VundoFix removes vundo, but the vundo reappears...ljjiifc.dll

Lionet · 07-20-2007, 11:23 AM

Ever since I returned home from break, I have this program that runs on startup that says "Security Warning: Your computer may be infected with harmful or unwanted software!" And whenever I run VundoFix, it does not find ljjiifc.dll, when i googled the .dll a bunch of german sites came up talking about how to get rid of it, however i don't speak German >.> After running VundoFix, it searches fine, cleanes just fine, but then the files come back. Randomly I get popups, firefox gets an 0x0xxxxxxxxx error every time i close it and my sound driver often has an error and closes, so that I don't have sound until i restart. Please help me! This is ruining my school work and leisure fun!

Logfile of HijackThis v1.99.1
Scan saved at 1:16:58 PM, on 7/20/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\System32\Ati2evxx.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\system32\Ati2evxx.exe
C:\windows\system32\spoolsv.exe
C:\windows\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\windows\System32\svchost.exe
C:\windows\system32\wuauclt.exe
C:\windows\SOUNDMAN.EXE
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\UltraMon\UltraMon.exe
D:\Program Files\AIM\aim.exe
C:\Program Files\DAEMON Tools\daemon.exe
D:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
D:\Program Files\iTunes\iTunes.exe
D:\Desktop\Desktop\analize.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = home.netscape.com
O1 - Hosts: 66.98.148.65 auto.search.msn.com
O1 - Hosts: 66.98.148.65 auto.search.msn.es
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {2A9430A5-4D04-437D-A745-D212033D6AC1} - C:\windows\system32\vtsqn.dll
O2 - BHO: (no name) - {3F4F125D-F31E-4D37-AC35-E50128670469} - C:\windows\system32\ljjiifc.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [CTDrive] rundll32.exe C:\WINDOWS\system32\drvcup.dll,startup
O4 - HKCU\..\Run: [UltraMon] "C:\Program Files\UltraMon\UltraMon.exe" /auto
O4 - HKCU\..\Run: [AIM] D:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Update Service] C:\PROGRA~1\COMMON~1\TEKNUM~1\update.exe /startup
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = D:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - D:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/micr...?1179938781046
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1179938771406
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\PROGRA~1\MICROS~1\Office12\GR99D3~1.DLL
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: ljjiifc - C:\windows\SYSTEM32\ljjiifc.dll
O20 - Winlogon Notify: WBSrv - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll
O20 - Winlogon Notify: WgaLogon - C:\windows\
O20 - Winlogon Notify: wineil32 - C:\windows\SYSTEM32\wineil32.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\windows\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe (file missing)
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: mental ray 3.5 Satellite (32-bit) (mi-raysat_3dsmax9_32) - Unknown owner - D:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe
O23 - Service: TVersityMediaServer - Unknown owner - D:\Program Files\TVersity\Media Server\MediaServer.exe (file missing)

Lionet · 07-20-2007, 01:37 PM

I just noticed something else, in Firefox or Internet Explorer, if I'm viewing anything with audio, the audio will be barely audible. I have 5.1 speakers and I have to put the audio at 3x the norm to barely hear what is playing...not sure if that has anything at all to do with the Trojans but figured I would mention that.

Clark76 · 07-20-2007, 04:02 PM

Hello and welcome to TSF

I am currently reviewing your log. Please note that this is under the supervision of an expert analyst, and I will be back with a fix for your problem a.s.a.p

Please be patient with me during this time.

You may wish to subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe.

Clark76 · 07-20-2007, 05:17 PM

Hello again

Quote:

I just noticed something else, in Firefox or Internet Explorer, if I'm viewing anything with audio, the audio will be barely audible. I have 5.1 speakers and I have to put the audio at 3x the norm to barely hear what is playing...not sure if that has anything at all to do with the Trojans but figured I would mention that.

I am not sure if this is related to the infection on your system. Lets first clean your system up and see if it solves your audio problem

==================

Download ComboFix from here
http://download.bleepingcomputer.com...a/ComboFix.exe

**Save it directly to your desktop**

Double click on combofix.exe & follow the prompts.
When finished, it shall produce a log for you. Post that log in your next reply

Note:
Do not mouseclick combofix's window while it's running. That may cause it to stall

=================

I see no evidence of an AntiVirus program on your system. This must be resolved. Here are two very good free Antivirus products which are available:

Select one of these, or another of your choice. Download, install, update definitions, and run a full system scan.

===================

Then run Hijackthis again and post back with the log it produces also.

Lionet · 07-20-2007, 06:47 PM

ComboFix Log::

"Nick" - 2007-07-20 17:28:24 - ComboFix 07-07-14.6 - Service Pack 2 NTFS

((((((((((((((((((((((((( Files Created from 2007-06-20 to 2007-07-20 )))))))))))))))))))))))))))))))

2007-07-18 00:48 <DIR> d--h----- C:\WINDOWS\PIF
2007-07-18 00:27 720,896 --a------ C:\WINDOWS\iun6002ev.exe
2007-07-18 00:26 <DIR> d-------- C:\Program Files\directx
2007-07-17 23:33 <DIR> d-------- C:\Program Files\DAEMON Tools
2007-07-17 23:23 <DIR> d-------- C:\Program Files\Alcohol Soft
2007-07-17 19:32 <DIR> d-------- C:\rs
2007-07-17 19:31 <DIR> d-------- C:\Program Files\Common Files\SWF Studio
2007-07-17 19:30 32,768 --a------ C:\WINDOWS\NCUNINST.EXe
2007-07-17 02:50 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-07-17 02:04 <DIR> d-------- C:\VundoFix Backups
2007-07-16 20:48 786,432 --ah----- C:\DOCUME~1\ADMINI~1\NTUSER.DAT
2007-07-16 18:43 <DIR> d-------- C:\DOCUME~1\Nick\APPLIC~1\Prevx
2007-07-16 18:41 77,312 --a------ C:\WINDOWS\ua2.dll
2007-07-16 18:37 <DIR> d-------- C:\DOCUME~1\Nick\APPLIC~1\GetRightToGo
2007-07-15 20:37 26,624 --a------ C:\WINDOWS\system32\ssmenu.dll
2007-07-15 20:37 1,348 --a------ C:\WINDOWS\system32\tsdigsgn.dat
2007-07-15 20:37 <DIR> d---s---- C:\Program Files\Common Files\Teknum Systems
2007-07-15 20:37 <DIR> d-------- C:\Program Files\HandyBits
2007-07-15 20:30 68,992 --a------ C:\WINDOWS\system32\drivers\LMouKE.Sys
2007-07-15 20:30 52,992 --a------ C:\WINDOWS\system32\drivers\L8042MOU.SYS
2007-07-15 20:30 36,480 --a------ C:\WINDOWS\system32\drivers\LHidUsbK.sys
2007-07-15 20:30 13,056 --a------ C:\WINDOWS\system32\drivers\L8042Kbd.SYS
2007-07-15 20:29 49,152 --a------ C:\WINDOWS\KHALMNPR.Exe
2007-07-15 20:29 24,704 --a------ C:\WINDOWS\system32\drivers\LHidKE.Sys
2007-07-15 20:14 <DIR> d-------- C:\Program Files\Security Task Manager
2007-07-15 20:14 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\SecTaskMan
2007-07-15 13:23 <DIR> d-------- C:\WINDOWS\system32\vvenfkta
2007-07-14 01:52 98,304 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2007-07-13 15:55 <DIR> d-------- C:\Program Files\Hero Editor
2007-07-13 15:54 73,216 --a------ C:\WINDOWS\ST6UNST.EXE
2007-07-13 15:54 249,856 --------- C:\WINDOWS\Setup1.exe
2007-07-10 11:40 2,829 --a------ C:\WINDOWS\DiabUnin.pif
2007-07-10 11:40 118,784 --a------ C:\WINDOWS\DiabUnin.exe
2007-07-10 11:40 10,059 --a------ C:\WINDOWS\DiabUnin.dat
2007-07-10 11:24 43,520 --a------ C:\WINDOWS\system32\CmdLineExt03.dll
2007-07-10 11:14 21,840 --a----t- C:\WINDOWS\system32\SIntfNT.dll
2007-07-10 11:14 17,212 --a----t- C:\WINDOWS\system32\SIntf32.dll
2007-07-10 11:14 12,067 --a----t- C:\WINDOWS\system32\SIntf16.dll
2007-07-10 11:09 94,208 --a------ C:\WINDOWS\DIIUnin.exe
2007-07-10 11:09 35,277 --a------ C:\WINDOWS\DIIUnin.dat
2007-07-10 11:09 2,829 --a------ C:\WINDOWS\DIIUnin.pif
2007-07-08 22:21 <DIR> d-------- C:\Program Files\iPod
2007-07-08 22:18 <DIR> d-------- C:\Program Files\Common Files\Apple
2007-07-08 22:18 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-18 04:14:13 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-07-17 01:10:34 -------- d-----w C:\Program Files\BitTornado
2007-07-15 17:10:00 685,816 ----a-w C:\windows\system32\drivers\sptd.sys
2007-07-09 02:10:08 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\Apple Computer
2007-06-19 23:33:08 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\Aim
2007-06-19 23:22:45 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\Help
2007-06-15 04:50:12 -------- d-----w C:\Program Files\Movie Maker
2007-06-15 04:49:59 -------- d-----w C:\Program Files\Windows Media Connect 2
2007-06-15 04:49:56 -------- d-----w C:\Program Files\QuickTime Alternative
2007-06-15 04:49:56 -------- d-----w C:\Program Files\Messenger
2007-06-15 04:49:55 -------- d-----w C:\Program Files\DivX
2007-06-15 04:49:54 -------- d-----w C:\Program Files\AIM
2007-06-14 10:33:12 -------- d-----w C:\Program Files\QuickTime
2007-06-13 05:10:53 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\Ventrilo
2007-06-13 04:35:10 -------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2007-06-12 23:46:38 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\DivX
2007-06-06 15:38:34 -------- d-----w C:\Program Files\MSN Messenger
2007-06-05 19:21:32 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\Real
2007-06-05 19:14:37 -------- d-----w C:\Program Files\Common Files\xing shared
2007-06-05 19:14:33 -------- d-----w C:\Program Files\Common Files\Real
2007-06-05 18:44:59 1,568 ----a-w C:\windows\mozver.dat
2007-06-03 06:48:36 -------- d-----w C:\Program Files\Microsoft Works
2007-06-03 06:47:50 -------- d-----w C:\Program Files\MSBuild
2007-06-03 06:44:44 -------- d-----w C:\Program Files\Microsoft.NET
2007-06-03 06:41:52 -------- d-----w C:\Program Files\Microsoft Visual Studio 8
2007-06-03 04:41:56 -------- d-----w C:\Program Files\Common Files\Adobe Systems Shared
2007-06-03 01

