Welcome to Tech Support Forum home to more then 136,000 problems solved. Issues have included: Spyware, Malware, Virus Issues, Windows, Microsoft, Linux, Networking, Security, Hardware, and Gaming Getting your problem solved is as easy as:
1. Registering for a free account
2. Asking your question
3. Receiving an answer

Registered members:
* Get free support
* Communicate privately with other members (PM).
* Removal of this message
* See fewer ads.
* And much more..

 


Want to know how to post a question? click here Having problems with spyware and pop-ups? First Steps
Go Back   Tech Support Forum > Security Center > Virus/Trojan/Spyware Help > Resolved HJT Threads
Reload this Page Virus infected computer.
User Name
Password
Site Map Register Donate Rules Blogs Mark Forums Read


Resolved HJT Threads Resolved spyware and popup issues.

 
 
LinkBack Thread Tools
Old 08-19-2008, 03:35 AM   #1 (permalink)
Registered User
 
Join Date: Aug 2008
Posts: 12
OS: xp


Virus infected computer.
Hello, A couple of weeks ago i downloaded a program that Most likely was a trojan dropper. After a week my computer was extremely slow and I got frequent pop up ads. so i perfromed a system restore, and my computer seemed reasonably fine for a while. I got ad-aware which removed a couple of spyware cookies and malware. What was surprising was that every time i deleted them and performed another scan, it was always the same cookies and malware. i also used trend micro which did basically the same thing.

The virus protection software seeme to be doing well, but now my computer is slow again and getting frequent pop-ups.
Some of the popups are.

Antivirus 2009
Love calculater
Deal or no deal on your mobile

Some i couldn't see because trend micro blocked them, labeling them as dangerous, malicious.

So theres the information and here is my hijack this log.
for some reason it wouldn't let me attach it.
cheers.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:44:08 PM, on 8/19/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Maxtor\Sync\SyncServices.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe
C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Trend Micro\BM\TMBMSRV.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
C:\Program Files\Java\jre1.6.0_05\bin\jucheck.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\Rundll32.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.blackle.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.ninemsn.com.au/0SEENAU/SAOS01?FORM=TOOLBR
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [UfSeAgnt.exe] "C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe"
O4 - HKLM\..\Run: [mxomssmenu] "C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [{1574d93e-968b-83bd-0406-4f4a71cd966b}] C:\WINDOWS\System32\Rundll32.exe "C:\WINDOWS\system32\xlmchsexfnieqxg.dll" DllStart
O4 - HKLM\..\Run: [806d70e1] rundll32.exe "C:\WINDOWS\system32\tigdsves.dll",b
O4 - HKLM\..\Run: [BM835e437d] Rundll32.exe "C:\WINDOWS\system32\vmjhykcd.dll",s
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [OE] "C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: BlueSoleil.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O15 - Trusted Zone: http://flex.afgonline.com.au
O16 - DPF: {253A9D23-F982-11D4-8BE4-00D0B7E61414} (SiebelHTMLApplication Class) - http://flex.afgonline.com.au/back-of...siebelhtml.cab
O16 - DPF: {2E28242B-A689-11D4-80F2-0040266CBB8D} (KXHCM10 Control) - http://collegio-cam.pittstate.edu/kxhcm10.ocx
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1171523425390
O16 - DPF: {68CDB19A-6305-4589-8C35-41E3502CD451} (Siebel Option Pack for IE 7.5.3) - http://flex.afgonline.com.au/back-of...OptionPack.cab
O16 - DPF: {8F4F3368-54CA-4268-8225-0F4367472CF4} (MailClient Class) - http://flex.afgonline.com.au/back-of...MailClient.cab
O16 - DPF: {AF2E62B6-F9E1-4D4F-A10A-9DC8E6DCBCC0} (VideoEgg ActiveX Loader) - http://update.videoegg.com/Install/W...gPublisher.exe
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O20 - AppInit_DLLs: zzbeuh.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Maxtor Service (Maxtor Sync Service) - Seagate Technology LLC - C:\Program Files\Maxtor\Sync\SyncServices.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Trend Micro Central Control Component (SfCtlCom) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
O23 - Service: Trend Micro Unauthorized Change Prevention Service (TMBMServer) - Trend Micro Inc. - C:\Program Files\Trend Micro\BM\TMBMSRV.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\TmProxy.exe

--
End of file - 8751 bytes
arloporter is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Important Information
Join the #1 Tech Support Forum Today - It's Totally Free!

TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free.

Join TechSupportforum.com Today - Click Here

Old 08-21-2008, 07:23 PM   #2 (permalink)
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
 
Join Date: Oct 2007
Location: Georgia
Posts: 10,633
OS: XP SP3


Re: Virus infected computer.
Hello and Welcome to TSF.

Please Subscribe to this Thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant notification by email, then click Add Subscription.

Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions.

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding.
Ensure that there aren't any opened browsers when you are carrying out the procedures below.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

------------------------------------------------------

Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate.

Please stay with me until given the 'all clear' even if symptoms seemingly abate.

Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by a helper.

------------------------------------------------------

Please download ComboFix and Save it to your Desktop.

**Note: It is important that it is saved directly to your desktop**

First, we need to install the Windows Recovery Console.

The Windows Recovery Console will allow you to boot up into a special recovery(repair) mode, if needed. This allows us to help you in the case that your computer has a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Download the file from this Microsoft page:

For XP Home >> http://www.microsoft.com/downloads/d...displaylang=en

For XP Pro >> http://www.microsoft.com/downloads/d...displaylang=en

Save it as it is originally named to your Desktop.

Now close all open windows and programs, including all antivirus and antispyware programs. Get help here



Then drag the setup package onto ComboFix.exe and drop it. Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Recovery Console.

As part of installing the Recovery Console, ComboFix will begin to run. Your desktop may disappear. This is normal. It will return.

ComboFix will now automatically install the Windows Recovery Console onto your computer, which will show up as a new option when booting up your computer. Do not select the Windows Recovery Console option when you start your computer unless requested to by a helper.

Once the Recovery Console is installed, this blue window will appear:



Please continue as follows:
  • Close/disable all antivirus and antispyware programs so they do not interfere with the running of ComboFix. Get help here
  • Please click Yes to continue scanning for malware.
When the tool is finished, it will produce a log for you.

Please post that log, ComboFix.txt along with a new HijackThis log so we may continue cleansing the system.

------------------------------------------------------

Open HijackThis and click on 'Do a System Scan and Save a Logfile'. Save the logfile and post it here.

------------------------------------------------------

Go to Start > Run and copy/paste the following single-line command into the Run box and click OK:

C:\Qoobox\Add-Remove Programs.txt

A text file should open. Please post the contents of that file in your next reply.

------------------------------------------------------

Please post the following in your next reply:

C:\ComboFix.txt
new HijackThis log
Add-Remove Programs.txt

If you have any questions along the way...STOP and ask them before proceeding.
__________________
Our help is free but please donate

Proud member of ASAP
Proud member of UNITE
chemist is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 08-26-2008, 02:58 AM   #3 (permalink)
Registered User
 
Join Date: Aug 2008
Posts: 12
OS: xp


Re: Virus infected computer.
Thanks, i did this and here are the logs.

The combo fix log (log.txt) and the add remove programs log are attached but i couldn't attach the hijack this log so here it is:

ComboFix 08-08-24.03 - Jackson & Arlo 2008-08-26 18:21:53.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.61.1033.18.197 [GMT 10:00]
Running from: C:\Documents and Settings\Jackson & Arlo\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Jackson & Arlo\Desktop\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
* Created a new restore point
.
Error: Cfiles.dat

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Jackson & Arlo\Application Data\macromedia\Flash Player\#SharedObjects\FJSZP8Z3\interclick.com
C:\Documents and Settings\Jackson & Arlo\Application Data\macromedia\Flash Player\#SharedObjects\FJSZP8Z3\interclick.com\ud.sol
C:\Documents and Settings\Jackson & Arlo\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com
C:\Documents and Settings\Jackson & Arlo\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol
C:\Temp\1cb
C:\Temp\1cb\syscheck.log
C:\WINDOWS\BM835e437d.txt
C:\WINDOWS\BM835e437d.xml
C:\WINDOWS\system32\awtRHyVO.dll
C:\WINDOWS\system32\bbdnkvon.exe
C:\WINDOWS\system32\bcexlauh.exe
C:\WINDOWS\system32\bdjowyuq.dll
C:\WINDOWS\system32\blrmkkgs.dll
C:\WINDOWS\system32\cbXPGvtQ.dll
C:\WINDOWS\system32\ddcDvtrO.dll
C:\WINDOWS\system32\dtgkweac.dll
C:\WINDOWS\system32\dtvqblrv.dll
C:\WINDOWS\system32\efcYPjIa.dll
C:\WINDOWS\system32\geBqQGyV.dll
C:\WINDOWS\system32\geBsqRhe.dll
C:\WINDOWS\system32\hgGxYRhH.dll
C:\WINDOWS\system32\iifEusqp.dll
C:\WINDOWS\system32\ixiavdjx.dll
C:\WINDOWS\system32\jnggseim.dll
C:\WINDOWS\system32\jygxtlig.dll
C:\WINDOWS\system32\meycbort.dll
C:\WINDOWS\system32\mlJYrooo.dll
C:\WINDOWS\system32\mppyxwlv.dll
C:\WINDOWS\system32\nqonwnkd.dll
C:\WINDOWS\system32\oqdehftc.dll
C:\WINDOWS\system32\pqfqlois.ini
C:\WINDOWS\system32\pthreadVC.dll
C:\WINDOWS\system32\rtbfrgef.dll
C:\WINDOWS\system32\sevsdgit.ini
C:\WINDOWS\system32\sgkkmrlb.ini
C:\WINDOWS\system32\thxvldpv.dll
C:\WINDOWS\system32\vmjhykcd.dll
C:\WINDOWS\system32\vrsatbpp.dll
C:\WINDOWS\system32\vtUnmMcd.dll
C:\WINDOWS\system32\waJjlUvw.ini
C:\WINDOWS\system32\waJjlUvw.ini2
C:\WINDOWS\system32\wvUljJaw.dll
C:\WINDOWS\system32\wvUmNDwu.dll
C:\WINDOWS\system32\xxyyWMCr.dll
C:\WINDOWS\system32\zzbeuh.dll

.
((((((((((((((((((((((((( Files Created from 2008-07-26 to 2008-08-26 )))))))))))))))))))))))))))))))
.

