Welcome to Tech Support Forum home to more then 136,000 problems solved. Issues have included: Spyware, Malware, Virus Issues, Windows, Microsoft, Linux, Networking, Security, Hardware, and Gaming Getting your problem solved is as easy as:
1. Registering for a free account
2. Asking your question
3. Receiving an answer

Registered members:
* Get free support
* Communicate privately with other members (PM).
* Removal of this message
* See fewer ads.
* And much more..

 


Want to know how to post a question? click here Having problems with spyware and pop-ups? First Steps
Go Back   Tech Support Forum > Security Center > Virus/Trojan/Spyware Help > Resolved HJT Threads
Reload this Page Hijack Log Help - "Your computer is infected" on taskbar
User Name
Password
Site Map Register Donate Rules Blogs Mark Forums Read


Resolved HJT Threads Resolved spyware and popup issues.

 
 
LinkBack Thread Tools
Old 12-29-2007, 05:42 PM   #1 (permalink)
Registered User
 
Join Date: Dec 2007
Posts: 6
OS: windows xp sp2


Hijack Log Help - "Your computer is infected" on taskbar
Hello All,

I am getting a popup on my taskbar telling me I have "Windows security problems", and "infected files found". Also, when i search using google, when i click on links it redirects me to various sites and I must go back numerous times to be able to access the actual site.

I followed the 5 steps, here are the logs:

Panda:

Incident Status Location

Adware:Adware/AVSystemCare Not disinfected E:\WINDOWS\system32\encde.dll
Spyware:Cookie/RealMedia Not disinfected E:\Documents and Settings\Christofi\Cookies\christofi@247realmedia[1].txt
Spyware:Cookie/YieldManager Not disinfected E:\Documents and Settings\Christofi\Cookies\christofi@ad.yieldmanager[2].txt
Spyware:Cookie/AdDynamix Not disinfected E:\Documents and Settings\Christofi\Cookies\christofi@ads.addynamix[1].txt
Spyware:Cookie/PointRoll Not disinfected E:\Documents and Settings\Christofi\Cookies\christofi@ads.pointroll[2].txt
Spyware:Cookie/adultfriendfinder Not disinfected E:\Documents and Settings\Christofi\Cookies\christofi@adultfriendfinder[2].txt
Spyware:Cookie/Advertising Not disinfected E:\Documents and Settings\Christofi\Cookies\christofi@advertising[2].txt
Spyware:Cookie/Atlas DMT Not disinfected E:\Documents and Settings\Christofi\Cookies\christofi@atdmt[2].txt
Spyware:Cookie/Atwola Not disinfected E:\Documents and Settings\Christofi\Cookies\christofi@atwola[1].txt
Spyware:Cookie/Serving-sys Not disinfected E:\Documents and Settings\Christofi\Cookies\christofi@bs.serving-sys[2].txt
Spyware:Cookie/BurstNet Not disinfected E:\Documents and Settings\Christofi\Cookies\christofi@burstnet[2].txt
Spyware:Cookie/Casalemedia Not disinfected E:\Documents and Settings\Christofi\Cookies\christofi@casalemedia[2].txt
Spyware:Cookie/Cd Freaks Not disinfected E:\Documents and Settings\Christofi\Cookies\christofi@cdfreaks[2].txt
Spyware:Cookie/Cgi-bin Not disinfected E:\Documents and Settings\Christofi\Cookies\christofi@cgi-bin[1].txt
Spyware:Cookie/Com.com Not disinfected E:\Documents and Settings\Christofi\Cookies\christofi@com[1].txt
Spyware:Cookie/Doubleclick Not disinfected E:\Documents and Settings\Christofi\Cookies\christofi@doubleclick[1].txt
Spyware:Cookie/Enhance Not disinfected E:\Documents and Settings\Christofi\Cookies\christofi@enhance[2].txt
Spyware:Cookie/FastClick Not disinfected E:\Documents and Settings\Christofi\Cookies\christofi@fastclick[1].txt
Spyware:Cookie/HotLog Not disinfected E:\Documents and Settings\Christofi\Cookies\christofi@hotlog[1].txt
Spyware:Cookie/Overture Not disinfected E:\Documents and Settings\Christofi\Cookies\christofi@overture[1].txt
Spyware:Cookie/Overture Not disinfected E:\Documents and Settings\Christofi\Cookies\christofi@perf.overture[1].txt
Spyware:Cookie/QuestionMarket Not disinfected E:\Documents and Settings\Christofi\Cookies\christofi@questionmarket[2].txt
Spyware:Cookie/RealMedia Not disinfected E:\Documents and Settings\Christofi\Cookies\christofi@realmedia[1].txt
Spyware:Cookie/WUpd Not disinfected E:\Documents and Settings\Christofi\Cookies\christofi@revenue[2].txt
Spyware:Cookie/Searchportal Not disinfected E:\Documents and Settings\Christofi\Cookies\christofi@searchportal.information[1].txt
Spyware:Cookie/Server.iad.Liveperson Not disinfected E:\Documents and Settings\Christofi\Cookies\christofi@server.iad.liveperson[2].txt
Spyware:Cookie/Serving-sys Not disinfected E:\Documents and Settings\Christofi\Cookies\christofi@serving-sys[2].txt
Spyware:Cookie/WebtrendsLive Not disinfected E:\Documents and Settings\Christofi\Cookies\christofi@statse.webtrendslive[2].txt
Spyware:Cookie/Traffic Marketplace Not disinfected E:\Documents and Settings\Christofi\Cookies\christofi@trafficmp[2].txt
Spyware:Cookie/Tribalfusion Not disinfected E:\Documents and Settings\Christofi\Cookies\christofi@tribalfusion[2].txt
Spyware:Cookie/Yadro Not disinfected E:\Documents and Settings\Christofi\Cookies\christofi@yadro[1].txt
Spyware:Cookie/Zedo Not disinfected E:\Documents and Settings\Christofi\Cookies\christofi@zedo[1].txt
Potentially unwanted tool:Application/NirCmd.A Not disinfected E:\Documents and Settings\Christofi\Desktop\ComboFix.exe[nircmd.exe]
Potentially unwanted tool:Application/NirCmd.A Not disinfected E:\Documents and Settings\Christofi\Desktop\ComboFix.exe[nircmd.cfexe]
Virus:Trj/Downloader.QQO Disinfected E:\Documents and Settings\Christofi\Local Settings\Temp\doldbal.dll
Virus:Trj/Downloader.QQO Disinfected E:\Documents and Settings\Christofi\Local Settings\Temp\doldbal1.dll
Virus:Trj/Downloader.QQO Disinfected E:\Documents and Settings\Christofi\Local Settings\Temp\doldbal3.dll
Virus:Trj/Downloader.QQO Disinfected E:\Documents and Settings\Christofi\Local Settings\Temp\doldbal32.dll
Virus:Trj/Downloader.QQO Disinfected E:\Documents and Settings\Christofi\Local Settings\Temp\doldbal5.dll
Virus:Trj/Downloader.QQO Disinfected E:\Documents and Settings\Christofi\Local Settings\Temp\doldbal6.dll
Virus:Trj/Downloader.QQO Disinfected E:\Documents and Settings\Christofi\Local Settings\Temp\doldbal9.dll
Virus:Trj/Downloader.QQO Disinfected E:\Documents and Settings\Christofi\Local Settings\Temp\doldbal91.dll
Possible Virus. Not disinfected E:\WINDOWS\system32\encde.1
Adware:Adware/AVSystemCare Not disinfected E:\WINDOWS\system32\encde.2
Adware:Adware/AVSystemCare Not disinfected E:\WINDOWS\system32\encde.3
Virus:Trj/BHO.AA Disinfected E:\WINDOWS\system32\encde.4
Deckard's:
Deckard's System Scanner v20071014.68
Run by Christofi on 2007-12-29 19:24:32
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.


-- Last 5 Restore Point(s) --
6: 2007-12-30 00:24:46 UTC - RP239 - Deckard's System Scanner Restore Point
5: 2007-12-29 19:52:44 UTC - RP238 - System Checkpoint
4: 2007-12-28 17:37:41 UTC - RP237 - System Checkpoint
3: 2007-12-27 16:50:42 UTC - RP236 - System Checkpoint
2: 2007-12-21 08:04:42 UTC - RP235 - System Checkpoint


-- First Restore Point --
1: 2007-12-20 07:04:40 UTC - RP234 - System Checkpoint


Backed up registry hives.
Performed disk cleanup.

Total Physical Memory: 255 MiB (512 MiB recommended).


