Blocked Web Access - Virtumonde

Keira_Wells · 08-21-2008, 11:04 AM

A while back, I started losing ability to access some web pages. It seemed to be those with more complex coding (For instance, I couldn't access GMail without using the basic HTML version). So I checked my processes, saw 2 Rundll's (With seemingly random names) and stopped them, and it fixed the problem. I found when I rebooted, they returned, and I ran Spyware S&D, which showed them and many others as Virtumonde, but crashed my computer (Blue screen, insufficient memory) when I attempted to fix them via the program. So, I took it upon myself and removed everything it labeled as Virtumonde, and it fixed the problem for a couple days, only to come back after a short while. I can't seem to get rid of it.

On top of this, if I use Internet Explorer (I normally use Firefox), then I have occasional ad popups, and so on.

So, here I am. I'm unable to get Windows XP SP3, as Automatic Updates seems to not want to start, regardless of if I attempt it with Services.msc or the control panel Automatic Updates area, or the Windows Security Center. Other than that, I've done all steps as posted.

Attached is my ActiveScan Log.

Below is my HiJackThis.Log contents
===================================

Code:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:53:56 AM, on 8/21/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Micro Innovations\Wireless Keyboard & Mouse Driver\KMWDSrv.exe
C:\Program Files\MioNet\MioNetManager.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\MioNet\jvm\bin\MioNet.exe
C:\WINDOWS\system32\Tablet.exe
C:\WINDOWS\system32\WTablet\TabUserW.exe
C:\WINDOWS\system32\Tablet.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://forums.secondlife.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R3 - URLSearchHook: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
O3 - Toolbar: Earn2Life Bar - {93344865-74BD-4873-BE65-56539D41A65C} - C:\WINDOWS\Downloaded Program Files\Earn2Life.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [BM6b90ceb9] Rundll32.exe "C:\WINDOWS\system32\nejmeiaq.dll",s
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O9 - Extra button: Earn2Life Bar - {07328B93-AFD8-4c6a-99E9-D0B3B5D6DAD9} - C:\WINDOWS\Downloaded Program Files\Earn2Life.dll
O9 - Extra 'Tools' menuitem: Earn2Life Bar - {07328B93-AFD8-4c6a-99E9-D0B3B5D6DAD9} - C:\WINDOWS\Downloaded Program Files\Earn2Life.dll
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1219336830093
O16 - DPF: {93344865-74BD-4873-BE65-56539D41A65C} (Earn2Life Bar) - http://www.earn2life.com/plugin/Earn2Life.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/...ampx_en_dl.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe Active File Monitor (AdobeActiveFileMonitor) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Keyboard And Mouse Communication Service (KMWDSERVICE) - UASSOFT.COM - C:\Program Files\Micro Innovations\Wireless Keyboard & Mouse Driver\KMWDSrv.exe
O23 - Service: MioNet Service (MioNet) - Unknown owner - C:\Program Files\MioNet\MioNetManager.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Photoshop Elements Device Connect (PhotoshopElementsDeviceConnect) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe

--
End of file - 7336 bytes

alba · 08-23-2008, 10:36 AM

Hi Keira_Wells

Please cut and paste your future logs straight into your reply Do Not wrap them in code or quotes thanks

Please read this post completely before begining the fix. If there's anything that you do not understand, kindly ask your questions before proceeding. Please ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.

We also suggest that you Subscribe to this thread to be notified of fixes as soon as they are posted by our Team. You can do this simply by clicking the "Thread Tools" button located in the original thread line and selecting "Subscribe to this Thread".

IT IS IMPORTANT THAT YOU DON'T MISS A STEP & PERFORM EVERYTHING IN THE RIGHT ORDER.

===============================================

We will begin with ComboFix.exe. Please visit this webpage for download links, and instructions for running the tool:

http://www.bleepingcomputer.com/comb...o-use-combofix

Please ensure you read this guide carefully and install the Recovery Console first.

The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once installed, you should see a blue screen prompt that says:

The Recovery Console was successfully installed.

Please continue as follows:

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Click Yes to allow ComboFix to continue scanning for malware.

When the tool is finished, it will produce a report for you.

Please include the following reports for further review, and so we may continue cleansing the system:

C:\ComboFix.txt
New HijackThis log.

Keira_Wells · 08-23-2008, 12:12 PM

The first run of Combofix, it ran, and it got to the 'Preparing Log File' bit, and went to the bathroom, and when I came back it was at the Windows Login screen, and when I logged in, Combofix didn't do anything, and when I looked for the log file, it didn't exist. So, I ran it again, and it created a log file this time. I'm hoping that it shows needed information.

ComboFix Log File
===============================

ComboFix 08-08-21.02 - Okiphia Fatali 2008-08-23 10:50:57.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.2634 [GMT -7:00]
Running from: C:\Documents and Settings\Okiphia Fatali\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
C:\Documents and Settings\Okiphia Fatali\Application Data\macromedia\Flash Player\#SharedObjects\CYAMCAYP\interclick.com
C:\Documents and Settings\Okiphia Fatali\Application Data\macromedia\Flash Player\#SharedObjects\CYAMCAYP\interclick.com\ud.sol
C:\Documents and Settings\Okiphia Fatali\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com
C:\Documents and Settings\Okiphia Fatali\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol
C:\install.exe
C:\WINDOWS\BM6b90ceb9.txt
C:\WINDOWS\BM6b90ceb9.xml
C:\WINDOWS\cookies.ini
C:\WINDOWS\Downloaded Program Files\setup.inf
C:\WINDOWS\OPTIONS\CABS\_desktop.ini
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\aapaqmfm.ini
C:\WINDOWS\system32\abxpjpxo.dll
C:\WINDOWS\system32\accxik.dll
C:\WINDOWS\system32\adqalvpl.ini
C:\WINDOWS\system32\aefsnr.dll
C:\WINDOWS\system32\agyhvhei.ini
C:\WINDOWS\system32\anqtojjm.ini
C:\WINDOWS\system32\aphptrjk.dll
C:\WINDOWS\system32\auqltvpf.exe
C:\WINDOWS\system32\avbxpr.dll
C:\WINDOWS\system32\avossg.dll
C:\WINDOWS\system32\avstjbwr.dll
C:\WINDOWS\system32\ayshnjfh.dll
C:\WINDOWS\system32\bassqjmi.ini
C:\WINDOWS\system32\bccpjnmg.ini
C:\WINDOWS\system32\bftstbld.ini
C:\WINDOWS\system32\bjutdokb.ini
C:\WINDOWS\system32\bpuomkud.ini
C:\WINDOWS\system32\bqehuvoe.ini
C:\WINDOWS\system32\bqujeifi.dll
C:\WINDOWS\system32\buepcyaf.ini
C:\WINDOWS\system32\buthhvux.ini
C:\WINDOWS\system32\carebkhk.ini
C:\WINDOWS\system32\cfdakhbg.ini
C:\WINDOWS\system32\ckbhabak.dll
C:\WINDOWS\system32\clhvaavk.dll
C:\WINDOWS\system32\cpscgmkx.dll
C:\WINDOWS\system32\cqwifeaf.ini
C:\WINDOWS\system32\ctrtlyfj.ini
C:\WINDOWS\system32\cukxwxkv.ini
C:\WINDOWS\system32\cuydchsb.ini
C:\WINDOWS\system32\cwcrcpyl.ini
C:\WINDOWS\system32\cwqhjjpc.ini
C:\WINDOWS\system32\cxucastr.ini
C:\WINDOWS\system32\czjpcc.dll
C:\WINDOWS\system32\dfgpsktg.ini
C:\WINDOWS\system32\diucmcsc.dll
C:\WINDOWS\system32\dkdfyt.dll
C:\WINDOWS\system32\dqidfnjr.ini
C:\WINDOWS\system32\dsgmhaeu.ini
C:\WINDOWS\system32\dxdjocyp.ini
C:\WINDOWS\system32\edghgvim.dll
C:\WINDOWS\system32\eixrbblg.dll
C:\WINDOWS\system32\ejkqfedl.dll
C:\WINDOWS\system32\enwaqtkg.dll
C:\WINDOWS\system32\enyxnmfv.dll
C:\WINDOWS\system32\epaictlh.ini
C:\WINDOWS\system32\epvvdelf.dll
C:\WINDOWS\system32\erpumqpq.dll
C:\WINDOWS\system32\eslgudoh.ini
C:\WINDOWS\system32\ettuvbwe.dll
C:\WINDOWS\system32\euaciggv.dll
C:\WINDOWS\system32\eyirrmop.ini
C:\WINDOWS\system32\feruukdm.ini
C:\WINDOWS\system32\ffraudss.ini
C:\WINDOWS\system32\fgfpxcdc.dll
C:\WINDOWS\system32\fjboelug.dll
C:\WINDOWS\system32\fjevkw.dll
C:\WINDOWS\system32\fkhmvd.dll
C:\WINDOWS\system32\fpefbrln.dll
C:\WINDOWS\system32\fpucbf.dll
C:\WINDOWS\system32\funpnwvp.ini
C:\WINDOWS\system32\fxtady.dll
C:\WINDOWS\system32\gakcmpgf.ini
C:\WINDOWS\system32\gdvnoetn.dll
C:\WINDOWS\system32\geenaggm.dll
C:\WINDOWS\system32\ghojhlob.dll
C:\WINDOWS\system32\glbbrxie.ini
C:\WINDOWS\system32\gljnvsqd.ini
C:\WINDOWS\system32\gmfntucc.ini
C:\WINDOWS\system32\gnkwlv.dll
C:\WINDOWS\system32\gsipoxfu.dll
C:\WINDOWS\system32\gxsuublf.dll
C:\WINDOWS\system32\habersxh.dll
C:\WINDOWS\system32\hdsovmoo.dll
C:\WINDOWS\system32\heddyebl.ini
C:\WINDOWS\system32\hfbxcuwh.ini
C:\WINDOWS\system32\hfhvocrw.dll
C:\WINDOWS\system32\hjbbtp.dll
C:\WINDOWS\system32\hkhmacpr.dll
C:\WINDOWS\system32\hmvprotp.dll
C:\WINDOWS\system32\hoicmoxh.dll
C:\WINDOWS\system32\htmtwmoy.dll
C:\WINDOWS\system32\hxsrebah.ini
C:\WINDOWS\system32\ianpnqfi.dll
C:\WINDOWS\system32\ibjtyf.dll
C:\WINDOWS\system32\ibmkgwnd.ini
C:\WINDOWS\system32\idcxmwsp.dll
C:\WINDOWS\system32\idrvglks.dll
C:\WINDOWS\system32\idxkfq.dll
C:\WINDOWS\system32\ietpjwoc.ini
C:\WINDOWS\system32\iihwsuba.ini
C:\WINDOWS\system32\iqaglfsv.ini
C:\WINDOWS\system32\iqbhrtgj.ini
C:\WINDOWS\system32\iqglqjgf.dll
C:\WINDOWS\system32\irdxfobq.dll
C:\WINDOWS\system32\ithglutx.ini
C:\WINDOWS\system32\izzopq.dll
C:\WINDOWS\system32\jkbieptn.dll
C:\WINDOWS\system32\jpenqsoo.ini
C:\WINDOWS\system32\jphxwmvk.dll
C:\WINDOWS\system32\jqoyrsek.ini
C:\WINDOWS\system32\jqwwvqpe.dll
C:\WINDOWS\system32\jtltrq.dll
C:\WINDOWS\system32\jwksarhu.dll
C:\WINDOWS\system32\jyhrmp.dll
C:\WINDOWS\system32\jyvgle.dll
C:\WINDOWS\system32\kckudexa.dll
C:\WINDOWS\system32\kdkyhpdc.dll
C:\WINDOWS\system32\kjabkspn.dll
C:\WINDOWS\system32\kjsvjy.dll
C:\WINDOWS\system32\lkomjfqo.dll
C:\WINDOWS\system32\llofgwrw.dll
C:\WINDOWS\system32\lmrvremy.dll
C:\WINDOWS\system32\LmVvCJjl.ini
C:\WINDOWS\system32\LmVvCJjl.ini2
C:\WINDOWS\system32\lnklwecn.ini
C:\WINDOWS\system32\lnusfyob.dll
C:\WINDOWS\system32\loklufma.dll
C:\WINDOWS\system32\lrwairwg.dll
C:\WINDOWS\system32\lxaenx.dll
C:\WINDOWS\system32\mafdtkbp.ini
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mdibhsjp.dll
C:\WINDOWS\system32\mhztdj.dll
C:\WINDOWS\system32\mkeftb.dll
C:\WINDOWS\system32\mktmaqle.dll
C:\WINDOWS\system32\mlulrfio.dll
C:\WINDOWS\system32\mlxtxynw.dll
C:\WINDOWS\system32\mmavvqyy.dll
C:\WINDOWS\system32\mppcqcog.dll
C:\WINDOWS\system32\mqqbteja.ini
C:\WINDOWS\system32\muupqomq.dll
C:\WINDOWS\system32\ngbdcfte.dll
C:\WINDOWS\system32\ngcwaytb.ini
C:\WINDOWS\system32\ngrnicrx.dll
C:\WINDOWS\system32\nhqxswtw.dll
C:\WINDOWS\system32\nhroxocj.ini
C:\WINDOWS\system32\nntgscao.dll
C:\WINDOWS\system32\npmllh.dll
C:\WINDOWS\system32\nqcjsxwb.dll
C:\WINDOWS\system32\nuwqynex.ini
C:\WINDOWS\system32\ofqyicte.dll
C:\WINDOWS\system32\ogmbxgvw.ini
C:\WINDOWS\system32\ohfogdkw.dll
C:\WINDOWS\system32\omdbwrri.ini
C:\WINDOWS\system32\onktfipd.ini
C:\WINDOWS\system32\oovrrxww.ini
C:\WINDOWS\system32\otghwkpr.ini
C:\WINDOWS\system32\ouvmpigv.dll
C:\WINDOWS\system32\ouwscpaq.dll
C:\WINDOWS\system32\oyrrlg.dll
C:\WINDOWS\system32\pbepaenu.ini
C:\WINDOWS\system32\pcrklcxo.dll
C:\WINDOWS\system32\pfkqihes.dll
C:\WINDOWS\system32\pgtqokrl.dll
C:\WINDOWS\system32\pmnmnLBQ.dll
C:\WINDOWS\system32\poycaq.dll
C:\WINDOWS\system32\prkgvdsi.ini
C:\WINDOWS\system32\ptahddvd.ini
C:\WINDOWS\system32\pthreadVC.dll
C:\WINDOWS\system32\pudameau.ini
C:\WINDOWS\system32\pvabnkfw.dll
C:\WINDOWS\system32\pxgmpqbp.dll
C:\WINDOWS\system32\QBLnmnmp.ini
C:\WINDOWS\system32\QBLnmnmp.ini2
C:\WINDOWS\system32\qhbxtwoo.dll
C:\WINDOWS\system32\qmnikhbw.dll
C:\WINDOWS\system32\qnygphkq.ini
C:\WINDOWS\system32\qougxlvr.ini
C:\WINDOWS\system32\qqloib.dll
C:\WINDOWS\system32\qrwxtl.dll
C:\WINDOWS\system32\qufmnewh.ini
C:\WINDOWS\system32\qvwipncu.ini
C:\WINDOWS\system32\qwfvse.dll
C:\WINDOWS\system32\racwfwhy.dll
C:\WINDOWS\system32\raezsv.dll
C:\WINDOWS\system32\rcytcn.dll
C:\WINDOWS\system32\rdojdfso.dll
C:\WINDOWS\system32\riwinals.dll
C:\WINDOWS\system32\rmdejrvo.dll
C:\WINDOWS\system32\rngeqxbl.ini
C:\WINDOWS\system32\rpvnfwnm.ini
C:\WINDOWS\system32\rqkuuisx.dll
C:\WINDOWS\system32\rvnvrfrf.dll
C:\WINDOWS\system32\rwwbhuft.ini
C:\WINDOWS\system32\sievdr.dll
C:\WINDOWS\system32\sjocpvdr.ini
C:\WINDOWS\system32\sqhltqlr.ini
C:\WINDOWS\system32\sxihhsuu.ini
C:\WINDOWS\system32\tcnksqjl.dll
C:\WINDOWS\system32\thnrylev.dll
C:\WINDOWS\system32\tmknwuwd.dll
C:\WINDOWS\system32\tvyytmge.ini
C:\WINDOWS\system32\twdiwkbr.ini
C:\WINDOWS\system32\twfuxe.dll
C:\WINDOWS\system32\uaoykwxu.dll
C:\WINDOWS\system32\ubdpadpq.dll
C:\WINDOWS\system32\ubdrscvj.ini
C:\WINDOWS\system32\ubiytkrv.ini
C:\WINDOWS\system32\uetydsns.dll
C:\WINDOWS\system32\ugalgz.dll
C:\WINDOWS\system32\uouawqcc.ini
C:\WINDOWS\system32\uqlkokkx.dll
C:\WINDOWS\system32\uuqcpijf.ini
C:\WINDOWS\system32\uuyvby.dll
C:\WINDOWS\system32\uwnscqnw.ini
C:\WINDOWS\system32\vdfvxpwl.dll
C:\WINDOWS\system32\vgadlaiq.dll
C:\WINDOWS\system32\vucbco.dll
C:\WINDOWS\system32\vurrrj.dll
C:\WINDOWS\system32\vwgwkbgf.dll
C:\WINDOWS\system32\vwjbveel.dll
C:\WINDOWS\system32\vxxmdypw.dll
C:\WINDOWS\system32\wcstoneq.ini
C:\WINDOWS\system32\weyeywwg.dll
C:\WINDOWS\system32\wnfjbuua.ini
C:\WINDOWS\system32\wnukqfdi.dll
C:\WINDOWS\system32\wqdngqhg.dll
C:\WINDOWS\system32\wrdwsisw.dll
C:\WINDOWS\system32\wrpsssff.ini
C:\WINDOWS\system32\wthfldew.ini
C:\WINDOWS\system32\wubtwz.dll
C:\WINDOWS\system32\wuvduy.dll
C:\WINDOWS\system32\wvUlihff.dll
C:\WINDOWS\system32\wwxrrvoo.dll
C:\WINDOWS\system32\wyisjqij.ini
C:\WINDOWS\system32\xefmkgyg.dll
C:\WINDOWS\system32\xenyqwun.dll
C:\WINDOWS\system32\xgeanxfh.dll
C:\WINDOWS\system32\xgfake.dll
C:\WINDOWS\system32\xieppsty.dll
C:\WINDOWS\system32\xmwmdekv.dll
C:\WINDOWS\system32\xneerrfb.ini
C:\WINDOWS\system32\xrqmahts.dll
C:\WINDOWS\system32\xugpgg.dll
C:\WINDOWS\system32\xutiamsd.ini
C:\WINDOWS\system32\xvdoooir.dll
C:\WINDOWS\system32\ydbzgh.dll
C:\WINDOWS\system32\ydccfffe.dll
C:\WINDOWS\system32\ydoyssjf.dll
C:\WINDOWS\system32\yfeclpbw.ini
C:\WINDOWS\system32\yfggvwlf.ini
C:\WINDOWS\system32\ymfiavfe.dll
C:\WINDOWS\system32\yskplhdp.ini
C:\WINDOWS\system32\yujzft.dll
C:\WINDOWS\system32\yuxvnydk.dll
C:\WINDOWS\system32\yvxadntw.exe
C:\WINDOWS\system32\yybmriia.dll
C:\WINDOWS\system32\zcrgja.dll
C:\WINDOWS\system32\zojype.dll
C:\WINDOWS\system32\zzwpvb.dll

.
((((((((((((((((((((((((( Files Created from 2008-07-23 to 2008-08-23 )))))))))))))))))))))))))))))))
.

