Downloader.Delf.12.AN

paul.hunt · 11-10-2008, 05:51 PM

AVG Free 8.0 tells me I have this trojan in C:\Windows\system32\dsoun.dll. I have directed AVG to both quarantine and heal. I have run Spybot, AdAware, ComboFix, SpyNoMore. The trojan keeps reappearing.
Windows XP Home SP2
Dell Dimension 5150
I have downloaded and run gmer and dds and am ready to attach those logs.

Thanks,
Paul

tetonbob · 11-12-2008, 10:33 AM

Quote:

I have downloaded and run gmer and dds and am ready to attach those logs.

Please do. Perhaps you misunderstood the instructions, but we can't begin to help without logs.

Since it's now been a couple of days, please download DDS once again, even if you still have it (it's been updated), and run new scans with it, and also with GMER.

Post the DDS.txt

Attach Attach.txt and gmer.txt

paul.hunt · 11-12-2008, 04:29 PM

Yes, I did misunderstand.

dds.txt:

DDS (Version 1.0) - NTFSx86
Run by Ben at 18:08:27.56 on Wed 11/12/2008
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1014.446 [GMT -5:00]

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\system32\svchost -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\wdfmgr.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S0EIC1.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\SpyNoMore\SNM.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Documents and Settings\Ben\Desktop\dds.scr
C:\WINDOWS\system32\wbem\wmiprvse.exe

============== Psuedo HJT Report ===============

uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
BHO: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\program files\adobe\acrobat 6.0\acrobat\activex\AcroIEHelper.dll
BHO: {10708868-CEF5-49E5-A211-A8339B8F7188} - c:\windows\system32\dsoun.dll
BHO: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - c:\program files\avg\avg8\avgssie.dll
BHO: {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
BHO: {A057A204-BACC-4D26-9990-79A187E2698E} - c:\progra~1\avg\avg8\AVGTOO~1.DLL
BHO: {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
BHO: {AE7CD045-E861-484f-8273-0445EE161910} - c:\program files\adobe\acrobat 6.0\acrobat\AcroIEFavClient.dll
BHO: {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\program files\bae\BAE.dll
TB: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - c:\program files\adobe\acrobat 6.0\acrobat\AcroIEFavClient.dll
TB: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
TB: {A057A204-BACC-4D26-9990-79A187E2698E} - c:\progra~1\avg\avg8\AVGTOO~1.DLL
TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
TB: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - c:\program files\adobe\acrobat 6.0\acrobat\AcroIEFavClient.dll
TB: {A057A204-BACC-4D26-9990-79A187E2698E} - c:\progra~1\avg\avg8\AVGTOO~1.DLL
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [igfxtray] c:\windows\system32\igfxtray.exe
mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe
mRun: [igfxpers] c:\windows\system32\igfxpers.exe
mRun: [SunJavaUpdateSched] c:\program files\java\j2re1.4.2_03\bin\jusched.exe
mRun: [SigmatelSysTrayApp] stsystra.exe
mRun: [DMXLauncher] c:\program files\dell\media experience\DMXLauncher.exe
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [ISUSPM Startup] "c:\program files\common files\installshield\updateservice\isuspm.exe" -startup
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [Google Desktop Search] "c:\program files\google\google desktop search\GoogleDesktop.exe" /startup
mRun: [EPSON Stylus Photo 820 Series (Copy 1)] c:\windows\system32\spool\drivers\w32x86\3\E_S0EIC1.EXE /P38 "EPSON Stylus Photo 820 Series (Copy 1)" /O6 "USB001" /M "Stylus Photo 820"
mRun: [MSKDetectorExe] c:\program files\mcafee\spamkiller\MSKDetct.exe /uninstall
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
mRun: [SNM] c:\program files\spynomore\SNM.exe /startup
mRun: [ISTray] "c:\program files\spyware doctor\pctsTray.exe"
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\acroba~1.lnk - c:\program files\adobe\acrobat 6.0\distillr\acrotray.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\quickb~1.lnk - c:\program files\common files\intuit\quickbooks\qbupdate\qbupdate.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\servic~1.lnk - c:\program files\microsoft sql server\80\tools\binn\sqlmangr.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {08B0E5C0-4FCB-11CF-AAA5-00401C608501}
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office11\MSOXMLMF.DLL
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Notify: igfxcui -igfxdev.dll

============= SERVICES / DRIVERS ===============

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys
R2 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys
R0 edpwofvk;edpwofvk;c:\windows\system32\drivers\megvtacw.dat
R2 AdobeActiveFileMonitor;Adobe Active File Monitor;c:\program files\adobe\photoshop elements 3.0\PhotoshopElementsFileAgent.exe
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe
S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\google\google desktop search\GoogleDesktop.exe
R2 PhotoshopElementsDeviceConnect;Photoshop Elements Device Connect;c:\program files\adobe\photoshop elements 3.0\PhotoshopElementsDeviceConnect.exe
S3 PPCtlPriv;PPCtlPriv;c:\program files\ca\ca internet security suite\ca anti-spyware\PPCtlPriv.exe

=============== Created Last 30 ================

2008-11-10 19:30 <DIR> --d----- c:\program files\trend micro
2008-11-10 19:19 250 a------- c:\windows\gmer.ini
2008-11-10 14:50 <DIR> --d----- c:\program files\Lavasoft
2008-11-10 14:50 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Lavasoft
2008-11-10 14:50 <DIR> --d----- c:\program files\common files\Wise Installation Wizard
2008-11-10 14:30 <DIR> --d----- c:\program files\TeaTimer (Spybot - Search & Destroy)
2008-11-10 14:30 <DIR> --d----- c:\program files\SDHelper (Spybot - Search & Destroy)
2008-11-10 14:30 <DIR> --d----- c:\program files\Misc. Support Library (Spybot - Search & Destroy)
2008-11-10 14:30 <DIR> --d----- c:\program files\File Scanner Library (Spybot - Search & Destroy)
2008-11-10 13:22 81,288 a------- c:\windows\system32\drivers\iksyssec.sys
2008-11-10 13:22 66,952 a------- c:\windows\system32\drivers\iksysflt.sys
2008-11-10 13:22 40,840 a------- c:\windows\system32\drivers\ikfilesec.sys
2008-11-10 13:22 29,576 a------- c:\windows\system32\drivers\kcom.sys
2008-11-10 13:22 <DIR> --d----- c:\program files\Spyware Doctor
2008-11-10 13:22 <DIR> --d----- c:\docume~1\ben\applic~1\PC Tools
2008-11-07 20:22 1,152 a------- c:\windows\system32\windrv.sys
2008-11-07 20:22 <DIR> --d----- c:\program files\SpyNoMore
2008-11-07 12:47 161,792 a------- c:\windows\SWREG.exe
2008-11-07 12:47 98,816 a------- c:\windows\sed.exe
2008-11-07 12:42 <DIR> --dshr-- C:\cmdcons
2008-11-07 12:42 <DIR> --d----- c:\windows\setup.pss
2008-11-07 12:42 <DIR> --d----- c:\windows\setupupd
2008-11-06 09:56 <DIR> --d-h--- C:\$AVG8.VAULT$
2008-11-06 09:52 97,928 a------- c:\windows\system32\drivers\avgldx86.sys
2008-11-06 09:52 10,520 a------- c:\windows\system32\avgrsstx.dll
2008-11-06 09:52 <DIR> --d----- c:\windows\system32\drivers\Avg
2008-11-06 09:52 <DIR> --d----- c:\docume~1\ben\applic~1\AVGTOOLBAR
2008-11-06 09:51 76,040 a------- c:\windows\system32\drivers\avgtdix.sys
2008-11-06 09:51 <DIR> --d----- c:\program files\AVG
2008-11-06 09:51 <DIR> --d----- c:\docume~1\alluse~1\applic~1\avg8
2008-11-06 09:30 21,504 a------- c:\windows\system32\hidserv.dll
2008-11-06 09:30 21,504 a------- c:\windows\system32\dllcache\hidserv.dll
2008-11-06 09:30 31,616 a------- c:\windows\system32\drivers\usbccgp.sys
2008-11-06 09:30 31,616 a------- c:\windows\system32\dllcache\usbccgp.sys

==================== Find3M ====================

2008-11-06 09:48 <DIR> --d----- c:\docume~1\alluse~1\applic~1\McAfee.com
2008-10-15 11:57 332,800 -------- c:\windows\system32\dllcache\netapi32.dll
2008-09-15 06:57 1,846,016 a------- c:\windows\system32\win32k.sys
2008-09-15 06:57 1,846,016 -------- c:\windows\system32\dllcache\win32k.sys
2008-08-28 05:04 333,056 -------- c:\windows\system32\dllcache\srv.sys
2008-08-26 16:16 348,160 a------- c:\windows\system32\msvcr71.dll
2008-08-19 04:38 18,432 -------- c:\windows\system32\dllcache\iedw.exe
2008-06-14 13:49 <DIR> --d----- c:\docume~1\alluse~1\applic~1\MSScanAppDataDir
2008-06-09 05:47 <DIR> --d----- c:\docume~1\ben\applic~1\McAfee.com Personal Firewall
2008-03-02 08:51 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Dell
2008-01-07 06:36 <DIR> --d----- c:\docume~1\alluse~1\applic~1\McAfee.com Personal Firewall
2007-04-26 14:52 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2006-10-28 11:03 <DIR> --d----- c:\docume~1\ben\applic~1\Quark
2006-10-21 05:47 <DIR> --d----- c:\docume~1\ben\applic~1\FotoWire
2006-09-20 16:20 <DIR> --d----- c:\docume~1\ben\applic~1\Corel Photo Album
2006-08-06 15:54 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Quark
2006-06-14 10:28 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Intuit
2006-06-14 10:27 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Viewpoint
2004-08-10 12:13 <DIR> --d----- c:\docume~1\alluse~1\applic~1\SBSI
2007-08-24 18:27 1,135 ---sh--- c:\windows\fonts\ntp2.ini2
2007-02-18 14:41 88 ---shr-- c:\windows\system32\D47D29D109.sys
2007-02-18 14:41 3,350 a--sh--- c:\windows\system32\KGyGaAvL.sys

============= FINISH: 18:09:22.98 ===============

tetonbob · 11-12-2008, 05:09 PM

It seems as though you've run ComboFix recently also.