-- HijackThis (run as Christofi.exe) -------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:29:21 PM, on 12/29/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\Program Files\Ahead\InCD\InCDsrv.exe
E:\WINDOWS\system32\ZoneLabs\vsmon.exe
E:\WINDOWS\Explorer.EXE
E:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
E:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
E:\WINDOWS\system32\LEXBCES.EXE
E:\WINDOWS\system32\LEXPPS.EXE
E:\WINDOWS\system32\spoolsv.exe
E:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe
E:\WINDOWS\System32\GEARSec.exe
E:\Program Files\Common Files\LightScribe\LSSrvc.exe
e:\program files\mcafee.com\agent\mcdetect.exe
e:\PROGRA~1\mcafee.com\vso\mcshield.exe
e:\PROGRA~1\mcafee.com\agent\mctskshd.exe
e:\PROGRA~1\mcafee.com\vso\OasClnt.exe
E:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
E:\Program Files\Norton Ghost\Agent\VProSvc.exe
E:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
E:\WINDOWS\system32\nvsvc32.exe
e:\progra~1\mcafee.com\vso\mcvsescn.exe
E:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
E:\WINDOWS\system32\svchost.exe
E:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
E:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
E:\Program Files\Dell AIO Printer A940\dlbabmgr.exe
E:\Program Files\Ahead\InCD\InCD.exe
E:\WINDOWS\system32\wscntfy.exe
E:\Program Files\lg_fwupdate\fwupdate.exe
E:\PROGRA~1\mcafee.com\agent\mcagent.exe
E:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
E:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
E:\WINDOWS\system32\tbctray.exe
E:\Program Files\Dell AIO Printer A940\dlbabmon.exe
E:\WINDOWS\system32\ctfmon.exe
E:\Documents and Settings\Christofi\Desktop\dss.exe
E:\PROGRA~1\TRENDM~1\HIJACK~1\Christofi.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {D02DD94F-23DC-43B8-8DEF-3451AC3C187E} - E:\WINDOWS\system32\encde.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - e:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [Dell AIO Printer A940] "E:\Program Files\Dell AIO Printer A940\dlbabmgr.exe"
O4 - HKLM\..\Run: [DAEMON Tools-1033] "E:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [InCD] E:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [NeroFilterCheck] E:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LGODDFU] "E:\Program Files\lg_fwupdate\fwupdate.exe" blrun
O4 - HKLM\..\Run: [VSOCheckTask] "E:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] E:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [OASClnt] E:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [MCAgentExe] e:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] E:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] E:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "E:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [TraySantaCruz] E:\WINDOWS\system32\tbctray.exe
O4 - HKCU\..\Run: [P2kAutostart] C:\Moto Phone Progs\P2kCommanderV330\P2kAutostart.exe
O4 - HKCU\..\Run: [updateMgr] E:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [ctfmon.exe] E:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = E:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {05D96F71-87C6-11D3-9BE4-00902742D6E0} (QuickPlace Class) - http://crystal.atkinson.yorku.ca/qp2.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/S...in/AvSniff.cab
O16 - DPF: {4788DE0A-3552-49EA-AC8C-233DA52523B9} (AxLoaderPassword Class) - http://www.blackberry.com/devicesoftware/AxLoader.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/sof...iveXPlugin.cab
O23 - Service: Adobe LM Service - Adobe Systems - E:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Capture Device Service - InterVideo Inc. - E:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: GEARSecurity - GEAR Software - E:\WINDOWS\System32\GEARSec.exe
O23 - Service: Google Updater Service (gusvc) - Google - E:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - E:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - E:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - E:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - E:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - e:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - e:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - e:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - E:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: Norton Ghost - Symantec Corporation - E:\Program Files\Norton Ghost\Agent\VProSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - E:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - E:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: Symantec Core LC - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - E:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - E:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 8379 bytes

-- File Associations -----------------------------------------------------------

All associations okay.


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R0 d344bus - e:\windows\system32\drivers\d344bus.sys
R0 d344prt - e:\windows\system32\drivers\d344prt.sys
R0 Imagedrv - e:\windows\system32\drivers\imagedrv.sys <Not Verified; Ahead Software AG and its licensors; NERO IMAGEDRIVE>
R0 kgkwqqcz - e:\windows\system32\drivers\zddcvrmk.dat
R1 OMCI - e:\windows\system32\drivers\omci.sys <Not Verified; Dell Computer Corporation; OMCI Driver>
R1 PQNTDrv - e:\windows\system32\drivers\pqntdrv.sys <Not Verified; PowerQuest Corporation; PowerQuest product>
R3 pfc (Padus ASPI Shell) - e:\windows\system32\drivers\pfc.sys <Not Verified; Padus, Inc.; Padus(R) ASPI Shell>

S3 SDTHOOK - e:\windows\system32\drivers\sdthook.sys <Not Verified; Panda Software; Panda® Antivirus>
S3 usbsermpt (Motorola USB Modem Driver for MPT) - e:\windows\system32\drivers\usbsermpt.sys <Not Verified; Microsoft Corporation; Microsoft(R) Windows (R) 2000 Operating System>
S3 vtdg46xx - e:\program files\turtle beach\santa cruz\control panel\vtdg46xx.sys


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 Capture Device Service - "e:\program files\common files\intervideo\deviceservice\devsvc.exe" <Not Verified; InterVideo Inc.; Capture Device Service>
R2 GEARSecurity - e:\windows\system32\gearsec.exe <Not Verified; GEAR Software; gearsec>


-- Device Manager: Disabled ----------------------------------------------------

No disabled devices found.


-- Files created between 2007-11-29 and 2007-12-29 -----------------------------

2007-12-29 19:27:48 0 d-------- E:\Program Files\Trend Micro
2007-12-29 19:11:44 0 d-------- E:\Program Files\SpywareBlaster
2007-12-29 17:45:47 44928 --a------ E:\WINDOWS\system32\drivers\SDTHOOK.SYS <Not Verified; Panda Software; Panda® Antivirus>
2007-12-29 17:44:47 8576 --a------ E:\WINDOWS\system32\drivers\gnhrqpnhkifj.sys <Not Verified; Panda Software International; RKPavProc Driver>
2007-12-29 17:28:37 0 d-------- E:\WINDOWS\system32\ActiveScan
2007-12-21 12:15:10 0 d-------- E:\Program Files\Allok AVI to DVD SVCD VCD Converter
2007-12-21 11:08:34 0 d-------- E:\Program Files\Burrrn
2007-12-19 21:27:23 0 d-------- E:\Documents and Settings\Christofi\Application Data\Sibelius Software
2007-12-19 21:26:55 0 d-------- E:\Program Files\Sibelius Software
2007-12-16 11:59:20 0 d-------- E:\spoolerlogs
2007-12-11 14:46:02 3596288 --a------ E:\WINDOWS\system32\qt-dx331.dll
2007-12-11 14:44:28 196608 --a------ E:\WINDOWS\system32\dtu100.dll <Not Verified; DivX, Inc.; DivX, Inc. dtu100>
2007-12-11 14:44:28 81920 --a------ E:\WINDOWS\system32\dpl100.dll <Not Verified; DivX, Inc.; DivX, Inc. dpl100>
2007-12-11 14:44:18 802816 --a------ E:\WINDOWS\system32\divx_xx11.dll <Not Verified; DivX, Inc.; DivX?>
2007-12-11 14:44:18 823296 --a------ E:\WINDOWS\system32\divx_xx0c.dll <Not Verified; DivX, Inc.; DivX®>
2007-12-11 14:44:18 823296 --a------ E:\WINDOWS\system32\divx_xx07.dll <Not Verified; DivX, Inc.; DivX®>
2007-12-11 14:44:18 682496 --a------ E:\WINDOWS\system32\DivX.dll <Not Verified; DivX, Inc.; DivX®>
2007-12-11 14:43:44 12288 --a------ E:\WINDOWS\system32\DivXWMPExtType.dll
2007-12-04 22:45:59 0 d-------- E:\Documents and Settings\All Users\Application Data\Google
2007-12-04 22:44:24 0 d-------- E:\Documents and Settings\Christofi\Application Data\Google
2007-12-04 22:44:23 0 d-------- E:\Program Files\Google
2007-11-30 21:56:58 0 d-------- E:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy


-- Find3M Report ---------------------------------------------------------------

2007-12-29 19:15:56 0 d-------- E:\Program Files\lg_fwupdate
2007-12-29 18:08:51 0 d-------- E:\Program Files\Messenger
2007-12-29 18:07:20 0 d-------- E:\Program Files\Dell AIO Printer A940
2007-12-29 18:07:11 0 d-------- E:\Program Files\D-Tools
2007-12-29 1837 0 d-------- E:\Program Files\Common Files\Symantec Shared
2007-12-29 18:05:37 0 d-------- E:\Program Files\Common Files\LightScribe
2007-12-29 17:39:21 0 d-------- E:\Program Files\MSN Messenger
2007-12-21 11:59:27 0 d-------- E:\Program Files\DivX
2007-11-24 18:26:16 952 --ahs---- E:\WINDOWS\system32\KGyGaAvL.sys
2007-11-24 18:17:51 0 d-------- E:\Program Files\MSRASI
2007-11-24 13:41:10 0 d-------- E:\Program Files\Palisade
2007-11-15 09:23:06 0 d-------- E:\Documents and Settings\Christofi\Application Data\Research In Motion
2007-11-15 09:21:52 0 d-------- E:\Documents and Settings\Christofi\Application Data\Blackberry Desktop
2007-11-15 09:21:27 0 d-------- E:\Program Files\Common Files\Research In Motion
2007-11-15 09:21:18 0 d-------- E:\Program Files\Common Files
2007-11-15 09:21:04 0 d-------- E:\Program Files\Research In Motion
2007-11-14 13:13:50 0 d-------- E:\Documents and Settings\Christofi\Application Data\Help
2007-11-13 22:54:49 0 d-------- E:\Program Files\Common Files\L&H
2007-11-13 22:54:19 0 d-------- E:\Program Files\Microsoft ActiveSync
2007-11-13 22:53:27 0 d-------- E:\Program Files\Microsoft Works
2007-11-13 22:52:36 0 d-------- E:\Program Files\Microsoft.NET
2007-11-04 16:20:25 0 d-------- E:\Documents and Settings\Christofi\Application Data\Ulead Systems
2007-11-04 13:13:32 0 d-------- E:\Program Files\Common Files\InterVideo
2007-11-04 13:13:18 0 d--h----- E:\Program Files\InstallShield Installation Information
2007-11-04 13:03:52 0 d-------- E:\Program Files\Common Files\Ulead Systems
2007-11-04 13:01:10 0 d-------- E:\Program Files\Ulead Systems
2007-11-04 12:21:40 0 d-------- E:\Documents and Settings\Christofi\Application Data\DivX
2007-11-03 18:50:55 0 d-------- E:\Documents and Settings\Christofi\Application Data\Media Player Classic
2007-11-03 13:21:07 0 d-------- E:\Documents and Settings\Christofi\Application Data\Leadertech
2007-11-03 13:15:40 0 d-------- E:\Program Files\Common Files\Sonic Shared
2007-11-03 13:14:59 0 d-------- E:\Program Files\Sonic
2007-11-03 13:02:17 0 d-------- E:\Program Files\QuickTime Alternative
2007-11-03 13:02:06 0 d-------- E:\Program Files\Media Player Classic
2007-11-03 13:02:02 0 d-------- E:\Documents and Settings\Christofi\Application Data\Apple Computer
2007-11-03 13:00:52 0 d-------- E:\Program Files\QuickTime
2007-11-03 12:57:47 37270 --a------ E:\WINDOWS\system32\OggDSUninst.exe