2008-08-23 08:12 . 2008-08-23 08:27 <DIR> d-------- C:\Documents and Settings\Okiphia Fatali\Application Data\flightgear.org
2008-08-23 08:11 . 2008-08-23 08:12 <DIR> d-------- C:\Program Files\FlightGear
2008-08-22 16:02 . 2008-08-22 16:03 <DIR> d-------- C:\Program Files\Phun
2008-08-22 15:36 . 2008-08-22 15:36 <DIR> d-------- C:\Program Files\Porrasturvat - Stair Dismount
2008-08-21 12:11 . 2008-05-19 18:16 186,407 --a------ C:\WINDOWS\system32\nvapps.nvb
2008-08-21 09:43 . 2008-08-21 09:43 <DIR> d-------- C:\Program Files\Trend Micro
2008-08-21 09:30 . 2008-08-21 09:30 <DIR> d-------- C:\ie-spyad_zo
2008-08-21 09:26 . 2008-08-21 09:26 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-08-21 09:26 . 2005-04-15 20:58 1,071,088 --a------ C:\WINDOWS\system32\MSCOMCTL.OCX
2008-08-21 09:26 . 2005-08-25 19:18 118,784 --a------ C:\WINDOWS\system32\MSSTDFMT.DLL
2008-08-21 07:24 . 2008-06-19 17:24 28,544 --a------ C:\WINDOWS\system32\drivers\pavboot.sys
2008-08-21 07:20 . 2008-08-21 07:20 <DIR> d-------- C:\Program Files\Panda Security
2008-08-19 14:42 . 2008-08-19 14:42 <DIR> d-------- C:\WINDOWS\nvidia icons
2008-08-19 14:40 . 2008-05-16 11:48 446,464 --a------ C:\WINDOWS\system32\NVUNINST.EXE

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-23 17:48 --------- d-----w C:\Documents and Settings\Okiphia Fatali\Application Data\WTablet
2008-08-23 17:40 --------- d-----w C:\Documents and Settings\LocalService\Application Data\WTablet
2008-07-28 05:47 --------- d-----w C:\Documents and Settings\Okiphia Fatali\Application Data\SPORE Creature Creator
2008-07-23 08:09 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-07-23 08:09 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-07-18 23:38 --------- d-----w C:\Documents and Settings\Okiphia Fatali\Application Data\AVG7
2008-07-17 22:48 --------- d-----w C:\Program Files\GameSpy
2008-07-17 22:47 22,328 ----a-w C:\Documents and Settings\Okiphia Fatali\Application Data\PnkBstrK.sys
2008-07-17 22:46 669,184 ----a-w C:\WINDOWS\system32\pbsvc.exe
2008-07-17 22:36 --------- d-----w C:\Program Files\Electronic Arts
2008-07-17 19:35 --------- d-----w C:\Program Files\SecondLifeMono
2008-07-16 20:14 --------- d-----w C:\Program Files\SecondLifeReleaseCandidate
2008-07-13 21:10 --------- d-----w C:\Program Files\ArchipelisDesigner
2008-07-03 03:22 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-29 01:13 --------- d--h--r C:\Documents and Settings\Okiphia Fatali\Application Data\SecuROM
2008-06-28 19:09 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-06-28 07:02 --------- d-----w C:\Program Files\JFK Reloaded
2008-06-11 23:55 41,296 ----a-w C:\WINDOWS\system32\xfcodec.dll
2008-06-11 03:38 147,456 ----a-w C:\WINDOWS\system32\imjqssab.dll
2008-05-31 01:09 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2008-03-04 02:27 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{93344865-74BD-4873-BE65-56539D41A65C}"= "C:\WINDOWS\Downloaded Program Files\Earn2Life.dll" [2007-05-14 18:18 303104]

[HKEY_CLASSES_ROOT\clsid\{93344865-74bd-4873-be65-56539d41a65c}]
[HKEY_CLASSES_ROOT\Earn2Life.LeadBar.1]
[HKEY_CLASSES_ROOT\TypeLib\{92F9C4A2-C2A5-41f6-9829-49B8C6FF0709}]
[HKEY_CLASSES_ROOT\Earn2Life.LeadBar]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-02-28 05:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24 286720]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-16 14:01 13529088]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-16 14:01 86016]
"nwiz"="nwiz.exe" [2008-05-16 14:01 1630208 C:\WINDOWS\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-10-22 08:30 219136]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"SENTINEL"= snti386.dll
"VIDC.XFR1"= xfcodec.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^TrayMin200.exe.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\TrayMin200.exe.lnk
backup=C:\WINDOWS\pss\TrayMin200.exe.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Okiphia Fatali^Start Menu^Programs^Startup^Xfire.lnk]
path=C:\Documents and Settings\Okiphia Fatali\Start Menu\Programs\Startup\Xfire.lnk
backup=C:\WINDOWS\pss\Xfire.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
C:\WINDOWS\system32\dumprep 0 -k [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\36X Raid Configurer]
-ra------ 2007-02-06 05:08 1953792 C:\WINDOWS\system32\JMRaidSetup.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC]
--a------ 2008-04-21 09:32 579584 C:\PROGRA~1\Grisoft\AVG7\avgcc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2006-02-28 05:00 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EA Core]
--a------ 2008-05-16 18:16 2732032 C:\Program Files\Electronic Arts\EADM\Core.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EasyTuneV]
--a------ 2007-04-26 15:50 24576 C:\Program Files\Gigabyte\ET5\ETcall.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ]
--a------ 2007-12-19 07:48 172280 C:\Program Files\ICQ6\ICQ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2007-09-26 14:42 267064 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\JMB36X IDE Setup]
-r------- 2006-10-30 05:44 36864 C:\WINDOWS\JM\JMInsIDE.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KMCONFIG]
--a------ 2007-03-06 14:51 212992 C:\Program Files\Micro Innovations\Wireless Keyboard & Mouse Driver\StartAutorun.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2004-10-13 09:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-01-19 12:54 5674352 C:\Program Files\MSN Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 2008-05-16 14:01 13529088 C:\WINDOWS\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
--a------ 2008-05-16 14:01 86016 C:\WINDOWS\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-ra------ 2008-02-01 18:22 21898024 C:\Program Files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
-rahs---- 2008-01-28 11:43 2097488 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
--a------ 2008-06-16 15:21 1271032 c:\Program Files\Steam\steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
--a------ 2007-08-15 12:23 68856 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2007-05-14 15:22 35328 C:\Program Files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
--a------ 2007-07-16 15:17 4670704 C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
-r------- 2005-05-03 03:43 69632 C:\WINDOWS\Alcmtr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2008-05-16 14:01 1630208 C:\WINDOWS\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
-r------- 2007-04-12 02:33 16132608 C:\WINDOWS\RTHDCPL.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Sony\\EverQuest II\\LaunchPad.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\mIRC\\mirc.exe"=
"C:\\Program Files\\Xfire\\xfire.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\ICQ6\\ICQ.exe"=
"C:\\Program Files\\America's Army\\System\\ArmyOps.exe"=
"C:\\Program Files\\SecondLife\\SLVoice.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\SecondLifeWindLight\\SLVoice.exe"=
"C:\\Program Files\\SecondLife\\SecondLife.exe"=
"C:\\Program Files\\Autodesk\\Maya 8.5 Personal Learning Edition\\bin\\maya.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\Program Files\\SecondLifeReleaseCandidate\\SLVoice.exe"=
"C:\\Program Files\\Turbine\\The Lord of the Rings Online\\lotroclient.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Ahead\\SIPPS\\SIPPS.exe"=
"C:\\Program Files\\Steam\\steamapps\\okiphiarayna\\team fortress 2\\hl2.exe"=
"C:\\Program Files\\Electronic Arts\\EADM\\Core.exe"=
"C:\\Program Files\\SecondLifeMono\\SLVoice.exe"=
"C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
"C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"C:\\Program Files\\Sony\\EverQuest II\\EverQuest2.exe"=
"C:\\Program Files\\FlightGear\\bin\\win32\\fgfs.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1700:TCP"= 1700:TCP:MioNet Remote Drive Access
"1641:TCP"= 1641:TCP:MioNet Remote Drive Verification

R0 pavboot;pavboot;C:\WINDOWS\system32\drivers\pavboot.sys [2008-06-19 17:24]
R2 AdobeActiveFileMonitor;Adobe Active File Monitor;C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe [2004-10-04 04:47]
R2 KMWDSERVICE;Keyboard And Mouse Communication Service;C:\Program Files\Micro Innovations\Wireless Keyboard & Mouse Driver\KMWDSrv.exe [2007-04-05 10:29]
R2 MioNet;MioNet Service;C:\Program Files\MioNet\MioNetManager.exe [2005-07-15 13:38]
R2 PhotoshopElementsDeviceConnect;Photoshop Elements Device Connect;C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe [2004-10-04 03:40]
R3 SCREAMINGBDRIVER;Screaming Bee Audio;C:\WINDOWS\system32\drivers\ScreamingBAudio.sys [2007-08-24 17:44]
R3 wacommousefilter;Wacom Mouse Filter Driver;C:\WINDOWS\system32\DRIVERS\wacommousefilter.sys [2007-02-16 12:12]
R3 wacomvhid;Wacom Virtual Hid Driver;C:\WINDOWS\system32\DRIVERS\wacomvhid.sys [2007-02-16 11:30]
S3 MarkFun_NT;MarkFun_NT;C:\Program Files\Gigabyte\ET5\markfun.w32 [2007-01-12 18:34]
.
- - - - ORPHANS REMOVED - - - -

BHO-{2F12212C-86CC-48BE-9A0D-AEDD97A5FD45} - C:\Documents and Settings\Okiphia Fatali\Local Settings\Temporary Internet Files\Content.IE5\EHVAN82O\3077htsbdjyf[1].dll
HKLM-Run-68a3fd25 - C:\WINDOWS\system32\habersxh.dll
HKLM-Run-BM6b90ceb9 - C:\WINDOWS\system32\yybmriia.dll
MSConfigStartUp-68a3fd25 - C:\WINDOWS\system32\xtulghti.dll
MSConfigStartUp-BM6b90ceb9 - C:\WINDOWS\system32\nejmeiaq.dll

.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Okiphia Fatali\Application Data\Mozilla\Firefox\Profiles\43f6o7qn.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - forums.secondlife.com
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-23 10:55:44
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\MarkFun_NT]
"ImagePath"="\??\C:\Program Files\Gigabyte\ET5\markfun.w32"
.
Completion time: 2008-08-23 11

26
ComboFix-quarantined-files.txt 2008-08-23 18:05:24

Pre-Run: 170,717,093,888 bytes free
Post-Run: 170,703,093,760 bytes free

468 --- E O F --- 2008-08-23 17:33:50

HijackThis Log File
===============================

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:08:05 AM, on 8/23/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Micro Innovations\Wireless Keyboard & Mouse Driver\KMWDSrv.exe
C:\Program Files\MioNet\MioNetManager.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Tablet.exe
C:\Program Files\MioNet\jvm\bin\MioNet.exe
C:\WINDOWS\system32\WTablet\TabUserW.exe
C:\WINDOWS\system32\Tablet.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://forums.secondlife.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R3 - URLSearchHook: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
O2 - BHO: (no name) - {05D94A99-829B-4321-967D-52495BB9C560} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0F826232-A771-43E4-B4B0-33EBBEBD9DB4} - (no file)
O2 - BHO: (no name) - {2108EB67-E999-4BFE-B1DC-EB13CBE532C9} - (no file)
O2 - BHO: (no name) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - (no file)
O2 - BHO: (no name) - {2425B543-277C-43E0-A7F3-899440E67DDF} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C6604D9-F366-4428-AD4D-F435A4B26252} - (no file)
O2 - BHO: (no name) - {6368B5F7-2EE2-4E4C-925D-1E3D967F5EDE} - (no file)
O2 - BHO: (no name) - {64C9DDDB-9189-4516-B4B9-3ADFA1B54E07} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E09D32C-E5E6-4184-B177-784CEE1E09C4} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O2 - BHO: (no name) - {C13D50C7-B777-4402-815C-617CE0EF9AF8} - (no file)
O2 - BHO: (no name) - {C6606FC9-7CE5-42CA-94B6-057F34185BFC} - (no file)
O2 - BHO: (no name) - {D6EA2814-C279-479C-A8D1-1559025C3CD2} - (no file)
O2 - BHO: (no name) - {DFA762CF-867A-4F48-90FF-72308F1A57DB} - (no file)
O2 - BHO: (no name) - {F38BB5DD-E0A5-4BAE-9503-695141A65ECd} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
O3 - Toolbar: Earn2Life Bar - {93344865-74BD-4873-BE65-56539D41A65C} - C:\WINDOWS\Downloaded Program Files\Earn2Life.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [BM6b90ceb9] Rundll32.exe "C:\WINDOWS\system32\prpvsemx.dll",s
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O9 - Extra button: Earn2Life Bar - {07328B93-AFD8-4c6a-99E9-D0B3B5D6DAD9} - C:\WINDOWS\Downloaded Program Files\Earn2Life.dll
O9 - Extra 'Tools' menuitem: Earn2Life Bar - {07328B93-AFD8-4c6a-99E9-D0B3B5D6DAD9} - C:\WINDOWS\Downloaded Program Files\Earn2Life.dll
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1219336830093
O16 - DPF: {93344865-74BD-4873-BE65-56539D41A65C} (Earn2Life Bar) - http://www.earn2life.com/plugin/Earn2Life.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/...ampx_en_dl.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe Active File Monitor (AdobeActiveFileMonitor) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Keyboard And Mouse Communication Service (KMWDSERVICE) - UASSOFT.COM - C:\Program Files\Micro Innovations\Wireless Keyboard & Mouse Driver\KMWDSrv.exe
O23 - Service: MioNet Service (MioNet) - Unknown owner - C:\Program Files\MioNet\MioNetManager.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Photoshop Elements Device Connect (PhotoshopElementsDeviceConnect) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe

--
End of file - 9180 bytes

alba · 08-23-2008, 04:06 PM

Hi Keira_Wells

Please read this post completely before begining the fix. If there's anything that you do not understand, kindly ask your questions before proceeding. Please ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.

IT IS IMPORTANT THAT YOU DON'T MISS A STEP & PERFORM EVERYTHING IN THE RIGHT ORDER.

===============================================

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

===============================================

Open notepad and carefully copy/paste all the text in the code box below into it:

Code:


File::
C:\WINDOWS\system32\imjqssab.dll

Registry::
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{855F3B16-6D32-4fe6-8A56-BBB695989046}"=- 
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{05D94A99-829B-4321-967D-52495BB9C560}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0F826232-A771-43E4-B4B0-33EBBEBD9DB4}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2108EB67-E999-4BFE-B1DC-EB13CBE532C9}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{22BF413B-C6D2-4d91-82A9-A0F997BA588C}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2425B543-277C-43E0-A7F3-899440E67DDF}] 
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5C6604D9-F366-4428-AD4D-F435A4B26252}] 
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6368B5F7-2EE2-4E4C-925D-1E3D967F5EDE}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{64C9DDDB-9189-4516-B4B9-3ADFA1B54E07}] 
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7E09D32C-E5E6-4184-B177-784CEE1E09C4}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C13D50C7-B777-4402-815C-617CE0EF9AF8}] 
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C6606FC9-7CE5-42CA-94B6-057F34185BFC}] 
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D6EA2814-C279-479C-A8D1-1559025C3CD2}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DFA762CF-867A-4F48-90FF-72308F1A57DB}] 
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F38BB5DD-E0A5-4BAE-9503-695141A65ECd}] 
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{855F3B16-6D32-4fe6-8A56-BBB695989046}]

Save this as CFScript.txt

Refering to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply.

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Additonally, ComboFix will generate a zipped file on your desktop called Submit [Date Time].zip

When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture a file to submit for analysis.

Ensure you are connected to the internet and click OK on the message box. A browser will open. Simply follow the instructions to copy/paste/send the requested file.

================================================
Establish an internet connection & perform an online scan with Internet Explorer at one of the following links

Answer Yes, when prompted to install an ActiveX component.

The program will then begin downloading the latest definition files.
Once the files have been downloaded click on NEXT
Locate the Scan Settings button & configure to:
- Scan using the following Anti-Virus database:
  - Extended
- Scan Options:
  - Scan Archives
  - Scan Mail Bases
Click OK & have it scan My Computer
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

* Turn off the real time scanner of any existing antivirus program while performing the online scan
Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%.

=================

Please Run a scan with HiJackThis and save the log

=================

In your next post, please include fresh logs from:

ComboFix.txt
Kaspersky report
HiJackThis

Please provide details of any problems you encountered whilst performing the above steps & update us on how the computer behaves now

Keira_Wells · 08-24-2008, 02:57 PM

I followed the directions exactly, but Combofix did not create a zipped filed, nor a message box for submitting said file. However, it showed 'C:\WINDOWS\system32\imjqssab.dll' listed at the top of the log file, so I figured it did what it was supposed to, and I didn't want to end up lacking information, so continued on.

When I boot, I see no RunDll file listed in processes, though it also gives an error message that reads:

'Error loading C:\WINDOWS\system32\prpvsemx.dll
The specified module could not be found'

Upon checking MSConfig, that RunDll file is listed in startup.

I've not noticed any blackage to any websites like before. It loads both versions of GMail, as well as various other sites fine.

ComboFix Log File
=====================
ComboFix 08-08-23.01 - Okiphia Fatali 2008-08-23 16:33:12.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.2548 [GMT -7:00]
Running from: C:\Documents and Settings\Okiphia Fatali\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Okiphia Fatali\Desktop\CFScript.txt
* Created a new restore point

FILE ::
C:\WINDOWS\system32\imjqssab.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\imjqssab.dll

.
((((((((((((((((((((((((( Files Created from 2008-07-23 to 2008-08-23 )))))))))))))))))))))))))))))))
.

2008-08-23 08:12 . 2008-08-23 08:27 <DIR> d-------- C:\Documents and Settings\Okiphia Fatali\Application Data\flightgear.org
2008-08-23 08:11 . 2008-08-23 08:12 <DIR> d-------- C:\Program Files\FlightGear
2008-08-22 16:02 . 2008-08-22 16:03 <DIR> d-------- C:\Program Files\Phun
2008-08-22 15:36 . 2008-08-22 15:36 <DIR> d-------- C:\Program Files\Porrasturvat - Stair Dismount
2008-08-21 12:11 . 2008-05-19 18:16 186,407 --a------ C:\WINDOWS\system32\nvapps.nvb
2008-08-21 09:43 . 2008-08-21 09:43 <DIR> d-------- C:\Program Files\Trend Micro
2008-08-21 09:30 . 2008-08-21 09:30 <DIR> d-------- C:\ie-spyad_zo
2008-08-21 09:26 . 2008-08-21 09:26 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-08-21 09:26 . 2005-04-15 20:58 1,071,088 --a------ C:\WINDOWS\system32\MSCOMCTL.OCX
2008-08-21 09:26 . 2005-08-25 19:18 118,784 --a------ C:\WINDOWS\system32\MSSTDFMT.DLL
2008-08-21 07:24 . 2008-06-19 17:24 28,544 --a------ C:\WINDOWS\system32\drivers\pavboot.sys
2008-08-21 07:20 . 2008-08-21 07:20 <DIR> d-------- C:\Program Files\Panda Security
2008-08-19 14:42 . 2008-08-19 14:42 <DIR> d-------- C:\WINDOWS\nvidia icons
2008-08-19 14:40 . 2008-05-16 11:48 446,464 --a------ C:\WINDOWS\system32\NVUNINST.EXE

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-23 17:48 --------- d-----w C:\Documents and Settings\Okiphia Fatali\Application Data\WTablet
2008-08-23 17:40 --------- d-----w C:\Documents and Settings\LocalService\Application Data\WTablet
2008-07-28 05:47 --------- d-----w C:\Documents and Settings\Okiphia Fatali\Application Data\SPORE Creature Creator
2008-07-23 08:09 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-07-23 08:09 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-07-18 23:38 --------- d-----w C:\Documents and Settings\Okiphia Fatali\Application Data\AVG7
2008-07-17 22:48 --------- d-----w C:\Program Files\GameSpy
2008-07-17 22:47 22,328 ----a-w C:\Documents and Settings\Okiphia Fatali\Application Data\PnkBstrK.sys
2008-07-17 22:46 669,184 ----a-w C:\WINDOWS\system32\pbsvc.exe
2008-07-17 22:36 --------- d-----w C:\Program Files\Electronic Arts
2008-07-17 19:35 --------- d-----w C:\Program Files\SecondLifeMono
2008-07-16 20:14 --------- d-----w C:\Program Files\SecondLifeReleaseCandidate
2008-07-13 21:10 --------- d-----w C:\Program Files\ArchipelisDesigner
2008-07-03 03:22 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-29 01:13 --------- d--h--r C:\Documents and Settings\Okiphia Fatali\Application Data\SecuROM
2008-06-28 19:09 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-06-28 07:02 --------- d-----w C:\Program Files\JFK Reloaded
2008-06-11 23:55 41,296 ----a-w C:\WINDOWS\system32\xfcodec.dll
2008-05-31 01:09 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2008-03-04 02:27 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{93344865-74BD-4873-BE65-56539D41A65C}"= "C:\WINDOWS\Downloaded Program Files\Earn2Life.dll" [2007-05-14 18:18 303104]

[HKEY_CLASSES_ROOT\clsid\{93344865-74bd-4873-be65-56539d41a65c}]
[HKEY_CLASSES_ROOT\Earn2Life.LeadBar.1]
[HKEY_CLASSES_ROOT\TypeLib\{92F9C4A2-C2A5-41f6-9829-49B8C6FF0709}]
[HKEY_CLASSES_ROOT\Earn2Life.LeadBar]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24 286720]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-16 14:01 13529088]
"BM6b90ceb9"="C:\WINDOWS\system32\prpvsemx.dll" [BU]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-10-22 08:30 219136]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"SENTINEL"= snti386.dll
"VIDC.XFR1"= xfcodec.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^TrayMin200.exe.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\TrayMin200.exe.lnk
backup=C:\WINDOWS\pss\TrayMin200.exe.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Okiphia Fatali^Start Menu^Programs^Startup^Xfire.lnk]
path=C:\Documents and Settings\Okiphia Fatali\Start Menu\Programs\Startup\Xfire.lnk
backup=C:\WINDOWS\pss\Xfire.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
C:\WINDOWS\system32\dumprep 0 -k [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\36X Raid Configurer]
-ra------ 2007-02-06 05:08 1953792 C:\WINDOWS\system32\JMRaidSetup.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC]
--a------ 2008-04-21 09:32 579584 C:\PROGRA~1\Grisoft\AVG7\avgcc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2006-02-28 05:00 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EA Core]
--a------ 2008-05-16 18:16 2732032 C:\Program Files\Electronic Arts\EADM\Core.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EasyTuneV]
--a------ 2007-04-26 15:50 24576 C:\Program Files\Gigabyte\ET5\ETcall.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ]
--a------ 2007-12-19 07:48 172280 C:\Program Files\ICQ6\ICQ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2007-09-26 14:42 267064 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\JMB36X IDE Setup]
-r------- 2006-10-30 05:44 36864 C:\WINDOWS\JM\JMInsIDE.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KMCONFIG]
--a------ 2007-03-06 14:51 212992 C:\Program Files\Micro Innovations\Wireless Keyboard & Mouse Driver\StartAutorun.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2004-10-13 09:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-01-19 12:54 5674352 C:\Program Files\MSN Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 2008-05-16 14:01 13529088 C:\WINDOWS\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
--a------ 2008-05-16 14:01 86016 C:\WINDOWS\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-ra------ 2008-02-01 18:22 21898024 C:\Program Files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
-rahs---- 2008-01-28 11:43 2097488 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
--a------ 2008-06-16 15:21 1271032 c:\Program Files\Steam\steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
--a------ 2007-08-15 12:23 68856 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2007-05-14 15:22 35328 C:\Program Files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
--a------ 2007-07-16 15:17 4670704 C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
-r------- 2005-05-03 03:43 69632 C:\WINDOWS\Alcmtr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2008-05-16 14:01 1630208 C:\WINDOWS\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
-r------- 2007-04-12 02:33 16132608 C:\WINDOWS\RTHDCPL.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Sony\\EverQuest II\\LaunchPad.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\mIRC\\mirc.exe"=
"C:\\Program Files\\Xfire\\xfire.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\ICQ6\\ICQ.exe"=
"C:\\Program Files\\America's Army\\System\\ArmyOps.exe"=
"C:\\Program Files\\SecondLife\\SLVoice.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\SecondLifeWindLight\\SLVoice.exe"=
"C:\\Program Files\\SecondLife\\SecondLife.exe"=
"C:\\Program Files\\Autodesk\\Maya 8.5 Personal Learning Edition\\bin\\maya.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\Program Files\\SecondLifeReleaseCandidate\\SLVoice.exe"=
"C:\\Program Files\\Turbine\\The Lord of the Rings Online\\lotroclient.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Ahead\\SIPPS\\SIPPS.exe"=
"C:\\Program Files\\Steam\\steamapps\\okiphiarayna\\team fortress 2\\hl2.exe"=
"C:\\Program Files\\Electronic Arts\\EADM\\Core.exe"=
"C:\\Program Files\\SecondLifeMono\\SLVoice.exe"=
"C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
"C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"C:\\Program Files\\Sony\\EverQuest II\\EverQuest2.exe"=
"C:\\Program Files\\FlightGear\\bin\\win32\\fgfs.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1700:TCP"= 1700:TCP:MioNet Remote Drive Access
"1641:TCP"= 1641:TCP:MioNet Remote Drive Verification

