vundo infection and various others

nessa333 · 07-03-2007, 02:42 AM

Hi
Could you please help me. When using Explorer i am get constant pop ups. I have tried various virus scans which pick up vundo and addcookies. The virus scans say they remove them but when i log on again, everything is the same.
As advised, i have posted logs below. Any help would be fantastic

Deckard's System Scanner v20070611.50
Run by Ness on 2007-07-03 at 18:24:37
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

System Restore is disabled; attempting to re-enable...success.

-- Last 1 Restore Point(s) --
1: 2007-07-03 08:24:44 UTC - RP1 - System Checkpoint

Backed up registry hives.

Performed disk cleanup.

-- HijackThis (run as Ness.exe) ------------------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 6:27:50 PM, on 3/07/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\SiteAdvisor\6066\SAService.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Mouse Driver\MouseDrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\Logitech\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam10\QuickCam10.exe
C:\Program Files\Common Files\Logitech\LComMgr\LVComSX.exe
C:\Program Files\SiteAdvisor\6066\SiteAdv.exe
C:\Program Files\OptusNet DSL Internet\DSC.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Dell\QuickSet\Quickset.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Apoint\Apntex.exe
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Documents and Settings\Ness\Application Data\tmp23.tmp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Ness\Application Data\tmpB1.tmp.exe
C:\Documents and Settings\Ness\Desktop\dss.exe
C:\PROGRA~1\HIJACK~1\Ness.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com/ap/ap/en/gen/default.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell.com/ap/ap/en/gen/default.htm
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
O2 - BHO: (no name) - {1F6581D5-AA53-4b73-A6F9-41420C6B61F1} - C:\WINDOWS\system32\tmp68.tmp.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7942d531-d61f-4108-9d3b-abc8f7e8312e} - C:\WINDOWS\system32\jgawdes.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\program files\mcafee\virusscan\scriptcl.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [CreativeMouse ] C:\Program Files\Mouse Driver\MouseDrv.exe
O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [Z0R6Ephi] C:\WINDOWS\osekari.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\Logitech\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
O4 - HKLM\..\Run: [LVCOMSX] "C:\Program Files\Common Files\Logitech\LComMgr\LVComSX.exe"
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6066\SiteAdv.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Desktop Service Centre] C:\Program Files\OptusNet DSL Internet\DSC.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\Quickset.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/sh...6/mcinsctl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/sh...26/mcgdmgr.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
O20 - AppInit_DLLs: c:\windows\system32\vtutrpo.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: amcESP - amcESP.dll (file missing)
O20 - Winlogon Notify: cmprad - cmprad.dll (file missing)
O20 - Winlogon Notify: Dao2eml - Dao2eml.dll (file missing)
O20 - Winlogon Notify: dpvagn - dpvagn.dll (file missing)
O20 - Winlogon Notify: eudipt - eudipt.dll (file missing)
O20 - Winlogon Notify: glm737 - glm737.dll (file missing)
O20 - Winlogon Notify: IntelWireless - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll
O20 - Winlogon Notify: ipvtup - ipvtup.dll (file missing)
O20 - Winlogon Notify: jgawdes - C:\WINDOWS\SYSTEM32\jgawdes.dll
O20 - Winlogon Notify: mmsapi - mmsapi.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: DomainService - Unknown owner - C:\Documents and Settings\Ness\Application Data\tmp35.tmp.exe (file missing)
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\Logitech\SrvLnch\SrvLnch.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: SiteAdvisor Service - McAfee, Inc. - C:\Program Files\SiteAdvisor\6066\SAService.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

-- File Associations -----------------------------------------------------------

All associations okay.

-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R1 APPDRV - c:\windows\system32\drivers\appdrv.sys <Not Verified; Dell Inc; Application Driver>
R1 omci (OMCI WDM Device Driver) - c:\windows\system32\drivers\omci.sys <Not Verified; Dell Inc; OMCI Driver>
R1 SASDIFSV - c:\program files\superantispyware\sasdifsv.sys
R1 SASKUTIL - c:\program files\superantispyware\saskutil.sys
R2 AegisP (AEGIS Protocol (IEEE 802.1x) v3.1.0.1) - c:\windows\system32\drivers\aegisp.sys <Not Verified; Meetinghouse Data Communications; AEGIS Client 3.1.0.1>
R2 s24trans (WLAN Transport) - c:\windows\system32\drivers\s24trans.sys <Not Verified; Intel Corporation; Intel Wireless LAN Packet Driver>
R3 SASENUM - c:\program files\superantispyware\sasenum.sys <Not Verified; SuperAdBlocker, Inc.; SuperAntiSpyware>

S3 ENETHUSB (Speedstream Ethernet USB Adapter) - c:\windows\system32\drivers\enethusb.sys <Not Verified; Siemens Subscriber Networks, Inc.; Speedstream Ethernet USB Adapter>
S3 iBurstu (iBurst Terminal) - c:\windows\system32\drivers\iburstu.sys (file missing)
S3 wanatw (WAN Miniport (ATW)) - c:\windows\system32\drivers\wanatw4.sys (file missing)

-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 NICCONFIGSVC - c:\program files\dell\nicconfigsvc\nicconfigsvc.exe <Not Verified; Dell Inc.; NicConfigSvc>
R2 RegSrvc - c:\program files\intel\wireless\bin\regsrvc.exe <Not Verified; Intel Corporation; RegSrvc Module>
R2 WLANKEEPER - c:\program files\intel\wireless\bin\wlkeeper.exe <Not Verified; Intel® Corporation; SSOFSet Service>
R3 ServiceLayer - "c:\program files\common files\pcsuite\services\servicelayer.exe" <Not Verified; Nokia.; PC Connectivity Solution>

S2 DomainService - c:\documents and settings\ness\application data\tmp35.tmp.exe /service (file missing)

-- Scheduled Tasks -------------------------------------------------------------

2007-06-13 09:29:05 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
2007-04-01 01:00:20 350 --a------ C:\WINDOWS\Tasks\McQcTask.job
2007-03-01 05:55:41 348 --a------ C:\WINDOWS\Tasks\McDefragTask.job

-- Files created between 2007-06-03 and 2007-07-03 -----------------------------

2007-07-03 18:18:36 0 d-------- C:\WINDOWS\LastGood
2007-07-03 18:17:09 134914 --a------ C:\WINDOWS\geefdb.dll
2007-07-02 22:29:18 0 d-------- C:\Program Files\SpywareBlaster
2007-07-02 22:21:09 21312 --a------ C:\WINDOWS\choice.exe
2007-07-02 22:20:29 0 d-------- C:\ie-spyad
2007-07-02 21:33:14 134972 --a------ C:\WINDOWS\awussr.dll
2007-07-02 20:47:23 0 d-------- C:\WINDOWS\system32\ActiveScan
2007-07-02 20:13:55 38232 --a------ C:\WINDOWS\system32\jgawdes.dll
2007-07-02 20:13:43 49252 --a------ C:\WINDOWS\system32\awtsp.exe
2007-06-27 21:53:53 49252 --a------ C:\WINDOWS\system32\gebcc.exe
2007-06-27 21:48:51 0 --a------ C:\WINDOWS\system32\awtsq.exe
2007-06-27 21:38:39 0 d-------- C:\VundoFix Backups
2007-06-26 18:46:34 49252 --a------ C:\WINDOWS\system32\mljjh.exe
2007-06-25 21:36:17 49252 --a------ C:\WINDOWS\system32\mllml.exe
2007-06-25 20:54:22 0 d-------- C:\Documents and Settings\Administrator\Application Data\SUPERAntiSpyware.com
2007-06-25 20:52:50 0 d--h----- C:\Documents and Settings\Administrator\Templates
2007-06-25 20:52:50 0 dr------- C:\Documents and Settings\Administrator\Start Menu
2007-06-25 20:52:50 0 dr-h----- C:\Documents and Settings\Administrator\SendTo
2007-06-25 20:52:50 0 dr-h----- C:\Documents and Settings\Administrator\Recent
2007-06-25 20:52:50 0 d--h----- C:\Documents and Settings\Administrator\PrintHood
2007-06-25 20:52:50 0 d--h----- C:\Documents and Settings\Administrator\NetHood
2007-06-25 20:52:50 0 dr------- C:\Documents and Settings\Administrator\My Documents
2007-06-25 20:52:50 0 d--h----- C:\Documents and Settings\Administrator\Local Settings
2007-06-25 20:52:50 0 dr------- C:\Documents and Settings\Administrator\Favorites
2007-06-25 20:52:50 0 d-------- C:\Documents and Settings\Administrator\Desktop
2007-06-25 20:52:50 0 d--hs---- C:\Documents and Settings\Administrator\Cookies
2007-06-25 20:52:50 0 dr-h----- C:\Documents and Settings\Administrator\Application Data
2007-06-25 20:52:50 0 d-------- C:\Documents and Settings\Administrator\Application Data\Sun
2007-06-25 20:52:50 0 d---s---- C:\Documents and Settings\Administrator\Application Data\Microsoft
2007-06-25 20:52:50 0 d-------- C:\Documents and Settings\Administrator\Application Data\Intel
2007-06-25 20:52:50 0 d-------- C:\Documents and Settings\Administrator\Application Data\Identities
2007-06-25 20:52:49 786432 --ah----- C:\Documents and Settings\Administrator\NTUSER.DAT
2007-06-25 18:28:14 49252 --a------ C:\WINDOWS\system32\pmnlm.exe
2007-06-24 10:43:39 49252 --a------ C:\WINDOWS\system32\pmkjk.exe
2007-06-24 00:53:55 49252 --a------ C:\WINDOWS\system32\vtutu.exe
2007-06-24 00:37:46 49252 --a------ C:\WINDOWS\system32\awtqr.exe
2007-06-24 00:26:15 0 d-------- C:\Documents and Settings\All Users\Application Data\Trymedia
2007-06-23 23:46:56 0 d-------- C:\Program Files\Monopoly 3
2007-06-23 23:37:20 0 d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2007-06-23 23:36:29 0 d-------- C:\Program Files\SUPERAntiSpyware
2007-06-23 23:36:29 0 d-------- C:\Documents and Settings\Ness\Application Data\SUPERAntiSpyware.com
2007-06-23 23:34:56 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-06-23 22:35:53 0 d-------- C:\Documents and Settings\Ness\Application Data\GetRightToGo
2007-06-22 23:11:56 0 d-------- C:\Incomplete
2007-06-22 22:40:43 49252 --a------ C:\WINDOWS\system32\ddccc.exe
2007-06-21 22:52:16 47899 --a------ C:\WINDOWS\system32\vturp.exe
2007-06-21 07:24:28 47899 --a------ C:\WINDOWS\system32\vtstu.exe
2007-06-20 18:10:42 47899 --a------ C:\WINDOWS\system32\jkhhe.exe
2007-06-20 07:26:09 47899 --a------ C:\WINDOWS\system32\vturo.exe
2007-06-19 00:19:57 0 d-------- C:\Program Files\AVG Anti-Spyware 7.5
2007-06-19 00:19:07 47899 --a------ C:\WINDOWS\system32\ssqrs.exe
2007-06-18 23:55:45 47899 --a------ C:\WINDOWS\system32\jkhff.exe
2007-06-18 23:50:38 47899 --a------ C:\WINDOWS\system32\pmnll.exe
2007-06-18 23:45:36 10240 --a------ C:\WINDOWS\system32\gebya.exe
2007-06-15 22:21:21 47899 --a------ C:\WINDOWS\system32\awtqq.exe
2007-06-04 17:57:40 0 d-------- C:\Program Files\iPod