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D02DD94F-23DC-43B8-8DEF-3451AC3C187E}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"POINTER"="point32.exe" []
"Dell AIO Printer A940"="E:\Program Files\Dell AIO Printer A940\dlbabmgr.exe" [06/25/2003 10:29 AM]
"DAEMON Tools-1033"="E:\Program Files\D-Tools\daemon.exe" [12/27/2003 10:43 PM]
"InCD"="E:\Program Files\Ahead\InCD\InCD.exe" [07/12/2006 04:58 AM]
"NeroFilterCheck"="E:\WINDOWS\system32\NeroCheck.exe" [07/09/2001 01:50 PM]
"LGODDFU"="E:\Program Files\lg_fwupdate\fwupdate.exe" [04/15/2007 11:01 PM]
"VSOCheckTask"="E:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" [07/08/2005 08:18 PM]
"VirusScan Online"="E:\Program Files\McAfee.com\VSO\mcvsshld.exe" [08/10/2005 02:49 PM]
"OASClnt"="E:\Program Files\McAfee.com\VSO\oasclnt.exe" [08/12/2005 12:02 AM]
"MCAgentExe"="e:\PROGRA~1\mcafee.com\agent\mcagent.exe" [09/22/2005 08:29 PM]
"MCUpdateExe"="E:\PROGRA~1\mcafee.com\agent\McUpdate.exe" [01/11/2006 02:05 PM]
"SunJavaUpdateSched"="E:\Program Files\Java\jre1.5.0_03\bin\jusched.exe" [04/13/2005 05:48 AM]
"ZoneAlarm Client"="E:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [09/06/2007 03:14 PM]
"NvCplDaemon"="NvQTwk" []
"TraySantaCruz"="E:\WINDOWS\system32\tbctray.exe" [04/03/2002 11:47 AM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PowerBar"="" []
"P2kAutostart"="C:\Moto Phone Progs\P2kCommanderV330\P2kAutostart.exe" [11/01/2005 06:56 PM]
"updateMgr"="E:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [03/30/2006 03:45 PM]
"ctfmon.exe"="E:\WINDOWS\system32\ctfmon.exe" [08/03/2004 05:56 PM]

E:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - E:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [9/23/2005 9:05:26 PM]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
"E:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a200d078-8d95-11dc-8336-0007e9bcdee7}]
AutoRun\command- J:\setupSNK.exe




-- End of Deckard's System Scanner: finished at 2007-12-29 19:30:48 ------------
Attached Files
File Type: txt extra.txt (16.8 KB, 1 views)
cspaz_03 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Important Information
Join the #1 Tech Support Forum Today - It's Totally Free!

TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free.

Join TechSupportforum.com Today - Click Here

Old 12-31-2007, 01:57 PM   #2 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,611
OS: 2000 Pro; XP Pro; XP Home


Re: Hijack Log Help - "Your computer is infected" on taskbar
Hello, and Welcome to TSF.

Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe.

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

---------------------------------------------------------------------------------------------

I see from your Panda log that you may already have ComboFix on your machine. I need you to delete it, and get the latest version from one of the links below. ComobFix is updated frequently, and should never be used unsupervised.
  1. Download ComboFix from one of these locations:

    Link 1
    Link 2
    Link 3

    * IMPORTANT !!! Place combofix.exe on your Desktop
  2. Disconnect from the internet....pull the plug!
  3. Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.
  4. Double click on combofix.exe & follow the prompts. Type 1, then press Enter to start the fix.
  5. Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.
  6. When finished, it shall produce a log for you. Post that log in your next reply

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

    ---------------------------------------------------------------------------------------------
  7. Ensure your AntiVirus and AntiSpyware applications are re-enabled. A reboot should have done this.
  8. Re-establish an internet connection.
  9. Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here.

    ---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-02-2008, 11:32 AM   #3 (permalink)
Registered User
 
Join Date: Dec 2007
Posts: 6
OS: windows xp sp2


Re: Hijack Log Help - "Your computer is infected" on taskbar
Thanks for the response. Its greatly appreciated. I followed the steps and here are the logs:

ComboFix 08-01-02.1 - Christofi 2008-01-02 13:05:43.1 - NTFSx86
Running from: E:\Documents and Settings\Christofi\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

E:\WINDOWS\system32\drivers\zddcvrmk.dat
E:\WINDOWS\system32\encde.1
E:\WINDOWS\system32\encde.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_KGKWQQCZ
-------\kgkwqqcz


((((((((((((((((((((((((( Files Created from 2007-12-02 to 2008-01-02 )))))))))))))))))))))))))))))))
.

2008-01-02 13:04 . 2000-08-31 08:00 51,200 --a------ E:\WINDOWS\NirCmd.exe
2007-12-29 19:27 . 2007-12-29 19:27 <DIR> d-------- E:\Program Files\Trend Micro
2007-12-29 19:23 . 2007-12-29 19:23 <DIR> d-------- E:\Deckard
2007-12-29 19:11 . 2007-12-29 19:19 <DIR> d-------- E:\Program Files\SpywareBlaster
2007-12-29 17:45 . 2007-06-05 10:56 44,928 --a------ E:\WINDOWS\system32\drivers\SDTHOOK.SYS
2007-12-29 17:44 . 2007-06-08 09:44 8,576 --a------ E:\WINDOWS\system32\drivers\gnhrqpnhkifj.sys
2007-12-29 17:28 . 2007-12-29 18:20 <DIR> d-------- E:\WINDOWS\system32\ActiveScan
2007-12-29 17:28 . 2007-12-29 17:28 30,590 --a------ E:\WINDOWS\system32\pavas.ico
2007-12-29 17:28 . 2007-12-29 17:28 2,550 --a------ E:\WINDOWS\system32\Uninstall.ico
2007-12-29 17:28 . 2007-12-29 17:28 1,406 --a------ E:\WINDOWS\system32\Help.ico
2007-12-28 13:23 . 2007-12-28 13:41 8,628 --ah----- E:\WINDOWS\system32\CMMGR32.GID
2007-12-21 12:15 . 2007-12-21 12:17 <DIR> d-------- E:\Program Files\Allok AVI to DVD SVCD VCD Converter
2007-12-21 12:03 . 2007-12-21 12:03 54,156 --ah----- E:\WINDOWS\QTFont.qfn
2007-12-21 12:03 . 2007-12-21 12:03 1,409 --a------ E:\WINDOWS\QTFont.for
2007-12-21 11:59 . 2007-12-11 14:46 129,784 --------- E:\WINDOWS\system32\pxafs.dll
2007-12-21 11:59 . 2007-12-11 14:46 9,464 --------- E:\WINDOWS\system32\drivers\cdralw2k.sys
2007-12-21 11:59 . 2007-12-11 14:46 9,336 --------- E:\WINDOWS\system32\drivers\cdr4_xp.sys
2007-12-21 11:08 . 2007-12-21 11:49 <DIR> d-------- E:\Program Files\Burrrn
2007-12-19 21:27 . 2007-12-19 21:27 <DIR> d-------- E:\Documents and Settings\Christofi\Application Data\Sibelius Software
2007-12-19 21:26 . 2007-12-19 21:26 <DIR> d-------- E:\Program Files\Sibelius Software
2007-12-16 11:59 . 2007-12-16 11:59 <DIR> d-------- E:\spoolerlogs
2007-12-11 14:46 . 2007-12-11 14:46 3,596,288 --a------ E:\WINDOWS\system32\qt-dx331.dll
2007-12-11 14:46 . 2007-12-11 14:46 524,288 --a------ E:\WINDOWS\system32\DivXsm.exe
2007-12-11 14:46 . 2007-12-11 14:46 4,816 --a------ E:\WINDOWS\system32\divxsm.tlb
2007-12-11 14:45 . 2007-12-11 14:45 1,044,480 --a------ E:\WINDOWS\system32\libdivx.dll
2007-12-11 14:45 . 2007-12-11 14:45 200,704 --a------ E:\WINDOWS\system32\ssldivx.dll
2007-12-11 14:43 . 2007-12-11 14:43 12,288 --a------ E:\WINDOWS\system32\DivXWMPExtType.dll
2007-12-04 22:44 . 2007-12-06 10:00 <DIR> d-------- E:\Program Files\Google