R0 pavboot;pavboot;C:\WINDOWS\system32\drivers\pavboot.sys [2008-06-19 17:24]
R2 AdobeActiveFileMonitor;Adobe Active File Monitor;C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe [2004-10-04 04:47]
R2 KMWDSERVICE;Keyboard And Mouse Communication Service;C:\Program Files\Micro Innovations\Wireless Keyboard & Mouse Driver\KMWDSrv.exe [2007-04-05 10:29]
R2 MioNet;MioNet Service;C:\Program Files\MioNet\MioNetManager.exe [2005-07-15 13:38]
R2 PhotoshopElementsDeviceConnect;Photoshop Elements Device Connect;C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe [2004-10-04 03:40]
R3 SCREAMINGBDRIVER;Screaming Bee Audio;C:\WINDOWS\system32\drivers\ScreamingBAudio.sys [2007-08-24 17:44]
R3 wacommousefilter;Wacom Mouse Filter Driver;C:\WINDOWS\system32\DRIVERS\wacommousefilter.sys [2007-02-16 12:12]
R3 wacomvhid;Wacom Virtual Hid Driver;C:\WINDOWS\system32\DRIVERS\wacomvhid.sys [2007-02-16 11:30]
S3 MarkFun_NT;MarkFun_NT;C:\Program Files\Gigabyte\ET5\markfun.w32 [2007-01-12 18:34]
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-23 16:34:03
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\MarkFun_NT]
"ImagePath"="\??\C:\Program Files\Gigabyte\ET5\markfun.w32"
.
Completion time: 2008-08-23 16:35:18
ComboFix-quarantined-files.txt 2008-08-23 23:34:29
ComboFix2.txt 2008-08-23 18

26

Pre-Run: 170,750,865,408 bytes free
Post-Run: 170,737,016,832 bytes free

194 --- E O F --- 2008-08-23 17:33:50

Kaspersky Report
=====================

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Sunday, August 24, 2008
Operating System: Microsoft Windows XP Home Edition Service Pack 2 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Sunday, August 24, 2008 17:42:05
Records in database: 1140842
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\

Scan statistics:
Files scanned: 167781
Threat name: 55
Infected objects: 163
Suspicious objects: 0
Duration of the scan: 02:42:56

File name / Threat name / Threats count
C:\crap\jcoxorhn.txt Infected: Trojan-Spy.Win32.BZub.fay 1
C:\crap\jiqjsiyw.txt Infected: Trojan.Win32.Monder.fcy 1
C:\crap\jqsoxxwn.txt Infected: Trojan.Win32.Monder.ggc 1
C:\crap\rruadltv.txt Infected: Trojan.Win32.Agent.ytr 1
C:\crap\tyowirsb.TXT Infected: Trojan.Win32.Monder.dkx 1
C:\crap\ufoftlsu.txt Infected: Trojan-Spy.Win32.BZub.faz 1
C:\Program Files\MioNet\cmdow.exe Infected: not-a-virus:RiskTool.Win32.HideWindows 1
C:\Program Files\mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.621 1
C:\Program Files\Philips\SPC 200NC PC Camera\MioNet\install_MioNet_ver1_6_11.exe Infected: not-a-virus:RiskTool.Win32.HideWindows 1
C:\QooBox\Quarantine\C\WINDOWS\system32\abxpjpxo.dll.vir Infected: Trojan.Win32.Monder.cwr 1
C:\QooBox\Quarantine\C\WINDOWS\system32\accxik.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cva 1
C:\QooBox\Quarantine\C\WINDOWS\system32\aefsnr.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\aphptrjk.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\avbxpr.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.aeud 1
C:\QooBox\Quarantine\C\WINDOWS\system32\avossg.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\avstjbwr.dll.vir Infected: Trojan.Win32.Monder.zm 1
C:\QooBox\Quarantine\C\WINDOWS\system32\ayshnjfh.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.ccv 1
C:\QooBox\Quarantine\C\WINDOWS\system32\bqujeifi.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\ckbhabak.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\clhvaavk.dll.vir Infected: Trojan.Win32.Monder.wf 1
C:\QooBox\Quarantine\C\WINDOWS\system32\cpscgmkx.dll.vir Infected: Trojan.Win32.Monder.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\czjpcc.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.ciy 1
C:\QooBox\Quarantine\C\WINDOWS\system32\diucmcsc.dll.vir Infected: Trojan.Win32.Monder.axm 1
C:\QooBox\Quarantine\C\WINDOWS\system32\dkdfyt.dll.vir Infected: Trojan.Win32.Monder.awg 1
C:\QooBox\Quarantine\C\WINDOWS\system32\edghgvim.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cva 1
C:\QooBox\Quarantine\C\WINDOWS\system32\eixrbblg.dll.vir Infected: Trojan.Win32.Monder.esu 1
C:\QooBox\Quarantine\C\WINDOWS\system32\ejkqfedl.dll.vir Infected: Trojan.Win32.Monder.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\enwaqtkg.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\enyxnmfv.dll.vir Infected: Trojan.Win32.Monder.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\epvvdelf.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\erpumqpq.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\ettuvbwe.dll.vir Infected: Trojan.Win32.Monder.dkx 1
C:\QooBox\Quarantine\C\WINDOWS\system32\euaciggv.dll.vir Infected: Trojan.Win32.Monder.dkx 1
C:\QooBox\Quarantine\C\WINDOWS\system32\fgfpxcdc.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.aegv 1
C:\QooBox\Quarantine\C\WINDOWS\system32\fjboelug.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\fjevkw.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.zjk 1
C:\QooBox\Quarantine\C\WINDOWS\system32\fkhmvd.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\fpefbrln.dll.vir Infected: Trojan.Win32.Monder.dkx 1
C:\QooBox\Quarantine\C\WINDOWS\system32\fpucbf.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\fxtady.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\gdvnoetn.dll.vir Infected: Trojan.Win32.Monder.cmm 1
C:\QooBox\Quarantine\C\WINDOWS\system32\geenaggm.dll.vir Infected: Trojan.Win32.Monder.awj 1
C:\QooBox\Quarantine\C\WINDOWS\system32\ghojhlob.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\gnkwlv.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\gsipoxfu.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cju 1
C:\QooBox\Quarantine\C\WINDOWS\system32\gxsuublf.dll.vir Infected: Trojan.Win32.Monder.dkx 1
C:\QooBox\Quarantine\C\WINDOWS\system32\hdsovmoo.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cdg 1
C:\QooBox\Quarantine\C\WINDOWS\system32\hfhvocrw.dll.vir Infected: Trojan.Win32.Monder.awg 1
C:\QooBox\Quarantine\C\WINDOWS\system32\hjbbtp.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cur 1
C:\QooBox\Quarantine\C\WINDOWS\system32\hkhmacpr.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.aeuc 1
C:\QooBox\Quarantine\C\WINDOWS\system32\hmvprotp.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.wdd 1
C:\QooBox\Quarantine\C\WINDOWS\system32\hoicmoxh.dll.vir Infected: Trojan.Win32.Monder.bmc 1
C:\QooBox\Quarantine\C\WINDOWS\system32\htmtwmoy.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.zdg 1
C:\QooBox\Quarantine\C\WINDOWS\system32\ianpnqfi.dll.vir Infected: Trojan.Win32.Monder.bir 1
C:\QooBox\Quarantine\C\WINDOWS\system32\ibjtyf.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\idcxmwsp.dll.vir Infected: Trojan.Win32.Monder.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\idrvglks.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.abuh 1
C:\QooBox\Quarantine\C\WINDOWS\system32\idxkfq.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\imjqssab.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.yeb 1
C:\QooBox\Quarantine\C\WINDOWS\system32\iqglqjgf.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\irdxfobq.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cat 1
C:\QooBox\Quarantine\C\WINDOWS\system32\izzopq.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.aeuc 1
C:\QooBox\Quarantine\C\WINDOWS\system32\jkbieptn.dll.vir Infected: Trojan.Win32.Monder.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\jphxwmvk.dll.vir Infected: Trojan.Win32.Monder.aln 1
C:\QooBox\Quarantine\C\WINDOWS\system32\jqwwvqpe.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.aeud 1
C:\QooBox\Quarantine\C\WINDOWS\system32\jtltrq.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\jwksarhu.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\jyhrmp.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cdf 1
C:\QooBox\Quarantine\C\WINDOWS\system32\jyvgle.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cdg 1
C:\QooBox\Quarantine\C\WINDOWS\system32\kckudexa.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.vqh 1
C:\QooBox\Quarantine\C\WINDOWS\system32\kdkyhpdc.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\kjabkspn.dll.vir Infected: Trojan.Win32.Monder.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\kjsvjy.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\lkomjfqo.dll.vir Infected: Trojan.Win32.Monder.cbv 1
C:\QooBox\Quarantine\C\WINDOWS\system32\llofgwrw.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\lmrvremy.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\lnusfyob.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.abuh 1
C:\QooBox\Quarantine\C\WINDOWS\system32\loklufma.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\lrwairwg.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.tsm 1
C:\QooBox\Quarantine\C\WINDOWS\system32\lxaenx.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\mdibhsjp.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cti 1
C:\QooBox\Quarantine\C\WINDOWS\system32\mhztdj.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\mkeftb.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.aeue 1
C:\QooBox\Quarantine\C\WINDOWS\system32\mktmaqle.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\mlxtxynw.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.aeud 1
C:\QooBox\Quarantine\C\WINDOWS\system32\mmavvqyy.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cat 1
C:\QooBox\Quarantine\C\WINDOWS\system32\mppcqcog.dll.vir Infected: Trojan.Win32.Monder.zm 1
C:\QooBox\Quarantine\C\WINDOWS\system32\muupqomq.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cur 1
C:\QooBox\Quarantine\C\WINDOWS\system32\ngbdcfte.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\ngrnicrx.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\nhqxswtw.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\nntgscao.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\npmllh.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cat 1
C:\QooBox\Quarantine\C\WINDOWS\system32\nqcjsxwb.dll.vir Infected: Trojan.Win32.Monder.bbw 1
C:\QooBox\Quarantine\C\WINDOWS\system32\ofqyicte.dll.vir Infected: Trojan.Win32.Monder.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\ohfogdkw.dll.vir Infected: Trojan.Win32.Monder.bmc 1
C:\QooBox\Quarantine\C\WINDOWS\system32\ouvmpigv.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\ouwscpaq.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cdf 1
C:\QooBox\Quarantine\C\WINDOWS\system32\oyrrlg.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.chs 1
C:\QooBox\Quarantine\C\WINDOWS\system32\pcrklcxo.dll.vir Infected: Trojan.Win32.Monder.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\pfkqihes.dll.vir Infected: Trojan-Spy.Win32.BZub.eyc 1
C:\QooBox\Quarantine\C\WINDOWS\system32\pgtqokrl.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.ciy 1
C:\QooBox\Quarantine\C\WINDOWS\system32\poycaq.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.aema 1
C:\QooBox\Quarantine\C\WINDOWS\system32\pvabnkfw.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\pxgmpqbp.dll.vir Infected: Trojan.Win32.Monder.dkx 1
C:\QooBox\Quarantine\C\WINDOWS\system32\qhbxtwoo.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\qmnikhbw.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\qqloib.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cju 1
C:\QooBox\Quarantine\C\WINDOWS\system32\qrwxtl.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\qwfvse.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\racwfwhy.dll.vir Infected: Trojan.Win32.Monder.dkx 1
C:\QooBox\Quarantine\C\WINDOWS\system32\raezsv.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cti 1
C:\QooBox\Quarantine\C\WINDOWS\system32\rcytcn.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\rdojdfso.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\riwinals.dll.vir Infected: Trojan.Win32.Monder.cmm 1
C:\QooBox\Quarantine\C\WINDOWS\system32\rmdejrvo.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\rqkuuisx.dll.vir Infected: Trojan.Win32.Monder.aeo 1
C:\QooBox\Quarantine\C\WINDOWS\system32\rvnvrfrf.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.zjk 1
C:\QooBox\Quarantine\C\WINDOWS\system32\sievdr.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\tcnksqjl.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\thnrylev.dll.vir Infected: Trojan.Win32.Monder.zn 1
C:\QooBox\Quarantine\C\WINDOWS\system32\tmknwuwd.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\twfuxe.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.aegv 1
C:\QooBox\Quarantine\C\WINDOWS\system32\uaoykwxu.dll.vir Infected: Trojan.Win32.Monder.axm 1
C:\QooBox\Quarantine\C\WINDOWS\system32\ubdpadpq.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\uetydsns.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\ugalgz.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.ccv 1
C:\QooBox\Quarantine\C\WINDOWS\system32\uqlkokkx.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\uuyvby.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\vdfvxpwl.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\vgadlaiq.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\vurrrj.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\vwgwkbgf.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\vwjbveel.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\vxxmdypw.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.aema 1
C:\QooBox\Quarantine\C\WINDOWS\system32\weyeywwg.dll.vir Infected: Trojan.Win32.Monder.glg 1
C:\QooBox\Quarantine\C\WINDOWS\system32\wnukqfdi.dll.vir Infected: Trojan.Win32.Monder.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\wqdngqhg.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\wrdwsisw.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\wubtwz.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cdg 1
C:\QooBox\Quarantine\C\WINDOWS\system32\wuvduy.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.abuh 1
C:\QooBox\Quarantine\C\WINDOWS\system32\wvUlihff.dll.vir Infected: Trojan.Win32.Monder.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\wwxrrvoo.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.trp 1
C:\QooBox\Quarantine\C\WINDOWS\system32\xefmkgyg.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cdg 1
C:\QooBox\Quarantine\C\WINDOWS\system32\xenyqwun.dll.vir Infected: Trojan.Win32.Monder.dmj 1
C:\QooBox\Quarantine\C\WINDOWS\system32\xgeanxfh.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.aeue 1
C:\QooBox\Quarantine\C\WINDOWS\system32\xgfake.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.chs 1
C:\QooBox\Quarantine\C\WINDOWS\system32\xieppsty.dll.vir Infected: Trojan.Win32.Monder.dkx 1
C:\QooBox\Quarantine\C\WINDOWS\system32\xmwmdekv.dll.vir Infected: Trojan.Win32.Monder.acy 1
C:\QooBox\Quarantine\C\WINDOWS\system32\xrqmahts.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.bpu 1
C:\QooBox\Quarantine\C\WINDOWS\system32\xugpgg.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\xvdoooir.dll.vir Infected: Trojan.Win32.Monder.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\ydbzgh.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.abuh 1
C:\QooBox\Quarantine\C\WINDOWS\system32\ydccfffe.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.chs 1
C:\QooBox\Quarantine\C\WINDOWS\system32\ydoyssjf.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\ymfiavfe.dll.vir Infected: Trojan.Win32.Monder.dkx 1
C:\QooBox\Quarantine\C\WINDOWS\system32\yujzft.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.aeud 1
C:\QooBox\Quarantine\C\WINDOWS\system32\yuxvnydk.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.chs 1
C:\QooBox\Quarantine\C\WINDOWS\system32\zcrgja.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\zojype.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cat 1
C:\QooBox\Quarantine\C\WINDOWS\system32\zzwpvb.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\catchme2008-08-23_102527.73.zip Infected: Trojan.Win32.Pakes.cym 1
C:\WINDOWS\Downloaded Program Files\Earn2Life.dll Infected: not-a-virus:AdWare.Win32.NocsBar.e 1

The selected area was scanned.

HiJackThis Log File
=====================
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:44:42 PM, on 8/24/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Micro Innovations\Wireless Keyboard & Mouse Driver\KMWDSrv.exe
C:\Program Files\MioNet\MioNetManager.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\MioNet\jvm\bin\MioNet.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Tablet.exe
C:\WINDOWS\system32\WTablet\TabUserW.exe
C:\WINDOWS\system32\Tablet.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://forums.secondlife.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: (no name) - {05D94A99-829B-4321-967D-52495BB9C560} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0F826232-A771-43E4-B4B0-33EBBEBD9DB4} - (no file)
O2 - BHO: (no name) - {2108EB67-E999-4BFE-B1DC-EB13CBE532C9} - (no file)
O2 - BHO: (no name) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - (no file)
O2 - BHO: (no name) - {2425B543-277C-43E0-A7F3-899440E67DDF} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C6604D9-F366-4428-AD4D-F435A4B26252} - (no file)
O2 - BHO: (no name) - {6368B5F7-2EE2-4E4C-925D-1E3D967F5EDE} - (no file)
O2 - BHO: (no name) - {64C9DDDB-9189-4516-B4B9-3ADFA1B54E07} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E09D32C-E5E6-4184-B177-784CEE1E09C4} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O2 - BHO: (no name) - {C13D50C7-B777-4402-815C-617CE0EF9AF8} - (no file)
O2 - BHO: (no name) - {C6606FC9-7CE5-42CA-94B6-057F34185BFC} - (no file)
O2 - BHO: (no name) - {D6EA2814-C279-479C-A8D1-1559025C3CD2} - (no file)
O2 - BHO: (no name) - {DFA762CF-867A-4F48-90FF-72308F1A57DB} - (no file)
O2 - BHO: (no name) - {F38BB5DD-E0A5-4BAE-9503-695141A65ECd} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Earn2Life Bar - {93344865-74BD-4873-BE65-56539D41A65C} - C:\WINDOWS\Downloaded Program Files\Earn2Life.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [BM6b90ceb9] Rundll32.exe "C:\WINDOWS\system32\prpvsemx.dll",s
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O9 - Extra button: Earn2Life Bar - {07328B93-AFD8-4c6a-99E9-D0B3B5D6DAD9} - C:\WINDOWS\Downloaded Program Files\Earn2Life.dll
O9 - Extra 'Tools' menuitem: Earn2Life Bar - {07328B93-AFD8-4c6a-99E9-D0B3B5D6DAD9} - C:\WINDOWS\Downloaded Program Files\Earn2Life.dll
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1219336830093
O16 - DPF: {93344865-74BD-4873-BE65-56539D41A65C} (Earn2Life Bar) - http://www.earn2life.com/plugin/Earn2Life.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/...ampx_en_dl.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe Active File Monitor (AdobeActiveFileMonitor) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Keyboard And Mouse Communication Service (KMWDSERVICE) - UASSOFT.COM - C:\Program Files\Micro Innovations\Wireless Keyboard & Mouse Driver\KMWDSrv.exe
O23 - Service: MioNet Service (MioNet) - Unknown owner - C:\Program Files\MioNet\MioNetManager.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Photoshop Elements Device Connect (PhotoshopElementsDeviceConnect) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe

--
End of file - 8956 bytes

alba · 08-25-2008, 12:38 AM

Hi Keira_Wells

Please read this post completely before begining the fix. If there's anything that you do not understand, kindly ask your questions before proceeding. Please ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.

IT IS IMPORTANT THAT YOU DON'T MISS A STEP & PERFORM EVERYTHING IN THE RIGHT ORDER.

===============================================

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

===============================================

Open notepad and carefully copy/paste all the text in the code box below into it:

Code:


File::
C:\crap\jcoxorhn.txt
C:\crap\jiqjsiyw.txt
C:\crap\jqsoxxwn.txt
C:\crap\rruadltv.txt
C:\crap\tyowirsb.TXT
C:\crap\ufoftlsu.txt
C:\Program Files\MioNet\cmdow.exe

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BM6b90ceb9"=-

Save this as CFScript.txt

Refering to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply.

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

=================

Run a scan with HiJackThis & select/tick the following & click "Fix checked" :

O2 - BHO: (no name) - {0F826232-A771-43E4-B4B0-33EBBEBD9DB4} - (no file)
O2 - BHO: (no name) - {2108EB67-E999-4BFE-B1DC-EB13CBE532C9} - (no file)
O2 - BHO: (no name) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - (no file)
O2 - BHO: (no name) - {2425B543-277C-43E0-A7F3-899440E67DDF} - (no file)
O2 - BHO: (no name) - {5C6604D9-F366-4428-AD4D-F435A4B26252} - (no file)
O2 - BHO: (no name) - {6368B5F7-2EE2-4E4C-925D-1E3D967F5EDE} - (no file)
O2 - BHO: (no name) - {64C9DDDB-9189-4516-B4B9-3ADFA1B54E07} - (no file)
O2 - BHO: (no name) - {7E09D32C-E5E6-4184-B177-784CEE1E09C4} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {C13D50C7-B777-4402-815C-617CE0EF9AF8} - (no file)
O2 - BHO: (no name) - {C6606FC9-7CE5-42CA-94B6-057F34185BFC} - (no file)
O2 - BHO: (no name) - {D6EA2814-C279-479C-A8D1-1559025C3CD2} - (no file)
O2 - BHO: (no name) - {DFA762CF-867A-4F48-90FF-72308F1A57DB} - (no file)
O2 - BHO: (no name) - {F38BB5DD-E0A5-4BAE-9503-695141A65ECd} - (no file)

Please remember to close all other windows, including browsers then click Fix checked.

===============================================

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

Download the latest version of Java Runtime Environment (JRE) 6 and save it to your desktop.
Scroll down to where it says "Java Runtime Environment (JRE) 6 Update 7. The Java SE Runtime Environment (JRE) allows end-users to run Java applications."
Click the "Download" button to the right.
Select the Windows platform from the dropdown menu.
Read the License Agreement and then check the box that says: "Accept License Agreement". Click on Continue.The page will refresh.
Click on the link to download Windows Offline Installation and save the file to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u7-windows-i586-p.exe to install the newest version.

After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
- On the General tab, under Temporary Internet Files, click the Settings button.
- Next, click on the Delete Files button
- There are two options in the window to clear the cache - Leave BOTH Checked
  - Applications and Applets
    Trace and Log Files
- Click OK on Delete Temporary Files Window
  Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
- Click OK to leave the Temporary Files Window
- Click OK to leave the Java Control Panel.

=================

Please Run a scan with HiJackThis and save the log

=================

In your next post, please include fresh logs from:

ComboFix.txt
HiJackThis

Please provide details of any problems you encountered whilst performing the above steps & update us on how the computer behaves now

Keira_Wells · 08-25-2008, 01:49 PM

I encountered no problems while doing the steps, everything ran smooth. My computer seems a tad faster in general, no pages are failing to load except when the internet is being mean, and so on so forth.

Everything seems fine in general.