2008-08-26 15:39 . 2008-08-26 15:39 6,648 --a------ C:\WINDOWS\system32\gdcumcyt.exe
2008-08-26 15:36 . 2008-08-26 15:36 6,650 --a------ C:\WINDOWS\system32\chmryosd.dll
2008-08-26 15:33 . 2008-08-26 15:33 6,690 --a------ C:\WINDOWS\system32\crlrpdeo.dll
2008-08-26 15:30 . 2008-08-26 15:30 6,692 --a------ C:\WINDOWS\system32\jskgnpif.dll
2008-08-23 19:26 . 2008-08-23 19:26 6,650 --a------ C:\WINDOWS\system32\oxqakdps.dll
2008-08-23 19:23 . 2008-08-23 19:23 6,648 --a------ C:\WINDOWS\system32\snnikarp.exe
2008-08-23 19:20 . 2008-08-23 19:20 6,690 --a------ C:\WINDOWS\system32\qhayfkon.dll
2008-08-23 19:17 . 2008-08-23 19:17 6,692 --a------ C:\WINDOWS\system32\okacusdh.dll
2008-08-23 19:14 . 2008-08-23 19:14 6,686 --a------ C:\WINDOWS\system32\qsmfnvef.dll
2008-08-22 19:23 . 2008-08-22 19:23 6,692 --a------ C:\WINDOWS\system32\lbunyquy.dll
2008-08-22 19:20 . 2008-08-22 19:20 6,648 --a------ C:\WINDOWS\system32\qdvtjdgl.exe
2008-08-22 19:17 . 2008-08-22 19:17 6,690 --a------ C:\WINDOWS\system32\afdsuwao.dll
2008-08-22 19:14 . 2008-08-22 19:14 6,650 --a------ C:\WINDOWS\system32\dyckqngx.dll
2008-08-22 19:11 . 2008-08-22 19:11 6,686 --a------ C:\WINDOWS\system32\wamaperc.dll
2008-08-21 19:12 . 2008-08-21 19:12 6,648 --a------ C:\WINDOWS\system32\icrenogp.exe
2008-08-21 19:11 . 2008-08-21 19:11 6,692 --a------ C:\WINDOWS\system32\hpabdjlq.dll
2008-08-20 20:56 . 2008-08-20 20:56 <DIR> d-------- C:\Program Files\Sun
2008-08-20 18:21 . 2008-08-20 18:21 6,690 --a------ C:\WINDOWS\system32\thmgpmsr.dll
2008-08-20 18:17 . 2008-08-20 18:18 6,692 --a------ C:\WINDOWS\system32\gcphljwq.dll
2008-08-20 18:14 . 2008-08-20 18:14 6,650 --a------ C:\WINDOWS\system32\koabqjfj.dll
2008-08-19 17:56 . 2008-08-19 17:56 6,692 --a------ C:\WINDOWS\system32\hgcuvdls.dll
2008-08-19 17:54 . 2008-08-19 17:54 6,690 --a------ C:\WINDOWS\system32\gascrvhi.dll
2008-08-19 17:50 . 2008-08-19 17:50 6,650 --a------ C:\WINDOWS\system32\itvxqirh.dll
2008-08-18 08:02 . 2008-08-18 08:02 6,690 --a------ C:\WINDOWS\system32\qjpbyivv.dll
2008-08-17 07:15 . 2008-08-17 07:15 6,692 --a------ C:\WINDOWS\system32\hncewmlc.dll
2008-08-17 07:06 . 2008-08-17 07:06 6,650 --a------ C:\WINDOWS\system32\owiagwut.dll
2008-08-15 19:14 . 2008-08-18 23:02 842 --a------ C:\WINDOWS\cookies.ini
2008-08-15 19:09 . 2008-08-15 19:09 6,650 --a------ C:\WINDOWS\system32\bujnljfa.dll
2008-08-15 18:06 . 2008-08-15 18:06 6,692 --a------ C:\WINDOWS\system32\osepyftn.dll
2008-08-15 18:02 . 2008-08-20 19:51 10,752 --a------ C:\WINDOWS\DCEBoot.exe
2008-08-14 16:32 . 2008-08-14 16:32 6,650 --a------ C:\WINDOWS\system32\vrdlyvcp.dll
2008-08-14 16:31 . 2008-08-14 16:31 6,692 --a------ C:\WINDOWS\system32\rrykoyei.dll
2008-08-14 16:31 . 2008-08-14 16:31 6,690 --a------ C:\WINDOWS\system32\icxonxoa.dll
2008-08-14 16:26 . 2008-08-26 18:22 21 --a------ C:\WINDOWS\pskt.ini
2008-08-13 15:56 . 2008-08-13 15:56 6,690 --a------ C:\WINDOWS\system32\tjfjincf.dll
2008-08-13 15:53 . 2008-08-13 15:53 6,692 --a------ C:\WINDOWS\system32\ggnsijrf.dll
2008-08-13 15:51 . 2008-08-13 15:51 6,648 --a------ C:\WINDOWS\system32\cfywwerm.exe
2008-08-13 15:48 . 2008-08-13 15:48 6,686 --a------ C:\WINDOWS\system32\phvmjnew.dll
2008-08-13 15:48 . 2008-08-13 15:48 6,650 --a------ C:\WINDOWS\system32\gpimmchm.dll
2008-08-13 09:00 . 2008-08-13 09:00 64,896 --a------ C:\WINDOWS\system32\mkonhnyzuaxqg.exe
2008-08-13 08:57 . 2008-08-13 08:57 <DIR> d-------- C:\WINDOWS\system32\te2
2008-08-13 08:57 . 2008-08-13 08:57 <DIR> d-------- C:\WINDOWS\system32\sz1
2008-08-13 08:57 . 2008-08-13 08:57 <DIR> d-------- C:\WINDOWS\system32\mva
2008-08-13 08:57 . 2008-08-13 08:57 <DIR> d-------- C:\Temp\epr1
2008-08-13 08:57 . 2008-08-26 18:22 <DIR> d-------- C:\Temp
2008-08-12 15:49 . 2008-08-12 15:49 6,692 --a------ C:\WINDOWS\system32\cxrxegot.dll
2008-08-09 17:57 . 2008-08-09 17:57 6,690 --a------ C:\WINDOWS\system32\giuorpah.dll
2008-08-09 17:54 . 2008-08-09 17:54 6,648 --a------ C:\WINDOWS\system32\ojioipwu.exe
2008-08-09 17:51 . 2008-08-09 17:51 6,686 --a------ C:\WINDOWS\system32\pjomdjav.dll
2008-08-08 18:03 . 2008-08-08 18:03 6,650 --a------ C:\WINDOWS\system32\wogndeiv.dll
2008-08-08 18:00 . 2008-08-08 18:00 6,648 --a------ C:\WINDOWS\system32\uakuyqgu.exe
2008-08-08 17:57 . 2008-08-08 17:57 6,690 --a------ C:\WINDOWS\system32\rphqfjwq.dll
2008-08-08 17:54 . 2008-08-08 17:54 6,692 --a------ C:\WINDOWS\system32\ewarwuqt.dll
2008-08-08 17:51 . 2008-08-08 17:51 6,686 --a------ C:\WINDOWS\system32\rpvqyvyj.dll
2008-08-07 17:57 . 2008-08-07 17:57 6,690 --a------ C:\WINDOWS\system32\gmlqmwcl.dll
2008-08-07 17:54 . 2008-08-07 17:54 6,648 --a------ C:\WINDOWS\system32\vdehmfsv.exe
2008-08-07 17:51 . 2008-08-07 17:51 6,650 --a------ C:\WINDOWS\system32\uhyjkrgc.dll
2008-08-07 17:48 . 2008-08-07 17:48 6,692 --a------ C:\WINDOWS\system32\madgwdub.dll
2008-08-07 01:06 . 2008-08-07 01:06 160,768 --a------ C:\WINDOWS\system32\xlmchsexfnieqxg.dll
2008-08-06 18:00 . 2008-08-06 18:00 6,692 --a------ C:\WINDOWS\system32\fuwfjbqo.dll
2008-08-06 17:57 . 2008-08-06 17:57 6,650 --a------ C:\WINDOWS\system32\nluequso.dll
2008-08-06 17:54 . 2008-08-06 17:54 6,648 --a------ C:\WINDOWS\system32\augqcnvp.exe
2008-08-06 17:51 . 2008-08-06 17:51 6,690 --a------ C:\WINDOWS\system32\titbxbok.dll
2008-08-06 17:48 . 2008-08-06 17:48 6,686 --a------ C:\WINDOWS\system32\hpgsyvcm.dll
2008-08-06 16:16 . 2008-08-06 16:16 <DIR> d-------- C:\WINDOWS\system32\dnc
2008-08-06 16:16 . 2008-08-06 16:16 <DIR> d-------- C:\WINDOWS\system32\bet
2008-08-05 17:59 . 2008-08-05 17:59 6,692 --a------ C:\WINDOWS\system32\nwwvqhnf.dll
2008-08-05 17:56 . 2008-08-05 17:56 6,650 --a------ C:\WINDOWS\system32\iajsnogq.dll
2008-08-05 17:53 . 2008-08-05 17:53 6,648 --a------ C:\WINDOWS\system32\gqaqbxea.exe
2008-08-05 17:50 . 2008-08-05 17:50 6,690 --a------ C:\WINDOWS\system32\pvsssnav.dll
2008-08-05 17:47 . 2008-08-05 17:47 6,686 --a------ C:\WINDOWS\system32\nwkjylwk.dll
2008-08-04 17:47 . 2008-08-04 17:47 6,692 --a------ C:\WINDOWS\system32\dopuyigt.dll
2008-08-04 17:47 . 2008-08-04 17:47 6,690 --a------ C:\WINDOWS\system32\wcdqgiot.dll
2008-08-04 17:45 . 2008-08-04 17:45 6,686 --a------ C:\WINDOWS\system32\kbcklncv.dll
2008-08-04 17:45 . 2008-08-04 17:45 6,650 --a------ C:\WINDOWS\system32\cymahagu.dll
2008-08-03 19:05 . 2008-08-03 19:05 6,692 --a------ C:\WINDOWS\system32\vbhldcub.dll
2008-08-03 19:02 . 2008-08-03 19:02 6,650 --a------ C:\WINDOWS\system32\kdwfwwki.dll
2008-08-03 18:59 . 2008-08-03 18:59 6,690 --a------ C:\WINDOWS\system32\fqcxqncr.dll
2008-08-03 18:56 . 2008-08-03 18:56 6,686 --a------ C:\WINDOWS\system32\jdoabrxn.dll
2008-08-02 18:58 . 2008-08-02 18:58 6,690 --a------ C:\WINDOWS\system32\hemtsmpt.dll
2008-08-02 18:55 . 2008-08-02 18:55 6,692 --a------ C:\WINDOWS\system32\dbqrxtur.dll
2008-08-02 18:55 . 2008-08-02 18:55 6,686 --a------ C:\WINDOWS\system32\petndqbl.dll
2008-08-02 18:55 . 2008-08-02 18:55 6,650 --a------ C:\WINDOWS\system32\gvatjjra.dll
2008-08-01 19:02 . 2008-08-01 19:02 <DIR> d-------- C:\Program Files\Lavasoft
2008-08-01 19:02 . 2008-08-01 19:08 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-08-01 19:01 . 2008-08-01 19:01 6,692 --a------ C:\WINDOWS\system32\erujfucj.dll
2008-08-01 19:01 . 2008-08-01 19:01 6,690 --a------ C:\WINDOWS\system32\pgbwpxxg.dll
2008-08-01 19:01 . 2008-08-01 19:01 6,650 --a------ C:\WINDOWS\system32\dqgiikxy.dll
2008-08-01 19:00 . 2008-08-01 19:00 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-08-01 18:59 . 2008-08-01 18:59 <DIR> d-------- C:\WINDOWS\system32\kBin02
2008-08-01 18:58 . 2008-08-01 18:58 6,686 --a------ C:\WINDOWS\system32\mttaqbjj.dll
2008-08-01 18:47 . 2008-08-01 18:47 <DIR> d-------- C:\Program Files\iTunes

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-21 12:26 --------- d-----w C:\Documents and Settings\Jackson & Arlo\Application Data\uTorrent
2008-08-20 10:55 --------- d-----w C:\Program Files\Java
2008-08-13 13:00 --------- d-----w C:\Documents and Settings\Jackson & Arlo\Application Data\FrostWire
2008-08-13 07:59 --------- d-----w C:\Program Files\Incomplete
2008-08-13 07:59 --------- d-----w C:\Program Files\FrostWire
2008-08-13 01:08 --------- d-----w C:\Program Files\LimeWire
2008-08-02 01:25 --------- d-----w C:\Program Files\Trend Micro
2008-08-01 08:50 --------- d-----w C:\Program Files\Bonjour
2008-08-01 08:48 --------- d-----w C:\Program Files\Safari
2008-08-01 08:47 --------- d-----w C:\Program Files\iTunes(2)
2008-07-21 12:51 --------- d-----w C:\Program Files\iPod
2008-07-18 09:08 36,368 ----a-w C:\WINDOWS\system32\drivers\tmpreflt.sys
2008-07-18 09:08 205,328 ----a-w C:\WINDOWS\system32\drivers\tmxpflt.sys
2008-07-18 08:51 1,195,448 ----a-w C:\WINDOWS\system32\drivers\vsapint.sys
2008-07-09 11:13 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2006-10-09 06:09 19,666,504 ------w C:\Program Files\QuickTimeInstaller.exe
2006-10-09 06:05 36,656,704 ------w C:\Program Files\iTunesSetup.exe
2007-03-09 09:12 27,648 --sha-w C:\WINDOWS\system32\AVSredirect.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{665eddf3-7087-4b2c-f21c-b5886dc2fde8}]
2008-08-07 01:06 160768 --a------ C:\WINDOWS\system32\xlmchsexfnieqxg.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-02-28 22:00 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-25 16:07 68856]
"OE"="C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe" [2007-09-17 23:30 488712]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2004-02-10 11:55 155648]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2004-02-10 11:51 118784]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"UfSeAgnt.exe"="C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe" [2008-02-15 23:56 1398024]
"mxomssmenu"="C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe" [2007-09-06 14:53 169264]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 10:50 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-06-02 11:13 267048]
"{1574d93e-968b-83bd-0406-4f4a71cd966b}"="C:\WINDOWS\system32\xlmchsexfnieqxg.dll" [2008-08-07 01:06 160768]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
BlueSoleil.lnk - C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe [2007-03-22 02:50:17 1183744]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=zzbeuh.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.iac2"= G:\flv\iac25_32.ax

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"G:\\games\\Warcraft III\\Warcraft III.exe"=
"C:\\Program Files\\FrostWire\\FrostWire.exe"=

R2 Maxtor Sync Service;Maxtor Service;C:\Program Files\Maxtor\Sync\SyncServices.exe [2007-09-28 12:24]
R2 NMSAccessU;NMSAccessU;C:\Program Files\CDBurnerXP\NMSAccessU.exe [2007-10-12 07:34]
R3 MusCDriverV32;MusCDriverV32;C:\WINDOWS\system32\drivers\MusCDriverV32.sys [2007-07-19 14:58]
S3 BrSerIf;Brother MFC Serial Port Interface WDM Driver;C:\WINDOWS\system32\Drivers\BrSerIf.sys [2004-09-29 03:24]
S3 BrUsbSer;Brother MFC USB Serial WDM Driver;C:\WINDOWS\system32\Drivers\BrUsbSer.sys [2004-01-10 04:28]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
\Shell\AutoRun\command - .\Encryption Tool\MaxtorEncryption.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{57554e3e-a872-11dc-9aa7-000d56a4bcf2}]
\Shell\AutoRun\command - E:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{be50fd01-b6cc-11d7-99ce-000bdbc78264}]
\Shell\AutoRun\command - PortableApps\PortableAppsMenu\PortableAppsMenu.exe
.
Contents of the 'Scheduled Tasks' folder

2008-08-18 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57]

2008-08-23 C:\WINDOWS\Tasks\ErrorSmart Scheduled Scan.job
- C:\Program Files\ErrorSmart\ErrorSmart.exe []

2008-08-23 C:\WINDOWS\Tasks\ErrorSmart Scheduled Scan.job
- C:\Program Files\ErrorSmart []
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-msnmsgr - C:\Program Files\MSN Messenger\msnmsgr.exe
HKLM-Run-BM835e437d - C:\WINDOWS\system32\nqonwnkd.dll
Notify-efcDwVol - (no file)


.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Jackson & Arlo\Application Data\Mozilla\Firefox\Profiles\z4due6a9.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-26 18:40:14
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\brss01a.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2008-08-26 18:49:10 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-26 08:49:05

Pre-Run: 2,973,982,720 bytes free
Post-Run: 3,144,097,792 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /noexecute=optin

274 --- E O F --- 2008-07-14 21:15:55


hijack this log:
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\brss01a.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Maxtor\Sync\SyncServices.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\Rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\rundll32.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.blackle.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.ninemsn.com.au/0SEENAU/SAOS01?FORM=TOOLBR
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: radbanner browser enhancer - {665eddf3-7087-4b2c-f21c-b5886dc2fde8} - C:\WINDOWS\system32\xlmchsexfnieqxg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [UfSeAgnt.exe] "C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe"
O4 - HKLM\..\Run: [mxomssmenu] "C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [{1574d93e-968b-83bd-0406-4f4a71cd966b}] C:\WINDOWS\System32\Rundll32.exe "C:\WINDOWS\system32\xlmchsexfnieqxg.dll" DllStart
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [OE] "C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe"
O4 - Global Startup: BlueSoleil.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O15 - Trusted Zone: http://flex.afgonline.com.au
O16 - DPF: {253A9D23-F982-11D4-8BE4-00D0B7E61414} (SiebelHTMLApplication Class) - http://flex.afgonline.com.au/back-of...siebelhtml.cab
O16 - DPF: {2E28242B-A689-11D4-80F2-0040266CBB8D} (KXHCM10 Control) - http://collegio-cam.pittstate.edu/kxhcm10.ocx
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1171523425390
O16 - DPF: {68CDB19A-6305-4589-8C35-41E3502CD451} (Siebel Option Pack for IE 7.5.3) - http://flex.afgonline.com.au/back-of...OptionPack.cab
O16 - DPF: {8F4F3368-54CA-4268-8225-0F4367472CF4} (MailClient Class) - http://flex.afgonline.com.au/back-of...MailClient.cab
O16 - DPF: {AF2E62B6-F9E1-4D4F-A10A-9DC8E6DCBCC0} (VideoEgg ActiveX Loader) - http://update.videoegg.com/Install/W...gPublisher.exe
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O20 - AppInit_DLLs: zzbeuh.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Maxtor Service (Maxtor Sync Service) - Seagate Technology LLC - C:\Program Files\Maxtor\Sync\SyncServices.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: Trend Micro Central Control Component (SfCtlCom) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
O23 - Service: Trend Micro Unauthorized Change Prevention Service (TMBMServer) - Trend Micro Inc. - C:\Program Files\Trend Micro\BM\TMBMSRV.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\TmProxy.exe

--
End of file - 7941 bytes
Attached Files
File Type: txt log.txt (17.5 KB, 1 views)
File Type: txt Add-Remove Programs.txt (23.9 KB, 1 views)
Last edited by chemist; 08-26-2008 at 05:16 AM.
arloporter is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 08-26-2008, 03:08 AM   #4 (permalink)
Registered User
 
Join Date: Aug 2008
Posts: 12
OS: xp


Re: Virus infected computer.
Actually My computer is working now.
it is workingfast and i havn't got any pop-ups yet
thankyou for fixing it.
arloporter is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 08-26-2008, 05:02 AM   #5 (permalink)
Registered User
 
Join Date: Aug 2008
Posts: 12
OS: xp


Re: Virus infected computer.
wait i just had one popup, but it is still running fast.
arloporter is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 08-26-2008, 06:08 AM   #6 (permalink)
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
 
Join Date: Oct 2007
Location: Georgia
Posts: 10,633
OS: XP SP3


Re: Virus infected computer.
Hello again, arloporter. This will require several rounds.

Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions.

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding.
Ensure that there aren't any opened browsers when you are carrying out the procedures below.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

------------------------------------------------------

I see you have P2P software ( uTorrent, BitTorrent, and Limewire ) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares.

References for the risk of these programs are here, here, and here.

I would strongly recommend that you uninstall them, however that choice is up to you. If you choose to remove these programs, you can do so via Control Panel >> Add or Remove Programs.

If you decide to uninstall uTorrent, BitTorrent, and Limewire, also delete these Folders if they still exist:

C:\Documents and Settings\Jackson & Arlo\Application Data\uTorrent
C:\Documents and Settings\Jackson & Arlo\Application Data\BitTorrent
C:\Documents and Settings\Jackson & Arlo\Application Data\LimeWire
C:\Program Files\uTorrent
C:\Program Files\BitTorrent
C:\Program Files\LimeWire

------------------------------------------------------

Please go to: VirusTotal
  • On the page you'll find a Browse button.
  • Next to the Browse button you'll see a box to enter text.
  • Please copy/paste the following bolded text into the box:

    C:\WINDOWS\DCEBoot.exe

  • Then click the Send File button just below.
  • This will scan the file. Please be patient.
  • If you get a message saying File has already been analysed: click Reanalyse file now
  • Once scanned, copy and paste the results in your next reply.
------------------------------------------------------

Close any open browsers.

Disable your antivirus and antispyware applications, usually via a right-click on the System Tray icon. They may otherwise interfere with ComboFix.

Open Notepad and copy/paste all the text in the quotebox below into Notepad:

Quote:
http://www.techsupportforum.com/security-center/hijackthis-log-help/282177-virus-infected-computer.html#post1669966

Collect::
C:\WINDOWS\system32\xlmchsexfnieqxg.dll
C:\WINDOWS\system32\gdcumcyt.exe
C:\WINDOWS\system32\chmryosd.dll
C:\WINDOWS\system32\crlrpdeo.dll
C:\WINDOWS\system32\jskgnpif.dll
C:\WINDOWS\system32\oxqakdps.dll
C:\WINDOWS\system32\snnikarp.exe
C:\WINDOWS\system32\qhayfkon.dll
C:\WINDOWS\system32\okacusdh.dll
C:\WINDOWS\system32\qsmfnvef.dll
C:\WINDOWS\system32\wamaperc.dll
C:\WINDOWS\system32\mkonhnyzuaxqg.exe
C:\WINDOWS\system32\xlmchsexfnieqxg.dll

File::
C:\WINDOWS\system32\lbunyquy.dll
C:\WINDOWS\system32\qdvtjdgl.exe
C:\WINDOWS\system32\afdsuwao.dll
C:\WINDOWS\system32\dyckqngx.dll
C:\WINDOWS\system32\icrenogp.exe
C:\WINDOWS\system32\hpabdjlq.dll
C:\WINDOWS\system32\thmgpmsr.dll
C:\WINDOWS\system32\gcphljwq.dll
C:\WINDOWS\system32\koabqjfj.dll
C:\WINDOWS\system32\hgcuvdls.dll
C:\WINDOWS\system32\gascrvhi.dll
C:\WINDOWS\system32\itvxqirh.dll
C:\WINDOWS\system32\qjpbyivv.dll
C:\WINDOWS\system32\hncewmlc.dll
C:\WINDOWS\system32\owiagwut.dll
C:\WINDOWS\system32\bujnljfa.dll
C:\WINDOWS\system32\osepyftn.dll
C:\WINDOWS\system32\vrdlyvcp.dll
C:\WINDOWS\system32\rrykoyei.dll
C:\WINDOWS\system32\icxonxoa.dll
C:\WINDOWS\system32\tjfjincf.dll
C:\WINDOWS\system32\ggnsijrf.dll
C:\WINDOWS\system32\cfywwerm.exe
C:\WINDOWS\system32\phvmjnew.dll
C:\WINDOWS\system32\gpimmchm.dll
C:\WINDOWS\system32\cxrxegot.dll
C:\WINDOWS\system32\giuorpah.dll
C:\WINDOWS\system32\ojioipwu.exe
C:\WINDOWS\system32\pjomdjav.dll
C:\WINDOWS\system32\wogndeiv.dll
C:\WINDOWS\system32\uakuyqgu.exe
C:\WINDOWS\system32\rphqfjwq.dll
C:\WINDOWS\system32\ewarwuqt.dll
C:\WINDOWS\system32\rpvqyvyj.dll
C:\WINDOWS\system32\gmlqmwcl.dll
C:\WINDOWS\system32\vdehmfsv.exe
C:\WINDOWS\system32\uhyjkrgc.dll
C:\WINDOWS\system32\madgwdub.dll
C:\WINDOWS\system32\fuwfjbqo.dll
C:\WINDOWS\system32\nluequso.dll
C:\WINDOWS\system32\augqcnvp.exe
C:\WINDOWS\system32\titbxbok.dll
C:\WINDOWS\system32\hpgsyvcm.dll
C:\WINDOWS\system32\nwwvqhnf.dll
C:\WINDOWS\system32\iajsnogq.dll
C:\WINDOWS\system32\gqaqbxea.exe
C:\WINDOWS\system32\pvsssnav.dll
C:\WINDOWS\system32\nwkjylwk.dll
C:\WINDOWS\system32\dopuyigt.dll
C:\WINDOWS\system32\wcdqgiot.dll
C:\WINDOWS\system32\kbcklncv.dll
C:\WINDOWS\system32\cymahagu.dll
C:\WINDOWS\system32\vbhldcub.dll
C:\WINDOWS\system32\kdwfwwki.dll
C:\WINDOWS\system32\fqcxqncr.dll
C:\WINDOWS\system32\jdoabrxn.dll
C:\WINDOWS\system32\hemtsmpt.dll
C:\WINDOWS\system32\dbqrxtur.dll
C:\WINDOWS\system32\petndqbl.dll
C:\WINDOWS\system32\gvatjjra.dll
C:\WINDOWS\system32\erujfucj.dll
C:\WINDOWS\system32\pgbwpxxg.dll
C:\WINDOWS\system32\dqgiikxy.dll
C:\WINDOWS\system32\mttaqbjj.dll
C:\WINDOWS\Tasks\ErrorSmart Scheduled Scan.job
C:\WINDOWS\Tasks\ErrorSmart Scheduled Scan.job

Folder::
C:\WINDOWS\system32\te2
C:\WINDOWS\system32\sz1
C:\WINDOWS\system32\mva
C:\Temp\epr1
C:\WINDOWS\system32\dnc
C:\WINDOWS\system32\bet
C:\WINDOWS\system32\kBin02

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{665eddf3-7087-4b2c-f21c-b5886dc2fde8}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"{1574d93e-968b-83bd-0406-4f4a71cd966b}"=-
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=""

DirLook::
C:\Temp
Save this Notepad file as CFScript.txt to your Desktop and then close the file.





Referring to the picture above, drag CFScript onto ComboFix

If you are prompted to update ComboFix, please click Yes

Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.

When finished, it shall produce a log for you. Please post that log, ComboFix.txt in your next reply.

Note:
Do not mouseclick ComboFix's window whilst it's running. That may cause it to stall.

When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed.

With the above script, ComboFix will capture a file to submit for analysis.

Ensure you are connected to the internet and click OK. A browser will open. Simply follow the instructions to copy/paste/send the requested file.

Please let your helper know you successfully submitted the file.

------------------------------------------------------

Open HijackThis and click on 'Do a System Scan and Save a Logfile'. Save the logfile and post it here.

------------------------------------------------------

Please post the following in your next reply:

VirusTotal results
C:\ComboFix.txt
new HijackThis log
__________________
Our help is free but please donate

Proud member of ASAP
Proud member of UNITE
Last edited by chemist; 08-26-2008 at 07:50 PM.
chemist is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 08-29-2008, 01:25 AM   #7 (permalink)
Registered User
 
Join Date: Aug 2008
Posts: 12
OS: xp


Re: Virus infected computer.
Thanks
My virus total log (logforvirus)
and my Combofix log (log)
are attached
here is my hijack this log

ComboFix 08-08-28.04 - Jackson & Arlo 2008-08-29 15:28:53.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.61.1033.18.174 [GMT 10:00]
Running from: C:\Documents and Settings\Jackson & Arlo\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Jackson & Arlo\Desktop\CFScript.txt
* Created a new restore point

FILE ::
C:\WINDOWS\system32\afdsuwao.dll
C:\WINDOWS\system32\augqcnvp.exe
C:\WINDOWS\system32\bujnljfa.dll
C:\WINDOWS\system32\cfywwerm.exe
C:\WINDOWS\system32\cxrxegot.dll
C:\WINDOWS\system32\cymahagu.dll
C:\WINDOWS\system32\dbqrxtur.dll
C:\WINDOWS\system32\dopuyigt.dll
C:\WINDOWS\system32\dqgiikxy.dll
C:\WINDOWS\system32\dyckqngx.dll
C:\WINDOWS\system32\erujfucj.dll
C:\WINDOWS\system32\ewarwuqt.dll
C:\WINDOWS\system32\fqcxqncr.dll
C:\WINDOWS\system32\fuwfjbqo.dll
C:\WINDOWS\system32\gascrvhi.dll
C:\WINDOWS\system32\gcphljwq.dll
C:\WINDOWS\system32\ggnsijrf.dll
C:\WINDOWS\system32\giuorpah.dll
C:\WINDOWS\system32\gmlqmwcl.dll
C:\WINDOWS\system32\gpimmchm.dll
C:\WINDOWS\system32\gqaqbxea.exe
C:\WINDOWS\system32\gvatjjra.dll
C:\WINDOWS\system32\hemtsmpt.dll
C:\WINDOWS\system32\hgcuvdls.dll
C:\WINDOWS\system32\hncewmlc.dll
C:\WINDOWS\system32\hpabdjlq.dll
C:\WINDOWS\system32\hpgsyvcm.dll
C:\WINDOWS\system32\iajsnogq.dll
C:\WINDOWS\system32\icrenogp.exe
C:\WINDOWS\system32\icxonxoa.dll
C:\WINDOWS\system32\itvxqirh.dll
C:\WINDOWS\system32\jdoabrxn.dll
C:\WINDOWS\system32\kbcklncv.dll
C:\WINDOWS\system32\kdwfwwki.dll
C:\WINDOWS\system32\koabqjfj.dll
C:\WINDOWS\system32\lbunyquy.dll
C:\WINDOWS\system32\madgwdub.dll
C:\WINDOWS\system32\mttaqbjj.dll
C:\WINDOWS\system32\nluequso.dll
C:\WINDOWS\system32\nwkjylwk.dll
C:\WINDOWS\system32\nwwvqhnf.dll
C:\WINDOWS\system32\ojioipwu.exe
C:\WINDOWS\system32\osepyftn.dll
C:\WINDOWS\system32\owiagwut.dll
C:\WINDOWS\system32\petndqbl.dll
C:\WINDOWS\system32\pgbwpxxg.dll
C:\WINDOWS\system32\phvmjnew.dll
C:\WINDOWS\system32\pjomdjav.dll
C:\WINDOWS\system32\pvsssnav.dll
C:\WINDOWS\system32\qdvtjdgl.exe
C:\WINDOWS\system32\qjpbyivv.dll
C:\WINDOWS\system32\rphqfjwq.dll
C:\WINDOWS\system32\rpvqyvyj.dll
C:\WINDOWS\system32\rrykoyei.dll
C:\WINDOWS\system32\thmgpmsr.dll
C:\WINDOWS\system32\titbxbok.dll
C:\WINDOWS\system32\tjfjincf.dll
C:\WINDOWS\system32\uakuyqgu.exe
C:\WINDOWS\system32\uhyjkrgc.dll
C:\WINDOWS\system32\vbhldcub.dll
C:\WINDOWS\system32\vdehmfsv.exe
C:\WINDOWS\system32\vrdlyvcp.dll
C:\WINDOWS\system32\wcdqgiot.dll
C:\WINDOWS\system32\wogndeiv.dll
C:\WINDOWS\Tasks\ErrorSmart Scheduled Scan.job
.
Error: Cfiles.dat