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-02 18:16 6,283,296 --sha-w E:\WINDOWS\system32\drivers\fidbox.dat
2008-01-02 18:16 2,114,704 ----a-w E:\WINDOWS\Internet Logs\tvDebug.zip
2008-01-02 18:15 76,724 --sha-w E:\WINDOWS\system32\drivers\fidbox.idx
2008-01-02 17:31 --------- d-----w E:\Program Files\lg_fwupdate
2007-12-29 23:07 --------- d-----w E:\Program Files\Dell AIO Printer A940
2007-12-29 23:07 --------- d-----w E:\Program Files\D-Tools
2007-12-29 23:06 --------- d-----w E:\Program Files\Common Files\Symantec Shared
2007-12-29 23:05 --------- d-----w E:\Program Files\Common Files\LightScribe
2007-12-29 22:39 --------- d-----w E:\Program Files\MSN Messenger
2007-12-21 16:59 --------- d-----w E:\Program Files\DivX
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\RPRSTITL.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\RPRSTEXT.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\RPRSSTMP.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\RPRSSPEC.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\RPRSSCRP.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\RPRSREH_.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\RPRSMET_.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\RPRSCHOR.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\RPRS____.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\OPUSTEXT.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\OPUSSE__.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\OPUSS___.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\OPUSROMC.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\OPUSPC__.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\OPUSP___.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\OPUSO___.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\OPUSNN__.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\OPUSM___.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\OPUSJAPC.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\OPUSFS__.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\OPUSFBE_.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\OPUSFB__.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\OPUSCSC_.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\OPUSCS__.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\OPUSC___.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\OPUS____.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\INKPEN2_.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\INK2TEXT.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\INK2SPEC.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\INK2SCRI.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\INK2METR.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\INK2CHOR.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\HELST___.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\HELSS___.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\HELSM___.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\HELSINKI.FOT
2007-12-11 19:46 43,528 ------w E:\WINDOWS\system32\drivers\pxhelp20.sys
2007-12-11 19:46 120,056 ------w E:\WINDOWS\system32\pxcpyi64.exe
2007-12-11 19:46 118,520 ------w E:\WINDOWS\system32\pxinsi64.exe
2007-12-11 19:44 823,296 ----a-w E:\WINDOWS\system32\divx_xx0c.dll
2007-12-11 19:44 823,296 ----a-w E:\WINDOWS\system32\divx_xx07.dll
2007-12-11 19:44 81,920 ----a-w E:\WINDOWS\system32\dpl100.dll
2007-12-11 19:44 802,816 ----a-w E:\WINDOWS\system32\divx_xx11.dll
2007-12-11 19:44 682,496 ----a-w E:\WINDOWS\system32\DivX.dll
2007-12-11 19:44 593,920 ----a-w E:\WINDOWS\system32\dpuGUI11.dll
2007-12-11 19:44 57,344 ----a-w E:\WINDOWS\system32\dpv11.dll
2007-12-11 19:44 53,248 ----a-w E:\WINDOWS\system32\dpuGUI10.dll
2007-12-11 19:44 344,064 ----a-w E:\WINDOWS\system32\dpus11.dll
2007-12-11 19:44 294,912 ----a-w E:\WINDOWS\system32\dpu11.dll
2007-12-11 19:44 294,912 ----a-w E:\WINDOWS\system32\dpu10.dll
2007-12-11 19:44 196,608 ----a-w E:\WINDOWS\system32\dtu100.dll
2007-12-11 19:44 156,992 ----a-w E:\WINDOWS\system32\DivXCodecVersionChecker.exe
2007-12-01 15:10 --------- d-----w E:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-24 23:17 --------- d-----w E:\Program Files\MSRASI
2007-11-24 18:41 --------- d-----w E:\Program Files\Palisade
2007-11-15 14:23 --------- d-----w E:\Documents and Settings\Christofi\Application Data\Research In Motion
2007-11-15 14:21 --------- d-----w E:\Program Files\Research In Motion
2007-11-15 14:21 --------- d-----w E:\Program Files\Common Files\Research In Motion
2007-11-15 14:21 --------- d-----w E:\Documents and Settings\Christofi\Application Data\Blackberry Desktop
2007-11-14 03:54 --------- d-----w E:\Program Files\Microsoft ActiveSync
2007-11-14 03:54 --------- d-----w E:\Program Files\Common Files\L&H
2007-11-14 03:53 --------- d-----w E:\Program Files\Microsoft Works
2007-11-14 03:52 --------- d-----w E:\Program Files\Microsoft.NET
2007-11-04 21:20 --------- d-----w E:\Documents and Settings\Christofi\Application Data\Ulead Systems
2007-11-04 18:13 --------- d--h--w E:\Program Files\InstallShield Installation Information
2007-11-04 18:13 --------- d-----w E:\Program Files\Common Files\InterVideo
2007-11-04 18:13 --------- d-----w E:\Documents and Settings\All Users\Application Data\InterVideo
2007-11-04 18:06 --------- d-----w E:\Documents and Settings\All Users\Application Data\Ulead Systems
2007-11-04 18:03 --------- d-----w E:\Program Files\Common Files\Ulead Systems
2007-11-04 18:01 --------- d-----w E:\Program Files\Ulead Systems
2007-11-04 17:21 --------- d-----w E:\Documents and Settings\Christofi\Application Data\DivX
2007-11-03 23:50 --------- d-----w E:\Documents and Settings\Christofi\Application Data\Media Player Classic
2007-11-03 18:21 --------- d-----w E:\Documents and Settings\Christofi\Application Data\Leadertech
2007-11-03 18:15 --------- d-----w E:\Program Files\Common Files\Sonic Shared
2007-11-03 18:14 --------- d-----w E:\Program Files\Sonic
2007-11-03 18:02 --------- d-----w E:\Program Files\QuickTime Alternative
2007-11-03 18:02 --------- d-----w E:\Program Files\Media Player Classic
2007-11-03 18:02 --------- d-----w E:\Documents and Settings\Christofi\Application Data\Apple Computer
2007-11-03 18:02 --------- d-----w E:\Documents and Settings\All Users\Application Data\Apple Computer
2007-11-03 18:00 --------- d-----w E:\Program Files\QuickTime
2007-11-03 17:57 37,270 ----a-w E:\WINDOWS\system32\OggDSUninst.exe
2007-07-24 00:11 92,064 ----a-w E:\Documents and Settings\Christofi\mqdmmdm.sys
2007-07-24 00:11 9,232 ----a-w E:\Documents and Settings\Christofi\mqdmmdfl.sys
2007-07-24 00:11 79,328 ----a-w E:\Documents and Settings\Christofi\mqdmserd.sys
2007-07-24 00:11 66,656 ----a-w E:\Documents and Settings\Christofi\mqdmbus.sys
2007-07-24 00:11 6,208 ----a-w E:\Documents and Settings\Christofi\mqdmcmnt.sys
2007-07-24 00:11 5,936 ----a-w E:\Documents and Settings\Christofi\mqdmwhnt.sys
2007-07-24 00:11 4,048 ----a-w E:\Documents and Settings\Christofi\mqdmcr.sys
2007-07-24 00:11 25,600 ----a-w E:\Documents and Settings\Christofi\usbsermptxp.sys
2007-07-24 00:11 22,768 ----a-w E:\Documents and Settings\Christofi\usbsermpt.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PowerBar"="" []
"P2kAutostart"="C:\Moto Phone Progs\P2kCommanderV330\P2kAutostart.exe" [2005-11-01 18:56 24064]
"updateMgr"="E:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 15:45 313472]
"ctfmon.exe"="E:\WINDOWS\system32\ctfmon.exe" [2004-08-03 17:56 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"POINTER"="point32.exe" []
"Dell AIO Printer A940"="E:\Program Files\Dell AIO Printer A940\dlbabmgr.exe" [2003-06-25 10:29 294998]
"DAEMON Tools-1033"="E:\Program Files\D-Tools\daemon.exe" [2003-12-27 22:43 81920]
"InCD"="E:\Program Files\Ahead\InCD\InCD.exe" [2006-07-12 04:58 1397760]
"NeroFilterCheck"="E:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 13:50 155648]
"LGODDFU"="E:\Program Files\lg_fwupdate\fwupdate.exe" [2007-04-15 23:01 249856]
"VSOCheckTask"="E:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" [2005-07-08 20:18 151552]
"VirusScan Online"="E:\Program Files\McAfee.com\VSO\mcvsshld.exe" [2005-08-10 14:49 163840]
"OASClnt"="E:\Program Files\McAfee.com\VSO\oasclnt.exe" [2005-08-12 00:02 53248]
"MCAgentExe"="e:\PROGRA~1\mcafee.com\agent\mcagent.exe" [2005-09-22 20:29 303104]
"MCUpdateExe"="E:\PROGRA~1\mcafee.com\agent\McUpdate.exe" [2006-01-11 14:05 212992]
"SunJavaUpdateSched"="E:\Program Files\Java\jre1.5.0_03\bin\jusched.exe" [2005-04-13 05:48 36975]
"ZoneAlarm Client"="E:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-09-06 15:14 919016]
"NvCplDaemon"="NvQTwk" []
"TraySantaCruz"="E:\WINDOWS\system32\tbctray.exe" [2002-04-03 11:47 290816]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
2004-11-02 22:24 32768 --------- E:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe

R0 d344bus;d344bus;E:\WINDOWS\system32\DRIVERS\d344bus.sys [2003-12-27 22:42]
R0 d344prt;d344prt;E:\WINDOWS\system32\Drivers\d344prt.sys [2003-12-27 04:38]
R3 tbcspud;Santa Cruz Driver;E:\WINDOWS\system32\drivers\tbcspud.sys [2002-04-03 11:51]
R3 tbcwdm;Santa Cruz WDM Driver;E:\WINDOWS\system32\drivers\tbcwdm.sys [2002-04-03 11:51]
S3 motccgp;Motorola USB Composite Device Driver;E:\WINDOWS\system32\DRIVERS\motccgp.sys [2007-02-27 13:31]
S3 motccgpfl;MotCcgpFlService;E:\WINDOWS\system32\DRIVERS\motccgpfl.sys [2007-01-23 18:03]
S3 MotDev;Motorola Inc. USB Device;E:\WINDOWS\system32\DRIVERS\motodrv.sys [2006-12-14 09:27]
S3 motmodem;Motorola USB CDC ACM Driver;E:\WINDOWS\system32\DRIVERS\motmodem.sys [2007-02-27 13:31]
S3 vtdg46xx;vtdg46xx;E:\PROGRA~1\TURTLE~1\SANTAC~1\CONTRO~1\vtdg46xx.sys [2002-03-21 21:44]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a200d078-8d95-11dc-8336-0007e9bcdee7}]
\Shell\AutoRun\command - J:\setupSNK.exe

.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-02 13:16:24
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
PowerBar = ????????l?@?????????D??????w???????????????wl?@?l?@????? ??????????????w???w???????w?m?wx????????m?w???????? ??????????????|x???0????????????P???m?w????????????????????????U???????l?@?l?@????????w????t?@?????l?@?8?@?l?@?3??s????????????????????8?@?_??s8?@?8?@
P2kAutostart = C:\Moto Phone Progs\P2kCommanderV330\P2kAutostart.exe?0???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-02 13:20:27 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-02 18:20:20

HijackThis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:23:19 PM, on 1/2/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\Program Files\Ahead\InCD\InCDsrv.exe
E:\WINDOWS\system32\ZoneLabs\vsmon.exe
E:\WINDOWS\Explorer.EXE
E:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
E:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
E:\WINDOWS\system32\LEXBCES.EXE
E:\WINDOWS\system32\LEXPPS.EXE
E:\WINDOWS\system32\spoolsv.exe
E:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe
E:\WINDOWS\System32\GEARSec.exe
E:\Program Files\Common Files\LightScribe\LSSrvc.exe
e:\program files\mcafee.com\agent\mcdetect.exe
e:\PROGRA~1\mcafee.com\vso\mcshield.exe
e:\PROGRA~1\mcafee.com\agent\mctskshd.exe
e:\PROGRA~1\mcafee.com\vso\OasClnt.exe
E:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
E:\Program Files\Norton Ghost\Agent\VProSvc.exe
E:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
e:\progra~1\mcafee.com\vso\mcvsescn.exe
E:\WINDOWS\system32\nvsvc32.exe
E:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
E:\WINDOWS\system32\svchost.exe
E:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
E:\Program Files\Dell AIO Printer A940\dlbabmgr.exe
E:\Program Files\D-Tools\daemon.exe
E:\Program Files\Ahead\InCD\InCD.exe
E:\Program Files\Dell AIO Printer A940\dlbabmon.exe
E:\Program Files\lg_fwupdate\fwupdate.exe
E:\PROGRA~1\mcafee.com\agent\mcagent.exe
E:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
E:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
E:\WINDOWS\system32\tbctray.exe
C:\Moto Phone Progs\P2kCommanderV330\P2kAutostart.exe
E:\WINDOWS\system32\ctfmon.exe
E:\WINDOWS\system32\wscntfy.exe
E:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - e:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [Dell AIO Printer A940] "E:\Program Files\Dell AIO Printer A940\dlbabmgr.exe"
O4 - HKLM\..\Run: [DAEMON Tools-1033] "E:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [InCD] E:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [NeroFilterCheck] E:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LGODDFU] "E:\Program Files\lg_fwupdate\fwupdate.exe" blrun
O4 - HKLM\..\Run: [VSOCheckTask] "E:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] E:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [OASClnt] E:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [MCAgentExe] e:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] E:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] E:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "E:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [TraySantaCruz] E:\WINDOWS\system32\tbctray.exe
O4 - HKCU\..\Run: [P2kAutostart] C:\Moto Phone Progs\P2kCommanderV330\P2kAutostart.exe
O4 - HKCU\..\Run: [updateMgr] E:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [ctfmon.exe] E:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = E:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {05D96F71-87C6-11D3-9BE4-00902742D6E0} (QuickPlace Class) - http://crystal.atkinson.yorku.ca/qp2.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/S...in/AvSniff.cab
O16 - DPF: {4788DE0A-3552-49EA-AC8C-233DA52523B9} (AxLoaderPassword Class) - http://www.blackberry.com/devicesoftware/AxLoader.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/sof...iveXPlugin.cab
O23 - Service: Adobe LM Service - Adobe Systems - E:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Capture Device Service - InterVideo Inc. - E:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: GEARSecurity - GEAR Software - E:\WINDOWS\System32\GEARSec.exe
O23 - Service: Google Updater Service (gusvc) - Google - E:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - E:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - E:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - E:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - E:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - e:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - e:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - e:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - E:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: Norton Ghost - Symantec Corporation - E:\Program Files\Norton Ghost\Agent\VProSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - E:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - E:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: Symantec Core LC - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - E:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - E:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 8191 bytes



Thanks in advance
cspaz_03 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-02-2008, 11:42 AM   #4 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,611
OS: 2000 Pro; XP Pro; XP Home


Re: Hijack Log Help - "Your computer is infected" on taskbar
Good job....next steps...

P2P - I see you have P2P software ( Limewire ) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares.

References for the risk of these programs are here,
here and here.

I would strongly recommend that you uninstall them, however that choice is up to you. If you choose to remove these programs, you can do so via Control Panel >> Add or Remove Programs.

---------------------------------------------------------------------------------------------



Open notepad and copy/paste the text in the quotebox below into it:

Quote:
File::
E:\WINDOWS\system32\encde.2
E:\WINDOWS\system32\encde.3
Save this as CFScript.txt




Refering to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply.

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

---------------------------------------------------------------------------------------------

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

Updating Java:
  • Download the latest version of Java Runtime Environment (JRE) 6 u3 and save to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
  • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u3-windowsi586-p.exe to install the newest version.
  • After the install is complete, go into the Control Panel and double-click the Java Icon. (looks like a coffee cup)
    • On the General tab, under Temporary Internet Files, click the Settings button.
    • Next, click on the Delete Files button
    • There are two options in the window to clear the cache - Leave BOTH Checked
      • Applications and Applets
        Trace and Log Files
    • Click OK on Delete Temporary Files Window
      Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
    • Click OK to leave the Temporary Files Window
    • Click OK to leave the Java Control Panel.

---------------------------------------------------------------------------------------------

Please run this online scan to help look for remnants.

First, Go to Start>Control Panel>Add/Remove Programs and remove Kaspersky online scanner if present prior to downloading the most up-to-date one.

Next, establish an internet connection & perform an online scan using Internet Explorer at Kaspersky Online Scanner

Answer Yes, when prompted to install an ActiveX component.
  • The program will then begin downloading the latest definition files.
  • Once the files have been downloaded click on NEXT
  • Locate the Scan Settings button & configure to:
    • Scan using the following Anti-Virus database:
      • Extended
    • Scan Options:
      • Scan Archives
      • Scan Mail Bases
  • Click OK & have it scan My Computer
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Click the Save as Text button to save the file to your desktop so that you may post it in your next reply
* Turn off the real time scanner of any existing antivirus program while performing the online scan

Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%.

---------------------------------------------------------------------------------------------


Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here.

---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-03-2008, 12:33 AM   #5 (permalink)
Registered User
 
Join Date: Dec 2007
Posts: 6
OS: windows xp sp2


Re: Hijack Log Help - "Your computer is infected" on taskbar
When I included the CFScript, I dont think combofix deleted the files, it said they were in use...Here are the updated reports:

ComboFix 08-01-02.1 - Christofi 2008-01-02 17:22:27.3 - NTFSx86
Running from: E:\Documents and Settings\Christofi\Desktop\ComboFix.exe
Command switches used :: E:\Documents and Settings\Christofi\Desktop\CFScript.txt
* Created a new restore point

FILE
E:\WINDOWS\system32\encde.2
E:\WINDOWS\system32\encde.3
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

E:\WINDOWS\system32\encde.2
E:\WINDOWS\system32\encde.3

.
((((((((((((((((((((((((( Files Created from 2007-12-02 to 2008-01-02 )))))))))))))))))))))))))))))))
.