Please post the log located at C:\ComboFix.txt

paul.hunt · 11-12-2008, 06:47 PM

combofix.txt:

ComboFix 08-11-06.01 - Ben 2008-11-07 12:48:05.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.649 [GMT -5:00]
Running from: c:\documents and settings\Ben\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Amy\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
c:\windows\cookies.ini
c:\windows\Fonts\ntp2.ini
c:\windows\IE4 Error Log.txt
c:\windows\system32\acbeg.bak1
c:\windows\system32\acbeg.ini
c:\windows\system32\ahpnbwde.ini
c:\windows\system32\amkyuqnf.ini
c:\windows\system32\antnkkbd.ini
c:\windows\system32\arjkvtmn.ini
c:\windows\system32\atgddgcl.ini
c:\windows\system32\auibnnqp.ini
c:\windows\system32\bblhduyx.ini
c:\windows\system32\bcwhpvka.ini
c:\windows\system32\beopcdmp.ini
c:\windows\system32\bgycaavl.ini
c:\windows\system32\bkqjmhnw.ini
c:\windows\system32\blbtxcym.ini
c:\windows\system32\bllaytwx.ini
c:\windows\system32\bnmlcwdk.ini
c:\windows\system32\bpfwibor.ini
c:\windows\system32\bsknvmfr.ini
c:\windows\system32\bszip.dll
c:\windows\system32\btntbpsc.ini
c:\windows\system32\bxmxkdnk.ini
c:\windows\system32\byahvyka.ini
c:\windows\system32\byhilodc.ini
c:\windows\system32\byrtolog.ini
c:\windows\system32\byycmgkk.ini
c:\windows\system32\ccxbtjss.ini
c:\windows\system32\cequojch.ini
c:\windows\system32\cgfofexj.ini
c:\windows\system32\cilhhrtp.ini
c:\windows\system32\cjfgpvas.ini
c:\windows\system32\ckhbyqxu.ini
c:\windows\system32\ckiqmtdg.ini
c:\windows\system32\cplufkie.ini
c:\windows\system32\cuygccbi.ini
c:\windows\system32\cvakwipm.ini
c:\windows\system32\cwvmgvfa.ini
c:\windows\system32\cxrjbiwi.ini
c:\windows\system32\dgwbqxot.ini
c:\windows\system32\dklcxepi.ini
c:\windows\system32\dktayqrp.ini
c:\windows\system32\dqyqxydx.ini
c:\windows\system32\drurvbtp.ini
c:\windows\system32\dsvrehts.ini
c:\windows\system32\dvsfolbl.ini
c:\windows\system32\dxxlqgif.ini
c:\windows\system32\eaefagjm.ini
c:\windows\system32\eaxlplnb.ini
c:\windows\system32\edbednjr.ini
c:\windows\system32\eijvkysq.ini
c:\windows\system32\ejqpskkx.ini
c:\windows\system32\elpcfemt.ini
c:\windows\system32\eoilwagg.ini
c:\windows\system32\etnaqabs.ini
c:\windows\system32\evubqvyy.ini
c:\windows\system32\excdsrdw.ini
c:\windows\system32\faldqfww.ini
c:\windows\system32\famnyrbc.ini
c:\windows\system32\fismdcrv.ini
c:\windows\system32\flhpakqu.ini
c:\windows\system32\frubmasf.ini
c:\windows\system32\fubqlajw.ini
c:\windows\system32\fwivoeiy.ini
c:\windows\system32\gaagmuav.ini
c:\windows\system32\ggjxcluj.ini
c:\windows\system32\ghciopak.ini
c:\windows\system32\ghcuwlwr.ini
c:\windows\system32\ghqjjueg.ini
c:\windows\system32\gpfqmqaq.ini
c:\windows\system32\gpjsgdxl.ini
c:\windows\system32\grvtedld.ini
c:\windows\system32\gwbpsalt.ini
c:\windows\system32\gxirfijt.ini
c:\windows\system32\hasqoiww.ini
c:\windows\system32\heobduki.ini
c:\windows\system32\hfxwfyhs.ini
c:\windows\system32\hhllyhgg.ini
c:\windows\system32\hhqrlysi.ini
c:\windows\system32\hhuncrqf.ini
c:\windows\system32\huchbvwr.ini
c:\windows\system32\hwcogfyh.ini
c:\windows\system32\hxhjprlk.ini
c:\windows\system32\hxqksbld.ini
c:\windows\system32\hyjuelux.ini
c:\windows\system32\icmerwba.ini
c:\windows\system32\icyxdhbx.ini
c:\windows\system32\ieubelin.ini
c:\windows\system32\iiuaujti.ini
c:\windows\system32\ijjlm.bak1
c:\windows\system32\ijjlm.bak2
c:\windows\system32\ijjlm.ini
c:\windows\system32\ijjlm.ini2
c:\windows\system32\ijjlm.tmp
c:\windows\system32\ilqbfiwt.ini
c:\windows\system32\inmmrcnd.ini
c:\windows\system32\iqnoyrak.ini
c:\windows\system32\iufmridd.ini
c:\windows\system32\ivndlnwv.ini
c:\windows\system32\iywkjxcp.ini
c:\windows\system32\jafylfnd.ini
c:\windows\system32\japricsx.ini
c:\windows\system32\jdvtaybj.ini
c:\windows\system32\jiuydpsb.ini
c:\windows\system32\jnhoyvwt.ini
c:\windows\system32\jnsjcgeh.ini
c:\windows\system32\jsdigevb.ini
c:\windows\system32\jvsmknyg.ini
c:\windows\system32\jylusoip.ini
c:\windows\system32\jynjqcqx.ini
c:\windows\system32\kbfyyotu.ini
c:\windows\system32\kbloffih.ini
c:\windows\system32\kfawedjr.ini
c:\windows\system32\kgcrljuw.ini
c:\windows\system32\knecteqm.ini
c:\windows\system32\knpqkkhk.ini
c:\windows\system32\korepldf.ini
c:\windows\system32\kpksouci.ini
c:\windows\system32\kqgkdrhm.ini
c:\windows\system32\ktmasyqs.ini
c:\windows\system32\kyqonued.ini
c:\windows\system32\latoskxh.ini
c:\windows\system32\latsujun.ini
c:\windows\system32\lhhrylbe.ini
c:\windows\system32\ljbxpxni.ini
c:\windows\system32\lkcnonhh.ini
c:\windows\system32\lkyjoqci.ini
c:\windows\system32\llgyyyxm.ini
c:\windows\system32\lnajbhkb.ini
c:\windows\system32\logrvxwj.ini
c:\windows\system32\lojxqlxy.ini
c:\windows\system32\lrqxumpg.ini
c:\windows\system32\mabjhcgd.ini
c:\windows\system32\mbeomupp.ini
c:\windows\system32\mcgrqaaa.ini
c:\windows\system32\mcrh.tmp
c:\windows\system32\mhtowqpl.ini
c:\windows\system32\mkmqgkhr.ini
c:\windows\system32\mksseugp.ini
c:\windows\system32\mrpvbynd.ini
c:\windows\system32\mtqjnfjs.ini
c:\windows\system32\mwsojvbp.ini
c:\windows\system32\nbphwaxe.ini
c:\windows\system32\ncifgyrs.ini
c:\windows\system32\ndfgdmny.ini
c:\windows\system32\nekkftsi.ini
c:\windows\system32\nhsapfem.ini
c:\windows\system32\njjyioeh.ini
c:\windows\system32\nlgqpebf.ini
c:\windows\system32\noattktw.ini
c:\windows\system32\nrrwlyyh.ini
c:\windows\system32\nsiqtilb.ini
c:\windows\system32\nsiruoif.ini
c:\windows\system32\nsogahle.ini
c:\windows\system32\nsyppxgd.ini
c:\windows\system32\obdkirjq.ini
c:\windows\system32\ohykmfci.ini
c:\windows\system32\oigujvfl.ini
c:\windows\system32\onkgntap.ini
c:\windows\system32\osbsgkei.ini
c:\windows\system32\osfulmhk.ini
c:\windows\system32\oticfytr.ini
c:\windows\system32\owqnmqpg.ini
c:\windows\system32\oxjqsgqn.ini
c:\windows\system32\oxvufqex.ini
c:\windows\system32\oyhllxlm.ini
c:\windows\system32\pdxnssir.ini
c:\windows\system32\pfmanbrd.ini
c:\windows\system32\pjljwtuq.ini
c:\windows\system32\pmffsnne.ini
c:\windows\system32\pokckpvv.ini
c:\windows\system32\ppnbdtox.ini
c:\windows\system32\pptxujtl.ini
c:\windows\system32\pqcvdnaf.ini
c:\windows\system32\prfgopgo.ini
c:\windows\system32\ptviocug.ini
c:\windows\system32\pubmnpcx.ini
c:\windows\system32\pvamfnwh.ini
c:\windows\system32\qcrretne.ini
c:\windows\system32\qcvooudx.ini
c:\windows\system32\qevgldsa.ini
c:\windows\system32\qhwdjtvu.ini
c:\windows\system32\qrnnbond.ini
c:\windows\system32\qupkylky.ini
c:\windows\system32\qxdflprp.ini
c:\windows\system32\rfoccuwj.ini
c:\windows\system32\rguuruke.ini
c:\windows\system32\rifdqcqh.ini
c:\windows\system32\rimfogio.ini
c:\windows\system32\rimwcnoy.ini
c:\windows\system32\rlgmdjno.ini
c:\windows\system32\rluqnboq.ini
c:\windows\system32\rqnkkjcn.ini
c:\windows\system32\rvnqpsya.ini
c:\windows\system32\sahcbpap.ini
c:\windows\system32\sfdbjthe.ini
c:\windows\system32\sfyxqlww.ini
c:\windows\system32\sgdipqui.ini
c:\windows\system32\shdokogx.ini
c:\windows\system32\shnykbag.ini
c:\windows\system32\sjturrip.ini
c:\windows\system32\smhrfnkk.ini
c:\windows\system32\snxnfleq.ini
c:\windows\system32\sqyutwqc.ini
c:\windows\system32\ssohlmsf.ini
c:\windows\system32\sswpryab.ini
c:\windows\system32\ststv.bak1
c:\windows\system32\ststv.ini
c:\windows\system32\svhoifwj.ini
c:\windows\system32\svvwa.bak1
c:\windows\system32\svvwa.bak2
c:\windows\system32\svvwa.ini
c:\windows\system32\svvwa.tmp
c:\windows\system32\svvwa.tmp2
c:\windows\system32\tfmeaxuu.ini
c:\windows\system32\tlwadjsx.ini
c:\windows\system32\tpomyvll.ini
c:\windows\system32\ttutv.bak1
c:\windows\system32\ttutv.bak2
c:\windows\system32\ttutv.ini
c:\windows\system32\ttutv.ini2
c:\windows\system32\ttutv.tmp
c:\windows\system32\twbtgmhj.ini
c:\windows\system32\twlirdvr.ini
c:\windows\system32\twqiogta.ini
c:\windows\system32\tywdinkq.ini
c:\windows\system32\upnnaibf.ini
c:\windows\system32\utglaxis.ini
c:\windows\system32\utwkjpiw.ini
c:\windows\system32\uyhmleso.ini
c:\windows\system32\vdxqnmau.ini
c:\windows\system32\vgsmlkih.ini
c:\windows\system32\vlygiruy.ini
c:\windows\system32\vsdrcomw.ini
c:\windows\system32\wljxcxci.ini
c:\windows\system32\wnqagpvm.ini
c:\windows\system32\woyvmsxx.ini
c:\windows\system32\wptkfcfb.ini
c:\windows\system32\wxrxnaum.ini
c:\windows\system32\xeuymqje.ini
c:\windows\system32\xfqqbwbj.ini
c:\windows\system32\xgbqhths.ini
c:\windows\system32\xgtxkixy.ini
c:\windows\system32\xgxjaoll.ini
c:\windows\system32\xibsheiu.ini
c:\windows\system32\xmrjdtmv.ini
c:\windows\system32\xnmcvhca.ini
c:\windows\system32\xqidudbw.ini
c:\windows\system32\xrfbrdyy.ini
c:\windows\system32\xyadd.bak1
c:\windows\system32\xyadd.ini
c:\windows\system32\ybkxfgdx.ini
c:\windows\system32\ydnbfjjr.ini
c:\windows\system32\yfcwhoht.ini
c:\windows\system32\yiafxhmm.ini
c:\windows\system32\yidvwwxl.ini
c:\windows\system32\yonjcpnv.ini
c:\windows\system32\yuinbxvl.ini
c:\windows\system32\ywpgtmgo.ini
c:\windows\system32\yyjssuxw.ini
c:\windows\system32\yytvusfg.ini