ComboFix Log
==================

ComboFix 08-08-24.03 - Okiphia Fatali 2008-08-25 10:36:19.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.2526 [GMT -7:00]
Running from: C:\Documents and Settings\Okiphia Fatali\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Okiphia Fatali\Desktop\CFScript.txt
* Created a new restore point

FILE ::
C:\crap\jcoxorhn.txt
C:\crap\jiqjsiyw.txt
C:\crap\jqsoxxwn.txt
C:\crap\rruadltv.txt
C:\crap\tyowirsb.TXT
C:\crap\ufoftlsu.txt
C:\Program Files\MioNet\cmdow.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\crap\jcoxorhn.txt
C:\crap\jiqjsiyw.txt
C:\crap\jqsoxxwn.txt
C:\crap\rruadltv.txt
C:\crap\tyowirsb.TXT
C:\crap\ufoftlsu.txt
C:\Program Files\MioNet\cmdow.exe

.
((((((((((((((((((((((((( Files Created from 2008-07-25 to 2008-08-25 )))))))))))))))))))))))))))))))
.

2008-08-23 20:39 . 2008-06-13 06:10 272,128 --------- C:\WINDOWS\system32\drivers\bthport.sys
2008-08-23 20:39 . 2008-06-13 06:10 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-08-23 08:12 . 2008-08-24 19:39 <DIR> d-------- C:\Documents and Settings\Okiphia Fatali\Application Data\flightgear.org
2008-08-23 08:11 . 2008-08-23 08:12 <DIR> d-------- C:\Program Files\FlightGear
2008-08-22 16:02 . 2008-08-22 16:03 <DIR> d-------- C:\Program Files\Phun
2008-08-22 15:36 . 2008-08-22 15:36 <DIR> d-------- C:\Program Files\Porrasturvat - Stair Dismount
2008-08-21 12:11 . 2008-05-19 18:16 186,407 --a------ C:\WINDOWS\system32\nvapps.nvb
2008-08-21 09:43 . 2008-08-21 09:43 <DIR> d-------- C:\Program Files\Trend Micro
2008-08-21 09:30 . 2008-08-21 09:30 <DIR> d-------- C:\ie-spyad_zo
2008-08-21 09:26 . 2008-08-21 09:26 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-08-21 09:26 . 2005-04-15 20:58 1,071,088 --a------ C:\WINDOWS\system32\MSCOMCTL.OCX
2008-08-21 09:26 . 2005-08-25 19:18 118,784 --a------ C:\WINDOWS\system32\MSSTDFMT.DLL
2008-08-21 07:24 . 2008-06-19 17:24 28,544 --a------ C:\WINDOWS\system32\drivers\pavboot.sys
2008-08-21 07:20 . 2008-08-21 07:20 <DIR> d-------- C:\Program Files\Panda Security
2008-08-19 14:42 . 2008-08-19 14:42 <DIR> d-------- C:\WINDOWS\nvidia icons
2008-08-19 14:40 . 2008-05-16 11:48 446,464 --a------ C:\WINDOWS\system32\NVUNINST.EXE

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-25 17:36 --------- d-----w C:\Program Files\MioNet
2008-08-24 20:52 --------- d-----w C:\Documents and Settings\Okiphia Fatali\Application Data\WTablet
2008-08-23 17:40 --------- d-----w C:\Documents and Settings\LocalService\Application Data\WTablet
2008-07-28 05:47 --------- d-----w C:\Documents and Settings\Okiphia Fatali\Application Data\SPORE Creature Creator
2008-07-23 08:09 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-07-23 08:09 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-07-18 23:38 --------- d-----w C:\Documents and Settings\Okiphia Fatali\Application Data\AVG7
2008-07-17 22:48 --------- d-----w C:\Program Files\GameSpy
2008-07-17 22:47 22,328 ----a-w C:\Documents and Settings\Okiphia Fatali\Application Data\PnkBstrK.sys
2008-07-17 22:46 669,184 ----a-w C:\WINDOWS\system32\pbsvc.exe
2008-07-17 22:36 --------- d-----w C:\Program Files\Electronic Arts
2008-07-17 19:35 --------- d-----w C:\Program Files\SecondLifeMono
2008-07-16 20:14 --------- d-----w C:\Program Files\SecondLifeReleaseCandidate
2008-07-13 21:10 --------- d-----w C:\Program Files\ArchipelisDesigner
2008-07-07 20:32 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-07-03 03:22 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-29 01:13 --------- d--h--r C:\Documents and Settings\Okiphia Fatali\Application Data\SecuROM
2008-06-28 19:09 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-06-28 07:02 --------- d-----w C:\Program Files\JFK Reloaded
2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-23 16:57 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-11 23:55 41,296 ----a-w C:\WINDOWS\system32\xfcodec.dll
2008-05-31 01:09 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2008-03-04 02:27 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
.

((((((((((((((((((((((((((((( snapshot@2008-08-23_11.05.08.17 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-02-26 11:48:44 297,984 ----a-w C:\WINDOWS\$hf_mig$\KB932823-v3\SP2QFE\msctf.dll
+ 2007-03-06 01:22:36 14,048 ----a-w C:\WINDOWS\$hf_mig$\KB932823-v3\spmsg.dll
+ 2007-03-06 01:22:41 213,216 ----a-w C:\WINDOWS\$hf_mig$\KB932823-v3\spuninst.exe
+ 2007-03-06 01:22:34 22,752 ----a-w C:\WINDOWS\$hf_mig$\KB932823-v3\update\spcustom.dll
+ 2007-03-06 01:22:59 716,000 ----a-w C:\WINDOWS\$hf_mig$\KB932823-v3\update\update.exe
+ 2007-03-06 01:23:51 371,424 ----a-w C:\WINDOWS\$hf_mig$\KB932823-v3\update\updspapi.dll
+ 2008-07-07 20:06:43 253,952 ----a-w C:\WINDOWS\$hf_mig$\KB950974\SP2QFE\es.dll
+ 2008-07-07 20:26:58 253,952 ----a-w C:\WINDOWS\$hf_mig$\KB950974\SP3GDR\es.dll
+ 2008-07-07 20:23:18 253,952 ----a-w C:\WINDOWS\$hf_mig$\KB950974\SP3QFE\es.dll
+ 2007-11-30 12:39:22 17,272 ----a-w C:\WINDOWS\$hf_mig$\KB950974\spmsg.dll
+ 2007-11-30 12:39:22 231,288 ----a-w C:\WINDOWS\$hf_mig$\KB950974\spuninst.exe
+ 2007-11-30 12:39:22 26,488 ----a-w C:\WINDOWS\$hf_mig$\KB950974\update\spcustom.dll
+ 2007-11-30 12:39:18 755,576 ----a-w C:\WINDOWS\$hf_mig$\KB950974\update\update.exe
+ 2007-11-30 12:39:19 382,840 ----a-w C:\WINDOWS\$hf_mig$\KB950974\update\updspapi.dll
+ 2008-07-14 11:03:00 62,976 ----a-w C:\WINDOWS\$hf_mig$\KB951072-v2\SP2QFE\tzchange.exe
+ 2008-07-11 12:42:28 62,976 ----a-w C:\WINDOWS\$hf_mig$\KB951072-v2\SP3GDR\tzchange.exe
+ 2008-07-11 12:51:51 62,976 ----a-w C:\WINDOWS\$hf_mig$\KB951072-v2\SP3QFE\tzchange.exe
+ 2007-11-30 11:18:51 17,272 ----a-w C:\WINDOWS\$hf_mig$\KB951072-v2\spmsg.dll
+ 2007-11-30 11:18:51 231,288 ----a-w C:\WINDOWS\$hf_mig$\KB951072-v2\spuninst.exe
+ 2007-11-30 11:18:51 26,488 ----a-w C:\WINDOWS\$hf_mig$\KB951072-v2\update\spcustom.dll
+ 2007-11-30 12:39:22 755,576 ----a-w C:\WINDOWS\$hf_mig$\KB951072-v2\update\update.exe
+ 2007-11-30 12:39:22 382,840 ----a-w C:\WINDOWS\$hf_mig$\KB951072-v2\update\updspapi.dll
+ 2008-05-07 04:55:40 1,288,192 ----a-w C:\WINDOWS\$hf_mig$\KB951698\SP2QFE\quartz.dll
+ 2008-05-07 05:12:40 1,288,192 ----a-w C:\WINDOWS\$hf_mig$\KB951698\SP3GDR\quartz.dll
+ 2008-05-07 05:04:15 1,288,192 ----a-w C:\WINDOWS\$hf_mig$\KB951698\SP3QFE\quartz.dll
+ 2007-11-30 11:18:51 17,272 ----a-w C:\WINDOWS\$hf_mig$\KB951698\spmsg.dll
+ 2007-11-30 11:18:51 231,288 ----a-w C:\WINDOWS\$hf_mig$\KB951698\spuninst.exe
+ 2007-11-30 11:18:51 26,488 ----a-w C:\WINDOWS\$hf_mig$\KB951698\update\spcustom.dll
+ 2007-11-30 12:39:22 755,576 ----a-w C:\WINDOWS\$hf_mig$\KB951698\update\update.exe
+ 2007-11-30 12:39:22 382,840 ----a-w C:\WINDOWS\$hf_mig$\KB951698\update\updspapi.dll
+ 2006-08-16 12:08:32 100,352 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\6to4svc.dll
+ 2008-06-20 10:44:08 138,368 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\afd.sys
+ 2008-06-20 17:36:11 147,968 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\dnsapi.dll
+ 2008-06-20 17:36:11 245,248 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\mswsock.dll
+ 2008-06-20 10:44:42 360,960 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\tcpip.sys
+ 2008-06-20 09:32:39 225,920 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\tcpip6.sys
+ 2008-06-20 11:40:08 138,496 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP3GDR\afd.sys
+ 2008-06-20 17:46:57 147,968 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP3GDR\dnsapi.dll
+ 2008-06-20 17:46:57 245,248 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP3GDR\mswsock.dll
+ 2008-06-20 11:51:12 361,600 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP3GDR\tcpip.sys
+ 2008-06-20 11:08:27 225,856 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP3GDR\tcpip6.sys
+ 2008-06-20 11:48:03 138,496 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\afd.sys
+ 2008-06-20 17:43:05 147,968 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\dnsapi.dll
+ 2008-06-20 17:43:05 245,248 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\mswsock.dll
+ 2008-06-20 11:59:02 361,600 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\tcpip.sys
+ 2008-06-20 11:16:44 225,856 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\tcpip6.sys
+ 2007-11-30 12:39:22 17,272 ----a-w C:\WINDOWS\$hf_mig$\KB951748\spmsg.dll
+ 2007-11-30 12:39:22 231,288 ----a-w C:\WINDOWS\$hf_mig$\KB951748\spuninst.exe
+ 2007-11-30 12:39:22 26,488 ----a-w C:\WINDOWS\$hf_mig$\KB951748\update\spcustom.dll
+ 2007-11-30 12:39:18 755,576 ----a-w C:\WINDOWS\$hf_mig$\KB951748\update\update.exe
+ 2007-11-30 12:39:19 382,840 ----a-w C:\WINDOWS\$hf_mig$\KB951748\update\updspapi.dll
+ 2008-06-24 16:28:00 74,240 ----a-w C:\WINDOWS\$hf_mig$\KB952954\SP2QFE\mscms.dll
+ 2008-06-24 16:43:16 74,240 ----a-w C:\WINDOWS\$hf_mig$\KB952954\SP3GDR\mscms.dll
+ 2008-06-24 16:53:10 74,240 ----a-w C:\WINDOWS\$hf_mig$\KB952954\SP3QFE\mscms.dll
+ 2007-11-30 12:39:22 17,272 ----a-w C:\WINDOWS\$hf_mig$\KB952954\spmsg.dll
+ 2007-11-30 12:39:22 231,288 ----a-w C:\WINDOWS\$hf_mig$\KB952954\spuninst.exe
+ 2007-11-30 12:39:22 26,488 ----a-w C:\WINDOWS\$hf_mig$\KB952954\update\spcustom.dll
+ 2007-11-30 12:39:22 755,576 ----a-w C:\WINDOWS\$hf_mig$\KB952954\update\update.exe
+ 2007-11-30 12:39:22 382,840 ----a-w C:\WINDOWS\$hf_mig$\KB952954\update\updspapi.dll
+ 2008-06-13 13:10:50 272,128 ------w C:\WINDOWS\Driver Cache\i386\bthport.sys
+ 2008-03-01 13:06:20 124,928 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\advpack.dll
+ 2008-03-01 13:06:21 347,136 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\dxtmsft.dll
+ 2008-03-01 13:06:21 214,528 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\dxtrans.dll
+ 2008-03-01 13:06:21 133,120 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\extmgr.dll
+ 2008-03-01 13:06:21 63,488 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\icardie.dll
+ 2008-02-29 08:55:23 70,656 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\ie4uinit.exe
+ 2008-03-01 13:06:21 153,088 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\ieakeng.dll
+ 2008-03-01 13:06:21 230,400 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\ieaksie.dll
+ 2008-02-15 05:44:25 161,792 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\ieakui.dll
+ 2008-03-01 13:06:22 383,488 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\ieapfltr.dll
+ 2008-03-01 13:06:22 384,512 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\iedkcs32.dll
+ 2008-03-01 13:06:24 6,066,176 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\ieframe.dll
+ 2008-03-01 13:06:24 44,544 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\iernonce.dll
+ 2008-03-01 13:06:25 267,776 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\iertutil.dll
+ 2008-02-22 10:00:51 13,824 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\ieudinit.exe
+ 2008-02-29 08:55:46 625,664 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\iexplore.exe
+ 2008-03-01 13:06:25 27,648 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\jsproxy.dll
+ 2008-03-01 13:06:26 459,264 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\msfeeds.dll
+ 2008-03-01 13:06:26 52,224 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\msfeedsbs.dll
+ 2008-03-02 01:36:30 3,591,680 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\mshtml.dll
+ 2008-03-01 13:06:28 478,208 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\mshtmled.dll
+ 2008-03-01 13:06:28 193,024 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\msrating.dll
+ 2008-03-01 13:06:29 671,232 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\mstime.dll
+ 2008-03-01 13:06:29 102,912 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\occache.dll
+ 2008-03-01 13:06:29 44,544 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\pngfilt.dll
+ 2007-03-06 01:22:39 213,216 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\spuninst.exe
+ 2007-03-06 01:23:51 371,424 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\updspapi.dll
+ 2008-03-01 13:06:29 105,984 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\url.dll
+ 2008-03-01 13:06:30 1,159,680 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\urlmon.dll
+ 2008-03-01 13:06:30 233,472 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\webcheck.dll
+ 2008-03-01 13:06:31 826,368 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\wininet.dll
- 2008-03-01 13:06:20 124,928 ----a-w C:\WINDOWS\system32\advpack.dll
+ 2008-06-23 16:57:27 124,928 ----a-w C:\WINDOWS\system32\advpack.dll
- 2008-03-01 13:06:20 124,928 -c--a-w C:\WINDOWS\system32\dllcache\advpack.dll
+ 2008-06-23 16:57:27 124,928 -c--a-w C:\WINDOWS\system32\dllcache\advpack.dll
- 2006-02-28 12:00:00 138,496 -c--a-w C:\WINDOWS\system32\dllcache\afd.sys
+ 2008-06-20 10:44:38 138,368 -c--a-w C:\WINDOWS\system32\dllcache\afd.sys
- 2008-02-20 05:32:43 148,992 -c--a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
+ 2008-06-20 17:41:10 148,992 -c--a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
- 2008-03-01 13:06:21 347,136 -c--a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll
+ 2008-06-23 16:57:27 347,136 -c--a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll
- 2008-03-01 13:06:21 214,528 -c--a-w C:\WINDOWS\system32\dllcache\dxtrans.dll
+ 2008-06-23 16:57:27 214,528 -c--a-w C:\WINDOWS\system32\dllcache\dxtrans.dll
- 2005-07-26 04:39:45 243,200 -c--a-w C:\WINDOWS\system32\dllcache\es.dll
+ 2008-07-07 20:32:22 253,952 -c--a-w C:\WINDOWS\system32\dllcache\es.dll
- 2008-03-01 13:06:21 133,120 -c--a-w C:\WINDOWS\system32\dllcache\extmgr.dll
+ 2008-06-23 16:57:27 133,120 -c--a-w C:\WINDOWS\system32\dllcache\extmgr.dll
- 2008-03-01 13:06:21 63,488 -c----w C:\WINDOWS\system32\dllcache\icardie.dll
+ 2008-06-23 16:57:28 63,488 -c----w C:\WINDOWS\system32\dllcache\icardie.dll
- 2008-02-29 08:55:23 70,656 -c--a-w C:\WINDOWS\system32\dllcache\ie4uinit.exe
+ 2008-06-23 09:20:25 70,656 -c--a-w C:\WINDOWS\system32\dllcache\ie4uinit.exe
- 2008-03-01 13:06:21 153,088 -c--a-w C:\WINDOWS\system32\dllcache\ieakeng.dll
+ 2008-06-23 16:57:29 153,088 -c--a-w C:\WINDOWS\system32\dllcache\ieakeng.dll
- 2008-03-01 13:06:21 230,400 -c--a-w C:\WINDOWS\system32\dllcache\ieaksie.dll
+ 2008-06-23 16:57:29 230,400 -c--a-w C:\WINDOWS\system32\dllcache\ieaksie.dll
- 2008-02-15 05:44:25 161,792 -c--a-w C:\WINDOWS\system32\dllcache\ieakui.dll
+ 2008-06-21 05:23:54 161,792 -c--a-w C:\WINDOWS\system32\dllcache\ieakui.dll
- 2008-03-01 13:06:22 383,488 -c----w C:\WINDOWS\system32\dllcache\ieapfltr.dll
+ 2008-06-23 16:57:29 383,488 -c----w C:\WINDOWS\system32\dllcache\ieapfltr.dll
- 2008-03-01 13:06:22 384,512 -c--a-w C:\WINDOWS\system32\dllcache\iedkcs32.dll
+ 2008-06-23 16:57:29 384,512 -c--a-w C:\WINDOWS\system32\dllcache\iedkcs32.dll
- 2008-03-01 13:06:24 6,066,176 -c----w C:\WINDOWS\system32\dllcache\ieframe.dll
+ 2008-06-23 16:57:33 6,066,176 -c----w C:\WINDOWS\system32\dllcache\ieframe.dll
- 2008-03-01 13:06:24 44,544 -c--a-w C:\WINDOWS\system32\dllcache\iernonce.dll
+ 2008-06-23 16:57:33 44,544 -c--a-w C:\WINDOWS\system32\dllcache\iernonce.dll
- 2008-03-01 13:06:25 267,776 -c----w C:\WINDOWS\system32\dllcache\iertutil.dll
+ 2008-06-23 16:57:34 267,776 -c----w C:\WINDOWS\system32\dllcache\iertutil.dll
- 2008-02-22 10:00:51 13,824 -c----w C:\WINDOWS\system32\dllcache\ieudinit.exe
+ 2008-06-23 09:20:26 13,824 -c----w C:\WINDOWS\system32\dllcache\ieudinit.exe
- 2008-02-29 08:55:46 625,664 -c--a-w C:\WINDOWS\system32\dllcache\iexplore.exe
+ 2008-06-23 09:20:52 625,664 -c--a-w C:\WINDOWS\system32\dllcache\iexplore.exe
- 2007-08-21 06:15:44 683,520 -c--a-w C:\WINDOWS\system32\dllcache\inetcomm.dll
+ 2008-04-11 18:50:43 683,520 -c--a-w C:\WINDOWS\system32\dllcache\inetcomm.dll
- 2008-03-01 13:06:25 27,648 -c--a-w C:\WINDOWS\system32\dllcache\jsproxy.dll
+ 2008-06-23 16:57:35 27,648 -c--a-w C:\WINDOWS\system32\dllcache\jsproxy.dll
- 2006-02-28 12:00:00 331,776 -c--a-w C:\WINDOWS\system32\dllcache\msadce.dll
+ 2008-05-01 14:30:33 331,776 -c--a-w C:\WINDOWS\system32\dllcache\msadce.dll
- 2005-06-29 01:46:00 74,240 -c--a-w C:\WINDOWS\system32\dllcache\mscms.dll
+ 2008-06-24 16:23:05 74,240 -c--a-w C:\WINDOWS\system32\dllcache\mscms.dll
- 2006-02-28 12:00:00 294,400 -c--a-w C:\WINDOWS\system32\dllcache\msctf.dll
+ 2008-02-26 11:59:50 294,912 -c--a-w C:\WINDOWS\system32\dllcache\msctf.dll
- 2008-03-01 13:06:26 459,264 -c----w C:\WINDOWS\system32\dllcache\msfeeds.dll
+ 2008-06-23 16:57:36 459,264 -c----w C:\WINDOWS\system32\dllcache\msfeeds.dll
- 2008-03-01 13:06:26 52,224 -c----w C:\WINDOWS\system32\dllcache\msfeedsbs.dll
+ 2008-06-23 16:57:36 52,224 -c----w C:\WINDOWS\system32\dllcache\msfeedsbs.dll
- 2008-03-02 01:36:30 3,591,680 -c--a-w C:\WINDOWS\system32\dllcache\mshtml.dll
+ 2008-06-24 17:57:40 3,592,192 -c--a-w C:\WINDOWS\system32\dllcache\mshtml.dll
- 2008-03-01 13:06:28 478,208 -c--a-w C:\WINDOWS\system32\dllcache\mshtmled.dll
+ 2008-06-23 16:57:39 477,696 -c--a-w C:\WINDOWS\system32\dllcache\mshtmled.dll
- 2008-03-01 13:06:28 193,024 -c--a-w C:\WINDOWS\system32\dllcache\msrating.dll
+ 2008-06-23 16:57:39 193,024 -c--a-w C:\WINDOWS\system32\dllcache\msrating.dll
- 2008-03-01 13:06:29 671,232 -c--a-w C:\WINDOWS\system32\dllcache\mstime.dll
+ 2008-06-23 16:57:40 671,232 -c--a-w C:\WINDOWS\system32\dllcache\mstime.dll
- 2006-02-28 12:00:00 245,248 -c--a-w C:\WINDOWS\system32\dllcache\mswsock.dll
+ 2008-06-20 17:41:10 245,248 -c--a-w C:\WINDOWS\system32\dllcache\mswsock.dll
- 2008-03-01 13:06:29 102,912 -c--a-w C:\WINDOWS\system32\dllcache\occache.dll
+ 2008-06-23 16:57:40 102,912 -c--a-w C:\WINDOWS\system32\dllcache\occache.dll
- 2008-03-01 13:06:29 44,544 -c--a-w C:\WINDOWS\system32\dllcache\pngfilt.dll
+ 2008-06-23 16:57:40 44,544 -c--a-w C:\WINDOWS\system32\dllcache\pngfilt.dll
- 2007-10-29 22:43:03 1,287,680 -c--a-w C:\WINDOWS\system32\dllcache\quartz.dll
+ 2008-05-07 05:18:48 1,287,680 -c--a-w C:\WINDOWS\system32\dllcache\quartz.dll
- 2006-07-13 08:48:58 202,240 -c--a-w C:\WINDOWS\system32\dllcache\rmcast.sys
+ 2008-05-08 12:28:49 202,752 -c--a-w C:\WINDOWS\system32\dllcache\rmcast.sys
- 2007-10-30 17:20:55 360,064 -c--a-w C:\WINDOWS\system32\dllcache\tcpip.sys
+ 2008-06-20 10:45:13 360,320 -c--a-w C:\WINDOWS\system32\dllcache\tcpip.sys
- 2006-08-16 09:37:30 225,664 -c--a-w C:\WINDOWS\system32\dllcache\tcpip6.sys
+ 2008-06-20 09:52:06 225,920 -c--a-w C:\WINDOWS\system32\dllcache\tcpip6.sys
- 2008-03-01 13:06:29 105,984 -c--a-w C:\WINDOWS\system32\dllcache\url.dll
+ 2008-06-23 16:57:40 105,984 -c--a-w C:\WINDOWS\system32\dllcache\url.dll
- 2008-03-01 13:06:30 1,159,680 -c--a-w C:\WINDOWS\system32\dllcache\urlmon.dll
+ 2008-06-23 16:57:40 1,159,680 -c--a-w C:\WINDOWS\system32\dllcache\urlmon.dll
- 2008-03-01 13:06:30 233,472 -c--a-w C:\WINDOWS\system32\dllcache\webcheck.dll
+ 2008-06-23 16:57:41 233,472 -c--a-w C:\WINDOWS\system32\dllcache\webcheck.dll
- 2008-03-01 13:06:31 826,368 -c--a-w C:\WINDOWS\system32\dllcache\wininet.dll
+ 2008-06-23 16:57:41 826,368 -c--a-w C:\WINDOWS\system32\dllcache\wininet.dll
- 2008-02-20 05:32:43 148,992 ----a-w C:\WINDOWS\system32\dnsapi.dll
+ 2008-06-20 17:41:10 148,992 ----a-w C:\WINDOWS\system32\dnsapi.dll
- 2006-02-28 12:00:00 138,496 ----a-w C:\WINDOWS\system32\drivers\afd.sys
+ 2008-06-20 10:44:38 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
- 2006-07-13 08:48:58 202,240 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
+ 2008-05-08 12:28:49 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
- 2007-10-30 17:20:55 360,064 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
+ 2008-06-20 10:45:13 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
- 2006-08-16 09:37:30 225,664 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
+ 2008-06-20 09:52:06 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
- 2008-03-01 13:06:21 347,136 ----a-w C:\WINDOWS\system32\dxtmsft.dll
+ 2008-06-23 16:57:27 347,136 ----a-w C:\WINDOWS\system32\dxtmsft.dll
- 2008-03-01 13:06:21 214,528 ----a-w C:\WINDOWS\system32\dxtrans.dll
+ 2008-06-23 16:57:27 214,528 ----a-w C:\WINDOWS\system32\dxtrans.dll
- 2008-03-01 13:06:21 133,120 ----a-w C:\WINDOWS\system32\extmgr.dll
+ 2008-06-23 16:57:27 133,120 ----a-w C:\WINDOWS\system32\extmgr.dll
- 2008-03-01 13:06:21 63,488 ----a-w C:\WINDOWS\system32\icardie.dll
+ 2008-06-23 16:57:28 63,488 ----a-w C:\WINDOWS\system32\icardie.dll
- 2008-02-29 08:55:23 70,656 ----a-w C:\WINDOWS\system32\ie4uinit.exe
+ 2008-06-23 09:20:25 70,656 ----a-w C:\WINDOWS\system32\ie4uinit.exe
- 2008-03-01 13:06:21 153,088 ----a-w C:\WINDOWS\system32\ieakeng.dll
+ 2008-06-23 16:57:29 153,088 ----a-w C:\WINDOWS\system32\ieakeng.dll
- 2008-03-01 13:06:21 230,400 ----a-w C:\WINDOWS\system32\ieaksie.dll
+ 2008-06-23 16:57:29 230,400 ----a-w C:\WINDOWS\system32\ieaksie.dll
- 2008-02-15 05:44:25 161,792 ----a-w C:\WINDOWS\system32\ieakui.dll
+ 2008-06-21 05:23:54 161,792 ----a-w C:\WINDOWS\system32\ieakui.dll
- 2008-03-01 13:06:22 383,488 ----a-w C:\WINDOWS\system32\ieapfltr.dll
+ 2008-06-23 16:57:29 383,488 ----a-w C:\WINDOWS\system32\ieapfltr.dll
- 2008-03-01 13:06:22 384,512 ----a-w C:\WINDOWS\system32\iedkcs32.dll
+ 2008-06-23 16:57:29 384,512 ----a-w C:\WINDOWS\system32\iedkcs32.dll
- 2008-03-01 13:06:24 6,066,176 ----a-w C:\WINDOWS\system32\ieframe.dll
+ 2008-06-23 16:57:33 6,066,176 ----a-w C:\WINDOWS\system32\ieframe.dll
- 2008-03-01 13:06:24 44,544 ----a-w C:\WINDOWS\system32\iernonce.dll
+ 2008-06-23 16:57:33 44,544 ----a-w C:\WINDOWS\system32\iernonce.dll
- 2008-03-01 13:06:25 267,776 ----a-w C:\WINDOWS\system32\iertutil.dll
+ 2008-06-23 16:57:34 267,776 ----a-w C:\WINDOWS\system32\iertutil.dll
- 2008-02-22 10:00:51 13,824 ----a-w C:\WINDOWS\system32\ieudinit.exe
+ 2008-06-23 09:20:26 13,824 ----a-w C:\WINDOWS\system32\ieudinit.exe
- 2007-08-21 06:15:44 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
+ 2008-04-11 18:50:43 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
- 2008-03-01 13:06:25 27,648 ----a-w C:\WINDOWS\system32\jsproxy.dll
+ 2008-06-23 16:57:35 27,648 ----a-w C:\WINDOWS\system32\jsproxy.dll
- 2006-02-28 12:00:00 294,400 ----a-w C:\WINDOWS\system32\MSCTF.dll
+ 2008-02-26 11:59:50 294,912 ----a-w C:\WINDOWS\system32\msctf.dll
- 2008-03-01 13:06:26 459,264 ----a-w C:\WINDOWS\system32\msfeeds.dll
+ 2008-06-23 16:57:36 459,264 ----a-w C:\WINDOWS\system32\msfeeds.dll
- 2008-03-01 13:06:26 52,224 ----a-w C:\WINDOWS\system32\msfeedsbs.dll
+ 2008-06-23 16:57:36 52,224 ----a-w C:\WINDOWS\system32\msfeedsbs.dll
- 2008-03-02 01:36:30 3,591,680 ----a-w C:\WINDOWS\system32\mshtml.dll
+ 2008-06-24 17:57:40 3,592,192 ----a-w C:\WINDOWS\system32\mshtml.dll
- 2008-03-01 13:06:28 478,208 ----a-w C:\WINDOWS\system32\mshtmled.dll
+ 2008-06-23 16:57:39 477,696 ----a-w C:\WINDOWS\system32\mshtmled.dll
- 2008-03-01 13:06:28 193,024 ----a-w C:\WINDOWS\system32\msrating.dll
+ 2008-06-23 16:57:39 193,024 ----a-w C:\WINDOWS\system32\msrating.dll
- 2008-03-01 13:06:29 671,232 ----a-w C:\WINDOWS\system32\mstime.dll
+ 2008-06-23 16:57:40 671,232 ----a-w C:\WINDOWS\system32\mstime.dll
- 2008-03-01 13:06:29 102,912 ----a-w C:\WINDOWS\system32\occache.dll
+ 2008-06-23 16:57:40 102,912 ----a-w C:\WINDOWS\system32\occache.dll
- 2008-03-01 13:06:29 44,544 ----a-w C:\WINDOWS\system32\pngfilt.dll
+ 2008-06-23 16:57:40 44,544 ----a-w C:\WINDOWS\system32\pngfilt.dll
- 2007-10-29 22:43:03 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
+ 2008-05-07 05:18:48 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
- 2007-03-06 01:22:33 14,048 ------w C:\WINDOWS\system32\spmsg.dll
+ 2007-11-30 11:18:51 17,272 ------w C:\WINDOWS\system32\spmsg.dll
- 2007-11-13 11:31:11 60,416 ----a-w C:\WINDOWS\system32\tzchange.exe
+ 2008-07-14 11:09:18 62,976 ----a-w C:\WINDOWS\system32\tzchange.exe
- 2008-03-01 13:06:29 105,984 ----a-w C:\WINDOWS\system32\url.dll
+ 2008-06-23 16:57:40 105,984 ----a-w C:\WINDOWS\system32\url.dll
- 2008-03-01 13:06:30 1,159,680 ----a-w C:\WINDOWS\system32\urlmon.dll
+ 2008-06-23 16:57:40 1,159,680 ----a-w C:\WINDOWS\system32\urlmon.dll
- 2008-03-01 13:06:30 233,472 ----a-w C:\WINDOWS\system32\webcheck.dll
+ 2008-06-23 16:57:41 233,472 ----a-w C:\WINDOWS\system32\webcheck.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{93344865-74BD-4873-BE65-56539D41A65C}"= "C:\WINDOWS\Downloaded Program Files\Earn2Life.dll" [2007-05-14 18:18 303104]