2008-01-02 13:04 . 2000-08-31 08:00 51,200 --a------ E:\WINDOWS\NirCmd.exe
2007-12-29 19:27 . 2007-12-29 19:27 <DIR> d-------- E:\Program Files\Trend Micro
2007-12-29 19:23 . 2007-12-29 19:23 <DIR> d-------- E:\Deckard
2007-12-29 19:11 . 2007-12-29 19:19 <DIR> d-------- E:\Program Files\SpywareBlaster
2007-12-29 17:45 . 2007-06-05 10:56 44,928 --a------ E:\WINDOWS\system32\drivers\SDTHOOK.SYS
2007-12-29 17:44 . 2007-06-08 09:44 8,576 --a------ E:\WINDOWS\system32\drivers\gnhrqpnhkifj.sys
2007-12-29 17:28 . 2007-12-29 18:20 <DIR> d-------- E:\WINDOWS\system32\ActiveScan
2007-12-29 17:28 . 2007-12-29 17:28 30,590 --a------ E:\WINDOWS\system32\pavas.ico
2007-12-29 17:28 . 2007-12-29 17:28 2,550 --a------ E:\WINDOWS\system32\Uninstall.ico
2007-12-29 17:28 . 2007-12-29 17:28 1,406 --a------ E:\WINDOWS\system32\Help.ico
2007-12-28 13:23 . 2007-12-28 13:41 8,628 --ah----- E:\WINDOWS\system32\CMMGR32.GID
2007-12-21 12:15 . 2007-12-21 12:17 <DIR> d-------- E:\Program Files\Allok AVI to DVD SVCD VCD Converter
2007-12-21 12:03 . 2007-12-21 12:03 54,156 --ah----- E:\WINDOWS\QTFont.qfn
2007-12-21 12:03 . 2007-12-21 12:03 1,409 --a------ E:\WINDOWS\QTFont.for
2007-12-21 11:59 . 2007-12-11 14:46 129,784 --------- E:\WINDOWS\system32\pxafs.dll
2007-12-21 11:59 . 2007-12-11 14:46 9,464 --------- E:\WINDOWS\system32\drivers\cdralw2k.sys
2007-12-21 11:59 . 2007-12-11 14:46 9,336 --------- E:\WINDOWS\system32\drivers\cdr4_xp.sys
2007-12-21 11:08 . 2007-12-21 11:49 <DIR> d-------- E:\Program Files\Burrrn
2007-12-19 21:27 . 2007-12-19 21:27 <DIR> d-------- E:\Documents and Settings\Christofi\Application Data\Sibelius Software
2007-12-19 21:26 . 2007-12-19 21:26 <DIR> d-------- E:\Program Files\Sibelius Software
2007-12-16 11:59 . 2007-12-16 11:59 <DIR> d-------- E:\spoolerlogs
2007-12-11 14:46 . 2007-12-11 14:46 3,596,288 --a------ E:\WINDOWS\system32\qt-dx331.dll
2007-12-11 14:46 . 2007-12-11 14:46 524,288 --a------ E:\WINDOWS\system32\DivXsm.exe
2007-12-11 14:46 . 2007-12-11 14:46 4,816 --a------ E:\WINDOWS\system32\divxsm.tlb
2007-12-11 14:45 . 2007-12-11 14:45 1,044,480 --a------ E:\WINDOWS\system32\libdivx.dll
2007-12-11 14:45 . 2007-12-11 14:45 200,704 --a------ E:\WINDOWS\system32\ssldivx.dll
2007-12-11 14:43 . 2007-12-11 14:43 12,288 --a------ E:\WINDOWS\system32\DivXWMPExtType.dll
2007-12-04 22:44 . 2007-12-06 10:00 <DIR> d-------- E:\Program Files\Google

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-02 22:24 6,373,408 --sha-w E:\WINDOWS\system32\drivers\fidbox.dat
2008-01-02 18:18 --------- d-----w E:\Program Files\lg_fwupdate
2008-01-02 18:16 2,114,704 ----a-w E:\WINDOWS\Internet Logs\tvDebug.zip
2008-01-02 18:15 76,724 --sha-w E:\WINDOWS\system32\drivers\fidbox.idx
2007-12-29 23:07 --------- d-----w E:\Program Files\Dell AIO Printer A940
2007-12-29 23:07 --------- d-----w E:\Program Files\D-Tools
2007-12-29 23:06 --------- d-----w E:\Program Files\Common Files\Symantec Shared
2007-12-29 23:05 --------- d-----w E:\Program Files\Common Files\LightScribe
2007-12-29 22:39 --------- d-----w E:\Program Files\MSN Messenger
2007-12-21 16:59 --------- d-----w E:\Program Files\DivX
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\RPRSTITL.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\RPRSTEXT.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\RPRSSTMP.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\RPRSSPEC.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\RPRSSCRP.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\RPRSREH_.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\RPRSMET_.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\RPRSCHOR.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\RPRS____.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\OPUSTEXT.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\OPUSSE__.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\OPUSS___.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\OPUSROMC.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\OPUSPC__.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\OPUSP___.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\OPUSO___.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\OPUSNN__.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\OPUSM___.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\OPUSJAPC.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\OPUSFS__.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\OPUSFBE_.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\OPUSFB__.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\OPUSCSC_.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\OPUSCS__.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\OPUSC___.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\OPUS____.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\INKPEN2_.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\INK2TEXT.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\INK2SPEC.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\INK2SCRI.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\INK2METR.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\INK2CHOR.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\HELST___.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\HELSS___.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\HELSM___.FOT
2007-12-20 02:27 1,409 ----a-w E:\WINDOWS\Fonts\HELSINKI.FOT
2007-12-11 19:46 43,528 ------w E:\WINDOWS\system32\drivers\pxhelp20.sys
2007-12-11 19:46 120,056 ------w E:\WINDOWS\system32\pxcpyi64.exe
2007-12-11 19:46 118,520 ------w E:\WINDOWS\system32\pxinsi64.exe
2007-12-11 19:44 823,296 ----a-w E:\WINDOWS\system32\divx_xx0c.dll
2007-12-11 19:44 823,296 ----a-w E:\WINDOWS\system32\divx_xx07.dll
2007-12-11 19:44 81,920 ----a-w E:\WINDOWS\system32\dpl100.dll
2007-12-11 19:44 802,816 ----a-w E:\WINDOWS\system32\divx_xx11.dll
2007-12-11 19:44 682,496 ----a-w E:\WINDOWS\system32\DivX.dll
2007-12-11 19:44 593,920 ----a-w E:\WINDOWS\system32\dpuGUI11.dll
2007-12-11 19:44 57,344 ----a-w E:\WINDOWS\system32\dpv11.dll
2007-12-11 19:44 53,248 ----a-w E:\WINDOWS\system32\dpuGUI10.dll
2007-12-11 19:44 344,064 ----a-w E:\WINDOWS\system32\dpus11.dll
2007-12-11 19:44 294,912 ----a-w E:\WINDOWS\system32\dpu11.dll
2007-12-11 19:44 294,912 ----a-w E:\WINDOWS\system32\dpu10.dll
2007-12-11 19:44 196,608 ----a-w E:\WINDOWS\system32\dtu100.dll
2007-12-11 19:44 156,992 ----a-w E:\WINDOWS\system32\DivXCodecVersionChecker.exe
2007-12-01 15:10 --------- d-----w E:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-24 23:17 --------- d-----w E:\Program Files\MSRASI
2007-11-24 18:41 --------- d-----w E:\Program Files\Palisade
2007-11-15 14:23 --------- d-----w E:\Documents and Settings\Christofi\Application Data\Research In Motion
2007-11-15 14:21 --------- d-----w E:\Program Files\Research In Motion
2007-11-15 14:21 --------- d-----w E:\Program Files\Common Files\Research In Motion
2007-11-15 14:21 --------- d-----w E:\Documents and Settings\Christofi\Application Data\Blackberry Desktop
2007-11-14 03:54 --------- d-----w E:\Program Files\Microsoft ActiveSync
2007-11-14 03:54 --------- d-----w E:\Program Files\Common Files\L&H
2007-11-14 03:53 --------- d-----w E:\Program Files\Microsoft Works
2007-11-14 03:52 --------- d-----w E:\Program Files\Microsoft.NET
2007-11-04 21:20 --------- d-----w E:\Documents and Settings\Christofi\Application Data\Ulead Systems
2007-11-04 18:13 --------- d--h--w E:\Program Files\InstallShield Installation Information
2007-11-04 18:13 --------- d-----w E:\Program Files\Common Files\InterVideo
2007-11-04 18:13 --------- d-----w E:\Documents and Settings\All Users\Application Data\InterVideo
2007-11-04 18:06 --------- d-----w E:\Documents and Settings\All Users\Application Data\Ulead Systems
2007-11-04 18:03 --------- d-----w E:\Program Files\Common Files\Ulead Systems
2007-11-04 18:01 --------- d-----w E:\Program Files\Ulead Systems
2007-11-04 17:21 --------- d-----w E:\Documents and Settings\Christofi\Application Data\DivX
2007-11-03 23:50 --------- d-----w E:\Documents and Settings\Christofi\Application Data\Media Player Classic
2007-11-03 18:21 --------- d-----w E:\Documents and Settings\Christofi\Application Data\Leadertech
2007-11-03 18:15 --------- d-----w E:\Program Files\Common Files\Sonic Shared
2007-11-03 18:14 --------- d-----w E:\Program Files\Sonic
2007-11-03 18:02 --------- d-----w E:\Program Files\QuickTime Alternative
2007-11-03 18:02 --------- d-----w E:\Program Files\Media Player Classic
2007-11-03 18:02 --------- d-----w E:\Documents and Settings\Christofi\Application Data\Apple Computer
2007-11-03 18:02 --------- d-----w E:\Documents and Settings\All Users\Application Data\Apple Computer
2007-11-03 18:00 --------- d-----w E:\Program Files\QuickTime
2007-11-03 17:57 37,270 ----a-w E:\WINDOWS\system32\OggDSUninst.exe
2007-07-24 00:11 92,064 ----a-w E:\Documents and Settings\Christofi\mqdmmdm.sys
2007-07-24 00:11 9,232 ----a-w E:\Documents and Settings\Christofi\mqdmmdfl.sys
2007-07-24 00:11 79,328 ----a-w E:\Documents and Settings\Christofi\mqdmserd.sys
2007-07-24 00:11 66,656 ----a-w E:\Documents and Settings\Christofi\mqdmbus.sys
2007-07-24 00:11 6,208 ----a-w E:\Documents and Settings\Christofi\mqdmcmnt.sys
2007-07-24 00:11 5,936 ----a-w E:\Documents and Settings\Christofi\mqdmwhnt.sys
2007-07-24 00:11 4,048 ----a-w E:\Documents and Settings\Christofi\mqdmcr.sys
2007-07-24 00:11 25,600 ----a-w E:\Documents and Settings\Christofi\usbsermptxp.sys
2007-07-24 00:11 22,768 ----a-w E:\Documents and Settings\Christofi\usbsermpt.sys
.