-- Find3M Report ---------------------------------------------------------------

2007-07-03 18:23:36 4608 --a------ C:\Documents and Settings\Ness\Application Data\tmpB1.tmp.exe
2007-07-03 18:17:18 73971 --a------ C:\Documents and Settings\Ness\Application Data\tmp68.tmp.exe
2007-07-03 18:17:06 128231 --a------ C:\Documents and Settings\Ness\Application Data\tmp67.tmp.exe
2007-07-03 18:10:29 4608 --a------ C:\Documents and Settings\Ness\Application Data\tmp23.tmp.exe
2007-07-02 22:10:05 73991 --a------ C:\Documents and Settings\Ness\Application Data\tmp581.tmp.exe
2007-07-02 21:56:03 0 d-------- C:\Program Files\OptusNet DSL Internet
2007-07-02 21:55:51 0 d-------- C:\Program Files\MSN Messenger
2007-07-02 21:55:43 0 d-------- C:\Program Files\Mouse Driver
2007-07-02 21:51:54 0 d-------- C:\Program Files\iTunes
2007-07-02 21:51:17 0 d-------- C:\Program Files\Digital Line Detect
2007-07-02 21:49:12 0 d-------- C:\Program Files\Apoint
2007-07-02 21:33:10 128222 --a------ C:\Documents and Settings\Ness\Application Data\tmp3B9.tmp.exe
2007-07-02 20:32:09 73991 --a------ C:\Documents and Settings\Ness\Application Data\tmpBB.tmp.exe
2007-07-02 20:30:30 128222 --a------ C:\Documents and Settings\Ness\Application Data\tmpB3.tmp.exe
2007-07-02 20:13:36 0 d-------- C:\Documents and Settings\Ness\Application Data\SiteAdvisor
2007-06-27 21:37:45 128153 --a------ C:\Documents and Settings\Ness\Application Data\tmp22.tmp.exe
2007-06-26 18:48:33 73931 --a------ C:\Documents and Settings\Ness\Application Data\tmp16.tmp.exe
2007-06-24 23:08:56 73929 --a------ C:\Documents and Settings\Ness\Application Data\tmpB0.tmp.exe
2007-06-23 22:30:31 0 d-------- C:\Documents and Settings\Ness\Application Data\LimeWire
2007-06-22 22:50:43 0 d-------- C:\Program Files\McAfee
2007-06-21 23:45:20 128176 --a------ C:\Documents and Settings\Ness\Application Data\tmp84.tmp.exe
2007-06-20 20:12:38 240546 --a------ C:\Documents and Settings\Ness\Application Data\tmp89.tmp.exe
2007-06-19 00:01:59 0 d-------- C:\Program Files\Java
2007-06-18 23:40:59 147456 --a------ C:\Documents and Settings\Ness\Application Data\tmp83.tmp.exe
2007-06-18 23:38:16 147456 --a------ C:\Documents and Settings\Ness\Application Data\tmp7B.tmp.exe
2007-06-18 23:35:58 147456 --a------ C:\Documents and Settings\Ness\Application Data\tmp61.tmp.exe
2007-06-18 20:51:07 0 d-------- C:\Documents and Settings\Ness\Application Data\Sun
2007-06-15 23:30:22 0 d-------- C:\Documents and Settings\Ness\Application Data\Adobe
2007-06-12 19:46:28 0 d-------- C:\Program Files\Common Files\Adobe
2007-06-04 18:30:27 0 d-------- C:\Program Files\mIRC
2007-06-04 17:45:17 0 d-------- C:\Program Files\Apple Software Update
2007-05-22 22:40:22 0 d-------- C:\Program Files\LimeWire
2007-05-08 20:33:16 0 d-------- C:\Program Files\SiteAdvisor
2007-05-05 12:00:10 0 d-------- C:\Program Files\Siemens Subscriber Networks
2007-05-04 21:22:55 0 d--h----- C:\Program Files\InstallShield Installation Information
2007-05-04 21:16:58 0 d-------- C:\Program Files\QuickTime

-- Registry Dump ---------------------------------------------------------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{089FD14D-132B-48FC-8861-0048AE113215} C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
{1F6581D5-AA53-4b73-A6F9-41420C6B61F1} C:\WINDOWS\system32\tmp68.tmp.dll
{5CA3D70E-1895-11CF-8E15-001234567890} C:\WINDOWS\system32\dla\tfswshx.dll
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
{7942d531-d61f-4108-9d3b-abc8f7e8312e} C:\WINDOWS\system32\jgawdes.dll
{7DB2D5A0-7241-4E79-B68D-6309F01C5231} c:\program files\mcafee\virusscan\scriptcl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"Apoint"="C:\\Program Files\\Apoint\\Apoint.exe"
@=""
"IntelWireless"="C:\\Program Files\\Intel\\Wireless\\Bin\\ifrmewrk.exe /tf Intel PROSet/Wireless"
"ATIPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe"
"PCMService"="\"C:\\Program Files\\Dell\\Media Experience\\PCMService.exe\""
"DVDLauncher"="\"C:\\Program Files\\CyberLink\\PowerDVD\\DVDLauncher.exe\""
"ISUSPM Startup"="C:\\PROGRA~1\\COMMON~1\\INSTAL~1\\UPDATE~1\\ISUSPM.exe -startup"
"ISUSScheduler"="\"C:\\Program Files\\Common Files\\InstallShield\\UpdateService\\issch.exe\" -start"
"CreativeMouse "="C:\\Program Files\\Mouse Driver\\MouseDrv.exe"
"IST Service"="C:\\Program Files\\ISTsvc\\istsvc.exe"
"Z0R6Ephi"="C:\\WINDOWS\\osekari.exe"
"dla"="C:\\WINDOWS\\system32\\dla\\tfswctrl.exe"
"PCSuiteTrayApplication"="C:\\PROGRA~1\\Nokia\\NOKIAP~1\\LAUNCH~1.EXE -startup"
"LogitechCommunicationsManager"="\"C:\\Program Files\\Common Files\\Logitech\\LComMgr\\Communications_Helper.exe\""
"LogitechQuickCamRibbon"="\"C:\\Program Files\\Logitech\\QuickCam10\\QuickCam10.exe\" /hide"
"LVCOMSX"="\"C:\\Program Files\\Common Files\\Logitech\\LComMgr\\LVComSX.exe\""
"SiteAdvisor"="C:\\Program Files\\SiteAdvisor\\6066\\SiteAdv.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"Desktop Service Centre"="C:\\Program Files\\OptusNet DSL Internet\\DSC.exe"
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.6.0_01\\bin\\jusched.exe\""
"Dell QuickSet"="C:\\Program Files\\Dell\\QuickSet\\Quickset.exe"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background"
"PcSync"="C:\\Program Files\\Nokia\\Nokia PC Suite 6\\PcSync2.exe /NoDialog"
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"SUPERAntiSpyware"="C:\\Program Files\\SUPERAntiSpyware\\SUPERAntiSpyware.exe"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=dword:00000000

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=""

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\amcESP
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cmprad
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Dao2eml
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dpvagn
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\eudipt
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\glm737
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ipvtup
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\jgawdes
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mmsapi

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"appinit_dlls"="c:\windows\system32\vtutrpo.dll"

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
Authentication Packages REG_MULTI_SZ msv1_0\0\0
Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0
Notification Packages REG_MULTI_SZ scecli\0\0

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\MCODS

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d9281c87-1eac-11da-ad97-00c0eec3149e}]
Shell\AutoRun\command E:\setupSNK.exe

-- End of Deckard's System Scanner: finished at 2007-07-03 at 18:29:40 ---------

sUBs · 07-03-2007, 04:06 AM

1. Download & Save this file to Desktop -> http://download.bleepingcomputer.com...a/ComboFix.exe

2. Double click on combofix.exe & follow the prompts.

3. When finished, it shall produce a log for you. Post that log & a fresh HJT log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

nessa333 · 07-03-2007, 06:10 AM

Hi,
Thank you for the quick reply. I hope i have the right ones

Combofix log attached
Combofix quarrantine attached
Hijackthis log below

_____________

"Ness" - 2007-07-03 21:45:20 - ComboFix 07-07-03.8 - Service Pack 2

(((((((((((((((((((((((((((((((((((((((((((( V Log )))))))))))))))))))))))))))))))))))))))))))))))))))))))

C:\WINDOWS\system32\vtutu.exe

* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\DOCUME~1\Ness\APPLIC~1\tmp16.tmp.exe
C:\DOCUME~1\Ness\APPLIC~1\tmp22.tmp.exe
C:\DOCUME~1\Ness\APPLIC~1\tmp23.tmp.exe
C:\DOCUME~1\Ness\APPLIC~1\tmp3B9.tmp.exe
C:\DOCUME~1\Ness\APPLIC~1\tmp581.tmp.exe
C:\DOCUME~1\Ness\APPLIC~1\tmp61.tmp.exe
C:\DOCUME~1\Ness\APPLIC~1\tmp67.tmp.exe
C:\DOCUME~1\Ness\APPLIC~1\tmp68.tmp.exe
C:\DOCUME~1\Ness\APPLIC~1\tmp7B.tmp.exe
C:\DOCUME~1\Ness\APPLIC~1\tmp83.tmp.exe
C:\DOCUME~1\Ness\APPLIC~1\tmp84.tmp.exe
C:\DOCUME~1\Ness\APPLIC~1\tmp89.tmp.exe
C:\DOCUME~1\Ness\APPLIC~1\tmpB0.tmp.exe
C:\DOCUME~1\Ness\APPLIC~1\tmpB1.tmp.exe
C:\DOCUME~1\Ness\APPLIC~1\tmpB3.tmp.exe
C:\DOCUME~1\Ness\APPLIC~1\tmpBB.tmp.exe