.
((((((((((((((((((((((((( Files Created from 2008-10-07 to 2008-11-07 )))))))))))))))))))))))))))))))
.

2008-11-06 09:56 . 2008-11-06 13:17 <DIR> d--h----- C:\$AVG8.VAULT$
2008-11-06 09:52 . 2008-11-07 12:37 <DIR> d-------- c:\windows\system32\drivers\Avg
2008-11-06 09:52 . 2008-11-06 09:59 <DIR> d-------- c:\documents and settings\Ben\Application Data\AVGTOOLBAR
2008-11-06 09:52 . 2008-11-06 09:52 97,928 --a------ c:\windows\system32\drivers\avgldx86.sys
2008-11-06 09:52 . 2008-11-06 09:52 10,520 --a------ c:\windows\system32\avgrsstx.dll
2008-11-06 09:51 . 2008-11-06 09:51 <DIR> d-------- c:\program files\AVG
2008-11-06 09:51 . 2008-11-06 09:51 <DIR> d-------- c:\documents and settings\All Users\Application Data\avg8
2008-11-06 09:51 . 2008-11-06 09:51 76,040 --a------ c:\windows\system32\drivers\avgtdix.sys
2008-11-06 09:30 . 2004-08-03 23:08 31,616 --a------ c:\windows\system32\drivers\usbccgp.sys
2008-11-06 09:30 . 2004-08-03 23:08 31,616 --a------ c:\windows\system32\dllcache\usbccgp.sys
2008-11-06 09:30 . 2004-08-04 00:56 21,504 --a------ c:\windows\system32\hidserv.dll
2008-11-06 09:30 . 2004-08-04 00:56 21,504 --a------ c:\windows\system32\dllcache\hidserv.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-06 14:48 --------- d-----w c:\documents and settings\All Users\Application Data\McAfee.com
2008-11-03 01:49 --------- d-----w c:\documents and settings\Ben\Application Data\AdobeUM
2007-04-29 14:29 800,272 ----a-w c:\documents and settings\Ben\ppctl.dll
2007-08-24 23:27 1,135 --sh--w c:\windows\Fonts\ntp2.ini2
2007-02-18 19:41 88 --sh--r c:\windows\system32\D47D29D109.sys
2007-02-18 19:41 3,350 --sha-w c:\windows\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{10708868-CEF5-49E5-A211-A8339B8F7188}]
2008-03-10 17:21 98048 --a------ c:\windows\system32\dsoun.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-10-14 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-10-14 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-10-14 114688]
"SunJavaUpdateSched"="c:\program files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-11-19 32881]
"DMXLauncher"="c:\program files\Dell\Media Experience\DMXLauncher.exe" [2005-10-05 94208]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-06-14 98304]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 249856]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 81920]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-09-03 29744]
"EPSON Stylus Photo 820 Series (Copy 1)"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S0EIC1.EXE" [2002-04-10 74240]
"MSKDetectorExe"="c:\program files\McAfee\SpamKiller\MSKDetct.exe" [2006-11-07 1121280]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-08-26 185896]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-11-06 1234712]
"SigmatelSysTrayApp"="stsystra.exe" [2005-03-22 c:\windows\stsystra.exe]

c:\documents and settings\LocalService\Start Menu\Programs\Startup\
updtpcps.bat [2003-02-27 39]

c:\documents and settings\NetworkService\Start Menu\Programs\Startup\
updtpcps.bat [2003-02-27 39]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Acrobat Assistant.lnk - c:\program files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-05-15 217193]
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-10-20 113664]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-06-14 24576]
QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2004-11-11 806912]
Service Manager.lnk - c:\program files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2005-05-03 81920]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

R0 edpwofvk;edpwofvk;c:\windows\system32\drivers\megvtacw.dat [ ]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-11-06 97928]
R2 AdobeActiveFileMonitor;Adobe Active File Monitor;c:\program files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe [2004-10-20 98304]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-11-06 875288]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-11-06 231704]
R2 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2008-11-06 76040]
R2 PhotoshopElementsDeviceConnect;Photoshop Elements Device Connect;c:\program files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe [2004-10-20 118784]
S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2008-09-03 29744]
S3 PPCtlPriv;PPCtlPriv;c:\program files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe [ ]
.
Contents of the 'Scheduled Tasks' folder