((((((((((((((((((((((((((((( snapshot@2008-01-02_13.19.49.14 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-01-02 18:16:41 16,384 ----atw E:\WINDOWS\Temp\Perflib_Perfdata_68c.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PowerBar"="" []
"P2kAutostart"="C:\Moto Phone Progs\P2kCommanderV330\P2kAutostart.exe" [2005-11-01 18:56 24064]
"updateMgr"="E:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 15:45 313472]
"ctfmon.exe"="E:\WINDOWS\system32\ctfmon.exe" [2004-08-03 17:56 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"POINTER"="point32.exe" []
"Dell AIO Printer A940"="E:\Program Files\Dell AIO Printer A940\dlbabmgr.exe" [2003-06-25 10:29 294998]
"DAEMON Tools-1033"="E:\Program Files\D-Tools\daemon.exe" [2003-12-27 22:43 81920]
"InCD"="E:\Program Files\Ahead\InCD\InCD.exe" [2006-07-12 04:58 1397760]
"NeroFilterCheck"="E:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 13:50 155648]
"LGODDFU"="E:\Program Files\lg_fwupdate\fwupdate.exe" [2007-04-15 23:01 249856]
"VSOCheckTask"="E:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" [2005-07-08 20:18 151552]
"VirusScan Online"="E:\Program Files\McAfee.com\VSO\mcvsshld.exe" [2005-08-10 14:49 163840]
"OASClnt"="E:\Program Files\McAfee.com\VSO\oasclnt.exe" [2005-08-12 00:02 53248]
"MCAgentExe"="e:\PROGRA~1\mcafee.com\agent\mcagent.exe" [2005-09-22 20:29 303104]
"MCUpdateExe"="e:\PROGRA~1\mcafee.com\agent\mcupdate.exe" [2006-01-11 14:05 212992]
"SunJavaUpdateSched"="E:\Program Files\Java\jre1.5.0_03\bin\jusched.exe" [2005-04-13 05:48 36975]
"ZoneAlarm Client"="E:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-09-06 15:14 919016]
"NvCplDaemon"="NvQTwk" []
"TraySantaCruz"="E:\WINDOWS\system32\tbctray.exe" [2002-04-03 11:47 290816]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
2004-11-02 22:24 32768 --------- E:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe

R0 d344bus;d344bus;E:\WINDOWS\system32\DRIVERS\d344bus.sys [2003-12-27 22:42]
R0 d344prt;d344prt;E:\WINDOWS\system32\Drivers\d344prt.sys [2003-12-27 04:38]
R3 tbcspud;Santa Cruz Driver;E:\WINDOWS\system32\drivers\tbcspud.sys [2002-04-03 11:51]
R3 tbcwdm;Santa Cruz WDM Driver;E:\WINDOWS\system32\drivers\tbcwdm.sys [2002-04-03 11:51]
S3 motccgp;Motorola USB Composite Device Driver;E:\WINDOWS\system32\DRIVERS\motccgp.sys [2007-02-27 13:31]
S3 motccgpfl;MotCcgpFlService;E:\WINDOWS\system32\DRIVERS\motccgpfl.sys [2007-01-23 18:03]
S3 MotDev;Motorola Inc. USB Device;E:\WINDOWS\system32\DRIVERS\motodrv.sys [2006-12-14 09:27]
S3 motmodem;Motorola USB CDC ACM Driver;E:\WINDOWS\system32\DRIVERS\motmodem.sys [2007-02-27 13:31]
S3 vtdg46xx;vtdg46xx;E:\PROGRA~1\TURTLE~1\SANTAC~1\CONTRO~1\vtdg46xx.sys [2002-03-21 21:44]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a200d078-8d95-11dc-8336-0007e9bcdee7}]
\Shell\AutoRun\command - J:\setupSNK.exe

.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-02 17:24:51
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
PowerBar = ????????l?@?????????D??????w???????????????wl?@?l?@????? ??????????????w???w???????w?m?wx????????m?w???????? ??????????????|x???0????????????P???m?w????????????????????????U???????l?@?l?@????????w????t?@?????l?@?8?@?l?@?3??s????????????????????8?@?_??s8?@?8?@
P2kAutostart = C:\Moto Phone Progs\P2kCommanderV330\P2kAutostart.exe?0???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-02 17:25:41
ComboFix-quarantined-files.txt 2008-01-02 22:25:38
ComboFix2.txt 2008-01-02 22:20:08
ComboFix3.txt 2008-01-02 18:20:27


Kaspersky:

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Thursday, January 03, 2008 2:31:45 AM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 2/01/2008
Kaspersky Anti-Virus database records: 501789
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\
G:\
I:\
J:\

Scan Statistics:
Total number of scanned objects: 54279
Number of viruses found: 5
Number of infected objects: 7
Number of suspicious objects: 0
Duration of the scan process: 01:29:24

Infected Object Name / Virus Name / Last Action
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{31ACA42B-F489-45E4-B960-5AAF395EBBE7}\RP245\change.log Object is locked skipped
E:\Deckard\System Scanner\backup\WINDOWS\temp\ASHeuristic\encde_1.vir Infected: Trojan-Spy.Win32.BZub.btx skipped
E:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Logs\TaskScheduler\McTskshd001.log Object is locked skipped
E:\Documents and Settings\All Users\Application Data\McAfee.com\VSO\OASLogs\OAS.log Object is locked skipped
E:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped
E:\Documents and Settings\Christofi\Cookies\index.dat Object is locked skipped
E:\Documents and Settings\Christofi\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
E:\Documents and Settings\Christofi\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
E:\Documents and Settings\Christofi\Local Settings\History\History.IE5\index.dat Object is locked skipped
E:\Documents and Settings\Christofi\Local Settings\Temp\~DF7C18.tmp Object is locked skipped
E:\Documents and Settings\Christofi\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
E:\Documents and Settings\Christofi\ntuser.dat Object is locked skipped
E:\Documents and Settings\Christofi\ntuser.dat.LOG Object is locked skipped
E:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
E:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
E:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
E:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
E:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
E:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
E:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
E:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
E:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
E:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
E:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
E:\Program Files\Alcohol Soft\Alcohol 120\StarWind\logs\starwind.2008-01-02.18-00-50.log Object is locked skipped
E:\QooBox\Quarantine\catchme2008-01-02_131611.42.zip/encde.dll Infected: Trojan.Win32.BHO.abo skipped
E:\QooBox\Quarantine\catchme2008-01-02_131611.42.zip/zddcvrmk.dat Infected: Rootkit.Win32.Agent.ql skipped
E:\QooBox\Quarantine\catchme2008-01-02_131611.42.zip ZIP: infected - 2 skipped
E:\QooBox\Quarantine\E\WINDOWS\system32\drivers\zddcvrmk.dat.vir Object is locked skipped
E:\QooBox\Quarantine\E\WINDOWS\system32\encde.1.vir Infected: Trojan-Spy.Win32.BZub.btx skipped
E:\QooBox\Quarantine\E\WINDOWS\system32\encde.2.vir Infected: Trojan.Win32.BHO.yr skipped
E:\QooBox\Quarantine\E\WINDOWS\system32\encde.3.vir Infected: Trojan-Downloader.Win32.Delf.dbo skipped
E:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
E:\System Volume Information\_restore{31ACA42B-F489-45E4-B960-5AAF395EBBE7}\RP245\change.log Object is locked skipped
E:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
E:\WINDOWS\SchedLgU.Txt Object is locked skipped
E:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
E:\WINDOWS\Sti_Trace.log Object is locked skipped
E:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
E:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
E:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
E:\WINDOWS\system32\config\default Object is locked skipped
E:\WINDOWS\system32\config\default.LOG Object is locked skipped
E:\WINDOWS\system32\config\SAM Object is locked skipped
E:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
E:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
E:\WINDOWS\system32\config\SECURITY Object is locked skipped
E:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
E:\WINDOWS\system32\config\software Object is locked skipped
E:\WINDOWS\system32\config\software.LOG Object is locked skipped
E:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
E:\WINDOWS\system32\config\system Object is locked skipped
E:\WINDOWS\system32\config\system.LOG Object is locked skipped
E:\WINDOWS\system32\drivers\fidbox.dat Object is locked skipped
E:\WINDOWS\system32\drivers\fidbox.idx Object is locked skipped
E:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped
E:\WINDOWS\system32\h323log.txt Object is locked skipped
E:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
E:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
E:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
E:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
E:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
E:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
E:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
E:\WINDOWS\Temp\Perflib_Perfdata_708.dat Object is locked skipped
E:\WINDOWS\wiadebug.log Object is locked skipped
E:\WINDOWS\wiaservc.log Object is locked skipped
E:\WINDOWS\WindowsUpdate.log Object is locked skipped
F:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

Scan process completed.
Last edited by cspaz_03; 01-03-2008 at 12:37 AM.
cspaz_03 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-03-2008, 12:47 AM   #6 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,611
OS: 2000 Pro; XP Pro; XP Home


Re: Hijack Log Help - "Your computer is infected" on taskbar
Quote:
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

E:\WINDOWS\system32\encde.2
E:\WINDOWS\system32\encde.3

Quote:
E:\QooBox\Quarantine\E\WINDOWS\system32\encde.2.vir Infected: Trojan.Win32.BHO.yr skipped
E:\QooBox\Quarantine\E\WINDOWS\system32\encde.3.vir Infected: Trojan-Downloader.Win32.Delf.dbo skipped
They are deleted.