[HKEY_CLASSES_ROOT\clsid\{93344865-74bd-4873-be65-56539d41a65c}]
[HKEY_CLASSES_ROOT\Earn2Life.LeadBar.1]
[HKEY_CLASSES_ROOT\TypeLib\{92F9C4A2-C2A5-41f6-9829-49B8C6FF0709}]
[HKEY_CLASSES_ROOT\Earn2Life.LeadBar]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-02-28 05:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24 286720]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-16 14:01 13529088]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-10-22 08:30 219136]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"SENTINEL"= snti386.dll
"VIDC.XFR1"= xfcodec.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^TrayMin200.exe.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\TrayMin200.exe.lnk
backup=C:\WINDOWS\pss\TrayMin200.exe.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Okiphia Fatali^Start Menu^Programs^Startup^Xfire.lnk]
path=C:\Documents and Settings\Okiphia Fatali\Start Menu\Programs\Startup\Xfire.lnk
backup=C:\WINDOWS\pss\Xfire.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
C:\WINDOWS\system32\dumprep 0 -k [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\36X Raid Configurer]
-ra------ 2007-02-06 05:08 1953792 C:\WINDOWS\system32\JMRaidSetup.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC]
--a------ 2008-04-21 09:32 579584 C:\PROGRA~1\Grisoft\AVG7\avgcc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2006-02-28 05:00 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EA Core]
--a------ 2008-05-16 18:16 2732032 C:\Program Files\Electronic Arts\EADM\Core.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EasyTuneV]
--a------ 2007-04-26 15:50 24576 C:\Program Files\Gigabyte\ET5\ETcall.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ]
--a------ 2007-12-19 07:48 172280 C:\Program Files\ICQ6\ICQ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2007-09-26 14:42 267064 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\JMB36X IDE Setup]
-r------- 2006-10-30 05:44 36864 C:\WINDOWS\JM\JMInsIDE.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KMCONFIG]
--a------ 2007-03-06 14:51 212992 C:\Program Files\Micro Innovations\Wireless Keyboard & Mouse Driver\StartAutorun.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2004-10-13 09:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-01-19 12:54 5674352 C:\Program Files\MSN Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 2008-05-16 14:01 13529088 C:\WINDOWS\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
--a------ 2008-05-16 14:01 86016 C:\WINDOWS\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-ra------ 2008-02-01 18:22 21898024 C:\Program Files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
-rahs---- 2008-01-28 11:43 2097488 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
--a------ 2008-06-16 15:21 1271032 c:\Program Files\Steam\steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
--a------ 2007-08-15 12:23 68856 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2007-05-14 15:22 35328 C:\Program Files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
--a------ 2007-07-16 15:17 4670704 C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
-r------- 2005-05-03 03:43 69632 C:\WINDOWS\Alcmtr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2008-05-16 14:01 1630208 C:\WINDOWS\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
-r------- 2007-04-12 02:33 16132608 C:\WINDOWS\RTHDCPL.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Sony\\EverQuest II\\LaunchPad.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\mIRC\\mirc.exe"=
"C:\\Program Files\\Xfire\\xfire.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\ICQ6\\ICQ.exe"=
"C:\\Program Files\\America's Army\\System\\ArmyOps.exe"=
"C:\\Program Files\\SecondLife\\SLVoice.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\SecondLifeWindLight\\SLVoice.exe"=
"C:\\Program Files\\SecondLife\\SecondLife.exe"=
"C:\\Program Files\\Autodesk\\Maya 8.5 Personal Learning Edition\\bin\\maya.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\Program Files\\SecondLifeReleaseCandidate\\SLVoice.exe"=
"C:\\Program Files\\Turbine\\The Lord of the Rings Online\\lotroclient.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Ahead\\SIPPS\\SIPPS.exe"=
"C:\\Program Files\\Steam\\steamapps\\okiphiarayna\\team fortress 2\\hl2.exe"=
"C:\\Program Files\\Electronic Arts\\EADM\\Core.exe"=
"C:\\Program Files\\SecondLifeMono\\SLVoice.exe"=
"C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
"C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"C:\\Program Files\\Sony\\EverQuest II\\EverQuest2.exe"=
"C:\\Program Files\\FlightGear\\bin\\win32\\fgfs.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1700:TCP"= 1700:TCP:MioNet Remote Drive Access
"1641:TCP"= 1641:TCP:MioNet Remote Drive Verification

R0 pavboot;pavboot;C:\WINDOWS\system32\drivers\pavboot.sys [2008-06-19 17:24]
R2 AdobeActiveFileMonitor;Adobe Active File Monitor;C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe [2004-10-04 04:47]
R2 KMWDSERVICE;Keyboard And Mouse Communication Service;C:\Program Files\Micro Innovations\Wireless Keyboard & Mouse Driver\KMWDSrv.exe [2007-04-05 10:29]
R2 MioNet;MioNet Service;C:\Program Files\MioNet\MioNetManager.exe [2005-07-15 13:38]
R2 PhotoshopElementsDeviceConnect;Photoshop Elements Device Connect;C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe [2004-10-04 03:40]
R3 SCREAMINGBDRIVER;Screaming Bee Audio;C:\WINDOWS\system32\drivers\ScreamingBAudio.sys [2007-08-24 17:44]
R3 wacommousefilter;Wacom Mouse Filter Driver;C:\WINDOWS\system32\DRIVERS\wacommousefilter.sys [2007-02-16 12:12]
R3 wacomvhid;Wacom Virtual Hid Driver;C:\WINDOWS\system32\DRIVERS\wacomvhid.sys [2007-02-16 11:30]
S3 MarkFun_NT;MarkFun_NT;C:\Program Files\Gigabyte\ET5\markfun.w32 [2007-01-12 18:34]

*Newly Created Service* - CATCHME
.
- - - - ORPHANS REMOVED - - - -

BHO-{05D94A99-829B-4321-967D-52495BB9C560} - (no file)
BHO-{0F826232-A771-43E4-B4B0-33EBBEBD9DB4} - (no file)
BHO-{2108EB67-E999-4BFE-B1DC-EB13CBE532C9} - (no file)
BHO-{2425B543-277C-43E0-A7F3-899440E67DDF} - (no file)
BHO-{5C6604D9-F366-4428-AD4D-F435A4B26252} - (no file)
BHO-{6368B5F7-2EE2-4E4C-925D-1E3D967F5EDE} - (no file)
BHO-{64C9DDDB-9189-4516-B4B9-3ADFA1B54E07} - (no file)
BHO-{C13D50C7-B777-4402-815C-617CE0EF9AF8} - (no file)
BHO-{C6606FC9-7CE5-42CA-94B6-057F34185BFC} - (no file)
BHO-{D6EA2814-C279-479C-A8D1-1559025C3CD2} - (no file)
BHO-{DFA762CF-867A-4F48-90FF-72308F1A57DB} - (no file)
BHO-{F38BB5DD-E0A5-4BAE-9503-695141A65ECd} - (no file)

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-25 10:40:39
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\MarkFun_NT]
"ImagePath"="\??\C:\Program Files\Gigabyte\ET5\markfun.w32"
.
Completion time: 2008-08-25 10:48:36
ComboFix-quarantined-files.txt 2008-08-25 17:47:40
ComboFix2.txt 2008-08-23 23:35:19
ComboFix3.txt 2008-08-23 18:06:26

Pre-Run: 171,263,242,240 bytes free
Post-Run: 171,295,195,136 bytes free

481 --- E O F --- 2008-08-24 16:36:40

HijackThis Log
==================

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:44:51 PM, on 8/25/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Micro Innovations\Wireless Keyboard & Mouse Driver\KMWDSrv.exe
C:\Program Files\MioNet\MioNetManager.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Tablet.exe
C:\Program Files\MioNet\jvm\bin\MioNet.exe
C:\WINDOWS\system32\WTablet\TabUserW.exe
C:\WINDOWS\system32\Tablet.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://forums.secondlife.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: (no name) - {05D94A99-829B-4321-967D-52495BB9C560} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Earn2Life Bar - {93344865-74BD-4873-BE65-56539D41A65C} - C:\WINDOWS\Downloaded Program Files\Earn2Life.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE /auto
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O9 - Extra button: Earn2Life Bar - {07328B93-AFD8-4c6a-99E9-D0B3B5D6DAD9} - C:\WINDOWS\Downloaded Program Files\Earn2Life.dll
O9 - Extra 'Tools' menuitem: Earn2Life Bar - {07328B93-AFD8-4c6a-99E9-D0B3B5D6DAD9} - C:\WINDOWS\Downloaded Program Files\Earn2Life.dll
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1219336830093
O16 - DPF: {93344865-74BD-4873-BE65-56539D41A65C} (Earn2Life Bar) - http://www.earn2life.com/plugin/Earn2Life.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/...ampx_en_dl.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe Active File Monitor (AdobeActiveFileMonitor) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Keyboard And Mouse Communication Service (KMWDSERVICE) - UASSOFT.COM - C:\Program Files\Micro Innovations\Wireless Keyboard & Mouse Driver\KMWDSrv.exe
O23 - Service: MioNet Service (MioNet) - Unknown owner - C:\Program Files\MioNet\MioNetManager.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Photoshop Elements Device Connect (PhotoshopElementsDeviceConnect) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe

--
End of file - 7845 bytes

alba · 08-25-2008, 02:17 PM

Hi Keira_Wells

Your logs are clean

=================

The following procedure will clear out the tools we've used as well as the backups and quarantines created by the fix. It will also reset your System Restore by flushing out previous restore points (which contain the infections) and create a new restore point.

Click Start > Run and copy/paste, or type the following bolded text into the Run box and click OK:

ComboFix /u

To help protect your computer in the future I recommend that you get the following free programs if you do not already have them:

McAfee Site Advisor--free version. The folks there check out websites and based on their findings, rate it as Safe, Unknown, Caution, or Bad.

SpywareBlaster 3.5.1 to help prevent spyware from installing in the first place. Install & update SpywareBlaster with the latest definitions. After you have updated, click the button - enable protection for all unprotected items.

It will block any bad ActiveX from running in Internet Explorer and Firefox if it's listed in their database (which you should update frequently). To view their database and list of restricted sites, launch the program and click on each of the tabs on the main display page.

IESpyAD Zoned Out to block access to malicious websites so you cannot be redirected to them from an infected site or email. This severely impairs attempts to infect your system as it basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites.

Update, and scan with your onboard Anti Malware and Anti Virus programs regularly. Without regular updates you will not be protected when new malicious programs are released.

In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles:

PC Safety and Security--What Do I Need?

HOW DID I GET INFECTED IN THE FIRST PLACE? by Tony Klein
MAKING INTERNET EXPLORER SAFER

**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.

-----------------------------------------------------

Follow the list above and the potential for infection will reduce dramatically.

Please respond to this thread one more time so we can mark this thread as resolved.

Keira_Wells · 08-25-2008, 02:37 PM

Thank you much!

You rock. TSF rocks.