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

-------\LEGACY_DOMAINSERVICE
-------\DomainService

((((((((((((((((((((((((( Files Created from 2007-06-03 to 2007-07-03 )))))))))))))))))))))))))))))))

2007-07-03 21:44 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-07-03 18:24 <DIR> d-------- C:\Deckard
2007-07-02 22:29 <DIR> d-------- C:\Program Files\SpywareBlaster
2007-07-02 22:21 21,312 --a------ C:\WINDOWS\choice.exe
2007-07-02 22:20 <DIR> d-------- C:\ie-spyad
2007-07-02 22:10 59,378 --a------ C:\WINDOWS\system32\tmp581.tmp.dll
2007-07-02 20:47 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2007-07-02 20:32 59,378 --a------ C:\WINDOWS\system32\tmpBB.tmp.dll
2007-07-02 20:13 49,252 --a------ C:\WINDOWS\system32\awtsp.exe
2007-07-02 20:13 38,232 --a------ C:\WINDOWS\system32\jgawdes.dll
2007-06-28 20:16 59,409 --a------ C:\WINDOWS\system32\tmp68.tmp.dll
2007-06-27 21:53 49,252 --a------ C:\WINDOWS\system32\gebcc.exe
2007-06-27 21:48 0 --a------ C:\WINDOWS\system32\awtsq.exe
2007-06-27 21:38 <DIR> d-------- C:\VundoFix Backups
2007-06-27 20:02 38,232 --a------ C:\WINDOWS\system32\atl605.dll.vir
2007-06-26 18:46 49,252 --a------ C:\WINDOWS\system32\mljjh.exe
2007-06-25 21:36 49,252 --a------ C:\WINDOWS\system32\mllml.exe
2007-06-25 20:54 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\SUPERAntiSpyware.com
2007-06-25 20:52 786,432 --ah----- C:\DOCUME~1\ADMINI~1\NTUSER.DAT
2007-06-25 20:52 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Intel
2007-06-25 18:28 49,252 --a------ C:\WINDOWS\system32\pmnlm.exe
2007-06-24 10:43 49,252 --a------ C:\WINDOWS\system32\pmkjk.exe
2007-06-24 00:37 49,252 --a------ C:\WINDOWS\system32\awtqr.exe
2007-06-24 00:26 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Trymedia
2007-06-23 23:46 <DIR> d-------- C:\Program Files\Monopoly 3
2007-06-23 23:37 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\SUPERAntiSpyware.com
2007-06-23 23:36 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2007-06-23 23:36 <DIR> d-------- C:\DOCUME~1\Ness\APPLIC~1\SUPERAntiSpyware.com
2007-06-23 23:34 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-06-23 22:35 <DIR> d-------- C:\DOCUME~1\Ness\APPLIC~1\GetRightToGo
2007-06-22 23:11 <DIR> d-------- C:\Incomplete
2007-06-22 22:40 49,252 --a------ C:\WINDOWS\system32\ddccc.exe
2007-06-21 22:52 47,899 --a------ C:\WINDOWS\system32\vturp.exe
2007-06-21 07:24 47,899 --a------ C:\WINDOWS\system32\vtstu.exe
2007-06-20 18:10 47,899 --a------ C:\WINDOWS\system32\jkhhe.exe
2007-06-20 07:26 47,899 --a------ C:\WINDOWS\system32\vturo.exe
2007-06-19 00:19 47,899 --a------ C:\WINDOWS\system32\ssqrs.exe
2007-06-19 00:19 <DIR> d-------- C:\Program Files\AVG Anti-Spyware 7.5
2007-06-18 23:55 47,899 --a------ C:\WINDOWS\system32\jkhff.exe
2007-06-18 23:50 47,899 --a------ C:\WINDOWS\system32\pmnll.exe
2007-06-18 23:45 10,240 --a------ C:\WINDOWS\system32\gebya.exe
2007-06-15 22:21 47,899 --a------ C:\WINDOWS\system32\awtqq.exe
2007-06-04 17:57 <DIR> d-------- C:\Program Files\iPod

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-02 11:56:03 -------- d-----w C:\Program Files\OptusNet DSL Internet
2007-07-02 11:55:51 -------- d-----w C:\Program Files\MSN Messenger
2007-07-02 11:55:43 -------- d-----w C:\Program Files\Mouse Driver
2007-07-02 11:51:54 -------- d-----w C:\Program Files\iTunes
2007-07-02 11:51:17 -------- d-----w C:\Program Files\Digital Line Detect
2007-07-02 11:49:12 -------- d-----w C:\Program Files\Apoint
2007-07-02 10:13:36 -------- d-----w C:\DOCUME~1\Ness\APPLIC~1\SiteAdvisor
2007-06-23 12:30:31 -------- d-----w C:\DOCUME~1\Ness\APPLIC~1\LimeWire
2007-06-22 12:50:43 -------- d-----w C:\Program Files\McAfee
2007-06-04 08:30:27 -------- d-----w C:\Program Files\mIRC
2007-06-04 07:45:17 -------- d-----w C:\Program Files\Apple Software Update
2007-05-22 12:40:22 -------- d-----w C:\Program Files\LimeWire
2007-05-16 15:12:02 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-05-08 10:33:16 -------- d-----w C:\Program Files\SiteAdvisor
2007-05-05 02:00:10 -------- d-----w C:\Program Files\Siemens Subscriber Networks
2007-05-04 11:22:55 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-05-04 11:16:58 -------- d-----w C:\Program Files\QuickTime
2007-04-25 14:21:15 144,896 ----a-w C:\WINDOWS\system32\schannel.dll
2007-04-18 16:12:23 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll
2007-04-16 12:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll
2007-04-16 12:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll
2007-04-16 12:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
2007-04-16 12:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
2007-04-16 12:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
2007-04-16 12:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
2007-04-16 12:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
2007-04-16 12:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2006-12-18 03:16 59032 --a------ C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{089FD14D-132B-48FC-8861-0048AE113215}]
2007-03-31 01:41 1099304 --a------ C:\Program Files\SiteAdvisor\6066\SiteAdv.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5CA3D70E-1895-11CF-8E15-001234567890}]
2005-05-31 04:33 118844 --a------ C:\WINDOWS\system32\dla\tfswshx.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
2007-03-14 03:43 501400 --a------ C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7942d531-d61f-4108-9d3b-abc8f7e8312e}]
2007-07-02 20:13 38232 --a------ C:\WINDOWS\system32\jgawdes.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7DB2D5A0-7241-4E79-B68D-6309F01C5231}]
2006-12-22 15:02 67136 --a------ c:\program files\mcafee\virusscan\scriptcl.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2004-09-13 18:33]
"@"="" []
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2004-10-30 16:59]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-05-12 23:00]
"PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" []
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 18:19]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 18:50]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 18:50]
"CreativeMouse "="C:\Program Files\Mouse Driver\MouseDrv.exe" [2004-06-27 15:38]
"IST Service"="C:\Program Files\ISTsvc\istsvc.exe" []
"PCSuiteTrayApplication"="C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.exe" [2006-06-15 11:36]
"LogitechCommunicationsManager"="C:\Program Files\Common Files\Logitech\LComMgr\Communications_Helper.exe" [2006-10-31 00:03]
"LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" [2006-11-15 20:58]
"LVCOMSX"="C:\Program Files\Common Files\Logitech\LComMgr\LVComSX.exe" [2006-11-15 21:01]
"SiteAdvisor"="C:\Program Files\SiteAdvisor\6066\SiteAdv.exe" [2007-02-09 14:37]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41]
"Desktop Service Centre"="C:\Program Files\OptusNet DSL Internet\DSC.exe" [2005-11-30 12:21]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-05-26 12:45]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\Quickset.exe" [2005-03-04 13:26]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 11:54]
"PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-06-27 15:21]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:00]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-06-27 18:54]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"="C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2006-12-20 13:55]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\amcESP]
amcESP.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cmprad]
cmprad.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Dao2eml]
Dao2eml.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dpvagn]
dpvagn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\eudipt]
eudipt.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\glm737]
glm737.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
C:\Program Files\Intel\Wireless\Bin\LgNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ipvtup]
ipvtup.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\jgawdes]
jgawdes.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mmsapi]
mmsapi.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=c:\windows\system32\vtutrpo.dll

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d9281c87-1eac-11da-ad97-00c0eec3149e}]
AutoRun\command- E:\setupSNK.exe

Contents of the 'Scheduled Tasks' folder
2007-06-12 23:29:05 C:\WINDOWS\tasks\AppleSoftwareUpdate.job
2007-02-28 19:55:41 C:\WINDOWS\tasks\McDefragTask.job
2007-03-31 15:00:20 C:\WINDOWS\tasks\McQcTask.job

**************************************************************************

catchme 0.3.914 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-03 21:52:30
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

C:\WINDOWS\system32\dn_crash.log

scan completed successfully
hidden files: 1

**************************************************************************

Completion time: 2007-07-03 21:55:30 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-07-03 21:55