47 -------- d-----w C:\Program Files\Autodesk
2007-06-03 01

44 -------- d-----w C:\Program Files\Common Files\Autodesk Shared
2007-06-03 00:34:47 -------- d-----w C:\Program Files\PowerISO
2007-06-02 23:14:41 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\dvdcss
2007-06-01 01:21:17 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\vlc
2007-05-31 06:45:07 524,288 ----a-w C:\windows\system32\DivXsm.exe
2007-05-31 06:44:55 823,296 ----a-w C:\windows\system32\divx_xx07.dll
2007-05-31 06:44:54 823,296 ----a-w C:\windows\system32\divx_xx0c.dll
2007-05-31 06:44:54 802,816 ----a-w C:\windows\system32\divx_xx11.dll
2007-05-31 06:44:54 740,442 ----a-w C:\windows\system32\DivX.dll
2007-05-29 20:18:18 -------- d-----w C:\Program Files\Apple Software Update
2007-05-28 03:09:21 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\Lavasoft
2007-05-27 03:58:33 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\SmartFTP
2007-05-27 03:58:15 -------- d-----w C:\Program Files\SmartFTP Client
2007-05-25 19:00:07 -------- d-----w C:\Program Files\545 Studios
2007-05-25 18:50:31 -------- d-----w C:\Program Files\AOD
2007-05-25 17:58:57 -------- d-----w C:\Program Files\Windows NT
2007-05-25 05:05:34 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\Realtime Soft
2007-05-25 05:04:56 -------- d-----w C:\Program Files\UltraMon
2007-05-25 05:04:56 -------- d-----w C:\Program Files\Common Files\Realtime Soft
2007-05-25 04:51:31 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\Viewpoint
2007-05-25 04:38:41 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\Media Player Classic
2007-05-25 03:49:13 60,416 ----a-w C:\windows\ALCFDRTM.EXE
2007-05-25 03:42:45 -------- d-----w C:\Program Files\Stardock
2007-05-25 03:41:44 -------- d-----w C:\Program Files\VideoLAN
2007-05-25 02:16:07 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\Logitech
2007-05-25 02:13:33 -------- d-----w C:\Program Files\Common Files\Logitech
2007-05-25 02:13:03 -------- d-----w C:\Program Files\Logitech
2007-05-24 14:08:13 -------- d-----w C:\Program Files\PlayOnline
2007-05-24 11:29:22 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\WinRAR
2007-05-24 01:54:33 4,096 ----a-w C:\windows\d3dx.dat
2007-05-24 01:47:52 -------- d-----w C:\Program Files\Common Files\InstallShield
2007-05-23 03:22:06 -------- d-----w C:\Program Files\ATI Technologies
2007-05-23 03:12:18 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\.BitTornado
2007-05-23 03:11:35 -------- d-----w C:\Program Files\Viewpoint
2007-05-23 03:10:50 335 ----a-w C:\windows\nsreg.dat
2007-05-23 02:59:21 -------- d-----w C:\Program Files\microsoft frontpage
2007-05-23 02:55:15 0 --sha-r C:\MSDOS.SYS
2007-05-23 02:55:15 0 --sha-r C:\IO.SYS
2007-05-23 02:55:15 0 ----a-w C:\CONFIG.SYS
2007-05-23 02:55:15 0 ----a-w C:\AUTOEXEC.BAT
2007-05-23 02:52:30 -------- d-----w C:\Program Files\Common Files\MSSoap
2007-05-23 02:52:08 21,640 ----a-w C:\windows\system32\emptyregdb.dat
2007-05-23 02:51:11 -------- d--h--w C:\Program Files\WindowsUpdate
2007-05-23 02:51:10 -------- d-----w C:\Program Files\Online Services
2007-05-23 02:50:58 -------- d-----w C:\Program Files\MSN Gaming Zone
2007-05-22 22:10:05 -------- d-----w C:\Program Files\Common Files\ODBC
2007-05-22 22:10:01 -------- d-----w C:\Program Files\Common Files\SpeechEngines
2007-05-16 15:12:02 683,520 ----a-w C:\windows\system32\inetcomm.dll
2007-04-25 14:21:15 144,896 ----a-w C:\windows\system32\schannel.dll
2007-04-23 00:15:29 3,596,288 ----a-w C:\windows\system32\qt-dx331.dll
2007-04-23 00:15:24 129,784 ------w C:\windows\system32\pxafs.dll
2007-04-23 00:15:24 118,520 ------w C:\windows\system32\pxinsi64.exe
2007-04-23 00:15:24 116,472 ------w C:\windows\system32\pxcpyi64.exe
2007-04-23 00:15:18 200,704 ----a-w C:\windows\system32\ssldivx.dll
2007-04-23 00:15:18 1,044,480 ----a-w C:\windows\system32\libdivx.dll
2007-04-23 00:02:34 73,728 ----a-w C:\windows\system32\dpl100.dll
2007-04-23 00:02:34 196,608 ----a-w C:\windows\system32\dtu100.dll
2007-04-23 00:02:33 53,248 ----a-w C:\windows\system32\dpuGUI10.dll
2007-04-23 00:02:31 593,920 ----a-w C:\windows\system32\dpuGUI11.dll
2007-04-23 00:02:31 57,344 ----a-w C:\windows\system32\dpv11.dll
2007-04-23 00:02:31 344,064 ----a-w C:\windows\system32\dpus11.dll
2007-04-23 00:02:31 294,912 ----a-w C:\windows\system32\dpu11.dll
2007-04-23 00:02:31 294,912 ----a-w C:\windows\system32\dpu10.dll
2007-04-23 00:01:47 12,288 ----a-w C:\windows\system32\DivXWMPExtType.dll
2007-04-23 00:01:46 124,472 ----a-w C:\windows\system32\DivXCodecUpdateChecker.exe

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2006-10-22 23:08 62080 --a------ C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
2006-10-27 00:48 2210608 --a------ D:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
2007-03-14 03:43 501400 --a------ C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2004-12-01 03:54 C:\WINDOWS\SOUNDMAN.EXE]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2004-12-10 12:45 C:\WINDOWS\KHALMNPR.Exe]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]
"GrooveMonitor"="D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-06-05 15:14]
"iTunesHelper"="D:\Program Files\iTunes\iTunesHelper.exe" [2007-06-28 09:14]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41]
"PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2007-04-09 08:23]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UltraMon"="C:\Program Files\UltraMon\UltraMon.exe" [2006-10-12 21:27]
"AIM"="D:\Program Files\AIM\aim.exe" [2003-08-01 11:31]
"Update Service"="C:\PROGRA~1\COMMON~1\TEKNUM~1\update.exe" [2007-07-15 20:37]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-04-03 18:29]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"="D:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL" [2006-10-27 00:48]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv]
C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll --a------ 2007-05-24 23:46 176128 C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\WbSrv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=wbsys.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Nick^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=C:\Documents and Settings\Nick\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
AutoRun\command- E:\setup.exe

*Newly Created Service* - CATCHME

Contents of the 'Scheduled Tasks' folder
2007-07-17 20:17:03 C:\windows\tasks\AppleSoftwareUpdate.job

**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-20 17:30:20
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

**************************************************************************

Completion time: 2007-07-20 17:31:20
C:\ComboFix-quarantined-files.txt ... 2007-07-20 17:30
C:\ComboFix2.txt ... 2007-07-20 15:49

--- E O F ---

ComboFix Quarantined Files::

2007-05-01 11:35 146432 --a------ C:\Qoobox\Quarantine\C\Program Files\Common Files\Yazzle1162OinAdmin.exe.vir
2007-07-15 13:22 19968 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\wineil32.dll.vir
2007-07-15 13:22 72704 --a------ C:\Qoobox\Quarantine\C\Program Files\Common Files\YSTEM~1\regedit.exe~.vir
2007-07-15 13:23 31254 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\pmnolmk.dll.vir
2007-07-15 13:51 577536 --a------ C:\Qoobox\Quarantine\C\Program Files\Ultimate Fixer\ufixer.pkg.vir
2007-07-15 20:19 31254 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\pmnkigh.dll.vir
2007-07-16 01:36 66112 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\lvwpkhha.exe.vir
2007-07-17 02:55 31254 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\yaywvvs.dll.vir
2007-07-17 02:55 40183 --a------ C:\Qoobox\Quarantine\C\Program Files\Common Files\Yazzle1162OinUninstaller.exe.vir
2007-07-17 14:28 66112 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\xbvkpkin.exe.vir
2007-07-17 23:19 31254 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\tuvurss.dll.vir
2007-07-18 19:28 66112 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\vnfxygbj.exe.vir
2007-07-18 19:39 10240 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\syswin.exe.vir
2007-07-18 22:59 31254 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\ljjiifc.dll.vir
2007-07-19 23:58 66112 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\mawwoxqc.exe.vir
2007-07-20 12:42 266336 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\vtsqn.dll.vir
2007-07-20 12:51 2 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\wnsapisv32.exe.vir
2007-07-20 14:18 266336 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\geedd.dll.vir
2007-07-20 14:26 1803611 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\nqstv.bak1.vir
2007-07-20 14:26 66112 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\usjbvqtc.exe.vir
2007-07-20 15:39 4672 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\wapeuunl.exe.vir
2007-07-20 15:44 106 --a------ C:\Qoobox\Quarantine\catchme.log
2007-07-20 15:44 1822924 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\nqstv.ini.vir

Folder PATH listing
Volume serial number is B443-1A2E
C:\QOOBOX
\---Quarantine
| catchme.log
|
+---C
| +---Program Files
| | +---Common Files
| | | | Yazzle1162OinAdmin.exe.vir
| | | | Yazzle1162OinUninstaller.exe.vir
| | | |
| | | \---YSTEM~1
| | | regedit.exe~.vir
| | |
| | \---Ultimate Fixer
| | ufixer.pkg.vir
| |
| \---WINDOWS
| \---system32
| geedd.dll.vir
| ljjiifc.dll.vir
| lvwpkhha.exe.vir
| mawwoxqc.exe.vir
| nqstv.bak1.vir
| nqstv.ini.vir
| pmnkigh.dll.vir
| pmnolmk.dll.vir
| syswin.exe.vir
| tuvurss.dll.vir
| usjbvqtc.exe.vir
| vnfxygbj.exe.vir
| vtsqn.dll.vir
| wapeuunl.exe.vir
| wineil32.dll.vir
| wnsapisv32.exe.vir
| xbvkpkin.exe.vir
| yaywvvs.dll.vir
|
\---Registry_backups

Hijackthis Log

Logfile of HijackThis v1.99.1
Scan saved at 8:40:08 PM, on 7/20/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\csrss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\System32\Ati2evxx.exe
C:\windows\system32\svchost.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\system32\Ati2evxx.exe
C:\windows\System32\svchost.exe
C:\windows\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\windows\System32\svchost.exe
C:\Program Files\Windows Media Player\WMPNetwk.exe
C:\windows\System32\alg.exe
C:\windows\SOUNDMAN.EXE
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\UltraMon\UltraMon.exe
D:\Program Files\AIM\aim.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\windows\explorer.exe
D:\Program Files\BitTornado\btdownloadgui.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
D:\Desktop\Desktop\analize.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = home.netscape.com
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKCU\..\Run: [UltraMon] "C:\Program Files\UltraMon\UltraMon.exe" /auto
O4 - HKCU\..\Run: [AIM] D:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Update Service] C:\PROGRA~1\COMMON~1\TEKNUM~1\update.exe /startup
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = D:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - D:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/micr...?1179938781046
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1179938771406
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\PROGRA~1\MICROS~1\Office12\GR99D3~1.DLL
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: WBSrv - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll
O20 - Winlogon Notify: WgaLogon - C:\windows\
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\windows\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe (file missing)
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: mental ray 3.5 Satellite (32-bit) (mi-raysat_3dsmax9_32) - Unknown owner - D:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe
O23 - Service: TVersityMediaServer - Unknown owner - D:\Program Files\TVersity\Media Server\MediaServer.exe (file missing)

Amazing! Just one program got rid of just about all the bad files from before! Audio still won't work in IE or Firefox so it must be something else...

Clark76 · 07-20-2007, 08:16 PM

It appears that you have an older copy of ComboFix. The tool has been recently updated today. Please delete your current copy of Combofix and them follow my previous instruction again in the same order as listed.

run Combofix
install an anti-virus program, update it, and run a full system scan
get a new Hijackthis log

There will be three logs I will like to see:

C:\ComboFix.txt << this one should be the one from the newest run of Combofix
C:\ComboFix3.txt
new Hijackthis log

I would like to stress that you need to install an anti-virus program. Here are two very good free Antivirus products which are available:

Also, please do not assume that a lack of symptoms is a clean machine. Please stick with me till your logs are declared clean.

Lionet · 07-21-2007, 12:06 AM

Ok! I went with AVG, ran a full system scan and it found a few more trojans...lo and behold it was the diablo II nocd file. Also, I did not locate a ComboFix3.txt, I deleted all the old ComboFix files and ran a new one, it gave me ComboFix.txt and ComboFix-quarantinedfiles.txt So I've posted them below.

ComboFix.txt

"Nick" - 2007-07-21 1:58:37 - ComboFix 07-07-21.4 - Service Pack 2 NTFS

((((((((((((((((((((((((( Files Created from 2007-06-21 to 2007-07-21 )))))))))))))))))))))))))))))))

2007-07-18 00:48 <DIR> d--h----- C:\WINDOWS\PIF
2007-07-18 00:27 720,896 --a------ C:\WINDOWS\iun6002ev.exe
2007-07-18 00:26 <DIR> d-------- C:\Program Files\directx
2007-07-17 23:33 <DIR> d-------- C:\Program Files\DAEMON Tools
2007-07-17 23:23 <DIR> d-------- C:\Program Files\Alcohol Soft
2007-07-17 19:32 <DIR> d-------- C:\rs
2007-07-17 19:31 <DIR> d-------- C:\Program Files\Common Files\SWF Studio
2007-07-17 19:30 32,768 --a------ C:\WINDOWS\NCUNINST.EXe
2007-07-17 02:50 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-07-17 02:04 <DIR> d-------- C:\VundoFix Backups
2007-07-16 20:48 557,056 --a------ C:\DOCUME~1\ADMINI~1\NTUSER.DAT
2007-07-16 18:43 <DIR> d-------- C:\DOCUME~1\Nick\APPLIC~1\Prevx
2007-07-16 18:41 77,312 --a------ C:\WINDOWS\ua2.dll
2007-07-16 18:37 <DIR> d-------- C:\DOCUME~1\Nick\APPLIC~1\GetRightToGo
2007-07-15 20:37 26,624 --a------ C:\WINDOWS\system32\ssmenu.dll
2007-07-15 20:37 1,348 --a------ C:\WINDOWS\system32\tsdigsgn.dat
2007-07-15 20:37 <DIR> d---s---- C:\Program Files\Common Files\Teknum Systems
2007-07-15 20:37 <DIR> d-------- C:\Program Files\HandyBits
2007-07-15 20:30 68,992 --a------ C:\WINDOWS\system32\drivers\LMouKE.Sys
2007-07-15 20:30 52,992 --a------ C:\WINDOWS\system32\drivers\L8042MOU.SYS
2007-07-15 20:30 36,480 --a------ C:\WINDOWS\system32\drivers\LHidUsbK.sys
2007-07-15 20:30 13,056 --a------ C:\WINDOWS\system32\drivers\L8042Kbd.SYS
2007-07-15 20:29 49,152 --a------ C:\WINDOWS\KHALMNPR.Exe
2007-07-15 20:29 24,704 --a------ C:\WINDOWS\system32\drivers\LHidKE.Sys
2007-07-15 20:14 <DIR> d-------- C:\Program Files\Security Task Manager
2007-07-15 20:14 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\SecTaskMan
2007-07-15 13:23 <DIR> d-------- C:\WINDOWS\system32\vvenfkta
2007-07-14 01:52 98,304 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2007-07-13 15:55 <DIR> d-------- C:\Program Files\Hero Editor
2007-07-13 15:54 73,216 --a------ C:\WINDOWS\ST6UNST.EXE
2007-07-13 15:54 249,856 --------- C:\WINDOWS\Setup1.exe
2007-07-10 11:24 43,520 --a------ C:\WINDOWS\system32\CmdLineExt03.dll
2007-07-10 11:14 21,840 --a----t- C:\WINDOWS\system32\SIntfNT.dll
2007-07-10 11:14 17,212 --a----t- C:\WINDOWS\system32\SIntf32.dll
2007-07-10 11:14 12,067 --a----t- C:\WINDOWS\system32\SIntf16.dll
2007-07-10 11:09 94,208 --a------ C:\WINDOWS\DIIUnin.exe
2007-07-10 11:09 35,277 --a------ C:\WINDOWS\DIIUnin.dat
2007-07-10 11:09 2,829 --a------ C:\WINDOWS\DIIUnin.pif
2007-07-08 22:21 <DIR> d-------- C:\Program Files\iPod
2007-07-08 22:18 <DIR> d-------- C:\Program Files\Common Files\Apple
2007-07-08 22:18 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-20 22:53:12 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-07-17 01:10:34 -------- d-----w C:\Program Files\BitTornado
2007-07-15 17:10:00 685,816 ----a-w C:\windows\system32\drivers\sptd.sys
2007-07-09 02:10:08 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\Apple Computer
2007-06-19 23:33:08 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\Aim
2007-06-19 23:22:45 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\Help
2007-06-15 04:50:12 -------- d-----w C:\Program Files\Movie Maker
2007-06-15 04:49:59 -------- d-----w C:\Program Files\Windows Media Connect 2
2007-06-15 04:49:56 -------- d-----w C:\Program Files\QuickTime Alternative
2007-06-15 04:49:56 -------- d-----w C:\Program Files\Messenger
2007-06-15 04:49:55 -------- d-----w C:\Program Files\DivX
2007-06-15 04:49:54 -------- d-----w C:\Program Files\AIM
2007-06-14 10:33:12 -------- d-----w C:\Program Files\QuickTime
2007-06-13 05:10:53 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\Ventrilo
2007-06-13 04:35:10 -------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2007-06-12 23:46:38 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\DivX
2007-06-06 15:38:34 -------- d-----w C:\Program Files\MSN Messenger
2007-06-05 19:21:32 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\Real
2007-06-05 19:14:37 -------- d-----w C:\Program Files\Common Files\xing shared
2007-06-05 19:14:33 -------- d-----w C:\Program Files\Common Files\Real
2007-06-05 18:44:59 1,568 ----a-w C:\windows\mozver.dat
2007-06-03 06:48:36 -------- d-----w C:\Program Files\Microsoft Works
2007-06-03 06:47:50 -------- d-----w C:\Program Files\MSBuild
2007-06-03 06:44:44 -------- d-----w C:\Program Files\Microsoft.NET
2007-06-03 06:41:52 -------- d-----w C:\Program Files\Microsoft Visual Studio 8
2007-06-03 04:41:56 -------- d-----w C:\Program Files\Common Files\Adobe Systems Shared
2007-06-03 01