2008-10-31 c:\windows\Tasks\McAfee.com Scan for Viruses - My Computer (DH08H5B1-Amy).job
- c:\program files\mcafee.com\vso\mcmnhdlr.exe []
.
- - - - ORPHANS REMOVED - - - -

Notify-awvvs - c:\windows\system32\awvvs.dll
Notify-ddayx - c:\windows\system32\ddayx.dll
Notify-disknet - c:\windows\fonts\disknet.dll
Notify-gebyy - c:\windows\system32\gebyy.dll
Notify-mljji - c:\windows\system32\mljji.dll
Notify-vtsts - c:\windows\system32\vtsts.dll
Notify-vtutt - c:\windows\system32\vtutt.dll
Notify-efcbxvt - efcbxvt.dll

.
------- Supplementary Scan -------
.
FireFox -: Profile - c:\documents and settings\Ben\Application Data\Mozilla\Firefox\Profiles\zelqwdyd.default\
FF -: plugin - c:\program files\Adobe\Acrobat 6.0\Reader\browser\nppdf32.dll
FF -: plugin - c:\program files\Java\j2re1.4.2_03\bin\NPJava11.dll
FF -: plugin - c:\program files\Java\j2re1.4.2_03\bin\NPJava12.dll
FF -: plugin - c:\program files\Java\j2re1.4.2_03\bin\NPJava13.dll
FF -: plugin - c:\program files\Java\j2re1.4.2_03\bin\NPJava14.dll
FF -: plugin - c:\program files\Java\j2re1.4.2_03\bin\NPJava32.dll
FF -: plugin - c:\program files\Java\j2re1.4.2_03\bin\NPJPI142_03.dll
FF -: plugin - c:\program files\Java\j2re1.4.2_03\bin\NPOJI610.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\npGoogleGadgetPluginFirefoxWin.dll
FF -: plugin - c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-07 13:01:29
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\edpwofvk]
"ImagePath"="system32\drivers\megvtacw.dat"
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
c:\windows\system32\wdfmgr.exe
c:\program files\AVG\AVG8\avgrsx.exe
.
**************************************************************************
.
Completion time: 2008-11-07 13:04:22 - machine was rebooted
ComboFix-quarantined-files.txt 2008-11-07 18:04:16

Pre-Run: 56,067,465,216 bytes free
Post-Run: 58,160,807,936 bytes free

398 --- E O F --- 2008-10-25 02:37:56

tetonbob · 11-12-2008, 07:37 PM

Thanks.

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

---------------------------------------------------------------------------------------------

ComboFix is updated frequently. Please delete your current version, and get a new copy from one of the links below, and save it to your desktop.

Download ComboFix from one of these locations:

Link 1
Link 2
Link 3

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.

Open notepad and copy/paste the text in the quotebox below into it:

Quote:

http://www.techsupportforum.com/security-center/hijackthis-log-help/311548-downloader-delf-12-a.html#post1800370

Driver::
edpwofvk

Collect::
c:\windows\system32\drivers\megvtacw.dat
c:\windows\system32\dsoun.dll

Save this as CFScript.txt

Referring to the picture above, drag CFScript.txt into ComboFix.exe

Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.
When finished, it shall produce a log for you. Post that log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

When ComboFix finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture a file to submit for analysis.

Ensure you are connected to the internet and click OK. A browser will open. Simply follow the instructions to copy/paste/send the requested file.
Ensure your AntiVirus and AntiSpyware applications are re-enabled. A reboot should have done this.

paul.hunt · 11-13-2008, 07:32 AM

Quote:

Originally Posted by tetonbob

Thanks.
Ensure you are connected to the internet and click OK. A browser will open. Simply follow the instructions to copy/paste/send the requested file.

I did not have to respond OK to anything and it did not open my browser.

log.txt:

ComboFix 08-11-12.01 - Ben 2008-11-13 9:18:25.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.541 [GMT -5:00]
Running from: c:\documents and settings\Ben\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Ben\Desktop\CFScript.txt
* Created a new restore point
.
The following files were disabled during the run:
c:\program files\Spyware Doctor\smumhook.dll
c:\program files\Spyware Doctor\klg.dat

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\drivers\megvtacw.dat
c:\windows\system32\dsoun.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_EDPWOFVK
-------\Service_edpwofvk

((((((((((((((((((((((((( Files Created from 2008-10-13 to 2008-11-13 )))))))))))))))))))))))))))))))
.

2008-11-10 19:30 . 2008-11-10 19:30 <DIR> d-------- C:\rsit
2008-11-10 19:30 . 2008-11-10 19:30 <DIR> d-------- c:\program files\trend micro
2008-11-10 19:19 . 2008-11-12 18:17 250 --a------ c:\windows\gmer.ini
2008-11-10 14:50 . 2008-11-10 14:50 <DIR> d-------- c:\program files\Lavasoft
2008-11-10 14:50 . 2008-11-10 14:50 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard
2008-11-10 14:50 . 2008-11-10 14:51 <DIR> d-------- c:\documents and settings\All Users\Application Data\Lavasoft
2008-11-10 14:30 . 2008-11-10 14:30 <DIR> d-------- c:\program files\TeaTimer (Spybot - Search & Destroy)
2008-11-10 14:30 . 2008-11-10 14:30 <DIR> d-------- c:\program files\SDHelper (Spybot - Search & Destroy)
2008-11-10 14:30 . 2008-11-10 14:30 <DIR> d-------- c:\program files\Misc. Support Library (Spybot - Search & Destroy)
2008-11-10 14:30 . 2008-11-10 14:30 <DIR> d-------- c:\program files\File Scanner Library (Spybot - Search & Destroy)
2008-11-10 13:22 . 2008-11-13 09:21 <DIR> d-------- c:\program files\Spyware Doctor
2008-11-10 13:22 . 2008-11-10 13:22 <DIR> d-------- c:\documents and settings\Ben\Application Data\PC Tools
2008-11-10 13:22 . 2008-11-13 09:24 <DIR> d-a------ c:\documents and settings\All Users\Application Data\TEMP
2008-11-10 13:22 . 2008-08-25 12:36 81,288 --a------ c:\windows\system32\drivers\iksyssec.sys
2008-11-10 13:22 . 2008-08-25 12:36 66,952 --a------ c:\windows\system32\drivers\iksysflt.sys
2008-11-10 13:22 . 2008-08-25 12:36 40,840 --a------ c:\windows\system32\drivers\ikfilesec.sys
2008-11-10 13:22 . 2008-06-02 16:19 29,576 --a------ c:\windows\system32\drivers\kcom.sys
2008-11-07 20:22 . 2008-11-13 02:00 <DIR> d-------- c:\program files\SpyNoMore
2008-11-07 20:22 . 2008-11-07 20:22 1,152 --a------ c:\windows\system32\windrv.sys
2008-11-06 09:56 . 2008-11-12 12:41 <DIR> d--h----- C:\$AVG8.VAULT$
2008-11-06 09:52 . 2008-11-13 09:23 <DIR> d-------- c:\windows\system32\drivers\Avg
2008-11-06 09:52 . 2008-11-06 09:59 <DIR> d-------- c:\documents and settings\Ben\Application Data\AVGTOOLBAR
2008-11-06 09:52 . 2008-11-06 09:52 97,928 --a------ c:\windows\system32\drivers\avgldx86.sys
2008-11-06 09:52 . 2008-11-06 09:52 10,520 --a------ c:\windows\system32\avgrsstx.dll
2008-11-06 09:51 . 2008-11-06 09:51 <DIR> d-------- c:\program files\AVG
2008-11-06 09:51 . 2008-11-06 09:51 <DIR> d-------- c:\documents and settings\All Users\Application Data\avg8
2008-11-06 09:51 . 2008-11-06 09:51 76,040 --a------ c:\windows\system32\drivers\avgtdix.sys
2008-11-06 09:30 . 2004-08-03 23:08 31,616 --a------ c:\windows\system32\drivers\usbccgp.sys
2008-11-06 09:30 . 2004-08-03 23:08 31,616 --a------ c:\windows\system32\dllcache\usbccgp.sys
2008-11-06 09:30 . 2004-08-04 00:56 21,504 --a------ c:\windows\system32\hidserv.dll
2008-11-06 09:30 . 2004-08-04 00:56 21,504 --a------ c:\windows\system32\dllcache\hidserv.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-06 14:48 --------- d-----w c:\documents and settings\All Users\Application Data\McAfee.com
2008-11-03 01:49 --------- d-----w c:\documents and settings\Ben\Application Data\AdobeUM
2008-10-24 11:10 453,632 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2007-04-29 14:29 800,272 ----a-w c:\documents and settings\Ben\ppctl.dll
2007-08-24 23:27 1,135 --sh--w c:\windows\Fonts\ntp2.ini2
2007-02-18 19:41 88 --sh--r c:\windows\system32\D47D29D109.sys
2007-02-18 19:41 3,350 --sha-w c:\windows\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((( snapshot@2008-11-07_13.03.50.29 )))))))))))))))))))))))))))))))))))))))))
.
- 2006-05-05 09:41:45 453,120 ------w c:\windows\Driver Cache\i386\mrxsmb.sys
+ 2008-10-24 11:10:42 453,632 ------w c:\windows\Driver Cache\i386\mrxsmb.sys
+ 2008-11-11 00:19:44 884,736 ----a-w c:\windows\gmer.dll
+ 2008-11-11 00:19:31 811,008 ----a-w c:\windows\gmer.exe
+ 2008-11-13 08:00:39 32,768 ----a-r c:\windows\Installer\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}\icon.exe
- 2006-05-05 09:41:45 453,120 ------w c:\windows\system32\dllcache\mrxsmb.sys
+ 2008-10-24 11:10:42 453,632 ------w c:\windows\system32\dllcache\mrxsmb.sys
- 2007-06-26 06:08:16 1,104,896 ------w c:\windows\system32\dllcache\msxml3.dll
+ 2008-09-04 16:42:02 1,106,944 ------w c:\windows\system32\dllcache\msxml3.dll
+ 2008-04-29 15:19:50 12,960 ----a-w c:\windows\system32\drivers\Awrtpd.sys
+ 2008-04-29 15:19:54 15,648 ----a-w c:\windows\system32\drivers\Awrtrd.sys
+ 2008-11-11 00:19:44 85,969 ----a-w c:\windows\system32\drivers\gmer.sys
+ 2008-04-29 15:20:00 15,648 ----a-w c:\windows\system32\drivers\NSDriver.sys
+ 2008-05-16 15:58:04 12,632 ----a-w c:\windows\system32\lsdelete.exe
- 2007-06-26 06:08:16 1,104,896 ----a-w c:\windows\system32\msxml3.dll
+ 2008-09-04 16:42:02 1,106,944 ----a-w c:\windows\system32\msxml3.dll
- 2007-05-08 19:03:04 1,275,392 ----a-w c:\windows\system32\msxml4.dll
+ 2008-09-30 21:43:34 1,286,152 ----a-w c:\windows\system32\msxml4.dll
- 2008-11-02 10:39:59 61,188 ----a-w c:\windows\system32\perfc009.dat
+ 2008-11-10 18:23:43 61,188 ----a-w c:\windows\system32\perfc009.dat
- 2008-11-02 10:40:00 399,522 ----a-w c:\windows\system32\perfh009.dat
+ 2008-11-10 18:23:43 399,522 ----a-w c:\windows\system32\perfh009.dat
- 2007-11-30 11:18:51 17,272 ------w c:\windows\system32\spmsg.dll
+ 2008-07-08 13:02:01 17,272 ------w c:\windows\system32\spmsg.dll
+ 2008-11-13 14:22:02 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_6b8.dat
+ 2008-09-30 21:42:08 1,286,152 ----a-w c:\windows\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9870.0_x-ww_a32d74cf\msxml4.dll
+ 2008-09-30 21:45:12 91,656 ----a-w c:\windows\WinSxS\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.1.0_x-ww_2a41bceb\msxml4r.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-10-14 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-10-14 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-10-14 114688]
"SunJavaUpdateSched"="c:\program files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-11-19 32881]
"DMXLauncher"="c:\program files\Dell\Media Experience\DMXLauncher.exe" [2005-10-05 94208]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-06-14 98304]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 249856]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 81920]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-09-03 29744]
"EPSON Stylus Photo 820 Series (Copy 1)"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S0EIC1.EXE" [2002-04-10 74240]
"MSKDetectorExe"="c:\program files\McAfee\SpamKiller\MSKDetct.exe" [2006-11-07 1121280]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-08-26 185896]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-11-06 1234712]
"ISTray"="c:\program files\Spyware Doctor\pctsTray.exe" [2008-08-25 1168264]
"SigmatelSysTrayApp"="stsystra.exe" [2005-03-22 c:\windows\stsystra.exe]