Please also post a new HijackThis log. How's the machine behaving?
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-03-2008, 10:04 AM   #7 (permalink)
Registered User
 
Join Date: Dec 2007
Posts: 6
OS: windows xp sp2


Re: Hijack Log Help - "Your computer is infected" on taskbar
Thanks a lot for the help. I no longer get the pop-up, and all of my searches seem to bring me directly to the correct site. Going forward is there any software you recommend I use? currently i'm using mcaffee for antivirus, but it doesnt seem to be very thorough... Here's the Hijackthis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:00:55 PM, on 1/3/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\Program Files\Ahead\InCD\InCDsrv.exe
E:\WINDOWS\Explorer.EXE
E:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
E:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
E:\WINDOWS\system32\LEXBCES.EXE
E:\WINDOWS\system32\LEXPPS.EXE
E:\WINDOWS\system32\spoolsv.exe
E:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe
E:\WINDOWS\System32\GEARSec.exe
E:\Program Files\Common Files\LightScribe\LSSrvc.exe
e:\program files\mcafee.com\agent\mcdetect.exe
e:\PROGRA~1\mcafee.com\vso\mcshield.exe
e:\PROGRA~1\mcafee.com\agent\mctskshd.exe
e:\PROGRA~1\mcafee.com\vso\OasClnt.exe
E:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
E:\Program Files\Norton Ghost\Agent\VProSvc.exe
E:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
e:\progra~1\mcafee.com\vso\mcvsescn.exe
E:\WINDOWS\system32\nvsvc32.exe
E:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
E:\WINDOWS\system32\svchost.exe
E:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
E:\WINDOWS\system32\wscntfy.exe
E:\Program Files\Dell AIO Printer A940\dlbabmgr.exe
E:\Program Files\D-Tools\daemon.exe
E:\Program Files\Ahead\InCD\InCD.exe
E:\Program Files\lg_fwupdate\fwupdate.exe
E:\PROGRA~1\mcafee.com\agent\mcagent.exe
E:\WINDOWS\system32\tbctray.exe
E:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
E:\WINDOWS\system32\ctfmon.exe
E:\Program Files\Dell AIO Printer A940\dlbabmon.exe
e:\progra~1\mcafee.com\vso\mcvsftsn.exe
E:\Program Files\Messenger\msmsgs.exe
E:\WINDOWS\system32\dllhost.exe
E:\WINDOWS\System32\vssvc.exe
E:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - e:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [Dell AIO Printer A940] "E:\Program Files\Dell AIO Printer A940\dlbabmgr.exe"
O4 - HKLM\..\Run: [DAEMON Tools-1033] "E:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [InCD] E:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [NeroFilterCheck] E:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LGODDFU] "E:\Program Files\lg_fwupdate\fwupdate.exe" blrun
O4 - HKLM\..\Run: [VSOCheckTask] "E:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] E:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [OASClnt] E:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [MCAgentExe] e:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] e:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "E:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [SunJavaUpdateSched] "E:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [TraySantaCruz] E:\WINDOWS\system32\tbctray.exe
O4 - HKCU\..\Run: [P2kAutostart] C:\Moto Phone Progs\P2kCommanderV330\P2kAutostart.exe
O4 - HKCU\..\Run: [updateMgr] E:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [ctfmon.exe] E:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = E:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {05D96F71-87C6-11D3-9BE4-00902742D6E0} (QuickPlace Class) - http://crystal.atkinson.yorku.ca/qp2.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/S...in/AvSniff.cab
O16 - DPF: {4788DE0A-3552-49EA-AC8C-233DA52523B9} (AxLoaderPassword Class) - http://www.blackberry.com/devicesoftware/AxLoader.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/sof...iveXPlugin.cab
O23 - Service: Adobe LM Service - Adobe Systems - E:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Capture Device Service - InterVideo Inc. - E:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: GEARSecurity - GEAR Software - E:\WINDOWS\System32\GEARSec.exe
O23 - Service: Google Updater Service (gusvc) - Google - E:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - E:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - E:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - E:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - E:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - e:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - e:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - e:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - E:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: Norton Ghost - Symantec Corporation - E:\Program Files\Norton Ghost\Agent\VProSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - E:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - E:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: Symantec Core LC - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - E:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - E:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 8709 bytes
cspaz_03 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-03-2008, 10:17 AM   #8 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,611
OS: 2000 Pro; XP Pro; XP Home


Re: Hijack Log Help - "Your computer is infected" on taskbar
Thanks, that looks good.

Of paid antivirus products, Kaspersky and NOD32 by Eset are two of my favorites.

www.av-comparatives.org

For freeware, I like Avira.

This infection is quite often found by visiting warez or serial sites.....not sure if you're the only one with access to the machine, but it's something to know. No matter how good an AntiVirus is, if the door is opened, and the wolf is invited in, he will dine.

The items found by the online scan will be addressed in these next steps.

Your logs appear clean.You should be good to go. We still have a few items to address.

Go to -> Run -> copy/paste in the following single line command & click OK

combofix /u



This will uninstall ComboFix. It will also implement some cleanup procedures and reset System Restore points.

Now that your system is clean, to help protect your computer in the future I recommend that you follow these steps and use the following free programs:
  • Microsoft Windows Update - http://www.windowsupdate.com
    Visit regularly. This will ensure your computer always has the latest security updates. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

  • SpywareBlaster to help prevent spyware from installing in the first place.
    • Install & update SpywareBlaster with the latest definitions.
      After you have updated, click the button - enable protection for all unprotected items
  • SpywareGuard to catch and block spyware before it can execute.
  • IE-SpyAd - IE/Spyad places more than 4000 dubious websites and domains in the IE Restricted list. This severely impairs attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites. An installation tutorial is available here.

  • MVPS HOST FILE
    The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites form serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer.
    • Download Host.zip to your desktop.
    • From your Desktop right-click (hosts.zip) and select:
      Extract All from the menu.
    • Click Next, click Next, select the option:
      "Show Extracted files", click Finish
    • This will open the newly created hosts folder on your Desktop.
    • Double-click on the included mvps.bat file, this will rename the existing HOSTS file to HOSTS.MVP, then it will copy the included updated HOSTS file to the correct location on your machine.
    • Once updated you should see another prompt that the task was completed.
  • ANTIVIRUS SOFTWARE
    It is very important that you have anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future. It is imperative that you update your antivirus software at least once a week (even more if you wish). If you do not update your antivirus software then it will not be able to catch new malware that may have come out.

    Do not install more than one AntiVirus program because they will conflict with each other.

  • FIREWALL
    If you do not have a firewall, here are a couple of great free ones available for personal use. Using a third-party firewall will allow you to give/deny access for applications that want to go online. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. A tutorial on Firewalls and a listing of some available ones can be found here

    Do not install more than one firewall program because they will conflict with each other.

Scan here http://secunia.com/software_inspector/ for out of date & vulnerable common applications on your computer

Here are some additional utilities that will further enhance your safety.
  • http://www.trillian.cc ? Trillian or http://www.miranda-im.com ? Miranda-IM - These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN)

  • http://www.mozilla.org/products/firefox/ - Firefox - Use this alternate browser. While Internet Explorer is not a bad browser, almost every exploit crafted is targeted to take advantage of an IE weakness.

  • http://java.com/en/index.jsp - Sun's Java - It's much more secure than Microsoft's Java Virtual Machine.

  • http://www.aumha.org/downloads/erunt-setup.exe - ERUNT - A useful freeware utility for users of Windows 2000/XP. It's made up of two parts - ERUNT & NTREGOPT.

    ERUNT will create daily complete backups of your computer's Registry. Whilst System Restore does the same thing, a corrupt registry file may prevent Windows from booting & this effectively renders disables System Restore. With ERUNT, you're able to restore the damaged Registry.

    NTREGOPT works by recreating each registry hive "from scratch", thus removing any slack space that may be left from previously modified or deleted keys. In other words, it compacts the Registry to a small size which allows Windows to load & perform faster.


In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles
If you want to fight back the Malware Writers that have made your life a misery, please take a look here and read what you can do against it.

Please respond to this thread one more time so we can mark this thread as resolved.
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
 

« Previous Thread | Next Thread »

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off



All times are GMT -7. The time now is 08:55 PM.

Contact Us - Tech Support Forum - Archive - Privacy Statement - Top


Copyright 2001 - 2009, Tech Support Forum
Home Tips Plus | Outdoor Basecamp | Automotive Support Forum

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85