--- E O F ---

Logfile of HijackThis v1.99.1
Scan saved at 9:57:47 PM, on 3/07/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\SiteAdvisor\6066\SAService.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\WINDOWS\system32\cmd.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Mouse Driver\MouseDrv.exe
C:\Program Files\Common Files\Logitech\LComMgr\Communications_Helper.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Logitech\QuickCam10\QuickCam10.exe
C:\Program Files\Common Files\Logitech\LComMgr\LVComSX.exe
C:\Program Files\SiteAdvisor\6066\SiteAdv.exe
C:\Program Files\OptusNet DSL Internet\DSC.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Dell\QuickSet\Quickset.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\WINDOWS\explorer.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell.com/ap/ap/en/gen/default.htm
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7942d531-d61f-4108-9d3b-abc8f7e8312e} - C:\WINDOWS\system32\jgawdes.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\program files\mcafee\virusscan\scriptcl.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [CreativeMouse ] C:\Program Files\Mouse Driver\MouseDrv.exe
O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\Logitech\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
O4 - HKLM\..\Run: [LVCOMSX] "C:\Program Files\Common Files\Logitech\LComMgr\LVComSX.exe"
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6066\SiteAdv.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Desktop Service Centre] C:\Program Files\OptusNet DSL Internet\DSC.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\Quickset.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/sh...6/mcinsctl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/sh...26/mcgdmgr.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
O20 - AppInit_DLLs: c:\windows\system32\vtutrpo.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: amcESP - amcESP.dll (file missing)
O20 - Winlogon Notify: cmprad - cmprad.dll (file missing)
O20 - Winlogon Notify: Dao2eml - Dao2eml.dll (file missing)
O20 - Winlogon Notify: dpvagn - dpvagn.dll (file missing)
O20 - Winlogon Notify: eudipt - eudipt.dll (file missing)
O20 - Winlogon Notify: glm737 - glm737.dll (file missing)
O20 - Winlogon Notify: IntelWireless - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll
O20 - Winlogon Notify: ipvtup - ipvtup.dll (file missing)
O20 - Winlogon Notify: jgawdes - C:\WINDOWS\SYSTEM32\jgawdes.dll
O20 - Winlogon Notify: mmsapi - mmsapi.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\Logitech\SrvLnch\SrvLnch.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: SiteAdvisor Service - McAfee, Inc. - C:\Program Files\SiteAdvisor\6066\SAService.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

sUBs · 07-03-2007, 06:32 AM

Before fixing anything, open notepad and Copy/Paste the text in the box below into it:

Code:

@echo off
rem http://www.techsupportforum.com/security-center/hijackthis-log-help/165166-vundo-infection-various-others.html

For %%g in (
C:\WINDOWS\system32\tmp581.tmp.dll
C:\WINDOWS\system32\tmpBB.tmp.dll
C:\WINDOWS\system32\awtsp.exe
C:\WINDOWS\system32\jgawdes.dll
C:\WINDOWS\system32\tmp68.tmp.dll
C:\WINDOWS\system32\atl605.dll.vir
C:\WINDOWS\system32\mljjh.exe
C:\WINDOWS\system32\ddccc.exe
C:\WINDOWS\system32\vturp.exe
C:\WINDOWS\system32\jkhhe.exe
) do catchme -l nul -k %%g >nul
catchme -l nul -k "%0" >nul
nircmd execmd move /y "~$folder.desktop$\catchme.zip" "Submit [%date:/=-% %time::=.%].zip"
echo.Please submit the file - Submit [%date:/=-% %time::=.%].zip
nircmd wait 7000
del "%0"

Save this as Submit.bat Choose to "Save type as - All Files". It should look like this:

Double click on Submit.bat & allow it to generate a zipped file called Submit [Date Time].zip
Please submit this file to → http://www.bleepingcomputer.com/subm....php?channel=4

The file must be uploaded before proceeding to the next step.

---------------

Do a HijackThis scan & place a check next to these items and select "Fix checked":

O2 - BHO: (no name) - {7942d531-d61f-4108-9d3b-abc8f7e8312e} - C:\WINDOWS\system32\jgawdes.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Startup: PowerReg Scheduler.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O20 - AppInit_DLLs: c:\windows\system32\vtutrpo.dll
O20 - Winlogon Notify: amcESP - amcESP.dll (file missing)
O20 - Winlogon Notify: cmprad - cmprad.dll (file missing)
O20 - Winlogon Notify: Dao2eml - Dao2eml.dll (file missing)
O20 - Winlogon Notify: dpvagn - dpvagn.dll (file missing)
O20 - Winlogon Notify: eudipt - eudipt.dll (file missing)
O20 - Winlogon Notify: glm737 - glm737.dll (file missing)
O20 - Winlogon Notify: ipvtup - ipvtup.dll (file missing)
O20 - Winlogon Notify: jgawdes - C:\WINDOWS\SYSTEM32\jgawdes.dll
O20 - Winlogon Notify: mmsapi - mmsapi.dll (file missing)

---------------

Open notepad and copy/paste the text in the quotebox below into it:

Code:

File::
C:\WINDOWS\system32\tmp581.tmp.dll
C:\WINDOWS\system32\tmpBB.tmp.dll
C:\WINDOWS\system32\awtsp.exe
C:\WINDOWS\system32\jgawdes.dll
C:\WINDOWS\system32\tmp68.tmp.dll
C:\WINDOWS\system32\gebcc.exe
C:\WINDOWS\system32\awtsq.exe
C:\WINDOWS\system32\atl605.dll.vir
C:\WINDOWS\system32\mljjh.exe
C:\WINDOWS\system32\mllml.exe
C:\WINDOWS\system32\pmnlm.exe
C:\WINDOWS\system32\pmkjk.exe
C:\WINDOWS\system32\awtqr.exe
C:\WINDOWS\system32\ddccc.exe
C:\WINDOWS\system32\vturp.exe
C:\WINDOWS\system32\vtstu.exe
C:\WINDOWS\system32\jkhhe.exe
C:\WINDOWS\system32\vturo.exe
C:\WINDOWS\system32\ssqrs.exe
C:\WINDOWS\system32\jkhff.exe
C:\WINDOWS\system32\pmnll.exe
C:\WINDOWS\system32\gebya.exe
C:\WINDOWS\system32\awtqq.exe
Folder::
C:\Program Files\ISTsvc
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7942d531-d61f-4108-9d3b-abc8f7e8312e}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
@=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\amcESP]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cmprad]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Dao2eml]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dpvagn]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\eudipt]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\glm737]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ipvtup]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\jgawdes]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mmsapi]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=-

Save this as ComboFix-Do.txt

Refering to the picture above, drag ComboFix-Do.txt into ComboFix.exe
Then post the resultant log

---------------

Please perform an online scan using Internet Explorer at http://www.kaspersky.com/virusscanner

Answer Yes, when prompted to install an ActiveX component.

The program will then begin downloading the latest definition files.
Once the files have been downloaded click on NEXT
Locate the Scan Settings button & configure to:
- Scan using the following Anti-Virus database:
  - Extended
- Scan Options:
  - Scan Archives
  - Scan Mail Bases
Click OK & have it scan My Computer
Once the scan is complete, it will display if your system has been infected. We only require a report from it.
It does not provide an option to clean/disinfect.
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

* Turn off the real time scanner of any existing antivirus program while performing the online scan

Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%.

---------------

In your next post, please include fresh logs from:

Fresh Hijackthis log taken just before replying

Online scan

ComboFix's log

Please provide details of any problems you encountered whilst performing the above steps & update us on how the computer behaves now

nessa333 · 07-03-2007, 08:39 AM

Hi again.

See below HJT log which was run after the instructions were followed and just before posting this msg.

attached
online virus scan results
log when ComboFix-do was run

and

There was an error message when running HJT after the submit.bat was run

Logfile of HijackThis v1.99.1
Scan saved at 12:33:18 AM, on 4/07/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\SiteAdvisor\6066\SAService.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Mouse Driver\MouseDrv.exe
C:\Program Files\Common Files\Logitech\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam10\QuickCam10.exe
C:\Program Files\Common Files\Logitech\LComMgr\LVComSX.exe
C:\Program Files\SiteAdvisor\6066\SiteAdv.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\OptusNet DSL Internet\DSC.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Dell\QuickSet\Quickset.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell.com/ap/ap/en/gen/default.htm
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\program files\mcafee\virusscan\scriptcl.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [CreativeMouse ] C:\Program Files\Mouse Driver\MouseDrv.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\Logitech\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
O4 - HKLM\..\Run: [LVCOMSX] "C:\Program Files\Common Files\Logitech\LComMgr\LVComSX.exe"
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6066\SiteAdv.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Desktop Service Centre] C:\Program Files\OptusNet DSL Internet\DSC.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\Quickset.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/sh...6/mcinsctl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/sh...26/mcgdmgr.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: IntelWireless - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\Logitech\SrvLnch\SrvLnch.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: SiteAdvisor Service - McAfee, Inc. - C:\Program Files\SiteAdvisor\6066\SAService.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

"Ness" - 2007-07-03 22:50:32 - ComboFix 07-07-03.8 - Service Pack 2
Command switches used :: C:\comboFix-Do.txt

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\WINDOWS\system32\atl605.dll.vir
C:\WINDOWS\system32\awtqq.exe
C:\WINDOWS\system32\awtqr.exe
C:\WINDOWS\system32\awtsp.exe
C:\WINDOWS\system32\awtsq.exe
C:\WINDOWS\system32\ddccc.exe
C:\WINDOWS\system32\gebcc.exe
C:\WINDOWS\system32\gebya.exe
C:\WINDOWS\system32\jgawdes.dll
C:\WINDOWS\system32\jkhff.exe
C:\WINDOWS\system32\jkhhe.exe
C:\WINDOWS\system32\mljjh.exe
C:\WINDOWS\system32\mllml.exe
C:\WINDOWS\system32\pmkjk.exe
C:\WINDOWS\system32\pmnll.exe
C:\WINDOWS\system32\pmnlm.exe
C:\WINDOWS\system32\ssqrs.exe
C:\WINDOWS\system32\tmp581.tmp.dll
C:\WINDOWS\system32\tmp68.tmp.dll
C:\WINDOWS\system32\tmpBB.tmp.dll
C:\WINDOWS\system32\vtstu.exe
C:\WINDOWS\system32\vturo.exe
C:\WINDOWS\system32\vturp.exe

((((((((((((((((((((((((( Files Created from 2007-06-03 to 2007-07-03 )))))))))))))))))))))))))))))))

2007-07-03 21:44 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-07-03 18:24 <DIR> d-------- C:\Deckard
2007-07-02 22:29 <DIR> d-------- C:\Program Files\SpywareBlaster
2007-07-02 22:21 21,312 --a------ C:\WINDOWS\choice.exe
2007-07-02 22:20 <DIR> d-------- C:\ie-spyad
2007-07-02 20:47 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2007-06-27 21:38 <DIR> d-------- C:\VundoFix Backups
2007-06-25 20:54 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\SUPERAntiSpyware.com
2007-06-25 20:52 786,432 --ah----- C:\DOCUME~1\ADMINI~1\NTUSER.DAT
2007-06-25 20:52 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Intel
2007-06-24 00:26 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Trymedia
2007-06-23 23:46 <DIR> d-------- C:\Program Files\Monopoly 3
2007-06-23 23:37 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\SUPERAntiSpyware.com
2007-06-23 23:36 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2007-06-23 23:36 <DIR> d-------- C:\DOCUME~1\Ness\APPLIC~1\SUPERAntiSpyware.com
2007-06-23 23:34 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-06-23 22:35 <DIR> d-------- C:\DOCUME~1\Ness\APPLIC~1\GetRightToGo
2007-06-22 23:11 <DIR> d-------- C:\Incomplete
2007-06-19 00:19 <DIR> d-------- C:\Program Files\AVG Anti-Spyware 7.5
2007-06-04 17:57 <DIR> d-------- C:\Program Files\iPod