c:\documents and settings\LocalService\Start Menu\Programs\Startup\
updtpcps.bat [2003-02-27 39]

c:\documents and settings\NetworkService\Start Menu\Programs\Startup\
updtpcps.bat [2003-02-27 39]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Acrobat Assistant.lnk - c:\program files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-05-15 217193]
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-10-20 113664]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-06-14 24576]
QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2004-11-11 806912]
Service Manager.lnk - c:\program files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2005-05-03 81920]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-11-06 97928]
R2 AdobeActiveFileMonitor;Adobe Active File Monitor;c:\program files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe [2004-10-20 98304]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-11-06 875288]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-11-06 231704]
R2 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2008-11-06 76040]
R2 PhotoshopElementsDeviceConnect;Photoshop Elements Device Connect;c:\program files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe [2004-10-20 118784]
S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2008-09-03 29744]
S3 PPCtlPriv;PPCtlPriv;c:\program files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe [ ]
.
Contents of the 'Scheduled Tasks' folder

2008-11-07 c:\windows\Tasks\McAfee.com Scan for Viruses - My Computer (DH08H5B1-Amy).job
- c:\program files\mcafee.com\vso\mcmnhdlr.exe []
.
- - - - ORPHANS REMOVED - - - -

BHO-{10708868-CEF5-49E5-A211-A8339B8F7188} - c:\windows\system32\dsoun.dll

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-13 09:24:22
Windows 5.1.2600 Service Pack 2 NTFS

detected NTDLL code modification:
ZwClose

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
c:\program files\Spyware Doctor\pctsAuxs.exe
c:\program files\Spyware Doctor\pctsSvc.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\windows\system32\wdfmgr.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2008-11-13 9:27:10 - machine was rebooted
ComboFix-quarantined-files.txt 2008-11-13 14:27:05
ComboFix2.txt 2008-11-07 18:04:23

Pre-Run: 57,984,958,464 bytes free
Post-Run: 57,973,374,976 bytes free

176 --- E O F --- 2008-11-13 08:01:41

tetonbob · 11-13-2008, 08:08 AM

Please go to Start > Run and copy/paste the following, then press Enter:

C:\QooBox\ComboFix-quarantined-files.txt

Post the contents of the logfile which will open.