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Jackson & Arlo\Application Data\macromedia\Flash Player\#SharedObjects\2NUCUBGZ\interclick.com
C:\Documents and Settings\Jackson & Arlo\Application Data\macromedia\Flash Player\#SharedObjects\2NUCUBGZ\interclick.com\ud.sol
C:\Documents and Settings\Jackson & Arlo\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com
C:\Documents and Settings\Jackson & Arlo\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol
C:\Temp\epr1
C:\Temp\epr1\K19i.log
C:\WINDOWS\system32\~.exe
C:\WINDOWS\system32\afdsuwao.dll
C:\WINDOWS\system32\augqcnvp.exe
C:\WINDOWS\system32\bet
C:\WINDOWS\system32\bujnljfa.dll
C:\WINDOWS\system32\cfywwerm.exe
C:\WINDOWS\system32\chmryosd.dll
C:\WINDOWS\system32\crlrpdeo.dll
C:\WINDOWS\system32\cxrxegot.dll
C:\WINDOWS\system32\cymahagu.dll
C:\WINDOWS\system32\dbqrxtur.dll
C:\WINDOWS\system32\dnc
C:\WINDOWS\system32\dnc\inapDLL2.exe
C:\WINDOWS\system32\dopuyigt.dll
C:\WINDOWS\system32\dqgiikxy.dll
C:\WINDOWS\system32\dyckqngx.dll
C:\WINDOWS\system32\erujfucj.dll
C:\WINDOWS\system32\ewarwuqt.dll
C:\WINDOWS\system32\fqcxqncr.dll
C:\WINDOWS\system32\fuwfjbqo.dll
C:\WINDOWS\system32\gascrvhi.dll
C:\WINDOWS\system32\gcphljwq.dll
C:\WINDOWS\system32\gdcumcyt.exe
C:\WINDOWS\system32\ggnsijrf.dll
C:\WINDOWS\system32\giuorpah.dll
C:\WINDOWS\system32\gmlqmwcl.dll
C:\WINDOWS\system32\gpimmchm.dll
C:\WINDOWS\system32\gqaqbxea.exe
C:\WINDOWS\system32\gvatjjra.dll
C:\WINDOWS\system32\hemtsmpt.dll
C:\WINDOWS\system32\hgcuvdls.dll
C:\WINDOWS\system32\hncewmlc.dll
C:\WINDOWS\system32\hpabdjlq.dll
C:\WINDOWS\system32\hpgsyvcm.dll
C:\WINDOWS\system32\hRqrqqru.ini
C:\WINDOWS\system32\hRqrqqru.ini2
C:\WINDOWS\system32\iajsnogq.dll
C:\WINDOWS\system32\icrenogp.exe
C:\WINDOWS\system32\icxonxoa.dll
C:\WINDOWS\system32\itvxqirh.dll
C:\WINDOWS\system32\jdoabrxn.dll
C:\WINDOWS\system32\jskgnpif.dll
C:\WINDOWS\system32\kbcklncv.dll
C:\WINDOWS\system32\kBin02
C:\WINDOWS\system32\kBin02\kBin022328.exe
C:\WINDOWS\system32\kdwfwwki.dll
C:\WINDOWS\system32\koabqjfj.dll
C:\WINDOWS\system32\lbunyquy.dll
C:\WINDOWS\system32\madgwdub.dll
C:\WINDOWS\system32\mkonhnyzuaxqg.exe
C:\WINDOWS\system32\mttaqbjj.dll
C:\WINDOWS\system32\mva
C:\WINDOWS\system32\mva\GETFI22114.exe
C:\WINDOWS\system32\nluequso.dll
C:\WINDOWS\system32\nwkjylwk.dll
C:\WINDOWS\system32\nwwvqhnf.dll
C:\WINDOWS\system32\ojioipwu.exe
C:\WINDOWS\system32\okacusdh.dll
C:\WINDOWS\system32\osepyftn.dll
C:\WINDOWS\system32\owiagwut.dll
C:\WINDOWS\system32\oxqakdps.dll
C:\WINDOWS\system32\petndqbl.dll
C:\WINDOWS\system32\pgbwpxxg.dll
C:\WINDOWS\system32\phvmjnew.dll
C:\WINDOWS\system32\pjomdjav.dll
C:\WINDOWS\system32\pvsssnav.dll
C:\WINDOWS\system32\qdvtjdgl.exe
C:\WINDOWS\system32\qhayfkon.dll
C:\WINDOWS\system32\qjpbyivv.dll
C:\WINDOWS\system32\qsmfnvef.dll
C:\WINDOWS\system32\rphqfjwq.dll
C:\WINDOWS\system32\rpvqyvyj.dll
C:\WINDOWS\system32\rrykoyei.dll
C:\WINDOWS\system32\snnikarp.exe
C:\WINDOWS\system32\sz1
C:\WINDOWS\system32\te2
C:\WINDOWS\system32\te2\crv2203NT.exe
C:\WINDOWS\system32\thmgpmsr.dll
C:\WINDOWS\system32\titbxbok.dll
C:\WINDOWS\system32\tjfjincf.dll
C:\WINDOWS\system32\tuvUKBuR.dll
C:\WINDOWS\system32\uakuyqgu.exe
C:\WINDOWS\system32\uhyjkrgc.dll
C:\WINDOWS\system32\urqqrqRh.dll
C:\WINDOWS\system32\vbhldcub.dll
C:\WINDOWS\system32\vdehmfsv.exe
C:\WINDOWS\system32\vrdlyvcp.dll
C:\WINDOWS\system32\wamaperc.dll
C:\WINDOWS\system32\wcdqgiot.dll
C:\WINDOWS\system32\wogndeiv.dll
C:\WINDOWS\system32\xlmchsexfnieqxg.dll
C:\WINDOWS\system32\yayvWqpQ.dll
C:\WINDOWS\Tasks\ErrorSmart Scheduled Scan.job
G:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2008-07-28 to 2008-08-29 )))))))))))))))))))))))))))))))
.

2008-08-28 20:08 . 2008-08-28 20:08 6,692 --a------ C:\WINDOWS\system32\mnngekdg.dll
2008-08-28 20:08 . 2008-08-28 20:08 6,652 --a------ C:\WINDOWS\system32\qsldlagj.dll
2008-08-28 20:05 . 2008-08-28 20:05 6,694 --a------ C:\WINDOWS\system32\sqvlrobn.dll
2008-08-28 20:04 . 2008-08-28 20:04 6,650 --a------ C:\WINDOWS\system32\ppmbtyma.exe
2008-08-28 20:03 . 2008-08-28 20:03 6,688 --a------ C:\WINDOWS\system32\mcqpcbnu.dll
2008-08-27 21:12 . 2008-08-27 21:12 118 --a------ C:\WINDOWS\system32\MRT.INI
2008-08-27 21:07 . 2008-08-27 21:14 1,374 --a------ C:\WINDOWS\imsins.BAK
2008-08-27 08:11 . 2008-08-27 08:11 <DIR> d-------- C:\Program Files\HyCam2
2008-08-20 20:56 . 2008-08-20 20:56 <DIR> d-------- C:\Program Files\Sun
2008-08-15 19:14 . 2008-08-18 23:02 842 --a------ C:\WINDOWS\cookies.ini
2008-08-15 18:02 . 2008-08-20 19:51 10,752 --a------ C:\WINDOWS\DCEBoot.exe
2008-08-14 16:26 . 2008-08-26 18:22 21 --a------ C:\WINDOWS\pskt.ini
2008-08-13 08:57 . 2008-08-29 15:30 <DIR> d-------- C:\Temp
2008-08-01 19:02 . 2008-08-01 19:02 <DIR> d-------- C:\Program Files\Lavasoft
2008-08-01 19:02 . 2008-08-01 19:08 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-08-01 19:00 . 2008-08-01 19:00 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-08-01 18:47 . 2008-08-01 18:47 <DIR> d-------- C:\Program Files\iTunes

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-29 05:15 --------- d-----w C:\Program Files\FrostWire
2008-08-21 12:26 --------- d-----w C:\Documents and Settings\Jackson & Arlo\Application Data\uTorrent
2008-08-20 10:55 --------- d-----w C:\Program Files\Java
2008-08-13 13:00 --------- d-----w C:\Documents and Settings\Jackson & Arlo\Application Data\FrostWire
2008-08-13 07:59 --------- d-----w C:\Program Files\Incomplete
2008-08-13 01:08 --------- d-----w C:\Program Files\LimeWire
2008-08-02 01:25 --------- d-----w C:\Program Files\Trend Micro
2008-08-01 08:50 --------- d-----w C:\Program Files\Bonjour
2008-08-01 08:48 --------- d-----w C:\Program Files\Safari
2008-08-01 08:47 --------- d-----w C:\Program Files\iTunes(2)
2008-07-21 12:51 --------- d-----w C:\Program Files\iPod
2008-07-20 03:44 6,650 ----a-w C:\WINDOWS\system32\iedgjxpy.dll
2008-07-20 03:41 6,690 ----a-w C:\WINDOWS\system32\fscgxwbw.dll
2008-07-20 03:38 6,692 ----a-w C:\WINDOWS\system32\okoqlfpv.dll
2008-07-20 03:35 6,686 ----a-w C:\WINDOWS\system32\eobffllv.dll
2008-07-19 15:33 6,690 ----a-w C:\WINDOWS\system32\aulvfwnc.dll
2008-07-18 09:08 36,368 ----a-w C:\WINDOWS\system32\drivers\tmpreflt.sys
2008-07-18 09:08 205,328 ----a-w C:\WINDOWS\system32\drivers\tmxpflt.sys
2008-07-18 08:51 1,195,448 ----a-w C:\WINDOWS\system32\drivers\vsapint.sys
2008-07-09 11:13 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-07-07 20:32 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-23 16:57 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
2006-10-09 06:09 19,666,504 ------w C:\Program Files\QuickTimeInstaller.exe
2006-10-09 06:05 36,656,704 ------w C:\Program Files\iTunesSetup.exe
2007-03-09 09:12 27,648 --sha-w C:\WINDOWS\system32\AVSredirect.dll
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