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-02 11:56:03 -------- d-----w C:\Program Files\OptusNet DSL Internet
2007-07-02 11:55:51 -------- d-----w C:\Program Files\MSN Messenger
2007-07-02 11:55:43 -------- d-----w C:\Program Files\Mouse Driver
2007-07-02 11:51:54 -------- d-----w C:\Program Files\iTunes
2007-07-02 11:51:17 -------- d-----w C:\Program Files\Digital Line Detect
2007-07-02 11:49:12 -------- d-----w C:\Program Files\Apoint
2007-07-02 10:13:36 -------- d-----w C:\DOCUME~1\Ness\APPLIC~1\SiteAdvisor
2007-06-23 12:30:31 -------- d-----w C:\DOCUME~1\Ness\APPLIC~1\LimeWire
2007-06-22 12:50:43 -------- d-----w C:\Program Files\McAfee
2007-06-04 08:30:27 -------- d-----w C:\Program Files\mIRC
2007-06-04 07:45:17 -------- d-----w C:\Program Files\Apple Software Update
2007-05-22 12:40:22 -------- d-----w C:\Program Files\LimeWire
2007-05-16 15:12:02 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-05-08 10:33:16 -------- d-----w C:\Program Files\SiteAdvisor
2007-05-05 02:00:10 -------- d-----w C:\Program Files\Siemens Subscriber Networks
2007-05-04 11:22:55 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-05-04 11:16:58 -------- d-----w C:\Program Files\QuickTime
2007-04-25 14:21:15 144,896 ----a-w C:\WINDOWS\system32\schannel.dll
2007-04-18 16:12:23 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll
2007-04-16 12:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll
2007-04-16 12:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll
2007-04-16 12:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
2007-04-16 12:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
2007-04-16 12:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
2007-04-16 12:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
2007-04-16 12:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
2007-04-16 12:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2006-12-18 03:16 59032 --a------ C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{089FD14D-132B-48FC-8861-0048AE113215}]
2007-03-31 01:41 1099304 --a------ C:\Program Files\SiteAdvisor\6066\SiteAdv.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5CA3D70E-1895-11CF-8E15-001234567890}]
2005-05-31 04:33 118844 --a------ C:\WINDOWS\system32\dla\tfswshx.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
2007-03-14 03:43 501400 --a------ C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7DB2D5A0-7241-4E79-B68D-6309F01C5231}]
2006-12-22 15:02 67136 --a------ c:\program files\mcafee\virusscan\scriptcl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2004-09-13 18:33]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2004-10-30 16:59]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-05-12 23:00]
"PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" []
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 18:19]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 18:50]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 18:50]
"CreativeMouse "="C:\Program Files\Mouse Driver\MouseDrv.exe" [2004-06-27 15:38]
"PCSuiteTrayApplication"="C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.exe" [2006-06-15 11:36]
"LogitechCommunicationsManager"="C:\Program Files\Common Files\Logitech\LComMgr\Communications_Helper.exe" [2006-10-31 00:03]
"LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" [2006-11-15 20:58]
"LVCOMSX"="C:\Program Files\Common Files\Logitech\LComMgr\LVComSX.exe" [2006-11-15 21:01]
"SiteAdvisor"="C:\Program Files\SiteAdvisor\6066\SiteAdv.exe" [2007-02-09 14:37]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41]
"Desktop Service Centre"="C:\Program Files\OptusNet DSL Internet\DSC.exe" [2005-11-30 12:21]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-05-26 12:45]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\Quickset.exe" [2005-03-04 13:26]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 11:54]
"PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-06-27 15:21]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:00]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-06-27 18:54]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"="C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2006-12-20 13:55]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
C:\Program Files\Intel\Wireless\Bin\LgNotify.dll

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d9281c87-1eac-11da-ad97-00c0eec3149e}]
AutoRun\command- E:\setupSNK.exe

Contents of the 'Scheduled Tasks' folder
2007-06-12 23:29:05 C:\WINDOWS\tasks\AppleSoftwareUpdate.job
2007-02-28 19:55:41 C:\WINDOWS\tasks\McDefragTask.job
2007-03-31 15:00:20 C:\WINDOWS\tasks\McQcTask.job

**************************************************************************

catchme 0.3.914 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-03 22:56:19
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-03 22:58:58 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-07-03 22:58
C:\ComboFix2.txt ... 2007-07-03 21:55

--- E O F ---

sUBs · 07-03-2007, 10:18 AM

Open notepad and copy/paste the text in the quotebox below into it:

Code:

@echo off
if exist "%temp%\log.txt" del "%temp%\log.txt"
for %%g in (
"C:\Documents and Settings\Ness\Local Settings\Temp\{5FF7479C-1960-4E3C-A1B0-37F35A058DCF}\_extra\objects\cmdline.dll"
C:\Submit [Tue 03-07-2007 22.39.47.00].zip
) do (
del /a/f %%g >nul 2>&1
if exist %%g echo.%%g>>"%temp%\log.txt"
)
for %%g in (
"C:\Program Files\HijackThis\backups"
C:\QooBox
) do (
rd /s/q %%g >nul 2>&1
if exist %%g echo.%%g>>"%temp%\log.txt"
)
if exist "%temp%\log.txt" ( start notepad "%temp%\log.txt"
) else echo.Delete Successfully !!
nircmd wait 4000
del %0

Save this as fix.bat Choose to "Save type as - All Files"
It should look like this:

Double click on fix.bat & allow it to run

Post back to tell me what it says

nessa333 · 07-04-2007, 06:25 AM

hi,

The fix.bat gives the following

"C:\Documents and Settings\Ness\Local Settings\Temp\{5FF7479C-1960-4E3C-A1B0-37F35A058DCF}\_extra\objects\cmdline.dll"

sUBs · 07-04-2007, 06:29 AM

Reboot & try running it again

nessa333 · 07-04-2007, 06:51 AM

Hi, i rebooted and it say the follwoing again
"C:\Documents and Settings\Ness\Local Settings\Temp\{5FF7479C-1960-4E3C-A1B0-37F35A058DCF}\_extra\objects\cmdline.dll"

sUBs · 07-04-2007, 06:54 AM

Looks like we need a bigger gun.

Open notepad and copy/paste the text in the quotebox below into it:

Code:

File::
C:\Documents and Settings\Ness\Local Settings\Temp\{5FF7479C-1960-4E3C-A1B0-37F35A058DCF}\_extra\objects\cmdline.dll
Folder::
C:\Documents and Settings\Ness\Local Settings\Temp\{5FF7479C-1960-4E3C-A1B0-37F35A058DCF}

Save this as ComboFix-Do.txt

Refering to the picture above, drag ComboFix-Do.txt into ComboFix.exe
Then post the resultant log

nessa333 · 07-06-2007, 07:27 AM

Hi Sorry for the delay but the computer started acting bizare after running the above. The time format changed and the wirelss had trouble connecting.
I havent been getting the pop-ups i used to get and explorere seems to be running fine.
I am unsure where the logs went for the above as it wouldnt start up again initially after running it.

sUBs · 07-06-2007, 10:22 AM

Did it produce a log?

nessa333 · 07-06-2007, 06:53 PM

im not sure if it produced a log, would it have automatically saved? and cn i run it again?

sUBs · 07-07-2007, 12:37 AM

Please run it again

nessa333 · 07-07-2007, 01:16 AM

"Ness" - 2007-07-07 17:10:43 - ComboFix 07-07-03.8 - Service Pack 2
Command switches used :: C:\ComboFix-do.txt

((((((((((((((((((((((((( Files Created from 2007-06-07 to 2007-07-07 )))))))))))))))))))))))))))))))

2007-07-03 23:45 <DIR> d-------- C:\xnext post
2007-07-03 23:23 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2007-07-03 21:44 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-07-03 18:24 <DIR> d-------- C:\Deckard
2007-07-02 22:29 <DIR> d-------- C:\Program Files\SpywareBlaster
2007-07-02 22:21 21,312 --a------ C:\WINDOWS\choice.exe
2007-07-02 22:20 <DIR> d-------- C:\ie-spyad
2007-07-02 20:47 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2007-06-27 21:38 <DIR> d-------- C:\VundoFix Backups
2007-06-25 20:54 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\SUPERAntiSpyware.com
2007-06-25 20:52 786,432 --ah----- C:\DOCUME~1\ADMINI~1\NTUSER.DAT
2007-06-25 20:52 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Intel
2007-06-24 00:26 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Trymedia
2007-06-23 23:46 <DIR> d-------- C:\Program Files\Monopoly 3
2007-06-23 23:37 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\SUPERAntiSpyware.com
2007-06-23 23:36 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2007-06-23 23:36 <DIR> d-------- C:\DOCUME~1\Ness\APPLIC~1\SUPERAntiSpyware.com
2007-06-23 23:34 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-06-23 22:35 <DIR> d-------- C:\DOCUME~1\Ness\APPLIC~1\GetRightToGo
2007-06-22 23:11 <DIR> d-------- C:\Incomplete
2007-06-19 00:19 <DIR> d-------- C:\Program Files\AVG Anti-Spyware 7.5