47 -------- d-----w C:\Program Files\Autodesk
2007-06-03 01

44 -------- d-----w C:\Program Files\Common Files\Autodesk Shared
2007-06-03 00:34:47 -------- d-----w C:\Program Files\PowerISO
2007-06-02 23:14:41 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\dvdcss
2007-06-01 01:21:17 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\vlc
2007-05-31 06:45:07 524,288 ----a-w C:\windows\system32\DivXsm.exe
2007-05-31 06:44:55 823,296 ----a-w C:\windows\system32\divx_xx07.dll
2007-05-31 06:44:54 823,296 ----a-w C:\windows\system32\divx_xx0c.dll
2007-05-31 06:44:54 802,816 ----a-w C:\windows\system32\divx_xx11.dll
2007-05-31 06:44:54 740,442 ----a-w C:\windows\system32\DivX.dll
2007-05-29 20:18:18 -------- d-----w C:\Program Files\Apple Software Update
2007-05-28 03:09:21 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\Lavasoft
2007-05-27 03:58:33 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\SmartFTP
2007-05-27 03:58:15 -------- d-----w C:\Program Files\SmartFTP Client
2007-05-25 19:00:07 -------- d-----w C:\Program Files\545 Studios
2007-05-25 18:50:31 -------- d-----w C:\Program Files\AOD
2007-05-25 17:58:57 -------- d-----w C:\Program Files\Windows NT
2007-05-25 05:05:34 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\Realtime Soft
2007-05-25 05:04:56 -------- d-----w C:\Program Files\UltraMon
2007-05-25 05:04:56 -------- d-----w C:\Program Files\Common Files\Realtime Soft
2007-05-25 04:51:31 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\Viewpoint
2007-05-25 04:38:41 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\Media Player Classic
2007-05-25 03:49:13 60,416 ----a-w C:\windows\ALCFDRTM.EXE
2007-05-25 03:42:45 -------- d-----w C:\Program Files\Stardock
2007-05-25 03:41:44 -------- d-----w C:\Program Files\VideoLAN
2007-05-25 02:16:07 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\Logitech
2007-05-25 02:13:33 -------- d-----w C:\Program Files\Common Files\Logitech
2007-05-25 02:13:03 -------- d-----w C:\Program Files\Logitech
2007-05-24 14:08:13 -------- d-----w C:\Program Files\PlayOnline
2007-05-24 11:29:22 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\WinRAR
2007-05-24 01:54:33 4,096 ----a-w C:\windows\d3dx.dat
2007-05-24 01:47:52 -------- d-----w C:\Program Files\Common Files\InstallShield
2007-05-23 03:22:06 -------- d-----w C:\Program Files\ATI Technologies
2007-05-23 03:12:18 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\.BitTornado
2007-05-23 03:11:35 -------- d-----w C:\Program Files\Viewpoint
2007-05-23 03:10:50 335 ----a-w C:\windows\nsreg.dat
2007-05-23 02:59:21 -------- d-----w C:\Program Files\microsoft frontpage
2007-05-23 02:55:15 0 --sha-r C:\MSDOS.SYS
2007-05-23 02:55:15 0 --sha-r C:\IO.SYS
2007-05-23 02:55:15 0 ----a-w C:\CONFIG.SYS
2007-05-23 02:55:15 0 ----a-w C:\AUTOEXEC.BAT
2007-05-23 02:52:30 -------- d-----w C:\Program Files\Common Files\MSSoap
2007-05-23 02:52:08 21,640 ----a-w C:\windows\system32\emptyregdb.dat
2007-05-23 02:51:11 -------- d--h--w C:\Program Files\WindowsUpdate
2007-05-23 02:51:10 -------- d-----w C:\Program Files\Online Services
2007-05-23 02:50:58 -------- d-----w C:\Program Files\MSN Gaming Zone
2007-05-22 22:10:05 -------- d-----w C:\Program Files\Common Files\ODBC
2007-05-22 22:10:01 -------- d-----w C:\Program Files\Common Files\SpeechEngines
2007-05-16 15:12:02 683,520 ----a-w C:\windows\system32\inetcomm.dll
2007-04-25 14:21:15 144,896 ----a-w C:\windows\system32\schannel.dll
2007-04-23 00:15:29 3,596,288 ----a-w C:\windows\system32\qt-dx331.dll
2007-04-23 00:15:24 129,784 ------w C:\windows\system32\pxafs.dll
2007-04-23 00:15:24 118,520 ------w C:\windows\system32\pxinsi64.exe
2007-04-23 00:15:24 116,472 ------w C:\windows\system32\pxcpyi64.exe
2007-04-23 00:15:18 200,704 ----a-w C:\windows\system32\ssldivx.dll
2007-04-23 00:15:18 1,044,480 ----a-w C:\windows\system32\libdivx.dll
2007-04-23 00:02:34 73,728 ----a-w C:\windows\system32\dpl100.dll
2007-04-23 00:02:34 196,608 ----a-w C:\windows\system32\dtu100.dll
2007-04-23 00:02:33 53,248 ----a-w C:\windows\system32\dpuGUI10.dll
2007-04-23 00:02:31 593,920 ----a-w C:\windows\system32\dpuGUI11.dll
2007-04-23 00:02:31 57,344 ----a-w C:\windows\system32\dpv11.dll
2007-04-23 00:02:31 344,064 ----a-w C:\windows\system32\dpus11.dll
2007-04-23 00:02:31 294,912 ----a-w C:\windows\system32\dpu11.dll
2007-04-23 00:02:31 294,912 ----a-w C:\windows\system32\dpu10.dll
2007-04-23 00:01:47 12,288 ----a-w C:\windows\system32\DivXWMPExtType.dll
2007-04-23 00:01:46 124,472 ----a-w C:\windows\system32\DivXCodecUpdateChecker.exe

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2004-12-01 03:54 C:\WINDOWS\SOUNDMAN.EXE]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2004-12-10 12:45 C:\WINDOWS\KHALMNPR.Exe]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]
"GrooveMonitor"="D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-06-05 15:14]
"iTunesHelper"="D:\Program Files\iTunes\iTunesHelper.exe" [2007-06-28 09:14]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41]
"PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2007-04-09 08:23]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-07-20 21:01]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UltraMon"="C:\Program Files\UltraMon\UltraMon.exe" [2006-10-12 21:27]
"AIM"="D:\Program Files\AIM\aim.exe" [2003-08-01 11:31]
"Update Service"="C:\PROGRA~1\COMMON~1\TEKNUM~1\update.exe" [2007-07-15 20:37]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-04-03 18:29]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - D:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 01:48:20]
Adobe Reader Synchronizer.lnk - D:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 00:01:50]
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2007-05-24 22:13:29]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv]
C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll 2007-05-24 23:46 176128 C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\WbSrv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=wbsys.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Nick^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=C:\Documents and Settings\Nick\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup

023 - gmsipci - \??\E:\INSTALL\GMSIPCI.SYS
023 - l8042kbd - System32\Drivers\L8042Kbd.sys
023 - l8042mou - System32\Drivers\L8042mou.sys
023 - lhidke - System32\DRIVERS\LHidKE.Sys
023 - lhidusbk - System32\Drivers\LHidUsbK.Sys
023 - lmouke - System32\Drivers\LMouKE.sys
023 - microsoft office groove audit service - "D:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe"
023 - msicpl - \??\E:\install4\MSICPL.sys
023 - ntaccess - \??\E:\NTACCESS.sys
023 - odserv - "C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE"
023 - rtl8023xp - System32\DRIVERS\Rtlnicxp.sys
023 - saih8000 - System32\DRIVERS\SaiH8000.sys
023 - setupntglm7x - \??\E:\NTGLM7X.sys
023 - ultramonmirror - System32\DRIVERS\UltraMonMirror.sys
023 - ultramonutility - \??\C:\Program Files\Common Files\Realtime Soft\UltraMonMirrorDrv\x32\UltraMonUtility.sys
023 - vulfnths - \SystemRoot\System32\Drivers\vulfnth.sys
023 - vulfntrs - \SystemRoot\System32\Drivers\vulfntr.sys

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
AutoRun\command- E:\setup.exe

*Newly Created Service* - AVG7ALRT
*Newly Created Service* - AVG7CORE
*Newly Created Service* - AVG7RSW
*Newly Created Service* - AVG7RSXP
*Newly Created Service* - AVG7UPDSVC
*Newly Created Service* - AVGCLEAN
*Newly Created Service* - AVGEMS
*Newly Created Service* - AVGTDI
*Newly Created Service* - CATCHME

Contents of the 'Scheduled Tasks' folder
2007-07-17 20:17:03 C:\windows\tasks\AppleSoftwareUpdate.job

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-21 01:59:09
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden registry entries ...

scanning hidden files ...

**************************************************************************

Completion time: 2007-07-21 2:00:26
C:\ComboFix-quarantined-files.txt ... 2007-07-21 01:59

--- E O F ---

Quarantined Files:

2007-07-15 13:22 19968 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\wineil32.dll.vir
2007-07-15 13:23 31254 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\pmnolmk.dll.vir
2007-07-15 13:51 577536 --a------ C:\Qoobox\Quarantine\C\Program Files\Ultimate Fixer\ufixer.pkg.vir
2007-07-17 02:55 40183 --a------ C:\Qoobox\Quarantine\C\Program Files\Common Files\Yazzle1162OinUninstaller.exe.vir
2007-07-20 12:42 266336 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\vtsqn.dll.vir
2007-07-20 12:51 2 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\wnsapisv32.exe.vir
2007-07-20 14:18 266336 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\geedd.dll.vir
2007-07-20 14:26 1803611 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\nqstv.bak1.vir
2007-07-20 15:44 106 --a------ C:\Qoobox\Quarantine\catchme.log
2007-07-20 15:44 1822924 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\nqstv.ini.vir

Folder PATH listing
Volume serial number is B443-1A2E
C:\QOOBOX
\---Quarantine
| catchme.log
|
+---C
| +---Program Files
| | +---Common Files
| | | | Yazzle1162OinUninstaller.exe.vir
| | | |
| | | \---YSTEM~1
| | \---Ultimate Fixer
| | ufixer.pkg.vir
| |
| \---WINDOWS
| \---system32
| geedd.dll.vir
| nqstv.bak1.vir
| nqstv.ini.vir
| pmnolmk.dll.vir
| vtsqn.dll.vir
| wineil32.dll.vir
| wnsapisv32.exe.vir
|
\---Registry_backups

Hijackthis Log

Logfile of HijackThis v1.99.1
Scan saved at 2:05:01 AM, on 7/21/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\csrss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\System32\Ati2evxx.exe
C:\windows\system32\svchost.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\system32\Ati2evxx.exe
C:\windows\System32\svchost.exe
C:\windows\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\windows\System32\svchost.exe
C:\Program Files\Windows Media Player\WMPNetwk.exe
C:\windows\System32\alg.exe
C:\windows\SOUNDMAN.EXE
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\UltraMon\UltraMon.exe
D:\Program Files\AIM\aim.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Program Files\Grisoft\AVG7\avgwb.dat
C:\windows\explorer.exe
D:\Desktop\Desktop\analize.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = home.netscape.com
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [UltraMon] "C:\Program Files\UltraMon\UltraMon.exe" /auto
O4 - HKCU\..\Run: [AIM] D:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Update Service] C:\PROGRA~1\COMMON~1\TEKNUM~1\update.exe /startup
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = D:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - D:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/micr...?1179938781046
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1179938771406
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\PROGRA~1\MICROS~1\Office12\GR99D3~1.DLL
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: WBSrv - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll
O20 - Winlogon Notify: WgaLogon - C:\windows\
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\windows\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe (file missing)
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: mental ray 3.5 Satellite (32-bit) (mi-raysat_3dsmax9_32) - Unknown owner - D:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe
O23 - Service: TVersityMediaServer - Unknown owner - D:\Program Files\TVersity\Media Server\MediaServer.exe (file missing)

Clark76 · 07-21-2007, 10:00 PM

Hello

First I have a request, please do not put code or quote tags around your logs. It makes it more difficult to read. Thank you.

