSPM.exe -startup" "ISUSScheduler"="\"C:\\Program Files\\Common Files\\InstallShield\\UpdateService\\issch.exe\" -start" "DMXLauncher"="C:\\Program Files\\Dell\\Media Experience\\DMXLauncher.exe" "VirtualCloneDrive"="\"C:\\Program Files\\Elaborate Bytes\\VirtualCloneDrive\\VCDDaemon.exe\" /s" "avast!"="C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe" @="" "Launch LGDCore"="\"C:\\Program Files\\Logitech\\G-series Software\\LGDCore.exe\" /SHOWHIDE" "Launch LCDMon"="\"C:\\Program Files\\Logitech\\G-series Software\\LCDMon.exe\"" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "Windows Defender"="\"C:\\Program Files\\Windows Defender\\MSASCui.exe\" -hide" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "Startup Manager"="C:\\Documents and Settings\\nic\\Application Data\\Systweak\\ASO 2\\smstartUp manager.exe" "Gadwin PrintScreen 3.5"="C:\\Program Files\\Gadwin Systems\\PrintScreen\\PrintScreen.exe /nosplash" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] "UPnPMonitor"="{e57ce738-33e8-4c51-8354-bb4de9d215d1}" HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages REG_MULTI_SZ msv1_0\0\0 Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages REG_MULTI_SZ scecli\0\0 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AutoUpdate] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="s3k_autoupdate" "hkey"="HKCU" "command"="C:\\Program Files\\Serials3k\\s3k_autoupdate.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelMeM] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="IntelMEM" "hkey"="HKLM" "command"="C:\\Program Files\\Intel\\Modem Event Monitor\\IntelMEM.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="iTunesHelper" "hkey"="HKLM" "command"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="msmsgs" "hkey"="HKCU" "command"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="qttask" "hkey"="HKLM" "command"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0 [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dff9d237-d3e9-11db-925b-00123fd55adb}] Shell\AutoRun\command F:\CA_Install.exe Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\AppleSoftwareUpdate.job C:\WINDOWS\tasks\MP Scheduled Scan.job ****************************************************************** catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-05-02 12:27:13 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden services ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 ****************************************************************** Completion time: 07-05-02 12:27:38 C:\ComboFix-quarantined-files.txt ... 07-05-02 12:27 __________________ "Technology is dominated by two types of people. Those who manage what they do not understand and those who understand what they do not manage."