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-02 11:56:03 -------- d-----w C:\Program Files\OptusNet DSL Internet
2007-07-02 11:55:51 -------- d-----w C:\Program Files\MSN Messenger
2007-07-02 11:55:43 -------- d-----w C:\Program Files\Mouse Driver
2007-07-02 11:51:54 -------- d-----w C:\Program Files\iTunes
2007-07-02 11:51:17 -------- d-----w C:\Program Files\Digital Line Detect
2007-07-02 11:49:12 -------- d-----w C:\Program Files\Apoint
2007-07-02 10:13:36 -------- d-----w C:\DOCUME~1\Ness\APPLIC~1\SiteAdvisor
2007-06-23 12:30:31 -------- d-----w C:\DOCUME~1\Ness\APPLIC~1\LimeWire
2007-06-22 12:50:43 -------- d-----w C:\Program Files\McAfee
2007-06-04 08:30:27 -------- d-----w C:\Program Files\mIRC
2007-06-04 07:57:40 -------- d-----w C:\Program Files\iPod
2007-06-04 07:45:17 -------- d-----w C:\Program Files\Apple Software Update
2007-05-22 12:40:22 -------- d-----w C:\Program Files\LimeWire
2007-05-16 15:12:02 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-05-08 10:33:16 -------- d-----w C:\Program Files\SiteAdvisor
2007-04-25 14:21:15 144,896 ----a-w C:\WINDOWS\system32\schannel.dll
2007-04-18 16:12:23 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll
2007-04-16 12:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll
2007-04-16 12:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll
2007-04-16 12:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
2007-04-16 12:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
2007-04-16 12:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
2007-04-16 12:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
2007-04-16 12:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
2007-04-16 12:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2006-12-18 03:16 59032 --a------ C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{089FD14D-132B-48FC-8861-0048AE113215}]
2007-03-31 01:41 1099304 --a------ C:\Program Files\SiteAdvisor\6066\SiteAdv.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5CA3D70E-1895-11CF-8E15-001234567890}]
2005-05-31 04:33 118844 --a------ C:\WINDOWS\system32\dla\tfswshx.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
2007-03-14 03:43 501400 --a------ C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7DB2D5A0-7241-4E79-B68D-6309F01C5231}]
2006-12-22 15:02 67136 --a------ c:\program files\mcafee\virusscan\scriptcl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2004-09-13 18:33]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2004-10-30 16:59]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-05-12 23:00]
"PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" []
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 18:19]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 18:50]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 18:50]
"CreativeMouse "="C:\Program Files\Mouse Driver\MouseDrv.exe" [2004-06-27 15:38]
"PCSuiteTrayApplication"="C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.exe" [2006-06-15 11:36]
"LogitechCommunicationsManager"="C:\Program Files\Common Files\Logitech\LComMgr\Communications_Helper.exe" [2006-10-31 00:03]
"LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" [2006-11-15 20:58]
"LVCOMSX"="C:\Program Files\Common Files\Logitech\LComMgr\LVComSX.exe" [2006-11-15 21:01]
"SiteAdvisor"="C:\Program Files\SiteAdvisor\6066\SiteAdv.exe" [2007-02-09 14:37]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41]
"Desktop Service Centre"="C:\Program Files\OptusNet DSL Internet\DSC.exe" [2005-11-30 12:21]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-05-26 12:45]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\Quickset.exe" [2005-03-04 13:26]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 11:54]
"PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-06-27 15:21]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:00]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-06-27 18:54]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"="C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2006-12-20 13:55]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
C:\Program Files\Intel\Wireless\Bin\LgNotify.dll

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d9281c87-1eac-11da-ad97-00c0eec3149e}]
AutoRun\command- E:\setupSNK.exe

Contents of the 'Scheduled Tasks' folder
2007-06-12 23:29:05 C:\WINDOWS\tasks\AppleSoftwareUpdate.job
2007-02-28 19:55:41 C:\WINDOWS\tasks\McDefragTask.job
2007-03-31 15:00:20 C:\WINDOWS\tasks\McQcTask.job

**************************************************************************

catchme 0.3.914 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-07 17:13:19
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-07 17:14:16
C:\ComboFix-quarantined-files.txt ... 2007-07-07 17:14
C:\ComboFix2.txt ... 2007-07-03 22:58
C:\ComboFix3.txt ... 2007-07-03 21:55

--- E O F ---

sUBs · 07-07-2007, 01:28 AM

Log looks to be in order. Is the machine still acting bizarre ?

nessa333 · 07-07-2007, 01:35 AM

No the machine is running fine. there are no probs.
It was when i ran the first comboFix-do that had problems but this time it ran fine.
The superAntiSpyware program found a adware.tracking cookie this morning and has removed it. I rebooted and ran another scan and there was nothing found.

sUBs · 07-07-2007, 01:38 AM

Your system is clean, kindly follow these simple steps in order to keep your computer clean and secure:

CLEAR & RESET SYSTEM RESTORE'S CACHE - (System Volume Information folder)
Go to Start → Run → type control sysdm.cpl,,4 & press Enter
- Tick on the checkbox - Turn off System Restore on all drives
- Click Apply
Turn it back 'On' by unticking the same checkbox & click OK
DISABLE THE VIEWING OF SYSTEM FILES
From Windows Explorer, go to Tools>Folder Options> View tab.
- Untick - Show hidden files and folder
- Tick - Hide file extensions for known types
- Tick - Hide protected operating system files
Click Yes to confirm & then click OK
SECURING INTERNET EXPLORER
From within Internet Explorer click on the Tools menu and then click on Internet Options.
- Select the Security tab
  - Click once on the Internet icon so it becomes highlighted.
  - Select Custom Level .
    - Change 'Download signed ActiveX controls' to Prompt
    - Change 'Download unsigned ActiveX controls' to Disable
    - Change 'Initialize and script ActiveX controls not marked as safe' to Disable
    - Change 'Installation of desktop items' to Prompt
    - Change 'Launching programs and files in an IFRAME' to Prompt
    - Change 'Navigate sub-frames across different domains' to Prompt
    - When all these changes have been made, click on the OK button.
  - If it prompts you as to whether or not you want to save the settings, press the Yes button.
- Select OK to exit the Internet Properties page.
ANTIVIRUS SOFTWARE
It is very important that you have anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.

See this link for a listing of some online & their stand-alone antivirus programs:

Virus, Spyware, and Malware Protection and Removal Resources → http://www.bleepingcomputer.com/forums/topict405.html

It is imperative that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
FIREWALL
Without a firewall your computer is succeptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. A tutorial on Firewalls and a listing of some available ones can be found here → http://www.bleepingcomputer.com/forums/tutorial60.html
Microsoft Windows Update → http://www.windowsupdate.com
Visit regularly. This will ensure your computer always has the latest security updates. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
SPYBOT - SEARCH & DESTROY
Download and install Spybot - Search & Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with the program on a regular basis just as you would an antivirus software. A tutorial on installing & using this product can be found here → http://www.bleepingcomputer.com/forums/tutorial43.html
AD-AWARE
Download and install Ad-Aware. You should use this program to scan your computer on a regular basis just as you would an antivirus software in conjunction with Spybot. A tutorial on installing & using this product can be found here → http://www.bleepingcomputer.com/forums/tutorial48.html
SPYWAREBLASTER
SpywareBlaster prevents the installation of malicious ActiveX, adware, browser hijackers, dialers, and other potentially unwanted software. Blocks spyware/tracking cookies & restricts the actions of potentially unwanted sites.

Unlike other programs, SpywareBlaster does not have to remain running in the background. A tutorial on installing & using this product can be found here → http://www.bleepingcomputer.com/forums/tutorial49.html
IE-SPYAD
IE/Spyad places more than 4000 dubious websites and domains in the IE Restricted list. This severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites. A tutorial on installing this product can be found here http://www.spywarewarrior.com/uiuc/resource.htm

Update all these programs regularly. Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.

Follow this list and your potential for being infected again will reduce dramatically. Here are some additional utilities that will further enhance your safety.

http://www.trillian.cc → Trillian or http://www.miranda-im.com → Miranda-IM - These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN)
http://www.mozilla.org/products/firefox/ - Firefox - Use this alternate browser. Whilst Internet Explorer is not a bad browser, almost every exploit crafted is targeted to take advantage of an IE weakness.
http://java.com/en/index.jsp - Sun's Java - It's much more secure than Microsoft's Java Virtual Machine.
http://toolbar.google.com/ - Google Toolbar - Get the free google toolbar to help stop pop up windows.
http://cleanup.stevengould.org/ - CleanUP! - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.
http://www.aumha.org/downloads/erunt-setup.exe - ERUNT - A useful freeware utility for users of Windows 2000/XP. It's made up of two parts - ERUNT & NTREGOPT.

ERUNT will create daily complete backups of your computer's Registry. Whilst System Restore does the same thing, a corrupt registry file may prevent Windows from booting & this effectively renders disables System Restore. With ERUNT, you're able to restore the damaged Registry.

NTREGOPT works by recreating each registry hive "from scratch", thus removing any slack space that may be left from previously modified or deleted keys. In other words, it compacts the Registry to a small size which allows Windows to load & perform faster.
http://www.winpatrol.com/ -Winpatrol - Download and install the free version of Winpatrol.
A tutorial for this product is located here: http://www.winpatrol.com/features.html

To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Tony Klein - http://computercops.biz/postlite7736-.html

After doing all these, your system will be optimised against future threats.

It's okay to delete the Hijack This folder in a couple weeks if everything is working okay.
Have a safe & happy computing day.

Please respond to this thread one more time so we can mark this thread as resolved.

nessa333 · 07-07-2007, 01:44 AM

Thank you very much for you help

07-03-2007, 04:06 AM	#2 (permalink)
sUBs Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy Join Date: May 2005 Posts: 24,326 OS: N/A	Re: vundo infection and various others 1. Download & Save this file to Desktop -> http://download.bleepingcomputer.com...a/ComboFix.exe 2. Double click on combofix.exe & follow the prompts. 3. When finished, it shall produce a log for you. Post that log & a fresh HJT log in your next reply Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall __________________ Question - what have you done for the community today?