---- Directory of C:\Temp ----

2008-08-13 08:57 1858 --a------ C:\Temp\epr1\K19i.log


((((((((((((((((((((((((((((( snapshot@2008-08-26_18.48.23.57 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-04-23 04:16:28 124,928 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\advpack.dll
+ 2008-04-23 04:16:28 347,136 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\dxtmsft.dll
+ 2008-04-23 04:16:28 214,528 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\dxtrans.dll
+ 2008-04-23 04:16:28 133,120 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\extmgr.dll
+ 2008-04-23 04:16:28 63,488 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\icardie.dll
+ 2008-04-22 07:39:58 70,656 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\ie4uinit.exe
+ 2008-04-23 04:16:28 153,088 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\ieakeng.dll
+ 2008-04-23 04:16:28 230,400 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\ieaksie.dll
+ 2008-04-20 05:07:51 161,792 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\ieakui.dll
+ 2008-04-23 04:16:28 383,488 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\ieapfltr.dll
+ 2008-04-23 04:16:28 384,512 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\iedkcs32.dll
+ 2008-04-23 04:16:28 6,066,176 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\ieframe.dll
+ 2008-04-23 04:16:28 44,544 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\iernonce.dll
+ 2008-04-23 04:16:28 267,776 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\iertutil.dll
+ 2008-04-22 07:39:58 13,824 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\ieudinit.exe
+ 2008-04-22 07:40:18 625,664 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\iexplore.exe
+ 2008-04-23 04:16:28 27,648 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\jsproxy.dll
+ 2008-04-23 04:16:28 459,264 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\msfeeds.dll
+ 2008-04-23 04:16:28 52,224 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\msfeedsbs.dll
+ 2008-04-23 12:16:30 3,591,680 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\mshtml.dll
+ 2008-04-23 04:16:28 478,208 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\mshtmled.dll
+ 2008-04-23 04:16:28 193,024 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\msrating.dll
+ 2008-04-23 04:16:28 671,232 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\mstime.dll
+ 2008-04-23 04:16:28 102,912 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\occache.dll
+ 2008-04-23 04:16:28 44,544 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\pngfilt.dll
+ 2007-03-06 01:22:39 213,216 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\spuninst.exe
+ 2007-03-06 01:23:51 371,424 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\updspapi.dll
+ 2008-04-23 04:16:28 105,984 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\url.dll
+ 2008-04-23 04:16:29 1,159,680 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\urlmon.dll
+ 2008-04-23 04:16:29 233,472 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\webcheck.dll
+ 2008-04-23 04:16:29 826,368 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\wininet.dll
- 2008-07-09 11:14:05 12,288 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
+ 2008-08-27 11:13:08 12,288 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
- 2008-07-09 11:14:05 135,168 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\misc.exe
+ 2008-08-27 11:13:08 135,168 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\misc.exe
- 2008-07-09 11:14:05 11,264 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
+ 2008-08-27 11:13:08 11,264 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
- 2008-07-09 11:14:06 27,136 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
+ 2008-08-27 11:13:08 27,136 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
- 2008-07-09 11:14:06 4,096 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
+ 2008-08-27 11:13:08 4,096 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
- 2008-07-09 11:14:06 794,624 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\outicon.exe
+ 2008-08-27 11:13:09 794,624 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\outicon.exe
- 2008-07-09 11:14:05 249,856 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\pptico.exe
+ 2008-08-27 11:13:08 249,856 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\pptico.exe
- 2008-07-09 11:14:06 23,040 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
+ 2008-08-27 11:13:09 23,040 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
- 2008-07-09 11:14:05 286,720 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
+ 2008-08-27 11:13:08 286,720 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
- 2008-07-09 11:14:05 409,600 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
+ 2008-08-27 11:13:08 409,600 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
- 2008-04-23 04:16:28 124,928 ----a-w C:\WINDOWS\system32\advpack.dll
+ 2008-06-23 16:57:27 124,928 ----a-w C:\WINDOWS\system32\advpack.dll
- 2008-04-23 04:16:28 124,928 -c----w C:\WINDOWS\system32\dllcache\advpack.dll
+ 2008-06-23 16:57:27 124,928 -c----w C:\WINDOWS\system32\dllcache\advpack.dll
- 2008-04-23 04:16:28 347,136 -c----w C:\WINDOWS\system32\dllcache\dxtmsft.dll
+ 2008-06-23 16:57:27 347,136 -c----w C:\WINDOWS\system32\dllcache\dxtmsft.dll
- 2008-04-23 04:16:28 214,528 -c----w C:\WINDOWS\system32\dllcache\dxtrans.dll
+ 2008-06-23 16:57:27 214,528 -c----w C:\WINDOWS\system32\dllcache\dxtrans.dll
- 2005-07-26 04:39:45 243,200 -c----w C:\WINDOWS\system32\dllcache\es.dll
+ 2008-07-07 20:32:22 253,952 -c----w C:\WINDOWS\system32\dllcache\es.dll
- 2008-04-23 04:16:28 133,120 -c----w C:\WINDOWS\system32\dllcache\extmgr.dll
+ 2008-06-23 16:57:27 133,120 -c----w C:\WINDOWS\system32\dllcache\extmgr.dll
- 2008-04-23 04:16:28 63,488 -c----w C:\WINDOWS\system32\dllcache\icardie.dll
+ 2008-06-23 16:57:28 63,488 -c----w C:\WINDOWS\system32\dllcache\icardie.dll
- 2008-04-22 07:39:58 70,656 -c----w C:\WINDOWS\system32\dllcache\ie4uinit.exe
+ 2008-06-23 09:20:25 70,656 -c----w C:\WINDOWS\system32\dllcache\ie4uinit.exe
- 2008-04-23 04:16:28 153,088 -c----w C:\WINDOWS\system32\dllcache\ieakeng.dll
+ 2008-06-23 16:57:29 153,088 -c----w C:\WINDOWS\system32\dllcache\ieakeng.dll
- 2008-04-23 04:16:28 230,400 -c----w C:\WINDOWS\system32\dllcache\ieaksie.dll
+ 2008-06-23 16:57:29 230,400 -c----w C:\WINDOWS\system32\dllcache\ieaksie.dll
- 2008-04-20 05:07:51 161,792 -c----w C:\WINDOWS\system32\dllcache\ieakui.dll
+ 2008-06-21 05:23:54 161,792 -c----w C:\WINDOWS\system32\dllcache\ieakui.dll
- 2008-04-23 04:16:28 383,488 -c----w C:\WINDOWS\system32\dllcache\ieapfltr.dll
+ 2008-06-23 16:57:29 383,488 -c----w C:\WINDOWS\system32\dllcache\ieapfltr.dll
- 2008-04-23 04:16:28 384,512 -c----w C:\WINDOWS\system32\dllcache\iedkcs32.dll
+ 2008-06-23 16:57:29 384,512 -c----w C:\WINDOWS\system32\dllcache\iedkcs32.dll
- 2008-04-23 04:16:28 6,066,176 -c----w C:\WINDOWS\system32\dllcache\ieframe.dll
+ 2008-06-23 16:57:33 6,066,176 -c----w C:\WINDOWS\system32\dllcache\ieframe.dll
- 2008-04-23 04:16:28 44,544 -c----w C:\WINDOWS\system32\dllcache\iernonce.dll
+ 2008-06-23 16:57:33 44,544 -c----w C:\WINDOWS\system32\dllcache\iernonce.dll
- 2008-04-23 04:16:28 267,776 -c----w C:\WINDOWS\system32\dllcache\iertutil.dll
+ 2008-06-23 16:57:34 267,776 -c----w C:\WINDOWS\system32\dllcache\iertutil.dll
- 2008-04-22 07:39:58 13,824 -c----w C:\WINDOWS\system32\dllcache\ieudinit.exe
+ 2008-06-23 09:20:26 13,824 -c----w C:\WINDOWS\system32\dllcache\ieudinit.exe
- 2008-04-22 07:40:18 625,664 -c----w C:\WINDOWS\system32\dllcache\iexplore.exe
+ 2008-06-23 09:20:52 625,664 -c----w C:\WINDOWS\system32\dllcache\iexplore.exe
- 2007-08-21 06:15:44 683,520 -c----w C:\WINDOWS\system32\dllcache\inetcomm.dll
+ 2008-04-11 18:50:43 683,520 -c----w C:\WINDOWS\system32\dllcache\inetcomm.dll
- 2008-04-23 04:16:28 27,648 -c----w C:\WINDOWS\system32\dllcache\jsproxy.dll
+ 2008-06-23 16:57:35 27,648 -c----w C:\WINDOWS\system32\dllcache\jsproxy.dll
- 2004-08-03 14:56:44 331,776 -c----w C:\WINDOWS\system32\dllcache\msadce.dll
+ 2008-05-01 14:30:33 331,776 -c----w C:\WINDOWS\system32\dllcache\msadce.dll
- 2005-06-29 01:46:00 74,240 -c----w C:\WINDOWS\system32\dllcache\mscms.dll
+ 2008-06-24 16:23:05 74,240 -c----w C:\WINDOWS\system32\dllcache\mscms.dll
- 2008-04-23 04:16:28 459,264 -c----w C:\WINDOWS\system32\dllcache\msfeeds.dll
+ 2008-06-23 16:57:36 459,264 -c----w C:\WINDOWS\system32\dllcache\msfeeds.dll
- 2008-04-23 04:16:28 52,224 -c----w C:\WINDOWS\system32\dllcache\msfeedsbs.dll
+ 2008-06-23 16:57:36 52,224 -c----w C:\WINDOWS\system32\dllcache\msfeedsbs.dll
- 2008-04-23 12:16:30 3,591,680 -c----w C:\WINDOWS\system32\dllcache\mshtml.dll
+ 2008-06-24 00:57:40 3,592,192 -c----w C:\WINDOWS\system32\dllcache\mshtml.dll
- 2008-04-23 04:16:28 478,208 -c----w C:\WINDOWS\system32\dllcache\mshtmled.dll
+ 2008-06-23 16:57:39 477,696 -c----w C:\WINDOWS\system32\dllcache\mshtmled.dll
- 2008-04-23 04:16:28 193,024 -c----w C:\WINDOWS\system32\dllcache\msrating.dll
+ 2008-06-23 16:57:39 193,024 -c----w C:\WINDOWS\system32\dllcache\msrating.dll
- 2008-04-23 04:16:28 671,232 -c----w C:\WINDOWS\system32\dllcache\mstime.dll
+ 2008-06-23 16:57:40 671,232 -c----w C:\WINDOWS\system32\dllcache\mstime.dll
- 2008-04-23 04:16:28 102,912 -c----w C:\WINDOWS\system32\dllcache\occache.dll
+ 2008-06-23 16:57:40 102,912 -c----w C:\WINDOWS\system32\dllcache\occache.dll
- 2008-04-23 04:16:28 44,544 -c----w C:\WINDOWS\system32\dllcache\pngfilt.dll
+ 2008-06-23 16:57:40 44,544 -c----w C:\WINDOWS\system32\dllcache\pngfilt.dll
- 2008-04-23 04:16:28 105,984 -c----w C:\WINDOWS\system32\dllcache\url.dll
+ 2008-06-23 16:57:40 105,984 -c----w C:\WINDOWS\system32\dllcache\url.dll
- 2008-04-23 04:16:29 1,159,680 -c----w C:\WINDOWS\system32\dllcache\urlmon.dll
+ 2008-06-23 16:57:40 1,159,680 -c----w C:\WINDOWS\system32\dllcache\urlmon.dll
- 2008-04-23 04:16:29 233,472 -c----w C:\WINDOWS\system32\dllcache\webcheck.dll
+ 2008-06-23 16:57:41 233,472 -c----w C:\WINDOWS\system32\dllcache\webcheck.dll
- 2008-04-23 04:16:29 826,368 -c----w C:\WINDOWS\system32\dllcache\wininet.dll
+ 2008-06-23 16:57:41 826,368 -c----w C:\WINDOWS\system32\dllcache\wininet.dll
- 2008-04-23 04:16:28 347,136 ----a-w C:\WINDOWS\system32\dxtmsft.dll
+ 2008-06-23 16:57:27 347,136 ----a-w C:\WINDOWS\system32\dxtmsft.dll
- 2008-04-23 04:16:28 214,528 ----a-w C:\WINDOWS\system32\dxtrans.dll
+ 2008-06-23 16:57:27 214,528 ----a-w C:\WINDOWS\system32\dxtrans.dll
- 2008-04-23 04:16:28 133,120 ----a-w C:\WINDOWS\system32\extmgr.dll
+ 2008-06-23 16:57:27 133,120 ----a-w C:\WINDOWS\system32\extmgr.dll
- 2008-04-23 04:16:28 63,488 ----a-w C:\WINDOWS\system32\icardie.dll
+ 2008-06-23 16:57:28 63,488 ----a-w C:\WINDOWS\system32\icardie.dll
- 2008-04-22 07:39:58 70,656 ----a-w C:\WINDOWS\system32\ie4uinit.exe
+ 2008-06-23 09:20:25 70,656 ----a-w C:\WINDOWS\system32\ie4uinit.exe
- 2008-04-23 04:16:28 153,088 ----a-w C:\WINDOWS\system32\ieakeng.dll
+ 2008-06-23 16:57:29 153,088 ----a-w C:\WINDOWS\system32\ieakeng.dll
- 2008-04-23 04:16:28 230,400 ----a-w C:\WINDOWS\system32\ieaksie.dll
+ 2008-06-23 16:57:29 230,400 ----a-w C:\WINDOWS\system32\ieaksie.dll
- 2008-04-20 05:07:51 161,792 ----a-w C:\WINDOWS\system32\ieakui.dll
+ 2008-06-21 05:23:54 161,792 ----a-w C:\WINDOWS\system32\ieakui.dll
- 2008-04-23 04:16:28 383,488 ----a-w C:\WINDOWS\system32\ieapfltr.dll
+ 2008-06-23 16:57:29 383,488 ----a-w C:\WINDOWS\system32\ieapfltr.dll
- 2008-04-23 04:16:28 384,512 ----a-w C:\WINDOWS\system32\iedkcs32.dll
+ 2008-06-23 16:57:29 384,512 ----a-w C:\WINDOWS\system32\iedkcs32.dll
- 2008-04-23 04:16:28 6,066,176 ----a-w C:\WINDOWS\system32\ieframe.dll
+ 2008-06-23 16:57:33 6,066,176 ----a-w C:\WINDOWS\system32\ieframe.dll
- 2008-04-23 04:16:28 44,544 ----a-w C:\WINDOWS\system32\iernonce.dll
+ 2008-06-23 16:57:33 44,544 ----a-w C:\WINDOWS\system32\iernonce.dll
- 2008-04-23 04:16:28 267,776 ----a-w C:\WINDOWS\system32\iertutil.dll
+ 2008-06-23 16:57:34 267,776 ----a-w C:\WINDOWS\system32\iertutil.dll
- 2008-04-22 07:39:58 13,824 ----a-w C:\WINDOWS\system32\ieudinit.exe
+ 2008-06-23 09:20:26 13,824 ----a-w C:\WINDOWS\system32\ieudinit.exe
- 2007-08-21 06:15:44 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
+ 2008-04-11 18:50:43 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
- 2008-04-23 04:16:28 27,648 ----a-w C:\WINDOWS\system32\jsproxy.dll
+ 2008-06-23 16:57:35 27,648 ----a-w C:\WINDOWS\system32\jsproxy.dll
- 2008-06-25 16:15:46 17,972,344 ----a-w C:\WINDOWS\system32\MRT.exe
+ 2008-08-05 18:11:01 15,888,504 ----a-w C:\WINDOWS\system32\MRT.exe
- 2008-04-23 04:16:28 459,264 ----a-w C:\WINDOWS\system32\msfeeds.dll
+ 2008-06-23 16:57:36 459,264 ----a-w C:\WINDOWS\system32\msfeeds.dll
- 2008-04-23 04:16:28 52,224 ----a-w C:\WINDOWS\system32\msfeedsbs.dll
+ 2008-06-23 16:57:36 52,224 ----a-w C:\WINDOWS\system32\msfeedsbs.dll
- 2008-04-23 12:16:30 3,591,680 ----a-w C:\WINDOWS\system32\mshtml.dll
+ 2008-06-24 00:57:40 3,592,192 ----a-w C:\WINDOWS\system32\mshtml.dll
- 2008-04-23 04:16:28 478,208 ----a-w C:\WINDOWS\system32\mshtmled.dll
+ 2008-06-23 16:57:39 477,696 ----a-w C:\WINDOWS\system32\mshtmled.dll
- 2008-04-23 04:16:28 193,024 ----a-w C:\WINDOWS\system32\msrating.dll
+ 2008-06-23 16:57:39 193,024 ----a-w C:\WINDOWS\system32\msrating.dll
- 2008-04-23 04:16:28 671,232 ----a-w C:\WINDOWS\system32\mstime.dll
+ 2008-06-23 16:57:40 671,232 ----a-w C:\WINDOWS\system32\mstime.dll
- 2008-04-23 04:16:28 102,912 ----a-w C:\WINDOWS\system32\occache.dll
+ 2008-06-23 16:57:40 102,912 ----a-w C:\WINDOWS\system32\occache.dll
- 2008-08-02 01:21:29 60,740 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-08-27 12:10:20 60,624 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2008-08-02 01:21:29 400,772 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-08-27 12:10:20 400,464 ----a-w C:\WINDOWS\system32\perfh009.dat
- 2008-04-23 04:16:28 44,544 ----a-w C:\WINDOWS\system32\pngfilt.dll
+ 2008-06-23 16:57:40 44,544 ----a-w C:\WINDOWS\system32\pngfilt.dll
- 2007-11-13 11:31:11 60,416 ----a-w C:\WINDOWS\system32\tzchange.exe
+ 2008-07-14 11:09:18 62,976 ----a-w C:\WINDOWS\system32\tzchange.exe
- 2008-04-23 04:16:28 105,984 ----a-w C:\WINDOWS\system32\url.dll
+ 2008-06-23 16:57:40 105,984 ----a-w C:\WINDOWS\system32\url.dll
- 2008-04-23 04:16:29 1,159,680 ----a-w C:\WINDOWS\system32\urlmon.dll
+ 2008-06-23 16:57:40 1,159,680 ----a-w C:\WINDOWS\system32\urlmon.dll
- 2008-04-23 04:16:29 233,472 ----a-w C:\WINDOWS\system32\webcheck.dll
+ 2008-06-23 16:57:41 233,472 ----a-w C:\WINDOWS\system32\webcheck.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-02-28 22:00 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-25 16:07 68856]
"OE"="C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe" [2007-09-17 23:30 488712]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2004-02-10 11:55 155648]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2004-02-10 11:51 118784]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"UfSeAgnt.exe"="C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe" [2008-07-29 14:24 1398024]
"mxomssmenu"="C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe" [2007-09-06 14:53 169264]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-05-27 10:50 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-06-02 11:13 267048]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
BlueSoleil.lnk - C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe [2007-03-22 02:50:17 1183744]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.iac2"= G:\flv\iac25_32.ax

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"G:\\games\\Warcraft III\\Warcraft III.exe"=