Everything rocks ^-^

08-23-2008, 10:36 AM	#2 (permalink)
alba Analyst, Security Team Join Date: Feb 2005 Location: Eire Posts: 2,006 OS: Vista, Ubuntu 8.04	Re: Blocked Web Access - Virtumonde Hi Keira_Wells Please cut and paste your future logs straight into your reply Do Not wrap them in code or quotes thanks Please read this post completely before begining the fix. If there's anything that you do not understand, kindly ask your questions before proceeding. Please ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix. We also suggest that you Subscribe to this thread to be notified of fixes as soon as they are posted by our Team. You can do this simply by clicking the "Thread Tools" button located in the original thread line and selecting "Subscribe to this Thread". IT IS IMPORTANT THAT YOU DON'T MISS A STEP & PERFORM EVERYTHING IN THE RIGHT ORDER. =============================================== We will begin with ComboFix.exe. Please visit this webpage for download links, and instructions for running the tool: http://www.bleepingcomputer.com/comb...o-use-combofix Please ensure you read this guide carefully and install the Recovery Console first. The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time. Once installed, you should see a blue screen prompt that says: The Recovery Console was successfully installed. Please continue as follows: Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. Click Yes to allow ComboFix to continue scanning for malware. When the tool is finished, it will produce a report for you. Please include the following reports for further review, and so we may continue cleansing the system: C:\ComboFix.txt New HijackThis log. __________________ Member of UNITE If I have helped you in anyway, please DONATE to TSF Go raibh maith agat

08-23-2008, 12:12 PM	#3 (permalink)
Keira_Wells Registered User Join Date: May 2008 Posts: 21 OS: Windows XP Home	Re: Blocked Web Access - Virtumonde The first run of Combofix, it ran, and it got to the 'Preparing Log File' bit, and went to the bathroom, and when I came back it was at the Windows Login screen, and when I logged in, Combofix didn't do anything, and when I looked for the log file, it didn't exist. So, I ran it again, and it created a log file this time. I'm hoping that it shows needed information. ComboFix Log File =============================== ComboFix 08-08-21.02 - Okiphia Fatali 2008-08-23 10:50:57.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.2634 [GMT -7:00] Running from: C:\Documents and Settings\Okiphia Fatali\Desktop\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . ---- Previous Run ------- . C:\Documents and Settings\Okiphia Fatali\Application Data\macromedia\Flash Player\#SharedObjects\CYAMCAYP\interclick.com C:\Documents and Settings\Okiphia Fatali\Application Data\macromedia\Flash Player\#SharedObjects\CYAMCAYP\interclick.com\ud.sol C:\Documents and Settings\Okiphia Fatali\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com C:\Documents and Settings\Okiphia Fatali\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol C:\install.exe C:\WINDOWS\BM6b90ceb9.txt C:\WINDOWS\BM6b90ceb9.xml C:\WINDOWS\cookies.ini C:\WINDOWS\Downloaded Program Files\setup.inf C:\WINDOWS\OPTIONS\CABS\_desktop.ini C:\WINDOWS\pskt.ini C:\WINDOWS\system32\aapaqmfm.ini C:\WINDOWS\system32\abxpjpxo.dll C:\WINDOWS\system32\accxik.dll C:\WINDOWS\system32\adqalvpl.ini C:\WINDOWS\system32\aefsnr.dll C:\WINDOWS\system32\agyhvhei.ini C:\WINDOWS\system32\anqtojjm.ini C:\WINDOWS\system32\aphptrjk.dll C:\WINDOWS\system32\auqltvpf.exe C:\WINDOWS\system32\avbxpr.dll C:\WINDOWS\system32\avossg.dll C:\WINDOWS\system32\avstjbwr.dll C:\WINDOWS\system32\ayshnjfh.dll C:\WINDOWS\system32\bassqjmi.ini C:\WINDOWS\system32\bccpjnmg.ini C:\WINDOWS\system32\bftstbld.ini C:\WINDOWS\system32\bjutdokb.ini C:\WINDOWS\system32\bpuomkud.ini C:\WINDOWS\system32\bqehuvoe.ini C:\WINDOWS\system32\bqujeifi.dll C:\WINDOWS\system32\buepcyaf.ini C:\WINDOWS\system32\buthhvux.ini C:\WINDOWS\system32\carebkhk.ini C:\WINDOWS\system32\cfdakhbg.ini C:\WINDOWS\system32\ckbhabak.dll C:\WINDOWS\system32\clhvaavk.dll C:\WINDOWS\system32\cpscgmkx.dll C:\WINDOWS\system32\cqwifeaf.ini C:\WINDOWS\system32\ctrtlyfj.ini C:\WINDOWS\system32\cukxwxkv.ini C:\WINDOWS\system32\cuydchsb.ini C:\WINDOWS\system32\cwcrcpyl.ini C:\WINDOWS\system32\cwqhjjpc.ini C:\WINDOWS\system32\cxucastr.ini C:\WINDOWS\system32\czjpcc.dll C:\WINDOWS\system32\dfgpsktg.ini C:\WINDOWS\system32\diucmcsc.dll C:\WINDOWS\system32\dkdfyt.dll C:\WINDOWS\system32\dqidfnjr.ini C:\WINDOWS\system32\dsgmhaeu.ini C:\WINDOWS\system32\dxdjocyp.ini C:\WINDOWS\system32\edghgvim.dll C:\WINDOWS\system32\eixrbblg.dll C:\WINDOWS\system32\ejkqfedl.dll C:\WINDOWS\system32\enwaqtkg.dll C:\WINDOWS\system32\enyxnmfv.dll C:\WINDOWS\system32\epaictlh.ini C:\WINDOWS\system32\epvvdelf.dll C:\WINDOWS\system32\erpumqpq.dll C:\WINDOWS\system32\eslgudoh.ini C:\WINDOWS\system32\ettuvbwe.dll C:\WINDOWS\system32\euaciggv.dll C:\WINDOWS\system32\eyirrmop.ini C:\WINDOWS\system32\feruukdm.ini C:\WINDOWS\system32\ffraudss.ini C:\WINDOWS\system32\fgfpxcdc.dll C:\WINDOWS\system32\fjboelug.dll C:\WINDOWS\system32\fjevkw.dll C:\WINDOWS\system32\fkhmvd.dll C:\WINDOWS\system32\fpefbrln.dll C:\WINDOWS\system32\fpucbf.dll C:\WINDOWS\system32\funpnwvp.ini C:\WINDOWS\system32\fxtady.dll C:\WINDOWS\system32\gakcmpgf.ini C:\WINDOWS\system32\gdvnoetn.dll C:\WINDOWS\system32\geenaggm.dll C:\WINDOWS\system32\ghojhlob.dll C:\WINDOWS\system32\glbbrxie.ini C:\WINDOWS\system32\gljnvsqd.ini C:\WINDOWS\system32\gmfntucc.ini C:\WINDOWS\system32\gnkwlv.dll C:\WINDOWS\system32\gsipoxfu.dll C:\WINDOWS\system32\gxsuublf.dll C:\WINDOWS\system32\habersxh.dll C:\WINDOWS\system32\hdsovmoo.dll C:\WINDOWS\system32\heddyebl.ini C:\WINDOWS\system32\hfbxcuwh.ini C:\WINDOWS\system32\hfhvocrw.dll C:\WINDOWS\system32\hjbbtp.dll C:\WINDOWS\system32\hkhmacpr.dll C:\WINDOWS\system32\hmvprotp.dll C:\WINDOWS\system32\hoicmoxh.dll C:\WINDOWS\system32\htmtwmoy.dll C:\WINDOWS\system32\hxsrebah.ini C:\WINDOWS\system32\ianpnqfi.dll C:\WINDOWS\system32\ibjtyf.dll C:\WINDOWS\system32\ibmkgwnd.ini C:\WINDOWS\system32\idcxmwsp.dll C:\WINDOWS\system32\idrvglks.dll C:\WINDOWS\system32\idxkfq.dll C:\WINDOWS\system32\ietpjwoc.ini C:\WINDOWS\system32\iihwsuba.ini C:\WINDOWS\system32\iqaglfsv.ini C:\WINDOWS\system32\iqbhrtgj.ini C:\WINDOWS\system32\iqglqjgf.dll C:\WINDOWS\system32\irdxfobq.dll C:\WINDOWS\system32\ithglutx.ini C:\WINDOWS\system32\izzopq.dll C:\WINDOWS\system32\jkbieptn.dll C:\WINDOWS\system32\jpenqsoo.ini C:\WINDOWS\system32\jphxwmvk.dll C:\WINDOWS\system32\jqoyrsek.ini C:\WINDOWS\system32\jqwwvqpe.dll C:\WINDOWS\system32\jtltrq.dll C:\WINDOWS\system32\jwksarhu.dll C:\WINDOWS\system32\jyhrmp.dll C:\WINDOWS\system32\jyvgle.dll C:\WINDOWS\system32\kckudexa.dll C:\WINDOWS\system32\kdkyhpdc.dll C:\WINDOWS\system32\kjabkspn.dll C:\WINDOWS\system32\kjsvjy.dll C:\WINDOWS\system32\lkomjfqo.dll C:\WINDOWS\system32\llofgwrw.dll C:\WINDOWS\system32\lmrvremy.dll C:\WINDOWS\system32\LmVvCJjl.ini C:\WINDOWS\system32\LmVvCJjl.ini2 C:\WINDOWS\system32\lnklwecn.ini C:\WINDOWS\system32\lnusfyob.dll C:\WINDOWS\system32\loklufma.dll C:\WINDOWS\system32\lrwairwg.dll C:\WINDOWS\system32\lxaenx.dll C:\WINDOWS\system32\mafdtkbp.ini C:\WINDOWS\system32\mcrh.tmp C:\WINDOWS\system32\mdibhsjp.dll C:\WINDOWS\system32\mhztdj.dll C:\WINDOWS\system32\mkeftb.dll C:\WINDOWS\system32\mktmaqle.dll C:\WINDOWS\system32\mlulrfio.dll C:\WINDOWS\system32\mlxtxynw.dll C:\WINDOWS\system32\mmavvqyy.dll C:\WINDOWS\system32\mppcqcog.dll C:\WINDOWS\system32\mqqbteja.ini C:\WINDOWS\system32\muupqomq.dll C:\WINDOWS\system32\ngbdcfte.dll C:\WINDOWS\system32\ngcwaytb.ini C:\WINDOWS\system32\ngrnicrx.dll C:\WINDOWS\system32\nhqxswtw.dll C:\WINDOWS\system32\nhroxocj.ini C:\WINDOWS\system32\nntgscao.dll C:\WINDOWS\system32\npmllh.dll C:\WINDOWS\system32\nqcjsxwb.dll C:\WINDOWS\system32\nuwqynex.ini C:\WINDOWS\system32\ofqyicte.dll C:\WINDOWS\system32\ogmbxgvw.ini C:\WINDOWS\system32\ohfogdkw.dll C:\WINDOWS\system32\omdbwrri.ini C:\WINDOWS\system32\onktfipd.ini C:\WINDOWS\system32\oovrrxww.ini C:\WINDOWS\system32\otghwkpr.ini C:\WINDOWS\system32\ouvmpigv.dll C:\WINDOWS\system32\ouwscpaq.dll C:\WINDOWS\system32\oyrrlg.dll C:\WINDOWS\system32\pbepaenu.ini C:\WINDOWS\system32\pcrklcxo.dll C:\WINDOWS\system32\pfkqihes.dll C:\WINDOWS\system32\pgtqokrl.dll C:\WINDOWS\system32\pmnmnLBQ.dll C:\WINDOWS\system32\poycaq.dll C:\WINDOWS\system32\prkgvdsi.ini C:\WINDOWS\system32\ptahddvd.ini C:\WINDOWS\system32\pthreadVC.dll C:\WINDOWS\system32\pudameau.ini C:\WINDOWS\system32\pvabnkfw.dll C:\WINDOWS\system32\pxgmpqbp.dll C:\WINDOWS\system32\QBLnmnmp.ini C:\WINDOWS\system32\QBLnmnmp.ini2 C:\WINDOWS\system32\qhbxtwoo.dll C:\WINDOWS\system32\qmnikhbw.dll C:\WINDOWS\system32\qnygphkq.ini C:\WINDOWS\system32\qougxlvr.ini C:\WINDOWS\system32\qqloib.dll C:\WINDOWS\system32\qrwxtl.dll C:\WINDOWS\system32\qufmnewh.ini C:\WINDOWS\system32\qvwipncu.ini C:\WINDOWS\system32\qwfvse.dll C:\WINDOWS\system32\racwfwhy.dll C:\WINDOWS\system32\raezsv.dll C:\WINDOWS\system32\rcytcn.dll C:\WINDOWS\system32\rdojdfso.dll C:\WINDOWS\system32\riwinals.dll C:\WINDOWS\system32\rmdejrvo.dll C:\WINDOWS\system32\rngeqxbl.ini C:\WINDOWS\system32\rpvnfwnm.ini C:\WINDOWS\system32\rqkuuisx.dll C:\WINDOWS\system32\rvnvrfrf.dll C:\WINDOWS\system32\rwwbhuft.ini C:\WINDOWS\system32\sievdr.dll C:\WINDOWS\system32\sjocpvdr.ini C:\WINDOWS\system32\sqhltqlr.ini C:\WINDOWS\system32\sxihhsuu.ini C:\WINDOWS\system32\tcnksqjl.dll C:\WINDOWS\system32\thnrylev.dll C:\WINDOWS\system32\tmknwuwd.dll C:\WINDOWS\system32\tvyytmge.ini C:\WINDOWS\system32\twdiwkbr.ini C:\WINDOWS\system32\twfuxe.dll C:\WINDOWS\system32\uaoykwxu.dll C:\WINDOWS\system32\ubdpadpq.dll C:\WINDOWS\system32\ubdrscvj.ini C:\WINDOWS\system32\ubiytkrv.ini C:\WINDOWS\system32\uetydsns.dll C:\WINDOWS\system32\ugalgz.dll C:\WINDOWS\system32\uouawqcc.ini C:\WINDOWS\system32\uqlkokkx.dll C:\WINDOWS\system32\uuqcpijf.ini C:\WINDOWS\system32\uuyvby.dll C:\WINDOWS\system32\uwnscqnw.ini C:\WINDOWS\system32\vdfvxpwl.dll C:\WINDOWS\system32\vgadlaiq.dll C:\WINDOWS\system32\vucbco.dll C:\WINDOWS\system32\vurrrj.dll C:\WINDOWS\system32\vwgwkbgf.dll C:\WINDOWS\system32\vwjbveel.dll C:\WINDOWS\system32\vxxmdypw.dll C:\WINDOWS\system32\wcstoneq.ini C:\WINDOWS\system32\weyeywwg.dll C:\WINDOWS\system32\wnfjbuua.ini C:\WINDOWS\system32\wnukqfdi.dll C:\WINDOWS\system32\wqdngqhg.dll C:\WINDOWS\system32\wrdwsisw.dll C:\WINDOWS\system32\wrpsssff.ini C:\WINDOWS\system32\wthfldew.ini C:\WINDOWS\system32\wubtwz.dll C:\WINDOWS\system32\wuvduy.dll C:\WINDOWS\system32\wvUlihff.dll C:\WINDOWS\system32\wwxrrvoo.dll C:\WINDOWS\system32\wyisjqij.ini C:\WINDOWS\system32\xefmkgyg.dll C:\WINDOWS\system32\xenyqwun.dll C:\WINDOWS\system32\xgeanxfh.dll C:\WINDOWS\system32\xgfake.dll C:\WINDOWS\system32\xieppsty.dll C:\WINDOWS\system32\xmwmdekv.dll C:\WINDOWS\system32\xneerrfb.ini C:\WINDOWS\system32\xrqmahts.dll C:\WINDOWS\system32\xugpgg.dll C:\WINDOWS\system32\xutiamsd.ini C:\WINDOWS\system32\xvdoooir.dll C:\WINDOWS\system32\ydbzgh.dll C:\WINDOWS\system32\ydccfffe.dll C:\WINDOWS\system32\ydoyssjf.dll C:\WINDOWS\system32\yfeclpbw.ini C:\WINDOWS\system32\yfggvwlf.ini C:\WINDOWS\system32\ymfiavfe.dll C:\WINDOWS\system32\yskplhdp.ini C:\WINDOWS\system32\yujzft.dll C:\WINDOWS\system32\yuxvnydk.dll C:\WINDOWS\system32\yvxadntw.exe C:\WINDOWS\system32\yybmriia.dll C:\WINDOWS\system32\zcrgja.dll C:\WINDOWS\system32\zojype.dll C:\WINDOWS\system32\zzwpvb.dll . ((((((((((((((((((((((((( Files Created from 2008-07-23 to 2008-08-23 ))))))))))))))))))))))))))))))) . 2008-08-23 08:12 . 2008-08-23 08:27 <DIR> d-------- C:\Documents and Settings\Okiphia Fatali\Application Data\flightgear.org 2008-08-23 08:11 . 2008-08-23 08:12 <DIR> d-------- C:\Program Files\FlightGear 2008-08-22 16:02 . 2008-08-22 16:03 <DIR> d-------- C:\Program Files\Phun 2008-08-22 15:36 . 2008-08-22 15:36 <DIR> d-------- C:\Program Files\Porrasturvat - Stair Dismount 2008-08-21 12:11 . 2008-05-19 18:16 186,407 --a------ C:\WINDOWS\system32\nvapps.nvb 2008-08-21 09:43 . 2008-08-21 09:43 <DIR> d-------- C:\Program Files\Trend Micro 2008-08-21 09:30 . 2008-08-21 09:30 <DIR> d-------- C:\ie-spyad_zo 2008-08-21 09:26 . 2008-08-21 09:26 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-08-21 09:26 . 2005-04-15 20:58 1,071,088 --a------ C:\WINDOWS\system32\MSCOMCTL.OCX 2008-08-21 09:26 . 2005-08-25 19:18 118,784 --a------ C:\WINDOWS\system32\MSSTDFMT.DLL 2008-08-21 07:24 . 2008-06-19 17:24 28,544 --a------ C:\WINDOWS\system32\drivers\pavboot.sys 2008-08-21 07:20 . 2008-08-21 07:20 <DIR> d-------- C:\Program Files\Panda Security 2008-08-19 14:42 . 2008-08-19 14:42 <DIR> d-------- C:\WINDOWS\nvidia icons 2008-08-19 14:40 . 2008-05-16 11:48 446,464 --a------ C:\WINDOWS\system32\NVUNINST.EXE . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-23 17:48 --------- d-----w C:\Documents and Settings\Okiphia Fatali\Application Data\WTablet 2008-08-23 17:40 --------- d-----w C:\Documents and Settings\LocalService\Application Data\WTablet 2008-07-28 05:47 --------- d-----w C:\Documents and Settings\Okiphia Fatali\Application Data\SPORE Creature Creator 2008-07-23 08:09 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-07-23 08:09 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2008-07-18 23:38 --------- d-----w C:\Documents and Settings\Okiphia Fatali\Application Data\AVG7 2008-07-17 22:48 --------- d-----w C:\Program Files\GameSpy 2008-07-17 22:47 22,328 ----a-w C:\Documents and Settings\Okiphia Fatali\Application Data\PnkBstrK.sys 2008-07-17 22:46 669,184 ----a-w C:\WINDOWS\system32\pbsvc.exe 2008-07-17 22:36 --------- d-----w C:\Program Files\Electronic Arts 2008-07-17 19:35 --------- d-----w C:\Program Files\SecondLifeMono 2008-07-16 20:14 --------- d-----w C:\Program Files\SecondLifeReleaseCandidate 2008-07-13 21:10 --------- d-----w C:\Program Files\ArchipelisDesigner 2008-07-03 03:22 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-06-29 01:13 --------- d--h--r C:\Documents and Settings\Okiphia Fatali\Application Data\SecuROM 2008-06-28 19:09 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2008-06-28 07:02 --------- d-----w C:\Program Files\JFK Reloaded 2008-06-11 23:55 41,296 ----a-w C:\WINDOWS\system32\xfcodec.dll 2008-06-11 03:38 147,456 ----a-w C:\WINDOWS\system32\imjqssab.dll 2008-05-31 01:09 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe 2008-03-04 02:27 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{93344865-74BD-4873-BE65-56539D41A65C}"= "C:\WINDOWS\Downloaded Program Files\Earn2Life.dll" [2007-05-14 18:18 303104] [HKEY_CLASSES_ROOT\clsid\{93344865-74bd-4873-be65-56539d41a65c}] [HKEY_CLASSES_ROOT\Earn2Life.LeadBar.1] [HKEY_CLASSES_ROOT\TypeLib\{92F9C4A2-C2A5-41f6-9829-49B8C6FF0709}] [HKEY_CLASSES_ROOT\Earn2Life.LeadBar] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-02-28 05:00 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24 286720] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-16 14:01 13529088] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-16 14:01 86016] "nwiz"="nwiz.exe" [2008-05-16 14:01 1630208 C:\WINDOWS\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-10-22 08:30 219136] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "SENTINEL"= snti386.dll "VIDC.XFR1"= xfcodec.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^TrayMin200.exe.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\TrayMin200.exe.lnk backup=C:\WINDOWS\pss\TrayMin200.exe.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^Okiphia Fatali^Start Menu^Programs^Startup^Xfire.lnk] path=C:\Documents and Settings\Okiphia Fatali\Start Menu\Programs\Startup\Xfire.lnk backup=C:\WINDOWS\pss\Xfire.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck] C:\WINDOWS\system32\dumprep 0 -k [X] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\36X Raid Configurer] -ra------ 2007-02-06 05:08 1953792 C:\WINDOWS\system32\JMRaidSetup.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC] --a------ 2008-04-21 09:32 579584 C:\PROGRA~1\Grisoft\AVG7\avgcc.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] --a------ 2006-02-28 05:00 15360 C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EA Core] --a------ 2008-05-16 18:16 2732032 C:\Program Files\Electronic Arts\EADM\Core.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EasyTuneV] --a------ 2007-04-26 15:50 24576 C:\Program Files\Gigabyte\ET5\ETcall.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ] --a------ 2007-12-19 07:48 172280 C:\Program Files\ICQ6\ICQ.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2007-09-26 14:42 267064 C:\Program Files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\JMB36X IDE Setup] -r------- 2006-10-30 05:44 36864 C:\WINDOWS\JM\JMInsIDE.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KMCONFIG] --a------ 2007-03-06 14:51 212992 C:\Program Files\Micro Innovations\Wireless Keyboard & Mouse Driver\StartAutorun.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --a------ 2004-10-13 09:24 1694208 C:\Program Files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr] --a------ 2007-01-19 12:54 5674352 C:\Program Files\MSN Messenger\msnmsgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] --a------ 2008-05-16 14:01 13529088 C:\WINDOWS\system32\nvcpl.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] --a------ 2008-05-16 14:01 86016 C:\WINDOWS\system32\nvmctray.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] -ra------ 2008-02-01 18:22 21898024 C:\Program Files\Skype\Phone\Skype.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer] -rahs---- 2008-01-28 11:43 2097488 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] --a------ 2008-06-16 15:21 1271032 c:\Program Files\Steam\steam.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] --a------ 2007-08-15 12:23 68856 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] --a------ 2007-05-14 15:22 35328 C:\Program Files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager] --a------ 2007-07-16 15:17 4670704 C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr] -r------- 2005-05-03 03:43 69632 C:\WINDOWS\Alcmtr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] --a------ 2008-05-16 14:01 1630208 C:\WINDOWS\system32\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL] -r------- 2007-04-12 02:33 16132608 C:\WINDOWS\RTHDCPL.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"= "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"= "C:\\Program Files\\MSN Messenger\\livecall.exe"= "C:\\Program Files\\Sony\\EverQuest II\\LaunchPad.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\mIRC\\mirc.exe"= "C:\\Program Files\\Xfire\\xfire.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"= "C:\\Program Files\\ICQ6\\ICQ.exe"= "C:\\Program Files\\America's Army\\System\\ArmyOps.exe"= "C:\\Program Files\\SecondLife\\SLVoice.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\Program Files\\SecondLifeWindLight\\SLVoice.exe"= "C:\\Program Files\\SecondLife\\SecondLife.exe"= "C:\\Program Files\\Autodesk\\Maya 8.5 Personal Learning Edition\\bin\\maya.exe"= "C:\\Program Files\\Mozilla Firefox\\firefox.exe"= "C:\\Program Files\\SecondLifeReleaseCandidate\\SLVoice.exe"= "C:\\Program Files\\Turbine\\The Lord of the Rings Online\\lotroclient.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= "C:\\Program Files\\Ahead\\SIPPS\\SIPPS.exe"= "C:\\Program Files\\Steam\\steamapps\\okiphiarayna\\team fortress 2\\hl2.exe"= "C:\\Program Files\\Electronic Arts\\EADM\\Core.exe"= "C:\\Program Files\\SecondLifeMono\\SLVoice.exe"= "C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"= "C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"= "C:\\WINDOWS\\system32\\PnkBstrA.exe"= "C:\\WINDOWS\\system32\\PnkBstrB.exe"= "C:\\Program Files\\Sony\\EverQuest II\\EverQuest2.exe"= "C:\\Program Files\\FlightGear\\bin\\win32\\fgfs.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "1700:TCP"= 1700:TCP:MioNet Remote Drive Access "1641:TCP"= 1641:TCP:MioNet Remote Drive Verification R0 pavboot;pavboot;C:\WINDOWS\system32\drivers\pavboot.sys [2008-06-19 17:24] R2 AdobeActiveFileMonitor;Adobe Active File Monitor;C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe [2004-10-04 04:47] R2 KMWDSERVICE;Keyboard And Mouse Communication Service;C:\Program Files\Micro Innovations\Wireless Keyboard & Mouse Driver\KMWDSrv.exe [2007-04-05 10:29] R2 MioNet;MioNet Service;C:\Program Files\MioNet\MioNetManager.exe [2005-07-15 13:38] R2 PhotoshopElementsDeviceConnect;Photoshop Elements Device Connect;C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe [2004-10-04 03:40] R3 SCREAMINGBDRIVER;Screaming Bee Audio;C:\WINDOWS\system32\drivers\ScreamingBAudio.sys [2007-08-24 17:44] R3 wacommousefilter;Wacom Mouse Filter Driver;C:\WINDOWS\system32\DRIVERS\wacommousefilter.sys [2007-02-16 12:12] R3 wacomvhid;Wacom Virtual Hid Driver;C:\WINDOWS\system32\DRIVERS\wacomvhid.sys [2007-02-16 11:30] S3 MarkFun_NT;MarkFun_NT;C:\Program Files\Gigabyte\ET5\markfun.w32 [2007-01-12 18:34] . - - - - ORPHANS REMOVED - - - - BHO-{2F12212C-86CC-48BE-9A0D-AEDD97A5FD45} - C:\Documents and Settings\Okiphia Fatali\Local Settings\Temporary Internet Files\Content.IE5\EHVAN82O\3077htsbdjyf[1].dll HKLM-Run-68a3fd25 - C:\WINDOWS\system32\habersxh.dll HKLM-Run-BM6b90ceb9 - C:\WINDOWS\system32\yybmriia.dll MSConfigStartUp-68a3fd25 - C:\WINDOWS\system32\xtulghti.dll MSConfigStartUp-BM6b90ceb9 - C:\WINDOWS\system32\nejmeiaq.dll . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Documents and Settings\Okiphia Fatali\Application Data\Mozilla\Firefox\Profiles\43f6o7qn.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - forums.secondlife.com . ************************************************************************ catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-23 10:55:44 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... ********************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\MarkFun_NT] "ImagePath"="\??\C:\Program Files\Gigabyte\ET5\markfun.w32" . Completion time: 2008-08-23 1126 ComboFix-quarantined-files.txt 2008-08-23 18:05:24 Pre-Run: 170,717,093,888 bytes free Post-Run: 170,703,093,760 bytes free 468 --- E O F --- 2008-08-23 17:33:50 HijackThis Log File ===============================** Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:08:05 AM, on 8/23/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\Program Files\Micro Innovations\Wireless Keyboard & Mouse Driver\KMWDSrv.exe C:\Program Files\MioNet\MioNetManager.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\PSIService.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\Tablet.exe C:\Program Files\MioNet\jvm\bin\MioNet.exe C:\WINDOWS\system32\WTablet\TabUserW.exe C:\WINDOWS\system32\Tablet.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\WINDOWS\explorer.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://forums.secondlife.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R3 - URLSearchHook: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file) O2 - BHO: (no name) - {05D94A99-829B-4321-967D-52495BB9C560} - (no file) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {0F826232-A771-43E4-B4B0-33EBBEBD9DB4} - (no file) O2 - BHO: (no name) - {2108EB67-E999-4BFE-B1DC-EB13CBE532C9} - (no file) O2 - BHO: (no name) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - (no file) O2 - BHO: (no name) - {2425B543-277C-43E0-A7F3-899440E67DDF} - (no file) O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: (no name) - {5C6604D9-F366-4428-AD4D-F435A4B26252} - (no file) O2 - BHO: (no name) - {6368B5F7-2EE2-4E4C-925D-1E3D967F5EDE} - (no file) O2 - BHO: (no name) - {64C9DDDB-9189-4516-B4B9-3ADFA1B54E07} - (no file) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: (no name) - {7E09D32C-E5E6-4184-B177-784CEE1E09C4} - (no file) O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll O2 - BHO: (no name) - {C13D50C7-B777-4402-815C-617CE0EF9AF8} - (no file) O2 - BHO: (no name) - {C6606FC9-7CE5-42CA-94B6-057F34185BFC} - (no file) O2 - BHO: (no name) - {D6EA2814-C279-479C-A8D1-1559025C3CD2} - (no file) O2 - BHO: (no name) - {DFA762CF-867A-4F48-90FF-72308F1A57DB} - (no file) O2 - BHO: (no name) - {F38BB5DD-E0A5-4BAE-9503-695141A65ECd} - (no file) O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file) O3 - Toolbar: Earn2Life Bar - {93344865-74BD-4873-BE65-56539D41A65C} - C:\WINDOWS\Downloaded Program Files\Earn2Life.dll O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [BM6b90ceb9] Rundll32.exe "C:\WINDOWS\system32\prpvsemx.dll",s O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user') O9 - Extra button: Earn2Life Bar - {07328B93-AFD8-4c6a-99E9-D0B3B5D6DAD9} - C:\WINDOWS\Downloaded Program Files\Earn2Life.dll O9 - Extra 'Tools' menuitem: Earn2Life Bar - {07328B93-AFD8-4c6a-99E9-D0B3B5D6DAD9} - C:\WINDOWS\Downloaded Program Files\Earn2Life.dll O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1219336830093 O16 - DPF: {93344865-74BD-4873-BE65-56539D41A65C} (Earn2Life Bar) - http://www.earn2life.com/plugin/Earn2Life.cab O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/...ampx_en_dl.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Adobe Active File Monitor (AdobeActiveFileMonitor) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Keyboard And Mouse Communication Service (KMWDSERVICE) - UASSOFT.COM - C:\Program Files\Micro Innovations\Wireless Keyboard & Mouse Driver\KMWDSrv.exe O23 - Service: MioNet Service (MioNet) - Unknown owner - C:\Program Files\MioNet\MioNetManager.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Photoshop Elements Device Connect (PhotoshopElementsDeviceConnect) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe -- End of file - 9180 bytes Last edited by Keira_Wells; 08-23-2008 at 12:14 PM.