paul.hunt · 11-13-2008, 10:06 AM

2000-10-27 16:23:18 A------- 50,688 C:\Qoobox\Quarantine\C\WINDOWS\system32\BSZIP.DLL.vir
2006-07-09 18:56:19 A------- 53 C:\Qoobox\Quarantine\C\Documents and Settings\Amy\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML.vir
2006-09-14 17:11:46 A------- 3,310 C:\Qoobox\Quarantine\C\WINDOWS\IE4 Error Log.txt.vir
2007-04-26 12:14:28 A------- 1,402,424 C:\Qoobox\Quarantine\C\WINDOWS\system32\acbeg.ini.vir
2007-04-26 12:14:43 A------- 1,402,038 C:\Qoobox\Quarantine\C\WINDOWS\system32\acbeg.bak1.vir
2007-04-27 15:54:31 A------- 1,252,559 C:\Qoobox\Quarantine\C\WINDOWS\system32\svvwa.bak1.vir
2007-04-28 16:27:47 A------- 1,353,307 C:\Qoobox\Quarantine\C\WINDOWS\system32\svvwa.bak2.vir
2007-04-28 17:47:45 A------- 1,259,575 C:\Qoobox\Quarantine\C\WINDOWS\system32\svvwa.tmp.vir
2007-04-28 17:50:10 A------- 1,246,499 C:\Qoobox\Quarantine\C\WINDOWS\system32\svvwa.ini.vir
2007-05-03 15:50:06 A------- 1,463,664 C:\Qoobox\Quarantine\C\WINDOWS\system32\iufmridd.ini.vir
2007-05-05 19:08:18 A------- 1,463,124 C:\Qoobox\Quarantine\C\WINDOWS\system32\obdkirjq.ini.vir
2007-05-05 21:23:56 A------- 1,461,459 C:\Qoobox\Quarantine\C\WINDOWS\system32\pmffsnne.ini.vir
2007-05-06 06:32:43 A------- 1,462,719 C:\Qoobox\Quarantine\C\WINDOWS\system32\pptxujtl.ini.vir
2007-05-08 08:41:29 A------- 1,436,569 C:\Qoobox\Quarantine\C\WINDOWS\system32\lojxqlxy.ini.vir
2007-05-08 15:38:07 A------- 1,356,874 C:\Qoobox\Quarantine\C\WINDOWS\system32\svvwa.tmp2.vir
2007-05-08 17:38:53 A------- 2,112,171 C:\Qoobox\Quarantine\C\WINDOWS\system32\ijjlm.bak1.vir
2007-05-09 17:58:13 A------- 2,111,148 C:\Qoobox\Quarantine\C\WINDOWS\system32\ijjlm.bak2.vir
2007-05-10 11:36:51 A------- 1,550,267 C:\Qoobox\Quarantine\C\WINDOWS\system32\ijjlm.tmp.vir
2007-05-10 11:39:42 A------- 1,506,944 C:\Qoobox\Quarantine\C\WINDOWS\system32\ijjlm.ini.vir
2007-05-10 14:28:43 A------- 1,462,662 C:\Qoobox\Quarantine\C\WINDOWS\system32\eoilwagg.ini.vir
2007-05-14 11:19:45 A------- 1,431,757 C:\Qoobox\Quarantine\C\WINDOWS\system32\iywkjxcp.ini.vir
2007-05-15 06:52:04 A------- 1,466,012 C:\Qoobox\Quarantine\C\WINDOWS\system32\ohykmfci.ini.vir
2007-05-16 16:30:43 A------- 1,461,522 C:\Qoobox\Quarantine\C\WINDOWS\system32\smhrfnkk.ini.vir
2007-05-16 16:35:45 A------- 1,450,593 C:\Qoobox\Quarantine\C\WINDOWS\system32\nsiqtilb.ini.vir
2007-05-17 15:34:31 A------- 963 C:\Qoobox\Quarantine\C\WINDOWS\Fonts\ntp2.ini.vir
2007-05-18 04:30:33 A------- 1,062,520 C:\Qoobox\Quarantine\C\WINDOWS\system32\jnsjcgeh.ini.vir
2007-05-18 04:32:36 A------- 1,077,124 C:\Qoobox\Quarantine\C\WINDOWS\system32\ghqjjueg.ini.vir
2007-05-18 13:47:30 A------- 1,087,161 C:\Qoobox\Quarantine\C\WINDOWS\system32\nsyppxgd.ini.vir
2007-05-18 16:11:16 A------- 143 C:\Qoobox\Quarantine\C\WINDOWS\system32\mcrh.tmp.vir
2007-05-18 16:14:57 A------- 833,162 C:\Qoobox\Quarantine\C\WINDOWS\system32\yfcwhoht.ini.vir
2007-05-19 11:11:33 A------- 1,092,231 C:\Qoobox\Quarantine\C\WINDOWS\system32\yonjcpnv.ini.vir
2007-05-19 11:19:54 A------- 1,084,910 C:\Qoobox\Quarantine\C\WINDOWS\system32\oxvufqex.ini.vir
2007-05-21 16:14:29 A------- 831,977 C:\Qoobox\Quarantine\C\WINDOWS\system32\twlirdvr.ini.vir
2007-05-22 08:03:36 A------- 1,100,817 C:\Qoobox\Quarantine\C\WINDOWS\system32\grvtedld.ini.vir
2007-06-01 12:09:22 A------- 1,101,736 C:\Qoobox\Quarantine\C\WINDOWS\system32\edbednjr.ini.vir
2007-06-03 08:50:20 A------- 1,101,198 C:\Qoobox\Quarantine\C\WINDOWS\system32\excdsrdw.ini.vir
2007-06-03 12:28:23 A------- 1,101,540 C:\Qoobox\Quarantine\C\WINDOWS\system32\gwbpsalt.ini.vir
2007-06-03 18:01:11 A------- 1,067,167 C:\Qoobox\Quarantine\C\WINDOWS\system32\dxxlqgif.ini.vir
2007-06-04 12:25:46 A------- 965,959 C:\Qoobox\Quarantine\C\WINDOWS\system32\faldqfww.ini.vir
2007-06-09 08:04:46 A------- 970,852 C:\Qoobox\Quarantine\C\WINDOWS\system32\rguuruke.ini.vir
2007-06-10 04:46:42 A------- 970,791 C:\Qoobox\Quarantine\C\WINDOWS\system32\tlwadjsx.ini.vir
2007-06-11 10:45:59 A------- 1,893,659 C:\Qoobox\Quarantine\C\WINDOWS\system32\gpfqmqaq.ini.vir
2007-06-11 12:58:26 A------- 1,889,021 C:\Qoobox\Quarantine\C\WINDOWS\system32\xgbqhths.ini.vir
2007-06-11 14:17:23 A------- 1,883,410 C:\Qoobox\Quarantine\C\WINDOWS\system32\kqgkdrhm.ini.vir
2007-06-11 16:33:01 A------- 1,882,296 C:\Qoobox\Quarantine\C\WINDOWS\system32\fismdcrv.ini.vir
2007-06-11 17:41:14 A------- 1,879,273 C:\Qoobox\Quarantine\C\WINDOWS\system32\llgyyyxm.ini.vir
2007-06-12 04:12:15 A------- 1,873,477 C:\Qoobox\Quarantine\C\WINDOWS\system32\hhuncrqf.ini.vir
2007-06-12 07:53:18 A------- 2,120,010 C:\Qoobox\Quarantine\C\WINDOWS\system32\ijjlm.ini2.vir
2007-06-12 08:02:04 A------- 1,757,725 C:\Qoobox\Quarantine\C\WINDOWS\system32\hyjuelux.ini.vir
2007-06-12 12:55:25 A------- 1,752,487 C:\Qoobox\Quarantine\C\WINDOWS\system32\lrqxumpg.ini.vir
2007-06-12 15:16:38 A------- 1,834,783 C:\Qoobox\Quarantine\C\WINDOWS\system32\bkqjmhnw.ini.vir
2007-06-12 16:28:29 A------- 1,834,903 C:\Qoobox\Quarantine\C\WINDOWS\system32\nlgqpebf.ini.vir
2007-06-13 04:51:50 A------- 1,835,022 C:\Qoobox\Quarantine\C\WINDOWS\system32\pubmnpcx.ini.vir
2007-06-13 06