=========

P2P - I see you have P2P software <BitTornado> installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information.

=========

Click > Start > Control Panel > Add / Remove Programs and uninstall the following programs (if they exist):

Viewpoint

=========

Open notepad and copy/paste the text in the quotebox below into it:

Quote:

Folder::
C:\WINDOWS\system32\vvenfkta
C:\DOCUME~1\Nick\APPLIC~1\Viewpoint
C:\Program Files\Viewpoint

Save this as "CFScript"

Refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log

Note:
Do not mouseclick combofix's window while it's running. That may cause it to stall

==========

Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner

Answer Yes, when prompted to install an ActiveX component.

The program will then begin downloading the latest definition files.
Once the files have been downloaded click on NEXT
Locate the Scan Settings button & configure to:
- Scan using the following Anti-Virus database:
  - Extended
- Scan Options:
  - Scan Archives
  - Scan Mail Bases
Click OK & have it scan My Computer
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

* Turn off the real time scanner of any existing antivirus program while performing the online scan

Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%.

===========

Please provide the following logs with your next post:

C:\ComboFix.txt
Kaspersky report

Also include an update on how your system is running

Lionet · 07-22-2007, 12:44 PM

ComboFix:

"Nick" - 2007-07-22 0:48:34 - ComboFix 07-07-21.4 - Service Pack 2 NTFS
Command switches used :: D:\Desktop\Desktop\CFScript.txt

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\DOCUME~1\Nick\APPLIC~1\Viewpoint
C:\DOCUME~1\Nick\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-1018872981.swf
C:\DOCUME~1\Nick\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-1241215004.mtx
C:\DOCUME~1\Nick\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-26751412.mtz
C:\DOCUME~1\Nick\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-841353042.mtj&p2=1&p3=07613371004484973113502928007580&p4=0
C:\DOCUME~1\Nick\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\1959518023.mtj&p2=1&p3=07613371004484973113502928007580&p4=50463258
C:\DOCUME~1\Nick\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\416055122.swf
C:\DOCUME~1\Nick\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\URLCache.ini
C:\DOCUME~1\Nick\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\-1233786184.mtx
C:\DOCUME~1\Nick\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\-1355542221.mts
C:\DOCUME~1\Nick\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\-1860458717.mts
C:\DOCUME~1\Nick\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\1054459834.swf
C:\DOCUME~1\Nick\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\1743403442.swf
C:\DOCUME~1\Nick\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\1991437604.swf
C:\DOCUME~1\Nick\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\URLCache.ini
C:\DOCUME~1\Nick\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\-33400662.swf
C:\DOCUME~1\Nick\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\407034558.ini
C:\DOCUME~1\Nick\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\URLCache.ini
C:\DOCUME~1\Nick\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\-1850579979.swf
C:\DOCUME~1\Nick\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\2089844584.swf
C:\DOCUME~1\Nick\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\URLCache.ini
C:\DOCUME~1\Nick\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\UpdateVersionList_v2.mtx
C:\Program Files\Viewpoint
C:\Program Files\Viewpoint\Viewpoint Experience Technology\AxMetaStream.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\AxMetaStream_0305000D.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\ClassIDs.ini
C:\Program Files\Viewpoint\Viewpoint Experience Technology\ComponentMgr_0305001C.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\ComponentRegistry.ini
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\AOLArt.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\AOLShell.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\AOLUserShell.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\Cursors.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\DataTracking.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\GifReader.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\JpegReader.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\LensFlares.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\Mts3Reader.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\ObjectMovie.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\SceneComponent.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\ServiceComponent.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\SreeDMMX.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\SWFView.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\VectorView.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\VMPAudio.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\VMPExtras.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\VMPSpeech.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\VMPVideo.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\VMPVideo2.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\WaveletReader.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\ZoomView.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\DownLoadHist.ini
C:\Program Files\Viewpoint\Viewpoint Experience Technology\HostRegistry.ini
C:\Program Files\Viewpoint\Viewpoint Experience Technology\MetaStreamID.ini
C:\Program Files\Viewpoint\Viewpoint Experience Technology\MtsAxInstaller.exe
C:\Program Files\Viewpoint\Viewpoint Experience Technology\MTSDownloadSites.txt
C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.xpt
C:\WINDOWS\system32\vvenfkta
C:\WINDOWS\system32\vvenfkta\bg1.gif
C:\WINDOWS\system32\vvenfkta\bgtop.gif
C:\WINDOWS\system32\vvenfkta\bottom1.gif
C:\WINDOWS\system32\vvenfkta\essentials.gif
C:\WINDOWS\system32\vvenfkta\icon1.ico
C:\WINDOWS\system32\vvenfkta\install1.gif
C:\WINDOWS\system32\vvenfkta\left1.gif
C:\WINDOWS\system32\vvenfkta\li.gif
C:\WINDOWS\system32\vvenfkta\logo.gif
C:\WINDOWS\system32\vvenfkta\main.htm
C:\WINDOWS\system32\vvenfkta\mainframe.htm
C:\WINDOWS\system32\vvenfkta\reinstall1.gif
C:\WINDOWS\system32\vvenfkta\right1.gif
C:\WINDOWS\system32\vvenfkta\s1.htm
C:\WINDOWS\system32\vvenfkta\s2.htm
C:\WINDOWS\system32\vvenfkta\s3.htm
C:\WINDOWS\system32\vvenfkta\SMTop1.gif
C:\WINDOWS\system32\vvenfkta\SMTop2.gif
C:\WINDOWS\system32\vvenfkta\SMTop3.gif
C:\WINDOWS\system32\vvenfkta\SMTop4.gif
C:\WINDOWS\system32\vvenfkta\soft1_off.gif
C:\WINDOWS\system32\vvenfkta\soft1_off_ext.gif
C:\WINDOWS\system32\vvenfkta\soft1_on.gif
C:\WINDOWS\system32\vvenfkta\soft1_on_ext.gif
C:\WINDOWS\system32\vvenfkta\soft2_off.gif
C:\WINDOWS\system32\vvenfkta\soft2_off_ext.gif
C:\WINDOWS\system32\vvenfkta\soft2_on.gif
C:\WINDOWS\system32\vvenfkta\soft2_on_ext.gif
C:\WINDOWS\system32\vvenfkta\soft3_off.gif
C:\WINDOWS\system32\vvenfkta\soft3_off_ext.gif
C:\WINDOWS\system32\vvenfkta\soft3_on.gif
C:\WINDOWS\system32\vvenfkta\soft3_on_ext.gif
C:\WINDOWS\system32\vvenfkta\softbottom_off.gif
C:\WINDOWS\system32\vvenfkta\softbottom_on.gif
C:\WINDOWS\system32\vvenfkta\softleft_off.gif
C:\WINDOWS\system32\vvenfkta\softleft_on.gif
C:\WINDOWS\system32\vvenfkta\Thumbs.db
C:\WINDOWS\system32\vvenfkta\top1.gif
C:\WINDOWS\system32\vvenfkta\top2.gif
C:\WINDOWS\system32\vvenfkta\turnoff1.gif
C:\WINDOWS\system32\vvenfkta\turnon1.gif
C:\WINDOWS\system32\vvenfkta\vvenfkta1.exe
C:\WINDOWS\system32\vvenfkta\vvenfkta2.exe
C:\WINDOWS\system32\vvenfkta\vvenfkta3.exe

((((((((((((((((((((((((( Files Created from 2007-06-22 to 2007-07-22 )))))))))))))))))))))))))))))))

2007-07-18 00:48 <DIR> d--h----- C:\WINDOWS\PIF
2007-07-18 00:27 720,896 --a------ C:\WINDOWS\iun6002ev.exe
2007-07-18 00:26 <DIR> d-------- C:\Program Files\directx
2007-07-17 23:33 <DIR> d-------- C:\Program Files\DAEMON Tools
2007-07-17 23:23 <DIR> d-------- C:\Program Files\Alcohol Soft
2007-07-17 19:32 <DIR> d-------- C:\rs
2007-07-17 19:31 <DIR> d-------- C:\Program Files\Common Files\SWF Studio
2007-07-17 19:30 32,768 --a------ C:\WINDOWS\NCUNINST.EXe
2007-07-17 02:50 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-07-17 02:04 <DIR> d-------- C:\VundoFix Backups
2007-07-16 20:48 557,056 --a------ C:\DOCUME~1\ADMINI~1\NTUSER.DAT
2007-07-16 18:43 <DIR> d-------- C:\DOCUME~1\Nick\APPLIC~1\Prevx
2007-07-16 18:41 77,312 --a------ C:\WINDOWS\ua2.dll
2007-07-16 18:37 <DIR> d-------- C:\DOCUME~1\Nick\APPLIC~1\GetRightToGo
2007-07-15 20:37 26,624 --a------ C:\WINDOWS\system32\ssmenu.dll
2007-07-15 20:37 1,348 --a------ C:\WINDOWS\system32\tsdigsgn.dat
2007-07-15 20:37 <DIR> d---s---- C:\Program Files\Common Files\Teknum Systems
2007-07-15 20:37 <DIR> d-------- C:\Program Files\HandyBits
2007-07-15 20:30 68,992 --a------ C:\WINDOWS\system32\drivers\LMouKE.Sys
2007-07-15 20:30 52,992 --a------ C:\WINDOWS\system32\drivers\L8042MOU.SYS
2007-07-15 20:30 36,480 --a------ C:\WINDOWS\system32\drivers\LHidUsbK.sys
2007-07-15 20:30 13,056 --a------ C:\WINDOWS\system32\drivers\L8042Kbd.SYS
2007-07-15 20:29 49,152 --a------ C:\WINDOWS\KHALMNPR.Exe
2007-07-15 20:29 24,704 --a------ C:\WINDOWS\system32\drivers\LHidKE.Sys
2007-07-15 20:14 <DIR> d-------- C:\Program Files\Security Task Manager
2007-07-15 20:14 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\SecTaskMan
2007-07-14 01:52 98,304 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2007-07-13 15:55 <DIR> d-------- C:\Program Files\Hero Editor
2007-07-13 15:54 73,216 --a------ C:\WINDOWS\ST6UNST.EXE
2007-07-13 15:54 249,856 --------- C:\WINDOWS\Setup1.exe
2007-07-10 11:24 43,520 --a------ C:\WINDOWS\system32\CmdLineExt03.dll
2007-07-10 11:14 21,840 --a----t- C:\WINDOWS\system32\SIntfNT.dll
2007-07-10 11:14 17,212 --a----t- C:\WINDOWS\system32\SIntf32.dll
2007-07-10 11:14 12,067 --a----t- C:\WINDOWS\system32\SIntf16.dll
2007-07-10 11:09 94,208 --a------ C:\WINDOWS\DIIUnin.exe
2007-07-10 11:09 35,277 --a------ C:\WINDOWS\DIIUnin.dat
2007-07-10 11:09 2,829 --a------ C:\WINDOWS\DIIUnin.pif
2007-07-08 22:21 <DIR> d-------- C:\Program Files\iPod
2007-07-08 22:18 <DIR> d-------- C:\Program Files\Common Files\Apple
2007-07-08 22:18 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-20 22:53:12 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-07-17 01:10:34 -------- d-----w C:\Program Files\BitTornado
2007-07-15 17:10:00 685,816 ----a-w C:\windows\system32\drivers\sptd.sys
2007-07-09 02:10:08 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\Apple Computer
2007-06-19 23:33:08 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\Aim
2007-06-19 23:22:45 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\Help
2007-06-15 04:50:12 -------- d-----w C:\Program Files\Movie Maker
2007-06-15 04:49:59 -------- d-----w C:\Program Files\Windows Media Connect 2
2007-06-15 04:49:56 -------- d-----w C:\Program Files\QuickTime Alternative
2007-06-15 04:49:56 -------- d-----w C:\Program Files\Messenger
2007-06-15 04:49:55 -------- d-----w C:\Program Files\DivX
2007-06-15 04:49:54 -------- d-----w C:\Program Files\AIM
2007-06-14 10:33:12 -------- d-----w C:\Program Files\QuickTime
2007-06-13 05:10:53 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\Ventrilo
2007-06-13 04:35:10 -------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2007-06-12 23:46:38 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\DivX
2007-06-06 15:38:34 -------- d-----w C:\Program Files\MSN Messenger
2007-06-05 19:21:32 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\Real
2007-06-05 19:14:37 -------- d-----w C:\Program Files\Common Files\xing shared
2007-06-05 19:14:33 -------- d-----w C:\Program Files\Common Files\Real
2007-06-05 18:44:59 1,568 ----a-w C:\windows\mozver.dat
2007-06-03 06:48:36 -------- d-----w C:\Program Files\Microsoft Works
2007-06-03 06:47:50 -------- d-----w C:\Program Files\MSBuild
2007-06-03 06:44:44 -------- d-----w C:\Program Files\Microsoft.NET
2007-06-03 06:41:52 -------- d-----w C:\Program Files\Microsoft Visual Studio 8
2007-06-03 04:41:56 -------- d-----w C:\Program Files\Common Files\Adobe Systems Shared
2007-06-03 01