R2 Maxtor Sync Service;Maxtor Service;C:\Program Files\Maxtor\Sync\SyncServices.exe [2007-09-28 12:24]
R2 NMSAccessU;NMSAccessU;C:\Program Files\CDBurnerXP\NMSAccessU.exe [2007-10-12 07:34]
R3 MusCDriverV32;MusCDriverV32;C:\WINDOWS\system32\drivers\MusCDriverV32.sys [2007-07-19 14:58]
S3 BrSerIf;Brother MFC Serial Port Interface WDM Driver;C:\WINDOWS\system32\Drivers\BrSerIf.sys [2004-09-29 03:24]
S3 BrUsbSer;Brother MFC USB Serial WDM Driver;C:\WINDOWS\system32\Drivers\BrUsbSer.sys [2004-01-10 04:28]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
\Shell\AutoRun\command - .\Encryption Tool\MaxtorEncryption.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{57554e3e-a872-11dc-9aa7-000d56a4bcf2}]
\Shell\AutoRun\command - E:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{be50fd01-b6cc-11d7-99ce-000bdbc78264}]
\Shell\AutoRun\command - PortableApps\PortableAppsMenu\PortableAppsMenu.exe
.
Contents of the 'Scheduled Tasks' folder
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-29 15:44:43
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\brss01a.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2008-08-29 16:01:57 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-29 06:01:39
ComboFix2.txt 2008-08-26 08:49:11

Pre-Run: 5,827,801,088 bytes free
Post-Run: 5,639,892,992 bytes free

489 --- E O F --- 2008-08-27 11:14:34


ogfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:07, on 2008-08-29
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\cmd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Maxtor\Sync\SyncServices.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\MsiExec.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\PROGRA~1\MOZILL~1\uninstall\helper.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.blackle.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.ninemsn.com.au/0SEENAU/SAOS01?FORM=TOOLBR
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [UfSeAgnt.exe] "C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe"
O4 - HKLM\..\Run: [mxomssmenu] "C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [OE] "C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe"
O4 - Global Startup: BlueSoleil.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O15 - Trusted Zone: http://flex.afgonline.com.au
O16 - DPF: {253A9D23-F982-11D4-8BE4-00D0B7E61414} (SiebelHTMLApplication Class) - http://flex.afgonline.com.au/back-of...siebelhtml.cab
O16 - DPF: {2E28242B-A689-11D4-80F2-0040266CBB8D} (KXHCM10 Control) - http://collegio-cam.pittstate.edu/kxhcm10.ocx
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1171523425390
O16 - DPF: {68CDB19A-6305-4589-8C35-41E3502CD451} (Siebel Option Pack for IE 7.5.3) - http://flex.afgonline.com.au/back-of...OptionPack.cab
O16 - DPF: {8F4F3368-54CA-4268-8225-0F4367472CF4} (MailClient Class) - http://flex.afgonline.com.au/back-of...MailClient.cab
O16 - DPF: {AF2E62B6-F9E1-4D4F-A10A-9DC8E6DCBCC0} (VideoEgg ActiveX Loader) - http://update.videoegg.com/Install/W...gPublisher.exe
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Maxtor Service (Maxtor Sync Service) - Seagate Technology LLC - C:\Program Files\Maxtor\Sync\SyncServices.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: Trend Micro Central Control Component (SfCtlCom) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
O23 - Service: Trend Micro Unauthorized Change Prevention Service (TMBMServer) - Trend Micro Inc. - C:\Program Files\Trend Micro\BM\TMBMSRV.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\TmProxy.exe

--
End of file - 7473 bytes
Attached Files
File Type: txt log.txt (28.9 KB, 2 views)
File Type: txt log for virus.txt (2.7 KB, 2 views)
Last edited by chemist; 08-29-2008 at 05:11 AM.
arloporter is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 08-29-2008, 05:36 AM   #8 (permalink)
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
 
Join Date: Oct 2007
Location: Georgia
Posts: 10,633
OS: XP SP3


Re: Virus infected computer.
Hello again, arloporter. Did you successfully submit the [4]-Submit_date@time.zip file? Please let me know.

Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions.

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding.
Ensure that there aren't any opened browsers when you are carrying out the procedures below.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

------------------------------------------------------

Close any open browsers.

Disable your antivirus and antispyware applications, usually via a right-click on the System Tray icon. They may otherwise interfere with ComboFix.

Open Notepad and copy/paste all the text in the quotebox below into Notepad:

Quote:
File::
C:\WINDOWS\system32\mnngekdg.dll
C:\WINDOWS\system32\qsldlagj.dll
C:\WINDOWS\system32\sqvlrobn.dll
C:\WINDOWS\system32\ppmbtyma.exe
C:\WINDOWS\system32\mcqpcbnu.dll
C:\WINDOWS\system32\MRT.INI
C:\WINDOWS\system32\iedgjxpy.dll
C:\WINDOWS\system32\fscgxwbw.dll
C:\WINDOWS\system32\okoqlfpv.dll
C:\WINDOWS\system32\eobffllv.dll
C:\WINDOWS\system32\aulvfwnc.dll

Folder::
C:\Program Files\LimeWire

Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\LimeWire\\LimeWire.exe"=-
Save this Notepad file as CFScript.txt to your Desktop and then close the file.





Referring to the picture above, drag CFScript onto ComboFix

If you are prompted to update ComboFix, please click Yes

Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.

When finished, it shall produce a log for you. Please post that log, ComboFix.txt in your next reply.

Note:
Do not mouseclick ComboFix's window whilst it's running. That may cause it to stall.

------------------------------------------------------

You have old versions of Java still installed. Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version Java components.
  • Close any programs you may have running - especially your web browser.
  • Go to Start(or My Computer) > Control Panel and click on Add or Remove Programs
  • Click (highlight) the following items:
    • J2SE Runtime Environment 5.0 Update 11
    • Java(TM) 6 Update 2
    • Java(TM) 6 Update 3
    • Java(TM) 6 Update 5
    • Java(TM) SE Runtime Environment 6 Update 1
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java version.
  • Reboot your computer once all Java components are removed.
------------------------------------------------------

Please download ATF-Cleaner by Atribune and Save it to your Desktop.
This program is for XP and Windows 2000 only
  • Double-click ATF-Cleaner.exe to run the program.
  • Under Main choose: Select All
  • Click the Empty Selected button.
If you use Firefox browser
  • Click Firefox at the top and choose: Select All
  • Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browser
  • Click Opera at the top and choose: Select All
  • Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

------------------------------------------------------

Please run this online scan to help look for remnants.

Go here to run an online scannner from ESET.

**Note**
To optimize scanning time and produce a more sensible report for review:
  • Close any open programs.
  • Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.
  • Note: You will need to use Internet Explorer for this scan.
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the ActiveX control to install.
  • Close/disable all running programs, including your antivirus and all antispyware programs.
  • Click Start
  • Make sure that the option Remove found threats is unchecked.
  • Make sure the option Scan unwanted applications is checked.
  • Click Scan
  • Wait for the scan to finish.
  • Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
  • Copy and paste that log as a reply to this topic, along with a new HijackThis log and a description of any remaining problems.
------------------------------------------------------

Open HijackThis and click on 'Do a System Scan and Save a Logfile'. Save the logfile and post it here.

------------------------------------------------------

Please post the following in your next reply:

C:\ComboFix.txt
log.txt from ESET
fresh HijackThis log
report on system behavior
__________________
Our help is free but please donate

Proud member of ASAP
Proud member of UNITE
chemist is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 08-29-2008, 06:14 PM   #9 (permalink)
Registered User
 
Join Date: Aug 2008
Posts: 12
OS: xp


Re: Virus infected computer.
Well it came up with a screen from i think bleeping computer, i didn't know what to put in as combofix hadn't Displayed anything. When i put the cfs script into combofix though it had to update, would this of Affected the outcome?
arloporter is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 08-29-2008, 06:29 PM   #10 (permalink)
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
 
Join Date: Oct 2007
Location: Georgia
Posts: 10,633
OS: XP SP3


Re: Virus infected computer.
Is there a [4]-Submit_date@time.zip file on your desktop?
__________________
Our help is free but please donate

Proud member of ASAP
Proud member of UNITE
chemist is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 08-29-2008, 06:36 PM   #11 (permalink)
Registered User
 
Join Date: Aug 2008
Posts: 12
OS: xp


Re: Virus infected computer.
I just found the zip file [4]-submit_2008-08-29@15.28
Should i delete this, Drag cfs script onto CF again, So it comes up with the bleeping computer screen again?
or should i just continue with the next rounds.
arloporter is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 08-29-2008, 06:45 PM   #12 (permalink)
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
 
Join Date: Oct 2007
Location: Georgia
Posts: 10,633
OS: XP SP3


Re: Virus infected computer.
Continue with the instructions above in post #8 above. But first do this:

Please submit [4]-submit_2008-08-29@15.28 to this site ==> http://www.bleepingcomputer.com/subm....php?channel=4 and include this link in the message->>http://www.techsupportforum.com/security-center/hijackthis-log-help/282177-virus-infected-computer.html#post1669966

Let me know whether you successfully submitted it, then continue with post #8. Thanks.
__________________
Our help is free but please donate

Proud member of ASAP
Proud member of UNITE
chemist is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 08-29-2008, 08:01 PM   #13 (permalink)
Registered User
 
Join Date: Aug 2008
Posts: 12
OS: xp


Re: Virus infected computer.
?????
arloporter is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 08-29-2008, 08:06 PM   #14 (permalink)
Registered User
 
Join Date: Aug 2008
Posts: 12
OS: xp


Re: Virus infected computer.
I just Submitted it.
arloporter is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 08-29-2008, 08:11 PM   #15 (permalink)
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
 
Join Date: Oct 2007
Location: Georgia
Posts: 10,633
OS: XP SP3


Re: Virus infected computer.
Please continue with the instructions in post #8 above.
__________________
Our help is free but please donate

Proud member of ASAP
Proud member of UNITE
chemist is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 08-30-2008, 04:55 AM   #16 (permalink)
Registered User
 
Join Date: Aug 2008
Posts: 12
OS: xp


Re: Virus infected computer.
Here are the logs

Online virus scan:
# version=4
# OnlineScanner.ocx=1.0.0.56
# OnlineScannerDLLA.dll=1, 0, 0, 51
# OnlineScannerDLLW.dll=1, 0, 0, 51
# OnlineScannerUninstaller.exe=1, 0, 0, 49
# vers_standard_module=3401 (20080829)
# vers_arch_module=1.064 (20080214)
# vers_adv_heur_module=1.066 (20070917)
# EOSSerial=c3a10388fcfb7d47be6adaef9837c1f9
# end=finished
# remove_checked=false
# unwanted_checked=true
# utc_time=2008-08-30 10:26:24
# local_time=2008-08-30 08:26:24 (+1000, AUS Eastern Standard Time)
# country="United States"
# osver=5.1.2600 NT Service Pack 2
# scanned=499989
# found=9
# scan_time=4634
C:\Documents and Settings\Jackson & Arlo\Desktop\[4]-Submit_2008-08-29@15.28.zip multiple infiltrations AA95DF337C3F5A5A10F9B5B4E86BD460
C:\Documents and Settings\Jackson & Arlo\Desktop\[4]-Submit_2008-08-29@15.28.zip »ZIP »mkonhnyzuaxqg.exe Win32/Adware.GooochiBiz application 00000000000000000000000000000000
C:\Documents and Settings\Jackson & Arlo\Desktop\[4]-Submit_2008-08-29@15.28.zip »ZIP »xlmchsexfnieqxg.dll a variant of Win32/Adware.GooochiBiz application 00000000000000000000000000000000
C:\QooBox\Quarantine\C\WINDOWS\system32\dnc\inapDLL2.exe.vir Win32/TrojanDownloader.Small.IAW trojan 073E4107C0E4EB3528E8BF5ABD82F09F
C:\QooBox\Quarantine\C\WINDOWS\system32\kBin02\kBin022328.exe.vir a variant of Win32/TrojanDownloader.VB.AWJ trojan 998C2A0139F950E1552C4F0102DB34B9
C:\QooBox\Quarantine\C\WINDOWS\system32\mva\GETFI22114.exe.vir multiple infiltrations 8C327D893575BBBCC33E7371B41F31BC
C:\QooBox\Quarantine\C\WINDOWS\system32\mva\GETFI22114.exe.vir »NSIS »ý§€ a variant of Win32/Adware.GooochiBiz application 00000000000000000000000000000000
C:\QooBox\Quarantine\C\WINDOWS\system32\mva\GETFI22114.exe.vir »NSIS »ý¬€.exe Win32/Adware.GooochiBiz application 00000000000000000000000000000000
C:\QooBox\Quarantine\C\WINDOWS\system32\te2\crv2203NT.exe.vir Win32/TrojanDownloader.Small.IAW trojan 073E4107C0E4EB3528E8BF5ABD82F09F

Combo fix log:
omboFix 08-08-29.02 - Jackson & Arlo 2008-08-30 12:18:09.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.61.1033.18.238 [GMT 10:00]
Running from: C:\Documents and Settings\Jackson & Arlo\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Jackson & Arlo\Desktop\CFScript.txt
* Created a new restore point

FILE ::
C:\WINDOWS\system32\aulvfwnc.dll
C:\WINDOWS\system32\eobffllv.dll
C:\WINDOWS\system32\fscgxwbw.dll
C:\WINDOWS\system32\iedgjxpy.dll
C:\WINDOWS\system32\mcqpcbnu.dll
C:\WINDOWS\system32\mnngekdg.dll
C:\WINDOWS\system32\MRT.INI
C:\WINDOWS\system32\okoqlfpv.dll
C:\WINDOWS\system32\ppmbtyma.exe
C:\WINDOWS\system32\qsldlagj.dll
C:\WINDOWS\system32\sqvlrobn.dll
.
Error: Cfiles.dat

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\LimeWire
C:\Program Files\LimeWire\commons-httpclient.jar
C:\Program Files\LimeWire\GenericWindowsUtils.dll
C:\Program Files\LimeWire\hs_err_pid968.log
C:\Program Files\LimeWire\i18n.jar
C:\Program Files\LimeWire\id3v2.jar
C:\Program Files\LimeWire\jl011.jar
C:\Program Files\LimeWire\lib\jdic.dll
C:\Program Files\LimeWire\lib\LimeWire.ico
C:\Program Files\LimeWire\lib\log4j.properties
C:\Program Files\LimeWire\lib\SystemUtilities.dll
C:\Program Files\LimeWire\lib\SystemUtilitiesA.dll
C:\Program Files\LimeWire\lib\tray.dll
C:\Program Files\LimeWire\LimeWire On Startup.lnk
C:\Program Files\LimeWire\LimeWire.exe
C:\Program Files\LimeWire\LimeWire.ico
C:\Program Files\LimeWire\LimeWire20.dll
C:\Program Files\LimeWire\MessagesBundles.jar
C:\Program Files\LimeWire\mp3sp14.jar
C:\Program Files\LimeWire\pmf.ico
C:\Program Files\LimeWire\vorbis.jar
C:\Program Files\LimeWire\WindowsFirewall.dll
C:\Program Files\LimeWire\WindowsV5PlusUtils.dll
C:\Program Files\LimeWire\xerces.jar
C:\Program Files\LimeWire\xml-apis.jar
C:\WINDOWS\system32\aulvfwnc.dll
C:\WINDOWS\system32\eobffllv.dll
C:\WINDOWS\system32\fscgxwbw.dll
C:\WINDOWS\system32\iedgjxpy.dll
C:\WINDOWS\system32\mcqpcbnu.dll
C:\WINDOWS\system32\mnngekdg.dll
C:\WINDOWS\system32\MRT.INI
C:\WINDOWS\system32\okoqlfpv.dll
C:\WINDOWS\system32\ppmbtyma.exe
C:\WINDOWS\system32\qsldlagj.dll
C:\WINDOWS\system32\sqvlrobn.dll
G:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2008-07-28 to 2008-08-30 )))))))))))))))))))))))))))))))
.