40 A------- 1,835,141 C:\Qoobox\Quarantine\C\WINDOWS\system32\vlygiruy.ini.vir
2007-06-13 14:35:17 A------- 1,835,263 C:\Qoobox\Quarantine\C\WINDOWS\system32\shnykbag.ini.vir
2007-06-13 15:40:36 A------- 1,835,383 C:\Qoobox\Quarantine\C\WINDOWS\system32\xgxjaoll.ini.vir
2007-06-13 17:58:10 A------- 1,835,503 C:\Qoobox\Quarantine\C\WINDOWS\system32\mabjhcgd.ini.vir
2007-06-14 04:29:18 A------- 1,835,623 C:\Qoobox\Quarantine\C\WINDOWS\system32\ggjxcluj.ini.vir
2007-06-14 05:37:09 A------- 1,835,742 C:\Qoobox\Quarantine\C\WINDOWS\system32\bxmxkdnk.ini.vir
2007-06-14 06:56:01 A------- 1,835,863 C:\Qoobox\Quarantine\C\WINDOWS\system32\qxdflprp.ini.vir
2007-06-14 07:21:04 A------- 1,835,983 C:\Qoobox\Quarantine\C\WINDOWS\system32\utglaxis.ini.vir
2007-06-14 14:45:42 A------- 1,836,163 C:\Qoobox\Quarantine\C\WINDOWS\system32\heobduki.ini.vir
2007-06-15 04:36:29 A------- 1,836,522 C:\Qoobox\Quarantine\C\WINDOWS\system32\bpfwibor.ini.vir
2007-06-15 14:16:26 A------- 1,836,642 C:\Qoobox\Quarantine\C\WINDOWS\system32\rimwcnoy.ini.vir
2007-06-15 17:01:42 A------- 1,836,763 C:\Qoobox\Quarantine\C\WINDOWS\system32\dsvrehts.ini.vir
2007-06-15 17:44:01 A------- 1,836,883 C:\Qoobox\Quarantine\C\WINDOWS\system32\logrvxwj.ini.vir
2007-06-15 17:55:34 A------- 1,836,025 C:\Qoobox\Quarantine\C\WINDOWS\system32\lkcnonhh.ini.vir
2007-06-15 18:27:57 A------- 1,836,146 C:\Qoobox\Quarantine\C\WINDOWS\system32\jsdigevb.ini.vir
2007-06-16 03:38:57 A------- 1,836,265 C:\Qoobox\Quarantine\C\WINDOWS\system32\arjkvtmn.ini.vir
2007-06-16 09:09:30 A------- 1,836,385 C:\Qoobox\Quarantine\C\WINDOWS\system32\beopcdmp.ini.vir
2007-06-16 14:49:04 A------- 1,836,505 C:\Qoobox\Quarantine\C\WINDOWS\system32\nbphwaxe.ini.vir
2007-06-16 15:57:47 A------- 1,836,625 C:\Qoobox\Quarantine\C\WINDOWS\system32\sfyxqlww.ini.vir
2007-06-17 05:42:16 A------- 1,836,745 C:\Qoobox\Quarantine\C\WINDOWS\system32\yyjssuxw.ini.vir
2007-06-17 10:14:03 A------- 1,831,863 C:\Qoobox\Quarantine\C\WINDOWS\system32\icmerwba.ini.vir
2007-06-17 13:37:26 A------- 1,831,698 C:\Qoobox\Quarantine\C\WINDOWS\system32\etnaqabs.ini.vir
2007-06-17 15:11:30 A------- 1,831,818 C:\Qoobox\Quarantine\C\WINDOWS\system32\bllaytwx.ini.vir
2007-06-17 18:12:12 A------- 1,831,939 C:\Qoobox\Quarantine\C\WINDOWS\system32\qupkylky.ini.vir
2007-06-18 04:08:52 A------- 1,831,599 C:\Qoobox\Quarantine\C\WINDOWS\system32\jnhoyvwt.ini.vir
2007-06-18 09:24:56 A------- 1,831,720 C:\Qoobox\Quarantine\C\WINDOWS\system32\latsujun.ini.vir
2007-06-18 14:36:05 A------- 1,831,839 C:\Qoobox\Quarantine\C\WINDOWS\system32\bsknvmfr.ini.vir
2007-06-18 16:54:30 A------- 1,831,958 C:\Qoobox\Quarantine\C\WINDOWS\system32\kyqonued.ini.vir
2007-06-19 07:54:51 A------- 898,716 C:\Qoobox\Quarantine\C\WINDOWS\system32\cequojch.ini.vir
2007-06-19 11:21:07 A------- 898,849 C:\Qoobox\Quarantine\C\WINDOWS\system32\byrtolog.ini.vir
2007-06-19 14:31:18 A------- 898,968 C:\Qoobox\Quarantine\C\WINDOWS\system32\vdxqnmau.ini.vir
2007-06-19 16:30:25 A------- 902,465 C:\Qoobox\Quarantine\C\WINDOWS\system32\drurvbtp.ini.vir
2007-06-19 18:12:06 A------- 902,584 C:\Qoobox\Quarantine\C\WINDOWS\system32\mksseugp.ini.vir
2007-06-20 04:24:13 A------- 902,510 C:\Qoobox\Quarantine\C\WINDOWS\system32\snxnfleq.ini.vir
2007-06-20 09:27:01 A------- 901,241 C:\Qoobox\Quarantine\C\WINDOWS\system32\sfdbjthe.ini.vir
2007-06-20 11:08:20 A------- 868,144 C:\Qoobox\Quarantine\C\WINDOWS\system32\rimfogio.ini.vir
2007-07-14 12:52:02 A------- 1,971,618 C:\Qoobox\Quarantine\C\WINDOWS\system32\ststv.ini.vir
2007-07-14 12:52:24 A------- 1,947,574 C:\Qoobox\Quarantine\C\WINDOWS\system32\ststv.bak1.vir
2007-07-14 12:58:17 A------- 1,186,020 C:\Qoobox\Quarantine\C\WINDOWS\system32\oxjqsgqn.ini.vir
2007-08-07 18:02:24 A------- 1,782,015 C:\Qoobox\Quarantine\C\WINDOWS\system32\xyadd.ini.vir
2007-08-07 18:02:45 A------- 1,758,297 C:\Qoobox\Quarantine\C\WINDOWS\system32\xyadd.bak1.vir
2007-09-05 10:51:11 A------- 411,542 C:\Qoobox\Quarantine\C\WINDOWS\system32\ttutv.bak1.vir
2007-09-06 04:25:05 A------- 409,391 C:\Qoobox\Quarantine\C\WINDOWS\system32\ttutv.bak2.vir
2007-09-06 04:30:50 A------- 739,036 C:\Qoobox\Quarantine\C\WINDOWS\system32\knpqkkhk.ini.vir
2007-09-06 08:28:33 A------- 3,049 C:\Qoobox\Quarantine\C\WINDOWS\cookies.ini.vir
2007-09-07 04:46:03 A------- 637,051 C:\Qoobox\Quarantine\C\WINDOWS\system32\oyhllxlm.ini.vir
2007-09-07 04:46:06 A------- 2,050,898 C:\Qoobox\Quarantine\C\WINDOWS\system32\ttutv.tmp.vir
2007-09-07 04:56:49 A------- 6,442 C:\Qoobox\Quarantine\C\WINDOWS\system32\ttutv.ini.vir
2007-09-07 05:00:03 A------- 637,230 C:\Qoobox\Quarantine\C\WINDOWS\system32\jylusoip.ini.vir
2007-09-07 10:02:01 A------- 637,342 C:\Qoobox\Quarantine\C\WINDOWS\system32\hfxwfyhs.ini.vir
2007-09-07 10:29:16 A------- 637,650 C:\Qoobox\Quarantine\C\WINDOWS\system32\icyxdhbx.ini.vir
2007-09-07 15:40:16 A------- 637,762 C:\Qoobox\Quarantine\C\WINDOWS\system32\yiafxhmm.ini.vir
2007-09-07 17:54:32 A------- 637,890 C:\Qoobox\Quarantine\C\WINDOWS\system32\tywdinkq.ini.vir
2007-09-07 18:26:57 A------- 638,011 C:\Qoobox\Quarantine\C\WINDOWS\system32\ncifgyrs.ini.vir
2007-09-08 04:42:08 A------- 638,122 C:\Qoobox\Quarantine\C\WINDOWS\system32\cilhhrtp.ini.vir
2007-09-08 12:00:40 A------- 638,242 C:\Qoobox\Quarantine\C\WINDOWS\system32\vsdrcomw.ini.vir
2007-09-08 15:54:45 A------- 638,371 C:\Qoobox\Quarantine\C\WINDOWS\system32\kpksouci.ini.vir
2007-09-08 16:19:11 A------- 638,490 C:\Qoobox\Quarantine\C\WINDOWS\system32\wljxcxci.ini.vir
2007-09-08 17:41:53 A------- 638,671 C:\Qoobox\Quarantine\C\WINDOWS\system32\cplufkie.ini.vir
2007-09-09 05:42:15 A------- 638,782 C:\Qoobox\Quarantine\C\WINDOWS\system32\kgcrljuw.ini.vir
2007-09-09 11:58:49 A------- 638,910 C:\Qoobox\Quarantine\C\WINDOWS\system32\ckiqmtdg.ini.vir
2007-09-09 15:14:08 A------- 639,031 C:\Qoobox\Quarantine\C\WINDOWS\system32\osfulmhk.ini.vir
2007-09-09 16:18:17 A------- 639,151 C:\Qoobox\Quarantine\C\WINDOWS\system32\gpjsgdxl.ini.vir
2007-09-09 16:54:07 A------- 639,262 C:\Qoobox\Quarantine\C\WINDOWS\system32\wxrxnaum.ini.vir
2007-09-10 04:29:16 A------- 639,391 C:\Qoobox\Quarantine\C\WINDOWS\system32\bblhduyx.ini.vir
2007-09-10 09