47 -------- d-----w C:\Program Files\Autodesk
2007-06-03 01

44 -------- d-----w C:\Program Files\Common Files\Autodesk Shared
2007-06-03 00:34:47 -------- d-----w C:\Program Files\PowerISO
2007-06-02 23:14:41 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\dvdcss
2007-06-01 01:21:17 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\vlc
2007-05-31 06:45:07 524,288 ----a-w C:\windows\system32\DivXsm.exe
2007-05-31 06:44:55 823,296 ----a-w C:\windows\system32\divx_xx07.dll
2007-05-31 06:44:54 823,296 ----a-w C:\windows\system32\divx_xx0c.dll
2007-05-31 06:44:54 802,816 ----a-w C:\windows\system32\divx_xx11.dll
2007-05-31 06:44:54 740,442 ----a-w C:\windows\system32\DivX.dll
2007-05-29 20:18:18 -------- d-----w C:\Program Files\Apple Software Update
2007-05-28 03:09:21 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\Lavasoft
2007-05-27 03:58:33 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\SmartFTP
2007-05-27 03:58:15 -------- d-----w C:\Program Files\SmartFTP Client
2007-05-25 19:00:07 -------- d-----w C:\Program Files\545 Studios
2007-05-25 18:50:31 -------- d-----w C:\Program Files\AOD
2007-05-25 17:58:57 -------- d-----w C:\Program Files\Windows NT
2007-05-25 05:05:34 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\Realtime Soft
2007-05-25 05:04:56 -------- d-----w C:\Program Files\UltraMon
2007-05-25 05:04:56 -------- d-----w C:\Program Files\Common Files\Realtime Soft
2007-05-25 04:38:41 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\Media Player Classic
2007-05-25 03:49:13 60,416 ----a-w C:\windows\ALCFDRTM.EXE
2007-05-25 03:42:45 -------- d-----w C:\Program Files\Stardock
2007-05-25 03:41:44 -------- d-----w C:\Program Files\VideoLAN
2007-05-25 02:16:07 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\Logitech
2007-05-25 02:13:33 -------- d-----w C:\Program Files\Common Files\Logitech
2007-05-25 02:13:03 -------- d-----w C:\Program Files\Logitech
2007-05-24 14:08:13 -------- d-----w C:\Program Files\PlayOnline
2007-05-24 11:29:22 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\WinRAR
2007-05-24 01:54:33 4,096 ----a-w C:\windows\d3dx.dat
2007-05-24 01:47:52 -------- d-----w C:\Program Files\Common Files\InstallShield
2007-05-23 03:22:06 -------- d-----w C:\Program Files\ATI Technologies
2007-05-23 03:12:18 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\.BitTornado
2007-05-23 03:10:50 335 ----a-w C:\windows\nsreg.dat
2007-05-23 02:59:21 -------- d-----w C:\Program Files\microsoft frontpage
2007-05-23 02:55:15 0 --sha-r C:\MSDOS.SYS
2007-05-23 02:55:15 0 --sha-r C:\IO.SYS
2007-05-23 02:55:15 0 ----a-w C:\CONFIG.SYS
2007-05-23 02:55:15 0 ----a-w C:\AUTOEXEC.BAT
2007-05-23 02:52:30 -------- d-----w C:\Program Files\Common Files\MSSoap
2007-05-23 02:52:08 21,640 ----a-w C:\windows\system32\emptyregdb.dat
2007-05-23 02:51:11 -------- d--h--w C:\Program Files\WindowsUpdate
2007-05-23 02:51:10 -------- d-----w C:\Program Files\Online Services
2007-05-23 02:50:58 -------- d-----w C:\Program Files\MSN Gaming Zone
2007-05-22 22:10:05 -------- d-----w C:\Program Files\Common Files\ODBC
2007-05-22 22:10:01 -------- d-----w C:\Program Files\Common Files\SpeechEngines
2007-05-16 15:12:02 683,520 ----a-w C:\windows\system32\inetcomm.dll
2007-04-25 14:21:15 144,896 ----a-w C:\windows\system32\schannel.dll
2007-04-23 00:15:29 3,596,288 ----a-w C:\windows\system32\qt-dx331.dll
2007-04-23 00:15:24 129,784 ------w C:\windows\system32\pxafs.dll
2007-04-23 00:15:24 118,520 ------w C:\windows\system32\pxinsi64.exe
2007-04-23 00:15:24 116,472 ------w C:\windows\system32\pxcpyi64.exe
2007-04-23 00:15:18 200,704 ----a-w C:\windows\system32\ssldivx.dll
2007-04-23 00:15:18 1,044,480 ----a-w C:\windows\system32\libdivx.dll
2007-04-23 00:02:34 73,728 ----a-w C:\windows\system32\dpl100.dll
2007-04-23 00:02:34 196,608 ----a-w C:\windows\system32\dtu100.dll
2007-04-23 00:02:33 53,248 ----a-w C:\windows\system32\dpuGUI10.dll
2007-04-23 00:02:31 593,920 ----a-w C:\windows\system32\dpuGUI11.dll
2007-04-23 00:02:31 57,344 ----a-w C:\windows\system32\dpv11.dll
2007-04-23 00:02:31 344,064 ----a-w C:\windows\system32\dpus11.dll
2007-04-23 00:02:31 294,912 ----a-w C:\windows\system32\dpu11.dll
2007-04-23 00:02:31 294,912 ----a-w C:\windows\system32\dpu10.dll
2007-04-23 00:01:47 12,288 ----a-w C:\windows\system32\DivXWMPExtType.dll
2007-04-23 00:01:46 124,472 ----a-w C:\windows\system32\DivXCodecUpdateChecker.exe

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2004-12-01 03:54 C:\WINDOWS\SOUNDMAN.EXE]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2004-12-10 12:45 C:\WINDOWS\KHALMNPR.Exe]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]
"GrooveMonitor"="D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-06-05 15:14]
"iTunesHelper"="D:\Program Files\iTunes\iTunesHelper.exe" [2007-06-28 09:14]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41]
"PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2007-04-09 08:23]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-07-20 21:01]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UltraMon"="C:\Program Files\UltraMon\UltraMon.exe" [2006-10-12 21:27]
"AIM"="D:\Program Files\AIM\aim.exe" [2003-08-01 11:31]
"Update Service"="C:\PROGRA~1\COMMON~1\TEKNUM~1\update.exe" [2007-07-15 20:37]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-04-03 18:29]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - D:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 01:48:20]
Adobe Reader Synchronizer.lnk - D:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 00:01:50]
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2007-05-24 22:13:29]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv]
C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll 2007-05-24 23:46 176128 C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\WbSrv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=wbsys.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Nick^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=C:\Documents and Settings\Nick\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup

023 - gmsipci - \??\E:\INSTALL\GMSIPCI.SYS
023 - l8042kbd - System32\Drivers\L8042Kbd.sys
023 - l8042mou - System32\Drivers\L8042mou.sys
023 - lhidke - System32\DRIVERS\LHidKE.Sys
023 - lhidusbk - System32\Drivers\LHidUsbK.Sys
023 - lmouke - System32\Drivers\LMouKE.sys
023 - microsoft office groove audit service - "D:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe"
023 - msicpl - \??\E:\install4\MSICPL.sys
023 - ntaccess - \??\E:\NTACCESS.sys
023 - odserv - "C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE"
023 - rtl8023xp - System32\DRIVERS\Rtlnicxp.sys
023 - saih8000 - System32\DRIVERS\SaiH8000.sys
023 - setupntglm7x - \??\E:\NTGLM7X.sys
023 - ultramonmirror - System32\DRIVERS\UltraMonMirror.sys
023 - ultramonutility - \??\C:\Program Files\Common Files\Realtime Soft\UltraMonMirrorDrv\x32\UltraMonUtility.sys
023 - vulfnths - \SystemRoot\System32\Drivers\vulfnth.sys
023 - vulfntrs - \SystemRoot\System32\Drivers\vulfntr.sys

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
AutoRun\command- E:\setup.exe

*Newly Created Service* - AVG7ALRT
*Newly Created Service* - AVG7CORE
*Newly Created Service* - AVG7RSW
*Newly Created Service* - AVG7RSXP
*Newly Created Service* - AVG7UPDSVC
*Newly Created Service* - AVGCLEAN
*Newly Created Service* - AVGEMS
*Newly Created Service* - AVGTDI
*Newly Created Service* - CATCHME

Contents of the 'Scheduled Tasks' folder
2007-07-17 20:17:03 C:\windows\tasks\AppleSoftwareUpdate.job

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-22 00:51:20
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden registry entries ...

scanning hidden files ...

**************************************************************************

Completion time: 2007-07-22 0:52:35
C:\ComboFix-quarantined-files.txt ... 2007-07-22 00:51
C:\ComboFix2.txt ... 2007-07-21 02:00

--- E O F ---

Kaspersky Log:

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Sunday, July 22, 2007 5:54:25 AM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.93.0
Kaspersky Anti-Virus database last update: 22/07/2007
Kaspersky Anti-Virus database records: 366574
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\
E:\
F:\

Scan Statistics:
Total number of scanned objects: 86878
Number of viruses found: 15
Number of infected objects: 55
Number of suspicious objects: 0
Duration of the scan process: 01:38:33