08-23-2008, 04:06 PM	#4 (permalink)
alba Analyst, Security Team Join Date: Feb 2005 Location: Eire Posts: 2,006 OS: Vista, Ubuntu 8.04	Re: Blocked Web Access - Virtumonde Hi Keira_Wells Please read this post completely before begining the fix. If there's anything that you do not understand, kindly ask your questions before proceeding. Please ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix. IT IS IMPORTANT THAT YOU DON'T MISS A STEP & PERFORM EVERYTHING IN THE RIGHT ORDER. =============================================== 1. Close any open browsers. 2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. =============================================== Open notepad and carefully copy/paste all the text in the code box below into it: Code: File:: C:\WINDOWS\system32\imjqssab.dll Registry:: [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{855F3B16-6D32-4fe6-8A56-BBB695989046}"=- [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{05D94A99-829B-4321-967D-52495BB9C560}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0F826232-A771-43E4-B4B0-33EBBEBD9DB4}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2108EB67-E999-4BFE-B1DC-EB13CBE532C9}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{22BF413B-C6D2-4d91-82A9-A0F997BA588C}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2425B543-277C-43E0-A7F3-899440E67DDF}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5C6604D9-F366-4428-AD4D-F435A4B26252}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6368B5F7-2EE2-4E4C-925D-1E3D967F5EDE}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{64C9DDDB-9189-4516-B4B9-3ADFA1B54E07}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7E09D32C-E5E6-4184-B177-784CEE1E09C4}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C13D50C7-B777-4402-815C-617CE0EF9AF8}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C6606FC9-7CE5-42CA-94B6-057F34185BFC}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D6EA2814-C279-479C-A8D1-1559025C3CD2}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DFA762CF-867A-4F48-90FF-72308F1A57DB}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F38BB5DD-E0A5-4BAE-9503-695141A65ECd}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{855F3B16-6D32-4fe6-8A56-BBB695989046}] Save this as CFScript.txt Refering to the picture above, drag CFScript.txt into ComboFix.exe When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply. Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall Additonally, ComboFix will generate a zipped file on your desktop called Submit [Date Time].zip When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture a file to submit for analysis. Ensure you are connected to the internet and click OK on the message box. A browser will open. Simply follow the instructions to copy/paste/send the requested file. ================================================ Establish an internet connection & perform an online scan with Internet Explorer at one of the following links http://www.kaspersky.com/virusscanner http://www.kaspersky.com/kos/eng/par...=1219183311238 http://www.kaspersky.com/kos/eng/par...avwebscan.html Answer Yes, when prompted to install an ActiveX component. The program will then begin downloading the latest definition files. Once the files have been downloaded click on NEXT Locate the Scan Settings button & configure to: Scan using the following Anti-Virus database: Extended Scan Options: Scan Archives Scan Mail Bases Click OK & have it scan My Computer Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it. Click the Save as Text button to save the file to your desktop so that you may post it in your next reply * Turn off the real time scanner of any existing antivirus program while performing the online scan Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%. ================= Please Run a scan with HiJackThis and save the log ================= In your next post, please include fresh logs from: ComboFix.txt Kaspersky report HiJackThis Please provide details of any problems you encountered whilst performing the above steps & update us on how the computer behaves now __________________ Member of UNITE If I have helped you in anyway, please DONATE to TSF Go raibh maith agat