07-03-2007, 06:32 AM	#4 (permalink)
sUBs Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy Join Date: May 2005 Posts: 24,326 OS: N/A	Re: vundo infection and various others Before fixing anything, open notepad and Copy/Paste the text in the box below into it: Code: @echo off rem http://www.techsupportforum.com/security-center/hijackthis-log-help/165166-vundo-infection-various-others.html For %%g in ( C:\WINDOWS\system32\tmp581.tmp.dll C:\WINDOWS\system32\tmpBB.tmp.dll C:\WINDOWS\system32\awtsp.exe C:\WINDOWS\system32\jgawdes.dll C:\WINDOWS\system32\tmp68.tmp.dll C:\WINDOWS\system32\atl605.dll.vir C:\WINDOWS\system32\mljjh.exe C:\WINDOWS\system32\ddccc.exe C:\WINDOWS\system32\vturp.exe C:\WINDOWS\system32\jkhhe.exe ) do catchme -l nul -k %%g >nul catchme -l nul -k "%0" >nul nircmd execmd move /y "~$folder.desktop$\catchme.zip" "Submit [%date:/=-% %time::=.%].zip" echo.Please submit the file - Submit [%date:/=-% %time::=.%].zip nircmd wait 7000 del "%0" Save this as Submit.bat Choose to "Save type as - All Files". It should look like this: Double click on Submit.bat & allow it to generate a zipped file called Submit [Date Time].zip Please submit this file to → http://www.bleepingcomputer.com/subm....php?channel=4 The file must be uploaded before proceeding to the next step. --------------- Do a HijackThis scan & place a check next to these items and select "Fix checked": O2 - BHO: (no name) - {7942d531-d61f-4108-9d3b-abc8f7e8312e} - C:\WINDOWS\system32\jgawdes.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe O4 - Startup: PowerReg Scheduler V3.exe O4 - Startup: PowerReg Scheduler.exe O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file) O20 - AppInit_DLLs: c:\windows\system32\vtutrpo.dll O20 - Winlogon Notify: amcESP - amcESP.dll (file missing) O20 - Winlogon Notify: cmprad - cmprad.dll (file missing) O20 - Winlogon Notify: Dao2eml - Dao2eml.dll (file missing) O20 - Winlogon Notify: dpvagn - dpvagn.dll (file missing) O20 - Winlogon Notify: eudipt - eudipt.dll (file missing) O20 - Winlogon Notify: glm737 - glm737.dll (file missing) O20 - Winlogon Notify: ipvtup - ipvtup.dll (file missing) O20 - Winlogon Notify: jgawdes - C:\WINDOWS\SYSTEM32\jgawdes.dll O20 - Winlogon Notify: mmsapi - mmsapi.dll (file missing) --------------- Open notepad and copy/paste the text in the quotebox below into it: Code: File:: C:\WINDOWS\system32\tmp581.tmp.dll C:\WINDOWS\system32\tmpBB.tmp.dll C:\WINDOWS\system32\awtsp.exe C:\WINDOWS\system32\jgawdes.dll C:\WINDOWS\system32\tmp68.tmp.dll C:\WINDOWS\system32\gebcc.exe C:\WINDOWS\system32\awtsq.exe C:\WINDOWS\system32\atl605.dll.vir C:\WINDOWS\system32\mljjh.exe C:\WINDOWS\system32\mllml.exe C:\WINDOWS\system32\pmnlm.exe C:\WINDOWS\system32\pmkjk.exe C:\WINDOWS\system32\awtqr.exe C:\WINDOWS\system32\ddccc.exe C:\WINDOWS\system32\vturp.exe C:\WINDOWS\system32\vtstu.exe C:\WINDOWS\system32\jkhhe.exe C:\WINDOWS\system32\vturo.exe C:\WINDOWS\system32\ssqrs.exe C:\WINDOWS\system32\jkhff.exe C:\WINDOWS\system32\pmnll.exe C:\WINDOWS\system32\gebya.exe C:\WINDOWS\system32\awtqq.exe Folder:: C:\Program Files\ISTsvc Registry:: [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7942d531-d61f-4108-9d3b-abc8f7e8312e}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] @=- [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\amcESP] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cmprad] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Dao2eml] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dpvagn] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\eudipt] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\glm737] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ipvtup] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\jgawdes] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mmsapi] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "appinit_dlls"=- Save this as ComboFix-Do.txt Refering to the picture above, drag ComboFix-Do.txt into ComboFix.exe Then post the resultant log --------------- Please perform an online scan using Internet Explorer at http://www.kaspersky.com/virusscanner Answer Yes, when prompted to install an ActiveX component. The program will then begin downloading the latest definition files. Once the files have been downloaded click on NEXT Locate the Scan Settings button & configure to: Scan using the following Anti-Virus database: Extended Scan Options: Scan Archives Scan Mail Bases Click OK & have it scan My Computer Once the scan is complete, it will display if your system has been infected. We only require a report from it. It does not provide an option to clean/disinfect. Click the Save as Text button to save the file to your desktop so that you may post it in your next reply * Turn off the real time scanner of any existing antivirus program while performing the online scan Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%. --------------- In your next post, please include fresh logs from: Fresh Hijackthis log taken just before replying Online scan ComboFix's log Please provide details of any problems you encountered whilst performing the above steps & update us on how the computer behaves now __________________ Question - what have you done for the community today?

07-03-2007, 10:18 AM	#6 (permalink)
sUBs Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy Join Date: May 2005 Posts: 24,326 OS: N/A	Re: vundo infection and various others Open notepad and copy/paste the text in the quotebox below into it: Code: @echo off if exist "%temp%\log.txt" del "%temp%\log.txt" for %%g in ( "C:\Documents and Settings\Ness\Local Settings\Temp\{5FF7479C-1960-4E3C-A1B0-37F35A058DCF}\_extra\objects\cmdline.dll" C:\Submit [Tue 03-07-2007 22.39.47.00].zip ) do ( del /a/f %%g >nul 2>&1 if exist %%g echo.%%g>>"%temp%\log.txt" ) for %%g in ( "C:\Program Files\HijackThis\backups" C:\QooBox ) do ( rd /s/q %%g >nul 2>&1 if exist %%g echo.%%g>>"%temp%\log.txt" ) if exist "%temp%\log.txt" ( start notepad "%temp%\log.txt" ) else echo.Delete Successfully !! nircmd wait 4000 del %0 Save this as fix.bat Choose to "Save type as - All Files" It should look like this: Double click on fix.bat & allow it to run Post back to tell me what it says __________________ Question - what have you done for the community today?

07-04-2007, 06:25 AM	#7 (permalink)
nessa333 Registered User Join Date: Jun 2007 Posts: 10 OS: XP	Re: vundo infection and various others hi, The fix.bat gives the following "C:\Documents and Settings\Ness\Local Settings\Temp\{5FF7479C-1960-4E3C-A1B0-37F35A058DCF}\_extra\objects\cmdline.dll"

07-04-2007, 06:29 AM	#8 (permalink)
sUBs Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy Join Date: May 2005 Posts: 24,326 OS: N/A	Re: vundo infection and various others Reboot & try running it again __________________ Question - what have you done for the community today?

07-04-2007, 06:51 AM	#9 (permalink)
nessa333 Registered User Join Date: Jun 2007 Posts: 10 OS: XP	Re: vundo infection and various others Hi, i rebooted and it say the follwoing again "C:\Documents and Settings\Ness\Local Settings\Temp\{5FF7479C-1960-4E3C-A1B0-37F35A058DCF}\_extra\objects\cmdline.dll"

07-04-2007, 06:54 AM	#10 (permalink)
sUBs Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy Join Date: May 2005 Posts: 24,326 OS: N/A	Re: vundo infection and various others Looks like we need a bigger gun. Open notepad and copy/paste the text in the quotebox below into it: Code: File:: C:\Documents and Settings\Ness\Local Settings\Temp\{5FF7479C-1960-4E3C-A1B0-37F35A058DCF}\_extra\objects\cmdline.dll Folder:: C:\Documents and Settings\Ness\Local Settings\Temp\{5FF7479C-1960-4E3C-A1B0-37F35A058DCF} Save this as ComboFix-Do.txt Refering to the picture above, drag ComboFix-Do.txt into ComboFix.exe Then post the resultant log __________________ Question - what have you done for the community today?

07-06-2007, 07:27 AM	#11 (permalink)
nessa333 Registered User Join Date: Jun 2007 Posts: 10 OS: XP	Re: vundo infection and various others Hi Sorry for the delay but the computer started acting bizare after running the above. The time format changed and the wirelss had trouble connecting. I havent been getting the pop-ups i used to get and explorere seems to be running fine. I am unsure where the logs went for the above as it wouldnt start up again initially after running it.

07-06-2007, 10:22 AM	#12 (permalink)
sUBs Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy Join Date: May 2005 Posts: 24,326 OS: N/A	Re: vundo infection and various others Did it produce a log? __________________ Question - what have you done for the community today?

07-06-2007, 06:53 PM	#13 (permalink)
nessa333 Registered User Join Date: Jun 2007 Posts: 10 OS: XP	Re: vundo infection and various others im not sure if it produced a log, would it have automatically saved? and cn i run it again?

07-07-2007, 12:37 AM	#14 (permalink)
sUBs Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy Join Date: May 2005 Posts: 24,326 OS: N/A	Re: vundo infection and various others Please run it again __________________ Question - what have you done for the community today?