2008-08-27 21:07 . 2008-08-27 21:14 1,374 --a------ C:\WINDOWS\imsins.BAK
2008-08-27 08:11 . 2008-08-27 08:11 <DIR> d-------- C:\Program Files\HyCam2
2008-08-20 20:56 . 2008-08-20 20:56 <DIR> d-------- C:\Program Files\Sun
2008-08-15 19:14 . 2008-08-18 23:02 842 --a------ C:\WINDOWS\cookies.ini
2008-08-15 18:02 . 2008-08-20 19:51 10,752 --a------ C:\WINDOWS\DCEBoot.exe
2008-08-14 16:26 . 2008-08-26 18:22 21 --a------ C:\WINDOWS\pskt.ini
2008-08-13 08:57 . 2008-08-29 15:30 <DIR> d-------- C:\Temp
2008-08-01 19:02 . 2008-08-01 19:02 <DIR> d-------- C:\Program Files\Lavasoft
2008-08-01 19:02 . 2008-08-01 19:08 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-08-01 19:00 . 2008-08-01 19:00 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-08-01 18:47 . 2008-08-01 18:47 <DIR> d-------- C:\Program Files\iTunes
2008-07-23 07:22 . 2008-08-24 12:49 143 --a------ C:\WINDOWS\system32\mcrh.tmp
2008-07-21 22:50 . 2008-08-01 18:47 <DIR> d-------- C:\Program Files\iTunes(2)
2008-07-21 22:28 . 2008-08-01 18:50 <DIR> d-------- C:\Program Files\Bonjour
2008-07-21 21:53 . 2008-08-01 18:48 <DIR> d-------- C:\Program Files\Safari
2008-07-21 19:55 . 2008-07-30 19:51 78,420 --a------ C:\WINDOWS\system32\spywarewarning2.mht

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-30 00:22 --------- d-----w C:\Program Files\Java
2008-08-29 06:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-08-29 05:15 --------- d-----w C:\Program Files\FrostWire
2008-08-21 12:26 --------- d-----w C:\Documents and Settings\Jackson & Arlo\Application Data\uTorrent
2008-08-13 13:00 --------- d-----w C:\Documents and Settings\Jackson & Arlo\Application Data\FrostWire
2008-08-13 07:59 --------- d-----w C:\Program Files\Incomplete
2008-08-02 01:25 --------- d-----w C:\Program Files\Trend Micro
2008-07-21 12:51 --------- d-----w C:\Program Files\iPod
2008-07-18 09:08 36,368 ----a-w C:\WINDOWS\system32\drivers\tmpreflt.sys
2008-07-18 09:08 205,328 ----a-w C:\WINDOWS\system32\drivers\tmxpflt.sys
2008-07-18 08:51 1,195,448 ----a-w C:\WINDOWS\system32\drivers\vsapint.sys
2008-07-07 20:32 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-23 16:57 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-05-22 22:20 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-05-22 22:20 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2008-05-16 01:58 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe
2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
2006-10-09 06:09 19,666,504 ------w C:\Program Files\QuickTimeInstaller.exe
2006-10-09 06:05 36,656,704 ------w C:\Program Files\iTunesSetup.exe
2007-03-09 09:12 27,648 --sha-w C:\WINDOWS\system32\AVSredirect.dll
.

((((((((((((((((((((((((((((( snapshot_2008-08-29_16.00.42.71 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-02-15 07:05:36 64,088 ------w C:\WINDOWS\assembly\GAC\Microsoft.Vbe.Interop\11.0.0.0__71e9bce111e9429c\Microsoft.Vbe.Interop.dll
+ 2008-08-29 06:14:14 66,936 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.Vbe.Interop\11.0.0.0__71e9bce111e9429c\Microsoft.Vbe.Interop.dll
- 2007-02-15 07:05:35 223,800 ------w C:\WINDOWS\assembly\GAC\office\11.0.0.0__71e9bce111e9429c\OFFICE.DLL
+ 2008-08-29 06:14:02 226,656 ----a-w C:\WINDOWS\assembly\GAC\office\11.0.0.0__71e9bce111e9429c\OFFICE.DLL
+ 2006-10-26 09:49:48 1,011,488 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002109010090400000000000F01FEC\12.0.4518\MSDAIPP.DLL
+ 2006-10-26 09:49:46 970,528 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002109010090400000000000F01FEC\12.0.4518\MSONSEXT.DLL
+ 2006-10-27 05:00:12 1,751,904 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002119910000000000000000F01FEC\12.0.4518\ACECORE.DLL
+ 2006-10-27 05:00:10 576,376 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002119910000000000000000F01FEC\12.0.4518\ACEDAO.DLL
+ 2006-10-27 05:00:06 47,976 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002119910000000000000000F01FEC\12.0.4518\ACEERR.DLL
+ 2006-10-27 05:00:08 191,360 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002119910000000000000000F01FEC\12.0.4518\ACEES.DLL
+ 2006-10-26 10:13:34 338,800 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002119910000000000000000F01FEC\12.0.4518\ACEEXCH.DLL
+ 2006-10-26 10:13:44 629,616 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002119910000000000000000F01FEC\12.0.4518\ACEEXCL.DLL
+ 2006-10-26 10:13:28 207,736 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002119910000000000000000F01FEC\12.0.4518\ACELTS.DLL
+ 2006-10-26 10:13:32 279,352 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002119910000000000000000F01FEC\12.0.4518\ACEODBC.DLL
+ 2006-10-26 10:13:08 15,160 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002119910000000000000000F01FEC\12.0.4518\ACEODDBS.DLL
+ 2006-10-26 10:13:08 15,160 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002119910000000000000000F01FEC\12.0.4518\ACEODEXL.DLL
+ 2006-10-26 10:13:08 15,160 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002119910000000000000000F01FEC\12.0.4518\ACEODPDX.DLL
+ 2006-10-26 10:13:12 15,160 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002119910000000000000000F01FEC\12.0.4518\ACEODTXT.DLL
+ 2006-10-27 05:00:06 387,960 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002119910000000000000000F01FEC\12.0.4518\ACEOLEDB.DLL
+ 2006-10-26 10:13:38 392,048 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002119910000000000000000F01FEC\12.0.4518\ACEPDE.DLL
+ 2006-10-26 10:13:30 260,976 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002119910000000000000000F01FEC\12.0.4518\ACER2X.DLL
+ 2006-10-26 10:13:32 289,648 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002119910000000000000000F01FEC\12.0.4518\ACER3X.DLL
+ 2006-10-26 10:13:20 56,120 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002119910000000000000000F01FEC\12.0.4518\ACERCLR.DLL
+ 2006-10-26 10:13:38 551,800 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002119910000000000000000F01FEC\12.0.4518\ACEREP.DLL
+ 2006-10-26 10:13:30 224,104 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002119910000000000000000F01FEC\12.0.4518\ACETXT.DLL
+ 2006-10-26 10:13:34 371,568 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002119910000000000000000F01FEC\12.0.4518\ACEXBE.DLL
+ 2006-10-27 05:41:04 399,640 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002119910000000000000000F01FEC\12.0.4518\CDLMSO.DLL
+ 2006-10-26 09:59:24 205,616 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002119910000000000000000F01FEC\12.0.4518\CLVIEW.EXE
+ 2006-10-26 09:48:14 439,568 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002119910000000000000000F01FEC\12.0.4518\DWDCW20.DLL
+ 2006-10-26 04:10:08 1,190,688 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002119910000000000000000F01FEC\12.0.4518\FM20.DLL
+ 2006-10-26 09:21:24 1,682,232 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002119910000000000000000F01FEC\12.0.4518\FPSRVUTL.DLL
+ 2006-10-27 05:09:36 983,376 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002119910000000000000000F01FEC\12.0.4518\FPWEC.DLL
+ 2006-10-26 10:12:52 173,328 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002119910000000000000000F01FEC\12.0.4518\IEAWSDC.DLL
+ 2006-10-26 09:55:10 828,704 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002119910000000000000000F01FEC\12.0.4518\MEDCAT.DLL
+ 2006-10-26 03:58:14 117,552 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002119910000000000000000F01FEC\12.0.4518\MSCONV97.DLL
+ 2006-10-27 04:59:06 161,080 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002119910000000000000000F01FEC\12.0.4518\MSOCF.DLL
+ 2006-10-26 09:48:12 14,664 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002119910000000000000000F01FEC\12.0.4518\MSOCFU.DLL
+ 2006-10-26 10:12:58 428,816 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002119910000000000000000F01FEC\12.0.4518\MSODCW.DLL
+ 2006-10-26 11:13:36 26,936 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002119910000000000000000F01FEC\12.0.4518\MSOEURO.DLL
+ 2006-10-26 10:00:08 6,635,320 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002119910000000000000000F01FEC\12.0.4518\MSORES.DLL
+ 2006-10-26 03:56:36 436,520 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002119910000000000000000F01FEC\12.0.4518\MSORUN.DLL
+ 2006-10-26 03:56:40 505,136 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002119910000000000000000F01FEC\12.0.4518\MSSOAP30.DLL
+ 2006-10-26 09:55:12 832,800 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002119910000000000000000F01FEC\12.0.4518\MSTORDB.EXE
+ 2006-10-26 09:55:06 538,904 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002119910000000000000000F01FEC\12.0.4518\MSTORES.DLL
+ 2006-10-26 10:12:30 65,824 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002119910000000000000000F01FEC\12.0.4518\NAME.DLL
+ 2006-10-27 05:14:34 14,151,456 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002119910000000000000000F01FEC\12.0.4518\OART.DLL
+ 2006-10-26 1054 232,816 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002119910000000000000000F01FEC\12.0.4518\ODEPLOY.EXE
+ 2006-10-26 10:14:06 7,033,152 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002119910000000000000000F01FEC\12.0.4518\OFFOWC.DLL
+ 2006-10-27 05:18:36 1,658,152 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002119910000000000000000F01FEC\12.0.4518\OGL.DLL
+ 2006-10-26 10:00:08 274,744 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002119910000000000000000F01FEC\12.0.4518\OIS.EXE
+ 2006-10-26 10:00:12 998,208 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002119910000000000000000F01FEC\12.0.4518\OISAPP.DLL
+ 2006-10-26 10:00:10 285,008 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002119910000000000000000F01FEC\12.0.4518\OISGRAPH.DLL
+ 2006-10-26 10:07:04 6,536,992 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002119910000000000000000F01FEC\12.0.4518\OSETUP.DLL
+ 2006-07-26 08:53:56 459,080 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002119910000000000000000F01FEC\12.0.4518\OUTLFLTR.DLL
+ 2006-10-26 11:30:44 482,088 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002119910000000000000000F01FEC\12.0.4518\PORTCONN.DLL
+ 2006-10-26 11:13:38 38,168 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002119910000000000000000F01FEC\12.0.4518\REFEDIT.DLL
+ 2006-10-26 10:13:00 503,624 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002119910000000000000000F01FEC\12.0.4518\SELFCERT.EXE
+ 2006-10-26 1058 439,600 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002119910000000000000000F01FEC\12.0.4518\SETUP.EXE
+ 2007-05-09 05:19:48 2,585,936 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002119910000000000000000F01FEC\12.0.6215\VBE6.DLL
+ 2003-07-14 11:57:34 38,968 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.5614\AUTHZAX.DLL
+ 2003-07-14 11:53:06 94,768 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.5614\AW.DLL
+ 2003-07-14 11:56:54 14,904 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.5614\DSITF.DLL
+ 2003-07-14 11:57:14 98,360 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.5614\DSSM.EXE
+ 2003-07-14 11:41:44 13,368 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.5614\FINDER.EXE
+ 2003-07-14 11:40:12 179,768 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.5614\FPERSON.DLL
+ 2003-06-18 06:31:10 252,928 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.5614\MDIINK.DLL
+ 2003-07-14 11:51:44 87,104 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.5614\MSENCODE.DLL
+ 2003-07-14 11:52:52 17,464 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.5614\MSMH.DLL
+ 2003-07-14 11:57:16 120,888 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.5614\MSOAUTH.DLL
+ 2003-07-14 11:52:52 27,704 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.5614\MSODCW.DLL
+ 2003-07-14 11:52:56 55,360 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.5614\MSOHTMED.EXE
+ 2003-07-14 11:52:54 28,224 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.5614\MSOSTYLE.DLL
+ 2003-07-14 11:53:20 39,488 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.5614\MSOSVFBR.DLL
+ 2003-07-14 11:46:16 42,040 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.5614\MSOXEV.DLL
+ 2003-07-14 11:45:12 55,360 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.5614\MSOXMLED.EXE
+ 2003-07-14 11:45:12 39,488 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.5614\MSOXMLMF.DLL
+ 2003-06-18 06:31:50 16,384 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.5614\MSPGIMME.DLL
+ 2003-06-19 05:05:50 364,648 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.5614\MSPVIEW.EXE
+ 2003-07-14 11:52:58 41,528 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.5614\MSSH.DLL
+ 2003-07-14 12:00:54 145,984 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.5614\MSWEBCAP.DLL
+ 2003-07-14 11:57:10 56,888 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.5614\NAME.DLL
+ 2003-07-14 11:56:52 13,888 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.5614\NPOFFICE.DLL
+ 2007-02-15 07:05:35 223,800 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.5614\OFFICE.DLL
+ 2003-07-14 16:14:26 242,240 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.5614\OISGRAPH.DLL
+ 2003-07-14 12:05:24 1,054,264 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.5614\OMFC.DLL
+ 2003-07-14 11:44:34 102,968 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.5614\OUTLCTL.DLL
+ 2003-07-14 11:43:16 49,208 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.5614\OUTLWAB.DLL
+ 2003-07-14 16:18:44 93,752 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.5614\PP7X32.DLL
+ 2003-05-08 10:54:00 77,824 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.5614\REFEDIT.DLL
+ 2003-07-14 11:57:08 40,512 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.5614\REFIEBAR.DLL
+ 2003-07-21 00:46:38 390,712 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.5614\RTFHTML.DLL
+ 2003-07-14 11:44:16 66,616 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.5614\SENDTO.DLL
+ 2003-07-14 11:57:08 58,944 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.5614\SEQCHK10.DLL
+ 2003-07-14 11:53:14 11,848 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.5614\SMARTTAGINSTALL.EXE
+ 2007-02-15 07:05:36 64,088 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.5614\VBIDEPIA.DLL
+ 2005-05-03 1428 465,640 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.8173\MSDMENG.DLL
+ 2005-05-03 1432 1,411,816 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.8173\MSDMINE.DLL
+ 2005-05-03 1426 199,408 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.8173\MSMDUN80.DLL
- 2008-05-21 09:23:16 217,864 ----a-r C:\WINDOWS\Installer\{90120000-006E-0409-0000-0000000FF1CE}\misc.exe
+ 2008-08-29 06:10:56 217,864 ----a-r C:\WINDOWS\Installer\{90120000-006E-0409-0000-0000000FF1CE}\misc.exe
- 2008-07-09 11:13:13 20,240 ----a-r C:\WINDOWS\Installer\{91120000-0019-0000-0000-0000000FF1CE}\cagicon.exe
+ 2008-08-29 0630 20,240 ----a-r C:\WINDOWS\Installer\{91120000-0019-0000-0000-0000000FF1CE}\cagicon.exe
- 2008-07-09 11:13:13 217,864 ----a-r C:\WINDOWS\Installer\{91120000-0019-0000-0000-0000000FF1CE}\misc.exe
+ 2008-08-29 0630 217,864 ----a-r C:\WINDOWS\Installer\{91120000-0019-0000-0000-0000000FF1CE}\misc.exe
- 2008-07-09 11:13:13 18,704 ----a-r C:\WINDOWS\Installer\{91120000-0019-0000-0000-0000000FF1CE}\mspicons.exe
+ 2008-08-29 0630 18,704 ----a-r C:\WINDOWS\Installer\{91120000-0019-0000-0000-0000000FF1CE}\mspicons.exe
- 2008-07-09 11:13:13 35,088 ----a-r C:\WINDOWS\Installer\{91120000-0019-0000-0000-0000000FF1CE}\oisicon.exe
+ 2008-08-29 0630 35,088 ----a-r C:\WINDOWS\Installer\{91120000-0019-0000-0000-0000000FF1CE}\oisicon.exe
- 2008-07-09 11:13:13 272,648 ----a-r C:\WINDOWS\Installer\{91120000-0019-0000-0000-0000000FF1CE}\pubs.exe
+ 2008-08-29 0629 272,648 ----a-r C:\WINDOWS\Installer\{91120000-0019-0000-0000-0000000FF1CE}\pubs.exe
- 2008-08-27 11:13:08 12,288 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
+ 2008-08-29 06:14:50 12,288 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
- 2008-08-27 11:13:08 135,168 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\misc.exe
+ 2008-08-29 06:14:50 135,168 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\misc.exe
- 2008-08-27 11:13:08 11,264 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
+ 2008-08-29 06:14:50 11,264 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
- 2008-08-27 11:13:08 27,136 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
+ 2008-08-29 06:14:50 27,136 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
- 2008-08-27 11:13:08 4,096 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
+ 2008-08-29 06:14:50 4,096 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
- 2008-08-27 11:13:09 794,624 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\outicon.exe
+ 2008-08-29 06:14:50 794,624 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\outicon.exe
- 2008-08-27 11:13:08 249,856 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\pptico.exe
+ 2008-08-29 06:14:50 249,856 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\pptico.exe
- 2008-08-27 11:13:09 23,040 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
+ 2008-08-29 06:14:50 23,040 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
- 2008-08-27 11:13:08 286,720 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
+ 2008-08-29 06:14:50 286,720 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
- 2008-08-27 11:13:08 409,600 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
+ 2008-08-29 06:14:49 409,600 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
- 2006-10-26 04:10:08 1,190,688 ----a-w C:\WINDOWS\system32\FM20.DLL
+ 2007-08-22 15:03:38 1,195,888 ----a-w C:\WINDOWS\system32\FM20.DLL
- 2004-03-22 05:17:06 24,816 ----a-w C:\WINDOWS\system32\mdimon.dll
+ 2007-04-09 03:23:54 28,040 ----a-w C:\WINDOWS\system32\mdimon.dll
- 2008-08-27 12:10:20 60,624 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-08-29 22:15:04 60,624 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2008-08-27 12:10:20 400,464 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-08-29 22:15:04 400,464 ----a-w C:\WINDOWS\system32\perfh009.dat
- 2004-03-22 05:17:04 765,680 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\mdigraph.dll
+ 2007-04-09 03:24:04 758,664 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\mdigraph.dll
- 2004-03-22 05:17:10 42,224 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\mdiui.dll
+ 2007-04-09 03:23:58 46,472 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\mdiui.dll
- 2004-03-22 05:17:04 765,680 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\mdigraph.dll
+ 2007-04-09 03:24:04 758,664 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\mdigraph.dll
- 2004-03-22 05:17:10 42,224 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\mdiui.dll
+ 2007-04-09 03:23:58 46,472 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\mdiui.dll
- 2004-03-22 05:17:08 25,840 ----a-w C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll
+ 2007-04-09 03:23:54 28,552 ----a-w C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-02-28 22:00 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-25 16:07 68856]
"OE"="C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe" [2007-09-17 23:30 488712]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UserFaultCheck"="C:\WINDOWS\system32\dumprep 0 -u" [X]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2004-02-10 11:55 155648]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2004-02-10 11:51 118784]
"UfSeAgnt.exe"="C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe" [2008-07-29 14:24 1398024]
"mxomssmenu"="C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe" [2007-09-06 14:53 169264]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-05-27 10:50 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-06-02 11:13 267048]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
BlueSoleil.lnk - C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe [2007-03-22 02:50:17 1183744]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.iac2"= G:\flv\iac25_32.ax