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\avg7\Log\emc.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped
C:\Documents and Settings\All Users\Application Data\SecTaskMan\folcnufa.dll.q_FCBE000_q Infected: Trojan.Win32.Agent.atq skipped
C:\Documents and Settings\All Users\Application Data\SecTaskMan\qhyinnjh.dll.q_804441_q Infected: Trojan.Win32.BHO.bd skipped
C:\Documents and Settings\All Users\Application Data\SecTaskMan\rkoc.dll.q_804EE00_q Infected: not-a-virus:AdWare.Win32.PurityScan.ak skipped
C:\Documents and Settings\All Users\Application Data\SecTaskMan\tohsxmzo.dll.q_2CFC01_q Infected: Trojan-Downloader.Win32.Delf.aeo skipped
C:\Documents and Settings\All Users\DRM\drmstore.hds Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Nick\Application Data\Aim\ChurchBlueTeam\cert8.db Object is locked skipped
C:\Documents and Settings\Nick\Application Data\Aim\ChurchBlueTeam\key3.db Object is locked skipped
C:\Documents and Settings\Nick\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Nick\Local Settings\Application Data\Microsoft\Media Player\CurrentDatabase_360.wmdb Object is locked skipped
C:\Documents and Settings\Nick\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Nick\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Nick\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Nick\Local Settings\History\History.IE5\MSHist012007072220070723\index.dat Object is locked skipped
C:\Documents and Settings\Nick\Local Settings\Temp\~DF17E7.tmp Object is locked skipped
C:\Documents and Settings\Nick\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Nick\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Nick\ntuser.dat.LOG Object is locked skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\geedd.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.kr skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\pmnolmk.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.bq skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\vtsqn.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.kr skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\vvenfkta\vvenfkta1.exe.vir Infected: not-a-virus:FraudTool.Win32.UltimateDefender.c skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\vvenfkta\vvenfkta2.exe.vir Infected: not-a-virus:FraudTool.Win32.UltimateDefender.c skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\vvenfkta\vvenfkta3.exe.vir Infected: not-a-virus:FraudTool.Win32.UltimateDefender.c skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\wineil32.dll.vir Infected: Trojan.Win32.Dialer.qn skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP200\A0026676.exe Object is locked skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP200\A0026677.exe Infected: not-a-virus:FraudTool.Win32.UltimateDefender.c skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP201\A0026688.dll Infected: Trojan-Downloader.Win32.Delf.aeo skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP202\A0026690.exe Object is locked skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP202\A0026692.exe Object is locked skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP202\A0026693.dll Infected: Trojan.Win32.Agent.atq skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP202\A0026694.exe Object is locked skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP202\A0026695.exe Object is locked skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP202\A0026841.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP202\A0026912.exe Object is locked skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP202\A0026913.exe Infected: Trojan-Downloader.Win32.Alphabet.b skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP202\A0026921.exe Object is locked skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP202\A0027900.exe Object is locked skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP202\A0029929.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.kr skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP202\A0029930.dll Object is locked skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP202\A0029936.dll Object is locked skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP202\A0029965.exe Object is locked skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP202\A0038076.dll Object is locked skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP202\A0038094.dll Object is locked skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP202\A0038104.exe Object is locked skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP202\A0038106.exe Object is locked skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP202\A0038215.exe Object is locked skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP204\A0038235.dll Object is locked skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP209\A0038614.exe Object is locked skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP209\A0038615.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP209\A0038661.exe Object is locked skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP209\A0038662.dll Object is locked skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP209\A0038663.dll Object is locked skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP209\A0038664.exe Object is locked skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP209\A0038665.dll Object is locked skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP209\A0038683.dll Object is locked skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP209\A0038748.exe/data0002 Infected: not-a-virus:AdWare.Win32.PurityScan.fk skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP209\A0038748.exe/data0003 Infected: not-a-virus:AdWare.Win32.PurityScan.bu skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP209\A0038748.exe NSIS: infected - 2 skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP209\A0038757.exe Infected: not-a-virus:AdWare.Win32.PurityScan.fn skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP209\A0038762.exe Object is locked skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP209\A0038763.exe Object is locked skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP209\A0038766.dll Object is locked skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP209\A0038768.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP209\A0038773.dll Object is locked skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP209\A0038836.dll Object is locked skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP209\A0038837.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP209\A0038841.old Infected: Trojan-Downloader.Win32.Alphabet.h skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP209\A0038842.exe Object is locked skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP210\A0038973.exe/data0002 Infected: not-a-virus:AdWare.Win32.PurityScan.fk skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP210\A0038973.exe/data0003 Infected: not-a-virus:AdWare.Win32.PurityScan.bu skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP210\A0038973.exe NSIS: infected - 2 skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP210\A0038984.dll Object is locked skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP210\A0038985.dll Object is locked skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP210\A0038986.exe Object is locked skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP210\A0038987.dll Object is locked skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP210\A0039002.exe Object is locked skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP210\A0039003.exe Infected: not-a-virus:AdWare.Win32.PurityScan.fn skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP210\A0039010.exe/data0002 Infected: not-a-virus:AdWare.Win32.PurityScan.fk skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP210\A0039010.exe/data0003 Infected: not-a-virus:AdWare.Win32.PurityScan.bu skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP210\A0039010.exe NSIS: infected - 2 skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP210\A0039031.dll Object is locked skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP210\A0039077.exe Object is locked skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP210\A0039080.exe Object is locked skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP210\A0039081.exe Object is locked skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP210\A0039082.exe Object is locked skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP210\A0039083.exe Object is locked skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP210\A0039084.exe Object is locked skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP210\A0039085.dll Object is locked skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP210\A0039086.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.bq skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP210\A0039087.dll Object is locked skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP210\A0039088.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.kr skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP210\A0039089.dll Object is locked skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP210\A0039090.dll Infected: Trojan.Win32.Dialer.qn skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP210\A0039092.dll Object is locked skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP213\A0039658.old Infected: Trojan-Downloader.Win32.Alphabet.h skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP213\A0039659.old Infected: Trojan-Downloader.Win32.Alphabet.h skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP213\A0039687.exe Infected: not-a-virus:FraudTool.Win32.UltimateDefender.c skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP213\A0039688.exe Infected: not-a-virus:FraudTool.Win32.UltimateDefender.c skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP213\A0039689.exe Infected: not-a-virus:FraudTool.Win32.UltimateDefender.c skipped
C:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP213\change.log Object is locked skipped
C:\VundoFix Backups\vtsqn.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.kr skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edbtmp.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\ODiag.evt Object is locked skipped
C:\WINDOWS\system32\config\OSession.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
D:\Desktop\Desktop\backups\backup-20070720-123155-818.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak skipped
D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
D:\System Volume Information\_restore{0506A090-77BA-4FE1-B2B0-9CC63B218CA5}\RP11\A0000596.inf Object is locked skipped
D:\System Volume Information\_restore{0506A090-77BA-4FE1-B2B0-9CC63B218CA5}\RP11\A0000597.inf Object is locked skipped
D:\System Volume Information\_restore{0506A090-77BA-4FE1-B2B0-9CC63B218CA5}\RP11\A0000598.inf Object is locked skipped
D:\System Volume Information\_restore{0506A090-77BA-4FE1-B2B0-9CC63B218CA5}\RP11\A0000599.exe Object is locked skipped
D:\System Volume Information\_restore{0506A090-77BA-4FE1-B2B0-9CC63B218CA5}\RP11\A0000600.exe Object is locked skipped
D:\System Volume Information\_restore{0506A090-77BA-4FE1-B2B0-9CC63B218CA5}\RP11\A0000601.dll Object is locked skipped
D:\System Volume Information\_restore{0506A090-77BA-4FE1-B2B0-9CC63B218CA5}\RP11\A0000602.dll Object is locked skipped
D:\System Volume Information\_restore{0506A090-77BA-4FE1-B2B0-9CC63B218CA5}\RP11\A0000603.ver Object is locked skipped
D:\System Volume Information\_restore{0506A090-77BA-4FE1-B2B0-9CC63B218CA5}\RP11\A0000604.inf Object is locked skipped
D:\System Volume Information\_restore{0506A090-77BA-4FE1-B2B0-9CC63B218CA5}\RP11\A0000605.cat Object is locked skipped
D:\System Volume Information\_restore{0506A090-77BA-4FE1-B2B0-9CC63B218CA5}\RP11\A0000606.cat Object is locked skipped
D:\System Volume Information\_restore{0506A090-77BA-4FE1-B2B0-9CC63B218CA5}\RP11\A0000607.cat Object is locked skipped
D:\System Volume Information\_restore{0506A090-77BA-4FE1-B2B0-9CC63B218CA5}\RP11\A0000608.exe Object is locked skipped
D:\System Volume Information\_restore{0506A090-77BA-4FE1-B2B0-9CC63B218CA5}\RP11\A0000609.dll Object is locked skipped
D:\System Volume Information\_restore{0506A090-77BA-4FE1-B2B0-9CC63B218CA5}\RP11\A0000610.dll Object is locked skipped
D:\System Volume Information\_restore{0506A090-77BA-4FE1-B2B0-9CC63B218CA5}\RP11\A0000611.dll Object is locked skipped
D:\System Volume Information\_restore{0506A090-77BA-4FE1-B2B0-9CC63B218CA5}\RP11\A0000612.dll Object is locked skipped
D:\System Volume Information\_restore{0506A090-77BA-4FE1-B2B0-9CC63B218CA5}\RP11\A0000613.cat Object is locked skipped
D:\System Volume Information\_restore{079A32F0-CC7B-43CF-AD4C-89C445875E13}\RP2\A0000097.inf Object is locked skipped
D:\System Volume Information\_restore{079A32F0-CC7B-43CF-AD4C-89C445875E13}\RP2\A0000098.inf Object is locked skipped
D:\System Volume Information\_restore{079A32F0-CC7B-43CF-AD4C-89C445875E13}\RP2\A0000099.inf Object is locked skipped
D:\System Volume Information\_restore{079A32F0-CC7B-43CF-AD4C-89C445875E13}\RP2\A0000100.exe Object is locked skipped
D:\System Volume Information\_restore{079A32F0-CC7B-43CF-AD4C-89C445875E13}\RP2\A0000101.exe Object is locked skipped
D:\System Volume Information\_restore{079A32F0-CC7B-43CF-AD4C-89C445875E13}\RP2\A0000102.dll Object is locked skipped
D:\System Volume Information\_restore{079A32F0-CC7B-43CF-AD4C-89C445875E13}\RP2\A0000103.dll Object is locked skipped
D:\System Volume Information\_restore{079A32F0-CC7B-43CF-AD4C-89C445875E13}\RP2\A0000104.ver Object is locked skipped
D:\System Volume Information\_restore{079A32F0-CC7B-43CF-AD4C-89C445875E13}\RP2\A0000105.inf Object is locked skipped
D:\System Volume Information\_restore{079A32F0-CC7B-43CF-AD4C-89C445875E13}\RP2\A0000106.cat Object is locked skipped
D:\System Volume Information\_restore{079A32F0-CC7B-43CF-AD4C-89C445875E13}\RP2\A0000107.cat Object is locked skipped
D:\System Volume Information\_restore{079A32F0-CC7B-43CF-AD4C-89C445875E13}\RP2\A0000108.cat Object is locked skipped
D:\System Volume Information\_restore{079A32F0-CC7B-43CF-AD4C-89C445875E13}\RP2\A0000109.exe Object is locked skipped
D:\System Volume Information\_restore{079A32F0-CC7B-43CF-AD4C-89C445875E13}\RP2\A0000110.dll Object is locked skipped
D:\System Volume Information\_restore{079A32F0-CC7B-43CF-AD4C-89C445875E13}\RP2\A0000111.dll Object is locked skipped
D:\System Volume Information\_restore{079A32F0-CC7B-43CF-AD4C-89C445875E13}\RP2\A0000112.dll Object is locked skipped
D:\System Volume Information\_restore{079A32F0-CC7B-43CF-AD4C-89C445875E13}\RP2\A0000113.dll Object is locked skipped
D:\System Volume Information\_restore{079A32F0-CC7B-43CF-AD4C-89C445875E13}\RP2\A0000114.cat Object is locked skipped
D:\System Volume Information\_restore{361F64DE-7FAE-46A3-A9DB-DC380A7CC884}\RP89\A0020877.exe/Toolbar.exe Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped
D:\System Volume Information\_restore{361F64DE-7FAE-46A3-A9DB-DC380A7CC884}\RP89\A0020877.exe RAR: infected - 1 skipped
D:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP202\A0029915.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.kr skipped
D:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP202\A0029916.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak skipped
D:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP202\A0029917.dll Object is locked skipped
D:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP202\A0029918.dll Object is locked skipped
D:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP202\A0029919.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.kr skipped
D:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP202\A0029920.dll Object is locked skipped
D:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP202\A0029921.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.kr skipped
D:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP202\A0029922.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.kr skipped
D:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP202\A0029923.dll Object is locked skipped
D:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP202\A0029924.dll Object is locked skipped
D:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP202\A0029925.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.kr skipped
D:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP202\A0029926.dll Object is locked skipped
D:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP203\A0038230.dll Object is locked skipped
D:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP203\A0038231.dll Object is locked skipped
D:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP203\A0038232.dll Object is locked skipped
D:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP208\A0038601.dll Object is locked skipped
D:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP208\A0038602.dll Object is locked skipped
D:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP213\A0039660.dll Object is locked skipped
D:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP213\A0039661.dll Object is locked skipped
D:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP213\A0039662.dll Object is locked skipped
D:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP213\A0039663.dll Object is locked skipped
D:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP213\A0039664.exe/data.rar/keygen.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.bq skipped
D:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP213\A0039664.exe/data.rar/patch.exe Infected: Trojan.Win32.Dialer.qn skipped
D:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP213\A0039664.exe/data.rar/crack.exe Infected: Trojan-Dropper.Win32.Small.ayg skipped
D:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP213\A0039664.exe/data.rar Infected: Trojan-Dropper.Win32.Small.ayg skipped
D:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP213\A0039664.exe RarSFX: infected - 4 skipped
D:\System Volume Information\_restore{BA64D8DD-2E48-40C3-9795-6B4C7BF25A58}\RP213\change.log Object is locked skipped

Scan process completed.

Clark76 · 07-22-2007, 09:09 PM

Please open Security Task Manager

Locate the following file:

folcnufa.dll

Highlight it then click Remove at the top of the screen.

Repeat the process with the following files

qhyinnjh.dll
rkoc.dll
tohsxmzo.dll

Is your computer experiencing anymore problems?

Lionet · 07-22-2007, 11:47 PM

No, not as far as I can tell! Other than the almost minute sound in firefox I haven't experienced anything. Any ideas as to the firefox thing or would that be a driver issue? Thank you so much!

Clark76 · 07-23-2007, 09:43 PM

Well done, your logs are clean!

========

Please delete the following folders in blue

C:\ QooBox
C:\ VundoFix Backups

========

Flush the System Restore Points

To turn off System Restore click Start > Right Click My Computer > Properties. Click the System Restore tab and Check "Turn off System Restore" or "Turn off System Restore on all drives" Click Apply. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this then Click OK.

Turn on System Restore by Clicking Start. Right-click My Computer, and then click Properties. Click the System Restore tab. Uncheck "Turn off System Restore" or "Turn off System Restore on all drives." Click Apply, and then OK.

This will create a new Restore Point.

============

It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft and download all the critical updates to help prevent possible re-infection.

=================================================

This is a good time to set up protection against further attacks. Read TonyKlein's How Did I Get Infected In The First Place?. You need an antivirus that is continually updated, a good firewall, a spyware blocker such as Spyware Blaster, and a real time spyware program such as Spyware Guard, to prevent spyware intrusions. IE-Spyad is another excellent program that places over 4000 websites and domains in the IE Restricted list, which will help prevent attempts to infect your system. All of the above have good free versions available. However, be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.

More information and downloads are available at the following links:

Spyware Blaster
Spyware Guard
IE-Spyad

============

Please respond to this thread one more time so we can mark this thread as Resolved.

If you want to fight back the Malware Writers that have made your life a misery, please take a look here and read what you can do against it.

=============

Quote:

Any ideas as to the firefox thing or would that be a driver issue?

When does the sound problem happen? During video/flash type actions?
Is your sound problem happening in Internet Explorer also or just FireFox? If it is during both browsers, I would try downloading the newest driver from the manufacturer's web site. If it is only when using FireFox then it could be an application error. Then I would ask the tech's over in the Mozilla/FireFox if they might have any ideas.

Lionet · 07-24-2007, 09:15 PM

Ok all set! Yeah no sound in any site in either firefox or internet explorer, ive re downloaded my Sound card drivers, the cords are in the right places because iTunes audio plays perfect. Thank you so much for all of your help!

Clark76 · 07-24-2007, 09:30 PM

You are welcome

Hopefully the techs over at Mozilla/FireFox or at Internet Explorer forum can give you a hand with the sound problem.