07-07-2007, 01:16 AM	#15 (permalink)
nessa333 Registered User Join Date: Jun 2007 Posts: 10 OS: XP	Re: vundo infection and various others "Ness" - 2007-07-07 17:10:43 - ComboFix 07-07-03.8 - Service Pack 2 Command switches used :: C:\ComboFix-do.txt ((((((((((((((((((((((((( Files Created from 2007-06-07 to 2007-07-07 ))))))))))))))))))))))))))))))) 2007-07-03 23:45 <DIR> d-------- C:\xnext post 2007-07-03 23:23 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab 2007-07-03 21:44 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-07-03 18:24 <DIR> d-------- C:\Deckard 2007-07-02 22:29 <DIR> d-------- C:\Program Files\SpywareBlaster 2007-07-02 22:21 21,312 --a------ C:\WINDOWS\choice.exe 2007-07-02 22:20 <DIR> d-------- C:\ie-spyad 2007-07-02 20:47 <DIR> d-------- C:\WINDOWS\system32\ActiveScan 2007-06-27 21:38 <DIR> d-------- C:\VundoFix Backups 2007-06-25 20:54 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\SUPERAntiSpyware.com 2007-06-25 20:52 786,432 --ah----- C:\DOCUME~1\ADMINI~1\NTUSER.DAT 2007-06-25 20:52 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Intel 2007-06-24 00:26 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Trymedia 2007-06-23 23:46 <DIR> d-------- C:\Program Files\Monopoly 3 2007-06-23 23:37 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\SUPERAntiSpyware.com 2007-06-23 23:36 <DIR> d-------- C:\Program Files\SUPERAntiSpyware 2007-06-23 23:36 <DIR> d-------- C:\DOCUME~1\Ness\APPLIC~1\SUPERAntiSpyware.com 2007-06-23 23:34 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2007-06-23 22:35 <DIR> d-------- C:\DOCUME~1\Ness\APPLIC~1\GetRightToGo 2007-06-22 23:11 <DIR> d-------- C:\Incomplete 2007-06-19 00:19 <DIR> d-------- C:\Program Files\AVG Anti-Spyware 7.5 (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-07-02 11:56:03 -------- d-----w C:\Program Files\OptusNet DSL Internet 2007-07-02 11:55:51 -------- d-----w C:\Program Files\MSN Messenger 2007-07-02 11:55:43 -------- d-----w C:\Program Files\Mouse Driver 2007-07-02 11:51:54 -------- d-----w C:\Program Files\iTunes 2007-07-02 11:51:17 -------- d-----w C:\Program Files\Digital Line Detect 2007-07-02 11:49:12 -------- d-----w C:\Program Files\Apoint 2007-07-02 10:13:36 -------- d-----w C:\DOCUME~1\Ness\APPLIC~1\SiteAdvisor 2007-06-23 12:30:31 -------- d-----w C:\DOCUME~1\Ness\APPLIC~1\LimeWire 2007-06-22 12:50:43 -------- d-----w C:\Program Files\McAfee 2007-06-04 08:30:27 -------- d-----w C:\Program Files\mIRC 2007-06-04 07:57:40 -------- d-----w C:\Program Files\iPod 2007-06-04 07:45:17 -------- d-----w C:\Program Files\Apple Software Update 2007-05-22 12:40:22 -------- d-----w C:\Program Files\LimeWire 2007-05-16 15:12:02 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll 2007-05-08 10:33:16 -------- d-----w C:\Program Files\SiteAdvisor 2007-04-25 14:21:15 144,896 ----a-w C:\WINDOWS\system32\schannel.dll 2007-04-18 16:12:23 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll 2007-04-16 12:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll 2007-04-16 12:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll 2007-04-16 12:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll 2007-04-16 12:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll 2007-04-16 12:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll 2007-04-16 12:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll 2007-04-16 12:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe 2007-04-16 12:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) Note empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] 2006-12-18 03:16 59032 --a------ C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{089FD14D-132B-48FC-8861-0048AE113215}] 2007-03-31 01:41 1099304 --a------ C:\Program Files\SiteAdvisor\6066\SiteAdv.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5CA3D70E-1895-11CF-8E15-001234567890}] 2005-05-31 04:33 118844 --a------ C:\WINDOWS\system32\dla\tfswshx.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}] 2007-03-14 03:43 501400 --a------ C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7DB2D5A0-7241-4E79-B68D-6309F01C5231}] 2006-12-22 15:02 67136 --a------ c:\program files\mcafee\virusscan\scriptcl.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Apoint"="C:\Program Files\Apoint\Apoint.exe" [2004-09-13 18:33] "IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2004-10-30 16:59] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-05-12 23:00] "PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [] "DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 18:19] "ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 18:50] "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 18:50] "CreativeMouse "="C:\Program Files\Mouse Driver\MouseDrv.exe" [2004-06-27 15:38] "PCSuiteTrayApplication"="C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.exe" [2006-06-15 11:36] "LogitechCommunicationsManager"="C:\Program Files\Common Files\Logitech\LComMgr\Communications_Helper.exe" [2006-10-31 00:03] "LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" [2006-11-15 20:58] "LVCOMSX"="C:\Program Files\Common Files\Logitech\LComMgr\LVComSX.exe" [2006-11-15 21:01] "SiteAdvisor"="C:\Program Files\SiteAdvisor\6066\SiteAdv.exe" [2007-02-09 14:37] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41] "Desktop Service Centre"="C:\Program Files\OptusNet DSL Internet\DSC.exe" [2005-11-30 12:21] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-05-26 12:45] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43] "Dell QuickSet"="C:\Program Files\Dell\QuickSet\Quickset.exe" [2005-03-04 13:26] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 11:54] "PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-06-27 15:21] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:00] "SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-06-27 18:54] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"="C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2006-12-20 13:55] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless] C:\Program Files\Intel\Wireless\Bin\LgNotify.dll [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d9281c87-1eac-11da-ad97-00c0eec3149e}] AutoRun\command- E:\setupSNK.exe Contents of the 'Scheduled Tasks' folder 2007-06-12 23:29:05 C:\WINDOWS\tasks\AppleSoftwareUpdate.job 2007-02-28 19:55:41 C:\WINDOWS\tasks\McDefragTask.job 2007-03-31 15:00:20 C:\WINDOWS\tasks\McQcTask.job ************************************************************************ catchme 0.3.914 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-07-07 17:13:19 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************ Completion time: 2007-07-07 17:14:16 C:\ComboFix-quarantined-files.txt ... 2007-07-07 17:14 C:\ComboFix2.txt ... 2007-07-03 22:58 C:\ComboFix3.txt ... 2007-07-03 21:55 --- E O F ---

07-07-2007, 01:28 AM	#16 (permalink)
sUBs Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy Join Date: May 2005 Posts: 24,326 OS: N/A	Re: vundo infection and various others Log looks to be in order. Is the machine still acting bizarre ? __________________ Question - what have you done for the community today?

07-07-2007, 01:35 AM	#17 (permalink)
nessa333 Registered User Join Date: Jun 2007 Posts: 10 OS: XP	Re: vundo infection and various others No the machine is running fine. there are no probs. It was when i ran the first comboFix-do that had problems but this time it ran fine. The superAntiSpyware program found a adware.tracking cookie this morning and has removed it. I rebooted and ran another scan and there was nothing found.

07-07-2007, 01:38 AM	#18 (permalink)
sUBs Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy Join Date: May 2005 Posts: 24,326 OS: N/A	Re: vundo infection and various others Your system is clean, kindly follow these simple steps in order to keep your computer clean and secure: CLEAR & RESET SYSTEM RESTORE'S CACHE - (System Volume Information folder) Go to Start → Run → type control sysdm.cpl,,4 & press Enter Tick on the checkbox - Turn off System Restore on all drives Click Apply Turn it back 'On' by unticking the same checkbox & click OK DISABLE THE VIEWING OF SYSTEM FILES From Windows Explorer, go to Tools>Folder Options> View tab. Untick - Show hidden files and folder Tick - Hide file extensions for known types Tick - Hide protected operating system files Click Yes to confirm & then click OK SECURING INTERNET EXPLORER From within Internet Explorer click on the Tools menu and then click on Internet Options. Select the Security tab Click once on the Internet icon so it becomes highlighted. Select Custom Level . Change 'Download signed ActiveX controls' to Prompt Change 'Download unsigned ActiveX controls' to Disable Change 'Initialize and script ActiveX controls not marked as safe' to Disable Change 'Installation of desktop items' to Prompt Change 'Launching programs and files in an IFRAME' to Prompt Change 'Navigate sub-frames across different domains' to Prompt When all these changes have been made, click on the OK button. If it prompts you as to whether or not you want to save the settings, press the Yes button. Select OK to exit the Internet Properties page. ANTIVIRUS SOFTWARE It is very important that you have anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future. See this link for a listing of some online & their stand-alone antivirus programs: Virus, Spyware, and Malware Protection and Removal Resources → http://www.bleepingcomputer.com/forums/topict405.html It is imperative that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out. FIREWALL Without a firewall your computer is succeptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. A tutorial on Firewalls and a listing of some available ones can be found here → http://www.bleepingcomputer.com/forums/tutorial60.html Microsoft Windows Update → http://www.windowsupdate.com Visit regularly. This will ensure your computer always has the latest security updates. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates. SPYBOT - SEARCH & DESTROY Download and install Spybot - Search & Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with the program on a regular basis just as you would an antivirus software. A tutorial on installing & using this product can be found here → http://www.bleepingcomputer.com/forums/tutorial43.html AD-AWARE Download and install Ad-Aware. You should use this program to scan your computer on a regular basis just as you would an antivirus software in conjunction with Spybot. A tutorial on installing & using this product can be found here → http://www.bleepingcomputer.com/forums/tutorial48.html SPYWAREBLASTER SpywareBlaster prevents the installation of malicious ActiveX, adware, browser hijackers, dialers, and other potentially unwanted software. Blocks spyware/tracking cookies & restricts the actions of potentially unwanted sites. Unlike other programs, SpywareBlaster does not have to remain running in the background. A tutorial on installing & using this product can be found here → http://www.bleepingcomputer.com/forums/tutorial49.html IE-SPYAD IE/Spyad places more than 4000 dubious websites and domains in the IE Restricted list. This severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites. A tutorial on installing this product can be found here http://www.spywarewarrior.com/uiuc/resource.htm Update all these programs regularly. Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released. Follow this list and your potential for being infected again will reduce dramatically. Here are some additional utilities that will further enhance your safety. http://www.trillian.cc → Trillian or http://www.miranda-im.com → Miranda-IM - These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN) http://www.mozilla.org/products/firefox/ - Firefox - Use this alternate browser. Whilst Internet Explorer is not a bad browser, almost every exploit crafted is targeted to take advantage of an IE weakness. http://java.com/en/index.jsp - Sun's Java - It's much more secure than Microsoft's Java Virtual Machine. http://toolbar.google.com/ - Google Toolbar - Get the free google toolbar to help stop pop up windows. http://cleanup.stevengould.org/ - CleanUP! - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders. http://www.aumha.org/downloads/erunt-setup.exe - ERUNT - A useful freeware utility for users of Windows 2000/XP. It's made up of two parts - ERUNT & NTREGOPT. ERUNT will create daily complete backups of your computer's Registry. Whilst System Restore does the same thing, a corrupt registry file may prevent Windows from booting & this effectively renders disables System Restore. With ERUNT, you're able to restore the damaged Registry. NTREGOPT works by recreating each registry hive "from scratch", thus removing any slack space that may be left from previously modified or deleted keys. In other words, it compacts the Registry to a small size which allows Windows to load & perform faster. http://www.winpatrol.com/ -Winpatrol - Download and install the free version of Winpatrol. A tutorial for this product is located here: http://www.winpatrol.com/features.html To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Tony Klein - http://computercops.biz/postlite7736-.html After doing all these, your system will be optimised against future threats. It's okay to delete the Hijack This folder in a couple weeks if everything is working okay. Have a safe & happy computing day. Please respond to this thread one more time so we can mark this thread as resolved. __________________ Question - what have you done for the community today?

07-07-2007, 01:44 AM	#19 (permalink)
nessa333 Registered User Join Date: Jun 2007 Posts: 10 OS: XP	Re: vundo infection and various others Thank you very much for you help