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"G:\\games\\Warcraft III\\Warcraft III.exe"=

R2 Maxtor Sync Service;Maxtor Service;C:\Program Files\Maxtor\Sync\SyncServices.exe [2007-09-28 12:24]
R2 NMSAccessU;NMSAccessU;C:\Program Files\CDBurnerXP\NMSAccessU.exe [2007-10-12 07:34]
R3 MusCDriverV32;MusCDriverV32;C:\WINDOWS\system32\drivers\MusCDriverV32.sys [2007-07-19 14:58]
S3 BrSerIf;Brother MFC Serial Port Interface WDM Driver;C:\WINDOWS\system32\Drivers\BrSerIf.sys [2004-09-29 03:24]
S3 BrUsbSer;Brother MFC USB Serial WDM Driver;C:\WINDOWS\system32\Drivers\BrUsbSer.sys [2004-01-10 04:28]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
\Shell\AutoRun\command - .\Encryption Tool\MaxtorEncryption.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{57554e3e-a872-11dc-9aa7-000d56a4bcf2}]
\Shell\AutoRun\command - E:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{be50fd01-b6cc-11d7-99ce-000bdbc78264}]
\Shell\AutoRun\command - PortableApps\PortableAppsMenu\PortableAppsMenu.exe
.
Contents of the 'Scheduled Tasks' folder

2008-08-18 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57]
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-30 12:21:50
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


**************************************************************************
.
Completion time: 2008-08-30 12:25:18
ComboFix-quarantined-files.txt 2008-08-30 02:24:15
ComboFix2.txt 2008-08-29 06:01:59
ComboFix3.txt 2008-08-26 08:49:11

Pre-Run: 4,818,792,448 bytes free
Post-Run: 4,816,457,728 bytes free

322 --- E O F --- 2008-08-29 06:16:35


hijack this log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:51:35 PM, on 8/30/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Maxtor\Sync\SyncServices.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.blackle.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.ninemsn.com.au/0SEENAU/SAOS01?FORM=TOOLBR
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [UfSeAgnt.exe] "C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe"
O4 - HKLM\..\Run: [mxomssmenu] "C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [OE] "C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe"
O4 - Global Startup: BlueSoleil.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O15 - Trusted Zone: http://flex.afgonline.com.au
O16 - DPF: {253A9D23-F982-11D4-8BE4-00D0B7E61414} (SiebelHTMLApplication Class) - http://flex.afgonline.com.au/back-of...siebelhtml.cab
O16 - DPF: {2E28242B-A689-11D4-80F2-0040266CBB8D} (KXHCM10 Control) - http://collegio-cam.pittstate.edu/kxhcm10.ocx
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/OnlineScanner.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1171523425390
O16 - DPF: {68CDB19A-6305-4589-8C35-41E3502CD451} (Siebel Option Pack for IE 7.5.3) - http://flex.afgonline.com.au/back-of...OptionPack.cab
O16 - DPF: {8F4F3368-54CA-4268-8225-0F4367472CF4} (MailClient Class) - http://flex.afgonline.com.au/back-of...MailClient.cab
O16 - DPF: {AF2E62B6-F9E1-4D4F-A10A-9DC8E6DCBCC0} (VideoEgg ActiveX Loader) - http://update.videoegg.com/Install/W...gPublisher.exe
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Maxtor Service (Maxtor Sync Service) - Seagate Technology LLC - C:\Program Files\Maxtor\Sync\SyncServices.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: Trend Micro Central Control Component (SfCtlCom) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
O23 - Service: Trend Micro Unauthorized Change Prevention Service (TMBMServer) - Trend Micro Inc. - C:\Program Files\Trend Micro\BM\TMBMSRV.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\TmProxy.exe

--


System state:
It is running fine, i havn't had any popups and it is going fast
arloporter is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 08-30-2008, 08:26 AM   #17 (permalink)
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
 
Join Date: Oct 2007
Location: Georgia
Posts: 10,633
OS: XP SP3


Re: Virus infected computer.
Good job! Almost done.

Open Notepad and copy/paste the entire contents of the codebox below into Notepad:

Code:
@echo off
if exist "%temp%\log.txt" del "%temp%\log.txt"

for %%g in (

"C:\Documents and Settings\Jackson & Arlo\Desktop\[4]-Submit_2008-08-29@15.28.zip"
"C:\WINDOWS\system32\spywarewarning2.mht"

) do (
del /a/f %%g >nul 2>&1
if exist %%g echo.%%g>>"%temp%\log.txt"
)


if exist "%temp%\log.txt" ( start notepad "%temp%\log.txt"
) else echo.Deleted Successfully !!

pause
del %0
Save this Notepad file as fix.bat and choose to Save as type: - All Files then close the Notepad file.
It should look like this:

Double-click on fix.bat to run it.

Post back to tell me what it says, then press any key to continue.
__________________
Our help is free but please donate

Proud member of ASAP
Proud member of UNITE
chemist is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 08-30-2008, 06:03 PM   #18 (permalink)
Registered User
 
Join Date: Aug 2008
Posts: 12
OS: xp


Re: Virus infected computer.
deleted successfully!
arloporter is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 08-30-2008, 06:12 PM   #19 (permalink)
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
 
Join Date: Oct 2007
Location: Georgia
Posts: 10,633
OS: XP SP3


Re: Virus infected computer.
Congratulations. Well done! Your logs appear clean. You should be good to go.

As far as those infected objects listed in the ESET log, those are safely tucked away in ComboFix's quarantine folder or in old System Restore points, which we will be taking care of now.

Go to Start >> Run and Copy/Paste the following single-line command into the Run box and click OK
combofix /u
This will uninstall ComboFix and delete ComboFix's quarantine folder. It will also implement some cleanup procedures, remove old System Restore points which contain previous infections, and create a fresh, clean System Restore point.

Please re-enable your antivirus program and any other antispyware programs disabled earlier if you haven't already.

You can safely delete any tools downloaded or any logs, files, and any shortcuts on your desktop that were created during this fix.

------------------------------------------------------

MICROSOFT UPDATES
It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft and download all the critical updates to help prevent possible re-infection.

SPYWARE PREVENTION
This is a good time to set up protection against further attacks. In light of your recent problem, I'm sure you'd like to avoid any future infections. Please read these well written articles: To help protect your computer in the future I recommend that you get the following free programs if you do not already have them:
  • SpywareBlaster prevents the installation of ActiveX-based malware, blocks cookies, and restricts the actions of "bad" sites in Internet Explorer. See tutorial here
  • SpywareGuard catches and blocks spyware installation and browser hijacking in real-time. See tutorial here
  • IE-Spyad is another excellent program that places over 5000 dubious websites and domains in the IE Restricted list, which will help prevent attempts to infect your system. It basically prevents any downloads from the sites listed, although you will still be able to connect to the site. See tutorial here
  • MVPS HOSTS FILE replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. It basically prevents your computer from connecting to those sites by redirecting them to 127.0.0.1, which is the IP of your local computer. See guide here and for Windows Vista here
  • Spybot - Search & Destroy is an excellent spyware remover and also offers real-time protection against critical registry changes. Don't use the Immunize feature if you use SpywareBlaster. See tutorial here
Keep your antivirus program and antispyware programs updated and scan with them on a regular basis.

Please respond to this thread one more time so we can mark this thread as resolved.
__________________
Our help is free but please donate

Proud member of ASAP
Proud member of UNITE
chemist is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 09-01-2008, 02:57 PM   #20 (permalink)
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
 
Join Date: Oct 2007
Location: Georgia
Posts: 10,633
OS: XP SP3


Re: Virus infected computer.
Still with us, arloporter? Any trouble with those last instructions?
__________________
Our help is free but please donate

Proud member of ASAP
Proud member of UNITE
chemist is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
 

« Previous Thread | Next Thread »

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off



All times are GMT -7. The time now is 01:00 PM.

Contact Us - Tech Support Forum - Archive - Privacy Statement - Top


Copyright 2001 - 2009, Tech Support Forum
Home Tips Plus | Outdoor Basecamp | Automotive Support Forum

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85