07-20-2007, 11:23 AM	#1 (permalink)
Lionet Registered User Join Date: Nov 2006 Posts: 18 OS: WinXP	VundoFix removes vundo, but the vundo reappears...ljjiifc.dll Ever since I returned home from break, I have this program that runs on startup that says "Security Warning: Your computer may be infected with harmful or unwanted software!" And whenever I run VundoFix, it does not find ljjiifc.dll, when i googled the .dll a bunch of german sites came up talking about how to get rid of it, however i don't speak German >.> After running VundoFix, it searches fine, cleanes just fine, but then the files come back. Randomly I get popups, firefox gets an 0x0xxxxxxxxx error every time i close it and my sound driver often has an error and closes, so that I don't have sound until i restart. Please help me! This is ruining my school work and leisure fun! Logfile of HijackThis v1.99.1 Scan saved at 1:16:58 PM, on 7/20/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\windows\System32\smss.exe C:\windows\system32\winlogon.exe C:\windows\system32\services.exe C:\windows\system32\lsass.exe C:\windows\System32\Ati2evxx.exe C:\windows\system32\svchost.exe C:\windows\System32\svchost.exe C:\windows\system32\Ati2evxx.exe C:\windows\system32\spoolsv.exe C:\windows\Explorer.EXE C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe C:\windows\System32\svchost.exe C:\windows\system32\wuauclt.exe C:\windows\SOUNDMAN.EXE C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe D:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\PowerISO\PWRISOVM.EXE C:\Program Files\UltraMon\UltraMon.exe D:\Program Files\AIM\aim.exe C:\Program Files\DAEMON Tools\daemon.exe D:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE D:\Program Files\iTunes\iTunes.exe D:\Desktop\Desktop\analize.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = home.netscape.com O1 - Hosts: 66.98.148.65 auto.search.msn.com O1 - Hosts: 66.98.148.65 auto.search.msn.es O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {2A9430A5-4D04-437D-A745-D212033D6AC1} - C:\windows\system32\vtsqn.dll O2 - BHO: (no name) - {3F4F125D-F31E-4D37-AC35-E50128670469} - C:\windows\system32\ljjiifc.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [GrooveMonitor] "D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE O4 - HKLM\..\Run: [CTDrive] rundll32.exe C:\WINDOWS\system32\drvcup.dll,startup O4 - HKCU\..\Run: [UltraMon] "C:\Program Files\UltraMon\UltraMon.exe" /auto O4 - HKCU\..\Run: [AIM] D:\Program Files\AIM\aim.exe -cnetwait.odl O4 - HKCU\..\Run: [Update Service] C:\PROGRA~1\COMMON~1\TEKNUM~1\update.exe /startup O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = D:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - D:\Program Files\AIM\aim.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/micr...?1179938781046 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1179938771406 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\PROGRA~1\MICROS~1\Office12\GR99D3~1.DLL O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL O20 - Winlogon Notify: ljjiifc - C:\windows\SYSTEM32\ljjiifc.dll O20 - Winlogon Notify: WBSrv - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll O20 - Winlogon Notify: WgaLogon - C:\windows\ O20 - Winlogon Notify: wineil32 - C:\windows\SYSTEM32\wineil32.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\windows\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe (file missing) O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: mental ray 3.5 Satellite (32-bit) (mi-raysat_3dsmax9_32) - Unknown owner - D:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe O23 - Service: TVersityMediaServer - Unknown owner - D:\Program Files\TVersity\Media Server\MediaServer.exe (file missing)

07-20-2007, 01:37 PM	#2 (permalink)
Lionet Registered User Join Date: Nov 2006 Posts: 18 OS: WinXP	Re: VundoFix removes vundo, but the vundo reappears...ljjiifc.dll I just noticed something else, in Firefox or Internet Explorer, if I'm viewing anything with audio, the audio will be barely audible. I have 5.1 speakers and I have to put the audio at 3x the norm to barely hear what is playing...not sure if that has anything at all to do with the Trojans but figured I would mention that.

07-20-2007, 04:02 PM	#3 (permalink)
Clark76 Analyst, Security Team ; Rangemaster, TSF Academy Join Date: Jun 2006 Location: Cleveland, Ohio Posts: 1,693 OS: XP Pro, Vista, Ubuntu 8.10	Re: VundoFix removes vundo, but the vundo reappears...ljjiifc.dll Hello and welcome to TSF I am currently reviewing your log. Please note that this is under the supervision of an expert analyst, and I will be back with a fix for your problem a.s.a.p Please be patient with me during this time. You may wish to subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe. __________________ Proud Member of ASAP Proud Member of UNITE If you feel we've helped you, Please Donate to the Forum