08-24-2008, 02:57 PM	#5 (permalink)
Keira_Wells Registered User Join Date: May 2008 Posts: 21 OS: Windows XP Home	Re: Blocked Web Access - Virtumonde I followed the directions exactly, but Combofix did not create a zipped filed, nor a message box for submitting said file. However, it showed 'C:\WINDOWS\system32\imjqssab.dll' listed at the top of the log file, so I figured it did what it was supposed to, and I didn't want to end up lacking information, so continued on. When I boot, I see no RunDll file listed in processes, though it also gives an error message that reads: 'Error loading C:\WINDOWS\system32\prpvsemx.dll The specified module could not be found' Upon checking MSConfig, that RunDll file is listed in startup. I've not noticed any blackage to any websites like before. It loads both versions of GMail, as well as various other sites fine. ComboFix Log File ===================== ComboFix 08-08-23.01 - Okiphia Fatali 2008-08-23 16:33:12.3 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.2548 [GMT -7:00] Running from: C:\Documents and Settings\Okiphia Fatali\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Okiphia Fatali\Desktop\CFScript.txt * Created a new restore point FILE :: C:\WINDOWS\system32\imjqssab.dll . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\imjqssab.dll . ((((((((((((((((((((((((( Files Created from 2008-07-23 to 2008-08-23 ))))))))))))))))))))))))))))))) . 2008-08-23 08:12 . 2008-08-23 08:27 <DIR> d-------- C:\Documents and Settings\Okiphia Fatali\Application Data\flightgear.org 2008-08-23 08:11 . 2008-08-23 08:12 <DIR> d-------- C:\Program Files\FlightGear 2008-08-22 16:02 . 2008-08-22 16:03 <DIR> d-------- C:\Program Files\Phun 2008-08-22 15:36 . 2008-08-22 15:36 <DIR> d-------- C:\Program Files\Porrasturvat - Stair Dismount 2008-08-21 12:11 . 2008-05-19 18:16 186,407 --a------ C:\WINDOWS\system32\nvapps.nvb 2008-08-21 09:43 . 2008-08-21 09:43 <DIR> d-------- C:\Program Files\Trend Micro 2008-08-21 09:30 . 2008-08-21 09:30 <DIR> d-------- C:\ie-spyad_zo 2008-08-21 09:26 . 2008-08-21 09:26 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-08-21 09:26 . 2005-04-15 20:58 1,071,088 --a------ C:\WINDOWS\system32\MSCOMCTL.OCX 2008-08-21 09:26 . 2005-08-25 19:18 118,784 --a------ C:\WINDOWS\system32\MSSTDFMT.DLL 2008-08-21 07:24 . 2008-06-19 17:24 28,544 --a------ C:\WINDOWS\system32\drivers\pavboot.sys 2008-08-21 07:20 . 2008-08-21 07:20 <DIR> d-------- C:\Program Files\Panda Security 2008-08-19 14:42 . 2008-08-19 14:42 <DIR> d-------- C:\WINDOWS\nvidia icons 2008-08-19 14:40 . 2008-05-16 11:48 446,464 --a------ C:\WINDOWS\system32\NVUNINST.EXE . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-23 17:48 --------- d-----w C:\Documents and Settings\Okiphia Fatali\Application Data\WTablet 2008-08-23 17:40 --------- d-----w C:\Documents and Settings\LocalService\Application Data\WTablet 2008-07-28 05:47 --------- d-----w C:\Documents and Settings\Okiphia Fatali\Application Data\SPORE Creature Creator 2008-07-23 08:09 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-07-23 08:09 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2008-07-18 23:38 --------- d-----w C:\Documents and Settings\Okiphia Fatali\Application Data\AVG7 2008-07-17 22:48 --------- d-----w C:\Program Files\GameSpy 2008-07-17 22:47 22,328 ----a-w C:\Documents and Settings\Okiphia Fatali\Application Data\PnkBstrK.sys 2008-07-17 22:46 669,184 ----a-w C:\WINDOWS\system32\pbsvc.exe 2008-07-17 22:36 --------- d-----w C:\Program Files\Electronic Arts 2008-07-17 19:35 --------- d-----w C:\Program Files\SecondLifeMono 2008-07-16 20:14 --------- d-----w C:\Program Files\SecondLifeReleaseCandidate 2008-07-13 21:10 --------- d-----w C:\Program Files\ArchipelisDesigner 2008-07-03 03:22 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-06-29 01:13 --------- d--h--r C:\Documents and Settings\Okiphia Fatali\Application Data\SecuROM 2008-06-28 19:09 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2008-06-28 07:02 --------- d-----w C:\Program Files\JFK Reloaded 2008-06-11 23:55 41,296 ----a-w C:\WINDOWS\system32\xfcodec.dll 2008-05-31 01:09 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe 2008-03-04 02:27 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{93344865-74BD-4873-BE65-56539D41A65C}"= "C:\WINDOWS\Downloaded Program Files\Earn2Life.dll" [2007-05-14 18:18 303104] [HKEY_CLASSES_ROOT\clsid\{93344865-74bd-4873-be65-56539d41a65c}] [HKEY_CLASSES_ROOT\Earn2Life.LeadBar.1] [HKEY_CLASSES_ROOT\TypeLib\{92F9C4A2-C2A5-41f6-9829-49B8C6FF0709}] [HKEY_CLASSES_ROOT\Earn2Life.LeadBar] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24 286720] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-16 14:01 13529088] "BM6b90ceb9"="C:\WINDOWS\system32\prpvsemx.dll" [BU] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-10-22 08:30 219136] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "SENTINEL"= snti386.dll "VIDC.XFR1"= xfcodec.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^TrayMin200.exe.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\TrayMin200.exe.lnk backup=C:\WINDOWS\pss\TrayMin200.exe.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^Okiphia Fatali^Start Menu^Programs^Startup^Xfire.lnk] path=C:\Documents and Settings\Okiphia Fatali\Start Menu\Programs\Startup\Xfire.lnk backup=C:\WINDOWS\pss\Xfire.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck] C:\WINDOWS\system32\dumprep 0 -k [X] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\36X Raid Configurer] -ra------ 2007-02-06 05:08 1953792 C:\WINDOWS\system32\JMRaidSetup.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC] --a------ 2008-04-21 09:32 579584 C:\PROGRA~1\Grisoft\AVG7\avgcc.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] --a------ 2006-02-28 05:00 15360 C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EA Core] --a------ 2008-05-16 18:16 2732032 C:\Program Files\Electronic Arts\EADM\Core.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EasyTuneV] --a------ 2007-04-26 15:50 24576 C:\Program Files\Gigabyte\ET5\ETcall.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ] --a------ 2007-12-19 07:48 172280 C:\Program Files\ICQ6\ICQ.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2007-09-26 14:42 267064 C:\Program Files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\JMB36X IDE Setup] -r------- 2006-10-30 05:44 36864 C:\WINDOWS\JM\JMInsIDE.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KMCONFIG] --a------ 2007-03-06 14:51 212992 C:\Program Files\Micro Innovations\Wireless Keyboard & Mouse Driver\StartAutorun.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --a------ 2004-10-13 09:24 1694208 C:\Program Files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr] --a------ 2007-01-19 12:54 5674352 C:\Program Files\MSN Messenger\msnmsgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] --a------ 2008-05-16 14:01 13529088 C:\WINDOWS\system32\nvcpl.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] --a------ 2008-05-16 14:01 86016 C:\WINDOWS\system32\nvmctray.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] -ra------ 2008-02-01 18:22 21898024 C:\Program Files\Skype\Phone\Skype.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer] -rahs---- 2008-01-28 11:43 2097488 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] --a------ 2008-06-16 15:21 1271032 c:\Program Files\Steam\steam.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] --a------ 2007-08-15 12:23 68856 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] --a------ 2007-05-14 15:22 35328 C:\Program Files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager] --a------ 2007-07-16 15:17 4670704 C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr] -r------- 2005-05-03 03:43 69632 C:\WINDOWS\Alcmtr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] --a------ 2008-05-16 14:01 1630208 C:\WINDOWS\system32\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL] -r------- 2007-04-12 02:33 16132608 C:\WINDOWS\RTHDCPL.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"= "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"= "C:\\Program Files\\MSN Messenger\\livecall.exe"= "C:\\Program Files\\Sony\\EverQuest II\\LaunchPad.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\mIRC\\mirc.exe"= "C:\\Program Files\\Xfire\\xfire.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"= "C:\\Program Files\\ICQ6\\ICQ.exe"= "C:\\Program Files\\America's Army\\System\\ArmyOps.exe"= "C:\\Program Files\\SecondLife\\SLVoice.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\Program Files\\SecondLifeWindLight\\SLVoice.exe"= "C:\\Program Files\\SecondLife\\SecondLife.exe"= "C:\\Program Files\\Autodesk\\Maya 8.5 Personal Learning Edition\\bin\\maya.exe"= "C:\\Program Files\\Mozilla Firefox\\firefox.exe"= "C:\\Program Files\\SecondLifeReleaseCandidate\\SLVoice.exe"= "C:\\Program Files\\Turbine\\The Lord of the Rings Online\\lotroclient.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= "C:\\Program Files\\Ahead\\SIPPS\\SIPPS.exe"= "C:\\Program Files\\Steam\\steamapps\\okiphiarayna\\team fortress 2\\hl2.exe"= "C:\\Program Files\\Electronic Arts\\EADM\\Core.exe"= "C:\\Program Files\\SecondLifeMono\\SLVoice.exe"= "C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"= "C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"= "C:\\WINDOWS\\system32\\PnkBstrA.exe"= "C:\\WINDOWS\\system32\\PnkBstrB.exe"= "C:\\Program Files\\Sony\\EverQuest II\\EverQuest2.exe"= "C:\\Program Files\\FlightGear\\bin\\win32\\fgfs.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "1700:TCP"= 1700:TCP:MioNet Remote Drive Access "1641:TCP"= 1641:TCP:MioNet Remote Drive Verification R0 pavboot;pavboot;C:\WINDOWS\system32\drivers\pavboot.sys [2008-06-19 17:24] R2 AdobeActiveFileMonitor;Adobe Active File Monitor;C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe [2004-10-04 04:47] R2 KMWDSERVICE;Keyboard And Mouse Communication Service;C:\Program Files\Micro Innovations\Wireless Keyboard & Mouse Driver\KMWDSrv.exe [2007-04-05 10:29] R2 MioNet;MioNet Service;C:\Program Files\MioNet\MioNetManager.exe [2005-07-15 13:38] R2 PhotoshopElementsDeviceConnect;Photoshop Elements Device Connect;C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe [2004-10-04 03:40] R3 SCREAMINGBDRIVER;Screaming Bee Audio;C:\WINDOWS\system32\drivers\ScreamingBAudio.sys [2007-08-24 17:44] R3 wacommousefilter;Wacom Mouse Filter Driver;C:\WINDOWS\system32\DRIVERS\wacommousefilter.sys [2007-02-16 12:12] R3 wacomvhid;Wacom Virtual Hid Driver;C:\WINDOWS\system32\DRIVERS\wacomvhid.sys [2007-02-16 11:30] S3 MarkFun_NT;MarkFun_NT;C:\Program Files\Gigabyte\ET5\markfun.w32 [2007-01-12 18:34] . ************************************************************************ catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-23 16:34:03 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************ [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\MarkFun_NT] "ImagePath"="\??\C:\Program Files\Gigabyte\ET5\markfun.w32" . Completion time: 2008-08-23 16:35:18 ComboFix-quarantined-files.txt 2008-08-23 23:34:29 ComboFix2.txt 2008-08-23 1826 Pre-Run: 170,750,865,408 bytes free Post-Run: 170,737,016,832 bytes free 194 --- E O F --- 2008-08-23 17:33:50 Kaspersky Report ===================== -------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER 7 REPORT Sunday, August 24, 2008 Operating System: Microsoft Windows XP Home Edition Service Pack 2 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Sunday, August 24, 2008 17:42:05 Records in database: 1140842 -------------------------------------------------------------------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: C:\ D:\ Scan statistics: Files scanned: 167781 Threat name: 55 Infected objects: 163 Suspicious objects: 0 Duration of the scan: 02:42:56 File name / Threat name / Threats count C:\crap\jcoxorhn.txt Infected: Trojan-Spy.Win32.BZub.fay 1 C:\crap\jiqjsiyw.txt Infected: Trojan.Win32.Monder.fcy 1 C:\crap\jqsoxxwn.txt Infected: Trojan.Win32.Monder.ggc 1 C:\crap\rruadltv.txt Infected: Trojan.Win32.Agent.ytr 1 C:\crap\tyowirsb.TXT Infected: Trojan.Win32.Monder.dkx 1 C:\crap\ufoftlsu.txt Infected: Trojan-Spy.Win32.BZub.faz 1 C:\Program Files\MioNet\cmdow.exe Infected: not-a-virus:RiskTool.Win32.HideWindows 1 C:\Program Files\mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.621 1 C:\Program Files\Philips\SPC 200NC PC Camera\MioNet\install_MioNet_ver1_6_11.exe Infected: not-a-virus:RiskTool.Win32.HideWindows 1 C:\QooBox\Quarantine\C\WINDOWS\system32\abxpjpxo.dll.vir Infected: Trojan.Win32.Monder.cwr 1 C:\QooBox\Quarantine\C\WINDOWS\system32\accxik.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cva 1 C:\QooBox\Quarantine\C\WINDOWS\system32\aefsnr.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\aphptrjk.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\avbxpr.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.aeud 1 C:\QooBox\Quarantine\C\WINDOWS\system32\avossg.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\avstjbwr.dll.vir Infected: Trojan.Win32.Monder.zm 1 C:\QooBox\Quarantine\C\WINDOWS\system32\ayshnjfh.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.ccv 1 C:\QooBox\Quarantine\C\WINDOWS\system32\bqujeifi.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\ckbhabak.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\clhvaavk.dll.vir Infected: Trojan.Win32.Monder.wf 1 C:\QooBox\Quarantine\C\WINDOWS\system32\cpscgmkx.dll.vir Infected: Trojan.Win32.Monder.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\czjpcc.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.ciy 1 C:\QooBox\Quarantine\C\WINDOWS\system32\diucmcsc.dll.vir Infected: Trojan.Win32.Monder.axm 1 C:\QooBox\Quarantine\C\WINDOWS\system32\dkdfyt.dll.vir Infected: Trojan.Win32.Monder.awg 1 C:\QooBox\Quarantine\C\WINDOWS\system32\edghgvim.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cva 1 C:\QooBox\Quarantine\C\WINDOWS\system32\eixrbblg.dll.vir Infected: Trojan.Win32.Monder.esu 1 C:\QooBox\Quarantine\C\WINDOWS\system32\ejkqfedl.dll.vir Infected: Trojan.Win32.Monder.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\enwaqtkg.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\enyxnmfv.dll.vir Infected: Trojan.Win32.Monder.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\epvvdelf.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\erpumqpq.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\ettuvbwe.dll.vir Infected: Trojan.Win32.Monder.dkx 1 C:\QooBox\Quarantine\C\WINDOWS\system32\euaciggv.dll.vir Infected: Trojan.Win32.Monder.dkx 1 C:\QooBox\Quarantine\C\WINDOWS\system32\fgfpxcdc.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.aegv 1 C:\QooBox\Quarantine\C\WINDOWS\system32\fjboelug.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\fjevkw.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.zjk 1 C:\QooBox\Quarantine\C\WINDOWS\system32\fkhmvd.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\fpefbrln.dll.vir Infected: Trojan.Win32.Monder.dkx 1 C:\QooBox\Quarantine\C\WINDOWS\system32\fpucbf.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\fxtady.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\gdvnoetn.dll.vir Infected: Trojan.Win32.Monder.cmm 1 C:\QooBox\Quarantine\C\WINDOWS\system32\geenaggm.dll.vir Infected: Trojan.Win32.Monder.awj 1 C:\QooBox\Quarantine\C\WINDOWS\system32\ghojhlob.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\gnkwlv.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\gsipoxfu.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cju 1 C:\QooBox\Quarantine\C\WINDOWS\system32\gxsuublf.dll.vir Infected: Trojan.Win32.Monder.dkx 1 C:\QooBox\Quarantine\C\WINDOWS\system32\hdsovmoo.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cdg 1 C:\QooBox\Quarantine\C\WINDOWS\system32\hfhvocrw.dll.vir Infected: Trojan.Win32.Monder.awg 1 C:\QooBox\Quarantine\C\WINDOWS\system32\hjbbtp.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cur 1 C:\QooBox\Quarantine\C\WINDOWS\system32\hkhmacpr.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.aeuc 1 C:\QooBox\Quarantine\C\WINDOWS\system32\hmvprotp.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.wdd 1 C:\QooBox\Quarantine\C\WINDOWS\system32\hoicmoxh.dll.vir Infected: Trojan.Win32.Monder.bmc 1 C:\QooBox\Quarantine\C\WINDOWS\system32\htmtwmoy.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.zdg 1 C:\QooBox\Quarantine\C\WINDOWS\system32\ianpnqfi.dll.vir Infected: Trojan.Win32.Monder.bir 1 C:\QooBox\Quarantine\C\WINDOWS\system32\ibjtyf.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\idcxmwsp.dll.vir Infected: Trojan.Win32.Monder.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\idrvglks.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.abuh 1 C:\QooBox\Quarantine\C\WINDOWS\system32\idxkfq.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\imjqssab.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.yeb 1 C:\QooBox\Quarantine\C\WINDOWS\system32\iqglqjgf.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\irdxfobq.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cat 1 C:\QooBox\Quarantine\C\WINDOWS\system32\izzopq.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.aeuc 1 C:\QooBox\Quarantine\C\WINDOWS\system32\jkbieptn.dll.vir Infected: Trojan.Win32.Monder.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\jphxwmvk.dll.vir Infected: Trojan.Win32.Monder.aln 1 C:\QooBox\Quarantine\C\WINDOWS\system32\jqwwvqpe.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.aeud 1 C:\QooBox\Quarantine\C\WINDOWS\system32\jtltrq.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\jwksarhu.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\jyhrmp.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cdf 1 C:\QooBox\Quarantine\C\WINDOWS\system32\jyvgle.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cdg 1 C:\QooBox\Quarantine\C\WINDOWS\system32\kckudexa.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.vqh 1 C:\QooBox\Quarantine\C\WINDOWS\system32\kdkyhpdc.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\kjabkspn.dll.vir Infected: Trojan.Win32.Monder.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\kjsvjy.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\lkomjfqo.dll.vir Infected: Trojan.Win32.Monder.cbv 1 C:\QooBox\Quarantine\C\WINDOWS\system32\llofgwrw.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\lmrvremy.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\lnusfyob.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.abuh 1 C:\QooBox\Quarantine\C\WINDOWS\system32\loklufma.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\lrwairwg.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.tsm 1 C:\QooBox\Quarantine\C\WINDOWS\system32\lxaenx.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\mdibhsjp.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cti 1 C:\QooBox\Quarantine\C\WINDOWS\system32\mhztdj.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\mkeftb.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.aeue 1 C:\QooBox\Quarantine\C\WINDOWS\system32\mktmaqle.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\mlxtxynw.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.aeud 1 C:\QooBox\Quarantine\C\WINDOWS\system32\mmavvqyy.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cat 1 C:\QooBox\Quarantine\C\WINDOWS\system32\mppcqcog.dll.vir Infected: Trojan.Win32.Monder.zm 1 C:\QooBox\Quarantine\C\WINDOWS\system32\muupqomq.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cur 1 C:\QooBox\Quarantine\C\WINDOWS\system32\ngbdcfte.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\ngrnicrx.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\nhqxswtw.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\nntgscao.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\npmllh.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cat 1 C:\QooBox\Quarantine\C\WINDOWS\system32\nqcjsxwb.dll.vir Infected: Trojan.Win32.Monder.bbw 1 C:\QooBox\Quarantine\C\WINDOWS\system32\ofqyicte.dll.vir Infected: Trojan.Win32.Monder.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\ohfogdkw.dll.vir Infected: Trojan.Win32.Monder.bmc 1 C:\QooBox\Quarantine\C\WINDOWS\system32\ouvmpigv.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\ouwscpaq.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cdf 1 C:\QooBox\Quarantine\C\WINDOWS\system32\oyrrlg.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.chs 1 C:\QooBox\Quarantine\C\WINDOWS\system32\pcrklcxo.dll.vir Infected: Trojan.Win32.Monder.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\pfkqihes.dll.vir Infected: Trojan-Spy.Win32.BZub.eyc 1 C:\QooBox\Quarantine\C\WINDOWS\system32\pgtqokrl.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.ciy 1 C:\QooBox\Quarantine\C\WINDOWS\system32\poycaq.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.aema 1 C:\QooBox\Quarantine\C\WINDOWS\system32\pvabnkfw.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\pxgmpqbp.dll.vir Infected: Trojan.Win32.Monder.dkx 1 C:\QooBox\Quarantine\C\WINDOWS\system32\qhbxtwoo.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\qmnikhbw.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\qqloib.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cju 1 C:\QooBox\Quarantine\C\WINDOWS\system32\qrwxtl.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\qwfvse.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\racwfwhy.dll.vir Infected: Trojan.Win32.Monder.dkx 1 C:\QooBox\Quarantine\C\WINDOWS\system32\raezsv.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cti 1 C:\QooBox\Quarantine\C\WINDOWS\system32\rcytcn.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\rdojdfso.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\riwinals.dll.vir Infected: Trojan.Win32.Monder.cmm 1 C:\QooBox\Quarantine\C\WINDOWS\system32\rmdejrvo.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\rqkuuisx.dll.vir Infected: Trojan.Win32.Monder.aeo 1 C:\QooBox\Quarantine\C\WINDOWS\system32\rvnvrfrf.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.zjk 1 C:\QooBox\Quarantine\C\WINDOWS\system32\sievdr.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\tcnksqjl.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\thnrylev.dll.vir Infected: Trojan.Win32.Monder.zn 1 C:\QooBox\Quarantine\C\WINDOWS\system32\tmknwuwd.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\twfuxe.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.aegv 1 C:\QooBox\Quarantine\C\WINDOWS\system32\uaoykwxu.dll.vir Infected: Trojan.Win32.Monder.axm 1 C:\QooBox\Quarantine\C\WINDOWS\system32\ubdpadpq.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\uetydsns.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\ugalgz.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.ccv 1 C:\QooBox\Quarantine\C\WINDOWS\system32\uqlkokkx.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\uuyvby.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\vdfvxpwl.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\vgadlaiq.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\vurrrj.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\vwgwkbgf.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\vwjbveel.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\vxxmdypw.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.aema 1 C:\QooBox\Quarantine\C\WINDOWS\system32\weyeywwg.dll.vir Infected: Trojan.Win32.Monder.glg 1 C:\QooBox\Quarantine\C\WINDOWS\system32\wnukqfdi.dll.vir Infected: Trojan.Win32.Monder.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\wqdngqhg.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\wrdwsisw.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\wubtwz.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cdg 1 C:\QooBox\Quarantine\C\WINDOWS\system32\wuvduy.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.abuh 1 C:\QooBox\Quarantine\C\WINDOWS\system32\wvUlihff.dll.vir Infected: Trojan.Win32.Monder.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\wwxrrvoo.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.trp 1 C:\QooBox\Quarantine\C\WINDOWS\system32\xefmkgyg.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cdg 1 C:\QooBox\Quarantine\C\WINDOWS\system32\xenyqwun.dll.vir Infected: Trojan.Win32.Monder.dmj 1 C:\QooBox\Quarantine\C\WINDOWS\system32\xgeanxfh.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.aeue 1 C:\QooBox\Quarantine\C\WINDOWS\system32\xgfake.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.chs 1 C:\QooBox\Quarantine\C\WINDOWS\system32\xieppsty.dll.vir Infected: Trojan.Win32.Monder.dkx 1 C:\QooBox\Quarantine\C\WINDOWS\system32\xmwmdekv.dll.vir Infected: Trojan.Win32.Monder.acy 1 C:\QooBox\Quarantine\C\WINDOWS\system32\xrqmahts.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.bpu 1 C:\QooBox\Quarantine\C\WINDOWS\system32\xugpgg.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\xvdoooir.dll.vir Infected: Trojan.Win32.Monder.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\ydbzgh.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.abuh 1 C:\QooBox\Quarantine\C\WINDOWS\system32\ydccfffe.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.chs 1 C:\QooBox\Quarantine\C\WINDOWS\system32\ydoyssjf.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\ymfiavfe.dll.vir Infected: Trojan.Win32.Monder.dkx 1 C:\QooBox\Quarantine\C\WINDOWS\system32\yujzft.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.aeud 1 C:\QooBox\Quarantine\C\WINDOWS\system32\yuxvnydk.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.chs 1 C:\QooBox\Quarantine\C\WINDOWS\system32\zcrgja.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\zojype.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cat 1 C:\QooBox\Quarantine\C\WINDOWS\system32\zzwpvb.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\catchme2008-08-23_102527.73.zip Infected: Trojan.Win32.Pakes.cym 1 C:\WINDOWS\Downloaded Program Files\Earn2Life.dll Infected: not-a-virus:AdWare.Win32.NocsBar.e 1 The selected area was scanned. HiJackThis Log File ===================== Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 1:44:42 PM, on 8/24/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16705) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\Program Files\Micro Innovations\Wireless Keyboard & Mouse Driver\KMWDSrv.exe C:\Program Files\MioNet\MioNetManager.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe C:\WINDOWS\system32\PnkBstrA.exe C:\Program Files\MioNet\jvm\bin\MioNet.exe C:\WINDOWS\system32\PSIService.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\Tablet.exe C:\WINDOWS\system32\WTablet\TabUserW.exe C:\WINDOWS\system32\Tablet.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://forums.secondlife.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 O2 - BHO: (no name) - {05D94A99-829B-4321-967D-52495BB9C560} - (no file) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {0F826232-A771-43E4-B4B0-33EBBEBD9DB4} - (no file) O2 - BHO: (no name) - {2108EB67-E999-4BFE-B1DC-EB13CBE532C9} - (no file) O2 - BHO: (no name) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - (no file) O2 - BHO: (no name) - {2425B543-277C-43E0-A7F3-899440E67DDF} - (no file) O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: (no name) - {5C6604D9-F366-4428-AD4D-F435A4B26252} - (no file) O2 - BHO: (no name) - {6368B5F7-2EE2-4E4C-925D-1E3D967F5EDE} - (no file) O2 - BHO: (no name) - {64C9DDDB-9189-4516-B4B9-3ADFA1B54E07} - (no file) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: (no name) - {7E09D32C-E5E6-4184-B177-784CEE1E09C4} - (no file) O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll O2 - BHO: (no name) - {C13D50C7-B777-4402-815C-617CE0EF9AF8} - (no file) O2 - BHO: (no name) - {C6606FC9-7CE5-42CA-94B6-057F34185BFC} - (no file) O2 - BHO: (no name) - {D6EA2814-C279-479C-A8D1-1559025C3CD2} - (no file) O2 - BHO: (no name) - {DFA762CF-867A-4F48-90FF-72308F1A57DB} - (no file) O2 - BHO: (no name) - {F38BB5DD-E0A5-4BAE-9503-695141A65ECd} - (no file) O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: Earn2Life Bar - {93344865-74BD-4873-BE65-56539D41A65C} - C:\WINDOWS\Downloaded Program Files\Earn2Life.dll O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [BM6b90ceb9] Rundll32.exe "C:\WINDOWS\system32\prpvsemx.dll",s O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user') O9 - Extra button: Earn2Life Bar - {07328B93-AFD8-4c6a-99E9-D0B3B5D6DAD9} - C:\WINDOWS\Downloaded Program Files\Earn2Life.dll O9 - Extra 'Tools' menuitem: Earn2Life Bar - {07328B93-AFD8-4c6a-99E9-D0B3B5D6DAD9} - C:\WINDOWS\Downloaded Program Files\Earn2Life.dll O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1219336830093 O16 - DPF: {93344865-74BD-4873-BE65-56539D41A65C} (Earn2Life Bar) - http://www.earn2life.com/plugin/Earn2Life.cab O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/...ampx_en_dl.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Adobe Active File Monitor (AdobeActiveFileMonitor) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Keyboard And Mouse Communication Service (KMWDSERVICE) - UASSOFT.COM - C:\Program Files\Micro Innovations\Wireless Keyboard & Mouse Driver\KMWDSrv.exe O23 - Service: MioNet Service (MioNet) - Unknown owner - C:\Program Files\MioNet\MioNetManager.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Photoshop Elements Device Connect (PhotoshopElementsDeviceConnect) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe -- End of file - 8956 bytes Last edited by Keira_Wells; 08-24-2008 at 03:01 PM.

08-25-2008, 12:38 AM	#6 (permalink)
alba Analyst, Security Team Join Date: Feb 2005 Location: Eire Posts: 2,006 OS: Vista, Ubuntu 8.04	Re: Blocked Web Access - Virtumonde Hi Keira_Wells Please read this post completely before begining the fix. If there's anything that you do not understand, kindly ask your questions before proceeding. Please ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix. IT IS IMPORTANT THAT YOU DON'T MISS A STEP & PERFORM EVERYTHING IN THE RIGHT ORDER. =============================================== 1. Close any open browsers. 2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. =============================================== Open notepad and carefully copy/paste all the text in the code box below into it: Code: File:: C:\crap\jcoxorhn.txt C:\crap\jiqjsiyw.txt C:\crap\jqsoxxwn.txt C:\crap\rruadltv.txt C:\crap\tyowirsb.TXT C:\crap\ufoftlsu.txt C:\Program Files\MioNet\cmdow.exe Registry:: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BM6b90ceb9"=- Save this as CFScript.txt Refering to the picture above, drag CFScript.txt into ComboFix.exe When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply. Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall ================= Run a scan with HiJackThis & select/tick the following & click "Fix checked" : O2 - BHO: (no name) - {0F826232-A771-43E4-B4B0-33EBBEBD9DB4} - (no file) O2 - BHO: (no name) - {2108EB67-E999-4BFE-B1DC-EB13CBE532C9} - (no file) O2 - BHO: (no name) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - (no file) O2 - BHO: (no name) - {2425B543-277C-43E0-A7F3-899440E67DDF} - (no file) O2 - BHO: (no name) - {5C6604D9-F366-4428-AD4D-F435A4B26252} - (no file) O2 - BHO: (no name) - {6368B5F7-2EE2-4E4C-925D-1E3D967F5EDE} - (no file) O2 - BHO: (no name) - {64C9DDDB-9189-4516-B4B9-3ADFA1B54E07} - (no file) O2 - BHO: (no name) - {7E09D32C-E5E6-4184-B177-784CEE1E09C4} - (no file) O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: (no name) - {C13D50C7-B777-4402-815C-617CE0EF9AF8} - (no file) O2 - BHO: (no name) - {C6606FC9-7CE5-42CA-94B6-057F34185BFC} - (no file) O2 - BHO: (no name) - {D6EA2814-C279-479C-A8D1-1559025C3CD2} - (no file) O2 - BHO: (no name) - {DFA762CF-867A-4F48-90FF-72308F1A57DB} - (no file) O2 - BHO: (no name) - {F38BB5DD-E0A5-4BAE-9503-695141A65ECd} - (no file) *Please remember to close all other windows, including browsers then click Fix checked.* =============================================== Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update. Download the latest version of Java Runtime Environment (JRE) 6 and save it to your desktop. Scroll down to where it says "Java Runtime Environment (JRE) 6 Update 7. The Java SE Runtime Environment (JRE) allows end-users to run Java applications." Click the "Download" button to the right. Select the Windows platform from the dropdown menu. Read the License Agreement and then check the box that says: "Accept License Agreement". Click on Continue.The page will refresh. Click on the link to download Windows Offline Installation and save the file to your desktop. Close any programs you may have running - especially your web browser. Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java. Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name. Click the Remove or Change/Remove button. Repeat as many times as necessary to remove each Java versions. Reboot your computer once all Java components are removed. Then from your desktop double-click on jre-6u7-windows-i586-p.exe to install the newest version. After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup) On the General tab, under Temporary Internet Files, click the Settings button. Next, click on the Delete Files button There are two options in the window to clear the cache - Leave BOTH Checked Applications and Applets Trace and Log Files Click OK on Delete Temporary Files Window Note: This deletes ALL the Downloaded Applications and Applets from the CACHE. Click OK to leave the Temporary Files Window Click OK to leave the Java Control Panel. ================= Please Run a scan with HiJackThis and save the log ================= In your next post, please include fresh logs from: ComboFix.txt HiJackThis Please provide details of any problems you encountered whilst performing the above steps & update us on how the computer behaves now __________________ Member of UNITE If I have helped you in anyway, please DONATE to TSF Go raibh maith agat

08-25-2008, 02:17 PM	#8 (permalink)
alba Analyst, Security Team Join Date: Feb 2005 Location: Eire Posts: 2,006 OS: Vista, Ubuntu 8.04	Re: Blocked Web Access - Virtumonde Hi Keira_Wells Your logs are clean ================= The following procedure will clear out the tools we've used as well as the backups and quarantines created by the fix. It will also reset your System Restore by flushing out previous restore points (which contain the infections) and create a new restore point. Click Start > Run and copy/paste, or type the following bolded text into the Run box and click OK: ComboFix /u To help protect your computer in the future I recommend that you get the following free programs if you do not already have them: McAfee Site Advisor--free version. The folks there check out websites and based on their findings, rate it as Safe, Unknown, Caution, or Bad. SpywareBlaster 3.5.1 to help prevent spyware from installing in the first place. Install & update SpywareBlaster with the latest definitions. After you have updated, click the button - enable protection for all unprotected items. It will block any bad ActiveX from running in Internet Explorer and Firefox if it's listed in their database (which you should update frequently). To view their database and list of restricted sites, launch the program and click on each of the tabs on the main display page. IESpyAD Zoned Out to block access to malicious websites so you cannot be redirected to them from an infected site or email. This severely impairs attempts to infect your system as it basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites. Update, and scan with your onboard Anti Malware and Anti Virus programs regularly. Without regular updates you will not be protected when new malicious programs are released. In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles: PC Safety and Security--What Do I Need? HOW DID I GET INFECTED IN THE FIRST PLACE? by Tony Klein MAKING INTERNET EXPLORER SAFER Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them. ----------------------------------------------------- Follow the list above and the potential for infection will reduce dramatically. Please respond to this thread one more time so we can mark this thread as resolved. __________________ Member of UNITE If I have helped you in anyway, please DONATE to TSF Go raibh maith agat**

08-25-2008, 02:37 PM	#9 (permalink)
Keira_Wells Registered User Join Date: May 2008 Posts: 21 OS: Windows XP Home	Re: Blocked Web Access - Virtumonde Thank you much! You rock. TSF rocks. Everything rocks ^-^