07-20-2007, 06:47 PM	#5 (permalink)
Lionet Registered User Join Date: Nov 2006 Posts: 18 OS: WinXP	Re: VundoFix removes vundo, but the vundo reappears...ljjiifc.dll ComboFix Log:: "Nick" - 2007-07-20 17:28:24 - ComboFix 07-07-14.6 - Service Pack 2 NTFS ((((((((((((((((((((((((( Files Created from 2007-06-20 to 2007-07-20 ))))))))))))))))))))))))))))))) 2007-07-18 00:48 <DIR> d--h----- C:\WINDOWS\PIF 2007-07-18 00:27 720,896 --a------ C:\WINDOWS\iun6002ev.exe 2007-07-18 00:26 <DIR> d-------- C:\Program Files\directx 2007-07-17 23:33 <DIR> d-------- C:\Program Files\DAEMON Tools 2007-07-17 23:23 <DIR> d-------- C:\Program Files\Alcohol Soft 2007-07-17 19:32 <DIR> d-------- C:\rs 2007-07-17 19:31 <DIR> d-------- C:\Program Files\Common Files\SWF Studio 2007-07-17 19:30 32,768 --a------ C:\WINDOWS\NCUNINST.EXe 2007-07-17 02:50 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-07-17 02:04 <DIR> d-------- C:\VundoFix Backups 2007-07-16 20:48 786,432 --ah----- C:\DOCUME~1\ADMINI~1\NTUSER.DAT 2007-07-16 18:43 <DIR> d-------- C:\DOCUME~1\Nick\APPLIC~1\Prevx 2007-07-16 18:41 77,312 --a------ C:\WINDOWS\ua2.dll 2007-07-16 18:37 <DIR> d-------- C:\DOCUME~1\Nick\APPLIC~1\GetRightToGo 2007-07-15 20:37 26,624 --a------ C:\WINDOWS\system32\ssmenu.dll 2007-07-15 20:37 1,348 --a------ C:\WINDOWS\system32\tsdigsgn.dat 2007-07-15 20:37 <DIR> d---s---- C:\Program Files\Common Files\Teknum Systems 2007-07-15 20:37 <DIR> d-------- C:\Program Files\HandyBits 2007-07-15 20:30 68,992 --a------ C:\WINDOWS\system32\drivers\LMouKE.Sys 2007-07-15 20:30 52,992 --a------ C:\WINDOWS\system32\drivers\L8042MOU.SYS 2007-07-15 20:30 36,480 --a------ C:\WINDOWS\system32\drivers\LHidUsbK.sys 2007-07-15 20:30 13,056 --a------ C:\WINDOWS\system32\drivers\L8042Kbd.SYS 2007-07-15 20:29 49,152 --a------ C:\WINDOWS\KHALMNPR.Exe 2007-07-15 20:29 24,704 --a------ C:\WINDOWS\system32\drivers\LHidKE.Sys 2007-07-15 20:14 <DIR> d-------- C:\Program Files\Security Task Manager 2007-07-15 20:14 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\SecTaskMan 2007-07-15 13:23 <DIR> d-------- C:\WINDOWS\system32\vvenfkta 2007-07-14 01:52 98,304 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2007-07-13 15:55 <DIR> d-------- C:\Program Files\Hero Editor 2007-07-13 15:54 73,216 --a------ C:\WINDOWS\ST6UNST.EXE 2007-07-13 15:54 249,856 --------- C:\WINDOWS\Setup1.exe 2007-07-10 11:40 2,829 --a------ C:\WINDOWS\DiabUnin.pif 2007-07-10 11:40 118,784 --a------ C:\WINDOWS\DiabUnin.exe 2007-07-10 11:40 10,059 --a------ C:\WINDOWS\DiabUnin.dat 2007-07-10 11:24 43,520 --a------ C:\WINDOWS\system32\CmdLineExt03.dll 2007-07-10 11:14 21,840 --a----t- C:\WINDOWS\system32\SIntfNT.dll 2007-07-10 11:14 17,212 --a----t- C:\WINDOWS\system32\SIntf32.dll 2007-07-10 11:14 12,067 --a----t- C:\WINDOWS\system32\SIntf16.dll 2007-07-10 11:09 94,208 --a------ C:\WINDOWS\DIIUnin.exe 2007-07-10 11:09 35,277 --a------ C:\WINDOWS\DIIUnin.dat 2007-07-10 11:09 2,829 --a------ C:\WINDOWS\DIIUnin.pif 2007-07-08 22:21 <DIR> d-------- C:\Program Files\iPod 2007-07-08 22:18 <DIR> d-------- C:\Program Files\Common Files\Apple 2007-07-08 22:18 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-07-18 04:14:13 -------- d--h--w C:\Program Files\InstallShield Installation Information 2007-07-17 01:10:34 -------- d-----w C:\Program Files\BitTornado 2007-07-15 17:10:00 685,816 ----a-w C:\windows\system32\drivers\sptd.sys 2007-07-09 02:10:08 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\Apple Computer 2007-06-19 23:33:08 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\Aim 2007-06-19 23:22:45 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\Help 2007-06-15 04:50:12 -------- d-----w C:\Program Files\Movie Maker 2007-06-15 04:49:59 -------- d-----w C:\Program Files\Windows Media Connect 2 2007-06-15 04:49:56 -------- d-----w C:\Program Files\QuickTime Alternative 2007-06-15 04:49:56 -------- d-----w C:\Program Files\Messenger 2007-06-15 04:49:55 -------- d-----w C:\Program Files\DivX 2007-06-15 04:49:54 -------- d-----w C:\Program Files\AIM 2007-06-14 10:33:12 -------- d-----w C:\Program Files\QuickTime 2007-06-13 05:10:53 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\Ventrilo 2007-06-13 04:35:10 -------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2007-06-12 23:46:38 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\DivX 2007-06-06 15:38:34 -------- d-----w C:\Program Files\MSN Messenger 2007-06-05 19:21:32 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\Real 2007-06-05 19:14:37 -------- d-----w C:\Program Files\Common Files\xing shared 2007-06-05 19:14:33 -------- d-----w C:\Program Files\Common Files\Real 2007-06-05 18:44:59 1,568 ----a-w C:\windows\mozver.dat 2007-06-03 06:48:36 -------- d-----w C:\Program Files\Microsoft Works 2007-06-03 06:47:50 -------- d-----w C:\Program Files\MSBuild 2007-06-03 06:44:44 -------- d-----w C:\Program Files\Microsoft.NET 2007-06-03 06:41:52 -------- d-----w C:\Program Files\Microsoft Visual Studio 8 2007-06-03 04:41:56 -------- d-----w C:\Program Files\Common Files\Adobe Systems Shared 2007-06-03 0147 -------- d-----w C:\Program Files\Autodesk 2007-06-03 0144 -------- d-----w C:\Program Files\Common Files\Autodesk Shared 2007-06-03 00:34:47 -------- d-----w C:\Program Files\PowerISO 2007-06-02 23:14:41 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\dvdcss 2007-06-01 01:21:17 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\vlc 2007-05-31 06:45:07 524,288 ----a-w C:\windows\system32\DivXsm.exe 2007-05-31 06:44:55 823,296 ----a-w C:\windows\system32\divx_xx07.dll 2007-05-31 06:44:54 823,296 ----a-w C:\windows\system32\divx_xx0c.dll 2007-05-31 06:44:54 802,816 ----a-w C:\windows\system32\divx_xx11.dll 2007-05-31 06:44:54 740,442 ----a-w C:\windows\system32\DivX.dll 2007-05-29 20:18:18 -------- d-----w C:\Program Files\Apple Software Update 2007-05-28 03:09:21 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\Lavasoft 2007-05-27 03:58:33 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\SmartFTP 2007-05-27 03:58:15 -------- d-----w C:\Program Files\SmartFTP Client 2007-05-25 19:00:07 -------- d-----w C:\Program Files\545 Studios 2007-05-25 18:50:31 -------- d-----w C:\Program Files\AOD 2007-05-25 17:58:57 -------- d-----w C:\Program Files\Windows NT 2007-05-25 05:05:34 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\Realtime Soft 2007-05-25 05:04:56 -------- d-----w C:\Program Files\UltraMon 2007-05-25 05:04:56 -------- d-----w C:\Program Files\Common Files\Realtime Soft 2007-05-25 04:51:31 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\Viewpoint 2007-05-25 04:38:41 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\Media Player Classic 2007-05-25 03:49:13 60,416 ----a-w C:\windows\ALCFDRTM.EXE 2007-05-25 03:42:45 -------- d-----w C:\Program Files\Stardock 2007-05-25 03:41:44 -------- d-----w C:\Program Files\VideoLAN 2007-05-25 02:16:07 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\Logitech 2007-05-25 02:13:33 -------- d-----w C:\Program Files\Common Files\Logitech 2007-05-25 02:13:03 -------- d-----w C:\Program Files\Logitech 2007-05-24 14:08:13 -------- d-----w C:\Program Files\PlayOnline 2007-05-24 11:29:22 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\WinRAR 2007-05-24 01:54:33 4,096 ----a-w C:\windows\d3dx.dat 2007-05-24 01:47:52 -------- d-----w C:\Program Files\Common Files\InstallShield 2007-05-23 03:22:06 -------- d-----w C:\Program Files\ATI Technologies 2007-05-23 03:12:18 -------- d-----w C:\DOCUME~1\Nick\APPLIC~1\.BitTornado 2007-05-23 03:11:35 -------- d-----w C:\Program Files\Viewpoint 2007-05-23 03:10:50 335 ----a-w C:\windows\nsreg.dat 2007-05-23 02:59:21 -------- d-----w C:\Program Files\microsoft frontpage 2007-05-23 02:55:15 0 --sha-r C:\MSDOS.SYS 2007-05-23 02:55:15 0 --sha-r C:\IO.SYS 2007-05-23 02:55:15 0 ----a-w C:\CONFIG.SYS 2007-05-23 02:55:15 0 ----a-w C:\AUTOEXEC.BAT 2007-05-23 02:52:30 -------- d-----w C:\Program Files\Common Files\MSSoap 2007-05-23 02:52:08 21,640 ----a-w C:\windows\system32\emptyregdb.dat 2007-05-23 02:51:11 -------- d--h--w C:\Program Files\WindowsUpdate 2007-05-23 02:51:10 -------- d-----w C:\Program Files\Online Services 2007-05-23 02:50:58 -------- d-----w C:\Program Files\MSN Gaming Zone 2007-05-22 22:10:05 -------- d-----w C:\Program Files\Common Files\ODBC 2007-05-22 22:10:01 -------- d-----w C:\Program Files\Common Files\SpeechEngines 2007-05-16 15:12:02 683,520 ----a-w C:\windows\system32\inetcomm.dll 2007-04-25 14:21:15 144,896 ----a-w C:\windows\system32\schannel.dll 2007-04-23 00:15:29 3,596,288 ----a-w C:\windows\system32\qt-dx331.dll 2007-04-23 00:15:24 129,784 ------w C:\windows\system32\pxafs.dll 2007-04-23 00:15:24 118,520 ------w C:\windows\system32\pxinsi64.exe 2007-04-23 00:15:24 116,472 ------w C:\windows\system32\pxcpyi64.exe 2007-04-23 00:15:18 200,704 ----a-w C:\windows\system32\ssldivx.dll 2007-04-23 00:15:18 1,044,480 ----a-w C:\windows\system32\libdivx.dll 2007-04-23 00:02:34 73,728 ----a-w C:\windows\system32\dpl100.dll 2007-04-23 00:02:34 196,608 ----a-w C:\windows\system32\dtu100.dll 2007-04-23 00:02:33 53,248 ----a-w C:\windows\system32\dpuGUI10.dll 2007-04-23 00:02:31 593,920 ----a-w C:\windows\system32\dpuGUI11.dll 2007-04-23 00:02:31 57,344 ----a-w C:\windows\system32\dpv11.dll 2007-04-23 00:02:31 344,064 ----a-w C:\windows\system32\dpus11.dll 2007-04-23 00:02:31 294,912 ----a-w C:\windows\system32\dpu11.dll 2007-04-23 00:02:31 294,912 ----a-w C:\windows\system32\dpu10.dll 2007-04-23 00:01:47 12,288 ----a-w C:\windows\system32\DivXWMPExtType.dll 2007-04-23 00:01:46 124,472 ----a-w C:\windows\system32\DivXCodecUpdateChecker.exe ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) Note empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] 2006-10-22 23:08 62080 --a------ C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}] 2006-10-27 00:48 2210608 --a------ D:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}] 2007-03-14 03:43 501400 --a------ C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMan"="SOUNDMAN.EXE" [2004-12-01 03:54 C:\WINDOWS\SOUNDMAN.EXE] "Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2004-12-10 12:45 C:\WINDOWS\KHALMNPR.Exe] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43] "GrooveMonitor"="D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-06-05 15:14] "iTunesHelper"="D:\Program Files\iTunes\iTunesHelper.exe" [2007-06-28 09:14] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41] "PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2007-04-09 08:23] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "UltraMon"="C:\Program Files\UltraMon\UltraMon.exe" [2006-10-12 21:27] "AIM"="D:\Program Files\AIM\aim.exe" [2003-08-01 11:31] "Update Service"="C:\PROGRA~1\COMMON~1\TEKNUM~1\update.exe" [2007-07-15 20:37] "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-04-03 18:29] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"="D:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL" [2006-10-27 00:48] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv] C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll --a------ 2007-05-24 23:46 176128 C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\WbSrv.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "appinit_dlls"=wbsys.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Nick^Start Menu^Programs^Startup^Adobe Gamma.lnk] path=C:\Documents and Settings\Nick\Start Menu\Programs\Startup\Adobe Gamma.lnk backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E] AutoRun\command- E:\setup.exe Newly Created Service - CATCHME Contents of the 'Scheduled Tasks' folder 2007-07-17 20:17:03 C:\windows\tasks\AppleSoftwareUpdate.job ************************************************************************ catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-07-20 17:30:20 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... ********************************************************************** Completion time: 2007-07-20 17:31:20 C:\ComboFix-quarantined-files.txt ... 2007-07-20 17:30 C:\ComboFix2.txt ... 2007-07-20 15:49 --- E O F --- ComboFix Quarantined Files:: 2007-05-01 11:35 146432 --a------ C:\Qoobox\Quarantine\C\Program Files\Common Files\Yazzle1162OinAdmin.exe.vir 2007-07-15 13:22 19968 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\wineil32.dll.vir 2007-07-15 13:22 72704 --a------ C:\Qoobox\Quarantine\C\Program Files\Common Files\YSTEM~1\regedit.exe~.vir 2007-07-15 13:23 31254 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\pmnolmk.dll.vir 2007-07-15 13:51 577536 --a------ C:\Qoobox\Quarantine\C\Program Files\Ultimate Fixer\ufixer.pkg.vir 2007-07-15 20:19 31254 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\pmnkigh.dll.vir 2007-07-16 01:36 66112 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\lvwpkhha.exe.vir 2007-07-17 02:55 31254 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\yaywvvs.dll.vir 2007-07-17 02:55 40183 --a------ C:\Qoobox\Quarantine\C\Program Files\Common Files\Yazzle1162OinUninstaller.exe.vir 2007-07-17 14:28 66112 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\xbvkpkin.exe.vir 2007-07-17 23:19 31254 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\tuvurss.dll.vir 2007-07-18 19:28 66112 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\vnfxygbj.exe.vir 2007-07-18 19:39 10240 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\syswin.exe.vir 2007-07-18 22:59 31254 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\ljjiifc.dll.vir 2007-07-19 23:58 66112 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\mawwoxqc.exe.vir 2007-07-20 12:42 266336 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\vtsqn.dll.vir 2007-07-20 12:51 2 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\wnsapisv32.exe.vir 2007-07-20 14:18 266336 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\geedd.dll.vir 2007-07-20 14:26 1803611 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\nqstv.bak1.vir 2007-07-20 14:26 66112 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\usjbvqtc.exe.vir 2007-07-20 15:39 4672 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\wapeuunl.exe.vir 2007-07-20 15:44 106 --a------ C:\Qoobox\Quarantine\catchme.log 2007-07-20 15:44 1822924 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\nqstv.ini.vir Folder PATH listing Volume serial number is B443-1A2E C:\QOOBOX \---Quarantine \| catchme.log \| +---C \| +---Program Files \| \| +---Common Files \| \| \| \| Yazzle1162OinAdmin.exe.vir \| \| \| \| Yazzle1162OinUninstaller.exe.vir \| \| \| \| \| \| \| \---YSTEM~1 \| \| \| regedit.exe~.vir \| \| \| \| \| \---Ultimate Fixer \| \| ufixer.pkg.vir \| \| \| \---WINDOWS \| \---system32 \| geedd.dll.vir \| ljjiifc.dll.vir \| lvwpkhha.exe.vir \| mawwoxqc.exe.vir \| nqstv.bak1.vir \| nqstv.ini.vir \| pmnkigh.dll.vir \| pmnolmk.dll.vir \| syswin.exe.vir \| tuvurss.dll.vir \| usjbvqtc.exe.vir \| vnfxygbj.exe.vir \| vtsqn.dll.vir \| wapeuunl.exe.vir \| wineil32.dll.vir \| wnsapisv32.exe.vir \| xbvkpkin.exe.vir \| yaywvvs.dll.vir \| \---Registry_backups Hijackthis Log** Logfile of HijackThis v1.99.1 Scan saved at 8:40:08 PM, on 7/20/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\windows\System32\smss.exe C:\windows\system32\csrss.exe C:\windows\system32\winlogon.exe C:\windows\system32\services.exe C:\windows\system32\lsass.exe C:\windows\System32\Ati2evxx.exe C:\windows\system32\svchost.exe C:\windows\system32\svchost.exe C:\windows\System32\svchost.exe C:\windows\System32\svchost.exe C:\windows\system32\Ati2evxx.exe C:\windows\System32\svchost.exe C:\windows\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe C:\windows\System32\svchost.exe C:\Program Files\Windows Media Player\WMPNetwk.exe C:\windows\System32\alg.exe C:\windows\SOUNDMAN.EXE C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe D:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\PowerISO\PWRISOVM.EXE C:\Program Files\UltraMon\UltraMon.exe D:\Program Files\AIM\aim.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE C:\windows\explorer.exe D:\Program Files\BitTornado\btdownloadgui.exe C:\PROGRA~1\MOZILL~1\FIREFOX.EXE D:\Desktop\Desktop\analize.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = home.netscape.com O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [GrooveMonitor] "D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE O4 - HKCU\..\Run: [UltraMon] "C:\Program Files\UltraMon\UltraMon.exe" /auto O4 - HKCU\..\Run: [AIM] D:\Program Files\AIM\aim.exe -cnetwait.odl O4 - HKCU\..\Run: [Update Service] C:\PROGRA~1\COMMON~1\TEKNUM~1\update.exe /startup O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = D:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - D:\Program Files\AIM\aim.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/micr...?1179938781046 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1179938771406 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\PROGRA~1\MICROS~1\Office12\GR99D3~1.DLL O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL O20 - Winlogon Notify: WBSrv - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll O20 - Winlogon Notify: WgaLogon - C:\windows\ O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\windows\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe (file missing) O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: mental ray 3.5 Satellite (32-bit) (mi-raysat_3dsmax9_32) - Unknown owner - D:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe O23 - Service: TVersityMediaServer - Unknown owner - D:\Program Files\TVersity\Media Server\MediaServer.exe (file missing) Amazing! Just one program got rid of just about all the bad files from before! Audio still won't work in IE or Firefox so it must be something else...

07-20-2007, 08:16 PM	#6 (permalink)
Clark76 Analyst, Security Team ; Rangemaster, TSF Academy Join Date: Jun 2006 Location: Cleveland, Ohio Posts: 1,693 OS: XP Pro, Vista, Ubuntu 8.10	Re: VundoFix removes vundo, but the vundo reappears...ljjiifc.dll It appears that you have an older copy of ComboFix. The tool has been recently updated today. Please delete your current copy of Combofix and them follow my previous instruction again in the same order as listed. run Combofix install an anti-virus program, update it, and run a full system scan get a new Hijackthis log There will be three logs I will like to see: C:\ComboFix.txt << this one should be the one from the newest run of Combofix C:\ComboFix3.txt new Hijackthis log I would like to stress that you need to install an anti-virus program. Here are two very good free Antivirus products which are available: Avast! AVG Also, please do not assume that a lack of symptoms is a clean machine. Please stick with me till your logs are declared clean. __________________ Proud Member of ASAP Proud Member of UNITE If you feel we've helped you, Please Donate to the Forum

07-22-2007, 09:09 PM	#10 (permalink)
Clark76 Analyst, Security Team ; Rangemaster, TSF Academy Join Date: Jun 2006 Location: Cleveland, Ohio Posts: 1,693 OS: XP Pro, Vista, Ubuntu 8.10	Re: VundoFix removes vundo, but the vundo reappears...ljjiifc.dll Please open Security Task Manager Locate the following file: folcnufa.dll Highlight it then click Remove at the top of the screen. Repeat the process with the following files qhyinnjh.dll rkoc.dll tohsxmzo.dll Is your computer experiencing anymore problems? __________________ Proud Member of ASAP Proud Member of UNITE If you feel we've helped you, Please Donate to the Forum

07-22-2007, 11:47 PM	#11 (permalink)
Lionet Registered User Join Date: Nov 2006 Posts: 18 OS: WinXP	Re: VundoFix removes vundo, but the vundo reappears...ljjiifc.dll No, not as far as I can tell! Other than the almost minute sound in firefox I haven't experienced anything. Any ideas as to the firefox thing or would that be a driver issue? Thank you so much!

07-24-2007, 09:15 PM	#13 (permalink)
Lionet Registered User Join Date: Nov 2006 Posts: 18 OS: WinXP	Re: VundoFix removes vundo, but the vundo reappears...ljjiifc.dll Ok all set! Yeah no sound in any site in either firefox or internet explorer, ive re downloaded my Sound card drivers, the cords are in the right places because iTunes audio plays perfect. Thank you so much for all of your help!

07-24-2007, 09:30 PM	#14 (permalink)
Clark76 Analyst, Security Team ; Rangemaster, TSF Academy Join Date: Jun 2006 Location: Cleveland, Ohio Posts: 1,693 OS: XP Pro, Vista, Ubuntu 8.10	Re: VundoFix removes vundo, but the vundo reappears...ljjiifc.dll You are welcome Hopefully the techs over at Mozilla/FireFox or at Internet Explorer forum can give you a hand with the sound problem. __________________ Proud Member of ASAP Proud Member of UNITE If you feel we've helped you, Please Donate to the Forum