37 A------- 639,510 C:\Qoobox\Quarantine\C\WINDOWS\system32\fubqlajw.ini.vir
2007-09-10 11:41:17 A------- 639,691 C:\Qoobox\Quarantine\C\WINDOWS\system32\kbfyyotu.ini.vir
2007-09-10 15:26:26 A------- 639,802 C:\Qoobox\Quarantine\C\WINDOWS\system32\qevgldsa.ini.vir
2007-09-10 17:22:36 A------- 639,921 C:\Qoobox\Quarantine\C\WINDOWS\system32\nhsapfem.ini.vir
2007-09-10 18:54:06 A------- 640,051 C:\Qoobox\Quarantine\C\WINDOWS\system32\antnkkbd.ini.vir
2007-09-11 04:09:37 A------- 640,291 C:\Qoobox\Quarantine\C\WINDOWS\system32\pvamfnwh.ini.vir
2007-09-11 10:12:30 A------- 640,470 C:\Qoobox\Quarantine\C\WINDOWS\system32\sjturrip.ini.vir
2007-09-11 13:52:25 A------- 640,651 C:\Qoobox\Quarantine\C\WINDOWS\system32\atgddgcl.ini.vir
2007-09-11 16:51:02 A------- 640,762 C:\Qoobox\Quarantine\C\WINDOWS\system32\utwkjpiw.ini.vir
2007-09-11 20:28:26 A------- 640,899 C:\Qoobox\Quarantine\C\WINDOWS\system32\xrfbrdyy.ini.vir
2007-09-12 04:20:45 A------- 641,070 C:\Qoobox\Quarantine\C\WINDOWS\system32\eaefagjm.ini.vir
2007-09-12 08:49:35 A------- 641,182 C:\Qoobox\Quarantine\C\WINDOWS\system32\ljbxpxni.ini.vir
2007-09-12 10:16:17 A------- 641,302 C:\Qoobox\Quarantine\C\WINDOWS\system32\rlgmdjno.ini.vir
2007-09-12 12:17:44 A------- 641,430 C:\Qoobox\Quarantine\C\WINDOWS\system32\qrnnbond.ini.vir
2007-09-12 13:44:01 A------- 636,609 C:\Qoobox\Quarantine\C\WINDOWS\system32\pjljwtuq.ini.vir
2007-09-12 18:40:37 A------- 636,789 C:\Qoobox\Quarantine\C\WINDOWS\system32\auibnnqp.ini.vir
2007-09-13 04:28:16 A------- 636,909 C:\Qoobox\Quarantine\C\WINDOWS\system32\ghciopak.ini.vir
2007-09-13 05:12:22 A------- 637,020 C:\Qoobox\Quarantine\C\WINDOWS\system32\shdokogx.ini.vir
2007-09-13 13:19:50 A------- 637,148 C:\Qoobox\Quarantine\C\WINDOWS\system32\iqnoyrak.ini.vir
2007-09-13 18:16:20 A------- 637,260 C:\Qoobox\Quarantine\C\WINDOWS\system32\nrrwlyyh.ini.vir
2007-09-14 04:41:36 A------- 637,449 C:\Qoobox\Quarantine\C\WINDOWS\system32\ivndlnwv.ini.vir
2007-09-14 10:32:05 A------- 637,577 C:\Qoobox\Quarantine\C\WINDOWS\system32\oticfytr.ini.vir
2007-09-14 12:25:19 A------- 637,679 C:\Qoobox\Quarantine\C\WINDOWS\system32\sahcbpap.ini.vir
2007-09-14 14:57:14 A------- 637,809 C:\Qoobox\Quarantine\C\WINDOWS\system32\xmrjdtmv.ini.vir
2007-09-14 16:08:55 A------- 637,929 C:\Qoobox\Quarantine\C\WINDOWS\system32\gxirfijt.ini.vir
2007-09-14 16:59:16 A------- 638,049 C:\Qoobox\Quarantine\C\WINDOWS\system32\sqyutwqc.ini.vir
2007-09-14 18:25:48 A------- 638,228 C:\Qoobox\Quarantine\C\WINDOWS\system32\rluqnboq.ini.vir
2007-09-15 04:31:09 A------- 638,367 C:\Qoobox\Quarantine\C\WINDOWS\system32\prfgopgo.ini.vir
2007-09-15 06:37:28 A------- 638,460 C:\Qoobox\Quarantine\C\WINDOWS\system32\jynjqcqx.ini.vir
2007-09-15 06:50:15 A------- 638,588 C:\Qoobox\Quarantine\C\WINDOWS\system32\cgfofexj.ini.vir
2007-09-15 14:50:37 A------- 638,709 C:\Qoobox\Quarantine\C\WINDOWS\system32\dqyqxydx.ini.vir
2007-09-15 16:36:05 A------- 638,828 C:\Qoobox\Quarantine\C\WINDOWS\system32\xgtxkixy.ini.vir
2007-09-15 18:19:47 A------- 638,948 C:\Qoobox\Quarantine\C\WINDOWS\system32\nekkftsi.ini.vir
2007-09-16 04:48:11 A------- 639,068 C:\Qoobox\Quarantine\C\WINDOWS\system32\bnmlcwdk.ini.vir
2007-09-16 07:38:11 A------- 639,189 C:\Qoobox\Quarantine\C\WINDOWS\system32\elpcfemt.ini.vir
2007-09-16 13:29:00 A------- 639,309 C:\Qoobox\Quarantine\C\WINDOWS\system32\jiuydpsb.ini.vir
2007-09-16 18

51 A------- 639,420 C:\Qoobox\Quarantine\C\WINDOWS\system32\famnyrbc.ini.vir
2007-09-17 04:22:46 A------- 639,558 C:\Qoobox\Quarantine\C\WINDOWS\system32\bgycaavl.ini.vir
2007-09-17 08:20:03 A------- 639,728 C:\Qoobox\Quarantine\C\WINDOWS\system32\cuygccbi.ini.vir
2007-09-17 13:42:04 A------- 639,858 C:\Qoobox\Quarantine\C\WINDOWS\system32\jafylfnd.ini.vir
2007-09-18 04:32:49 A------- 639,969 C:\Qoobox\Quarantine\C\WINDOWS\system32\xibsheiu.ini.vir
2007-09-18 07:44:16 A------- 640,089 C:\Qoobox\Quarantine\C\WINDOWS\system32\upnnaibf.ini.vir
2007-09-18 17:53:03 A------- 640,209 C:\Qoobox\Quarantine\C\WINDOWS\system32\byahvyka.ini.vir
2007-09-18 18:18:05 A------- 640,329 C:\Qoobox\Quarantine\C\WINDOWS\system32\inmmrcnd.ini.vir
2007-09-19 03:30:01 A------- 640,399 C:\Qoobox\Quarantine\C\WINDOWS\system32\hhllyhgg.ini.vir
2007-09-19 11:59:22 A------- 640,568 C:\Qoobox\Quarantine\C\WINDOWS\system32\tpomyvll.ini.vir
2007-09-19 19:07:26 A------- 640,688 C:\Qoobox\Quarantine\C\WINDOWS\system32\vgsmlkih.ini.vir
2007-09-20 04:17:09 A------- 640,808 C:\Qoobox\Quarantine\C\WINDOWS\system32\fwivoeiy.ini.vir
2007-09-20 09:07:16 A------- 640,920 C:\Qoobox\Quarantine\C\WINDOWS\system32\hhqrlysi.ini.vir
2007-09-20 13:31:40 A------- 636,613 C:\Qoobox\Quarantine\C\WINDOWS\system32\amkyuqnf.ini.vir
2007-09-20 14:47:41 A------- 636,724 C:\Qoobox\Quarantine\C\WINDOWS\system32\nsogahle.ini.vir
2007-09-20 15:01:36 A------- 636,862 C:\Qoobox\Quarantine\C\WINDOWS\system32\oigujvfl.ini.vir
2007-09-21 04:29:51 A------- 637,042 C:\Qoobox\Quarantine\C\WINDOWS\system32\knecteqm.ini.vir
2007-09-21 06:53:35 A------- 637,153 C:\Qoobox\Quarantine\C\WINDOWS\system32\ywpgtmgo.ini.vir
2007-09-21 13:04:47 A------- 637,273 C:\Qoobox\Quarantine\C\WINDOWS\system32\noattktw.ini.vir
2007-09-22 03:24:20 A------- 637,393 C:\Qoobox\Quarantine\C\WINDOWS\system32\blbtxcym.ini.vir
2007-09-22 14:08:23 A------- 637,513 C:\Qoobox\Quarantine\C\WINDOWS\system32\eijvkysq.ini.vir
2007-09-22 20:47:55 A------- 637,624 C:\Qoobox\Quarantine\C\WINDOWS\system32\frubmasf.ini.vir
2007-09-23 04:49:17 A------- 637,753 C:\Qoobox\Quarantine\C\WINDOWS\system32\latoskxh.ini.vir
2007-09-23 19:02:30 A------- 637,873 C:\Qoobox\Quarantine\C\WINDOWS\system32\rqnkkjcn.ini.vir
2007-09-24 04

26 A------- 638,053 C:\Qoobox\Quarantine\C\WINDOWS\system32\dvsfolbl.ini.vir
2007-09-25 04:16:24 A------- 638,173 C:\Qoobox\Quarantine\C\WINDOWS\system32\mrpvbynd.ini.vir
2007-09-25 08:42:38 A------- 638,284 C:\Qoobox\Quarantine\C\WINDOWS\system32\ybkxfgdx.ini.vir
2007-09-25 11:53:48 A------- 638,413 C:\Qoobox\Quarantine\C\WINDOWS\system32\japricsx.ini.vir
2007-09-25 13:02:36 A------- 638,533 C:\Qoobox\Quarantine\C\WINDOWS\system32\korepldf.ini.vir
2007-09-25 14:16:37 A------- 638,722 C:\Qoobox\Quarantine\C\WINDOWS\system32\byycmgkk.ini.vir
2007-09-26 04:21:09 A------- 638,842 C:\Qoobox\Quarantine\C\WINDOWS\system32\twqiogta.ini.vir
2007-09-26 11:32:46 A------- 639,013 C:\Qoobox\Quarantine\C\WINDOWS\system32\qcvooudx.ini.vir
2007-09-26 13:17:37 A------- 98,048 C:\Qoobox\Quarantine\C\WINDOWS\system32\dsoun.dll.vir
2007-09-26 13:22:46 A------- 639,133 C:\Qoobox\Quarantine\C\WINDOWS\system32\nsiruoif.ini.vir
2007-09-26 18:53:00 A------- 639,313 C:\Qoobox\Quarantine\C\WINDOWS\system32\sgdipqui.ini.vir
2007-09-27 08:49:17 A------- 639,493 C:\Qoobox\Quarantine\C\WINDOWS\system32\njjyioeh.ini.vir
2007-09-27 13:33:41 A------- 639,613 C:\Qoobox\Quarantine\C\WINDOWS\system32\xeuymqje.ini.vir
2007-09-27 15:33:45 A------- 639,733 C:\Qoobox\Quarantine\C\WINDOWS\system32\ieubelin.ini.vir
2007-09-27 16:41:09 A------- 639,853 C:\Qoobox\Quarantine\C\WINDOWS\system32\xnmcvhca.ini.vir
2007-09-28 04:11:58 A------- 640,033 C:\Qoobox\Quarantine\C\WINDOWS\system32\cxrjbiwi.ini.vir
2007-09-28 12:55:41 A------- 640,213 C:\Qoobox\Quarantine\C\WINDOWS\system32\qcrretne.ini.vir
2007-09-28 16:54:43 A------- 640,324 C:\Qoobox\Quarantine\C\WINDOWS\system32\woyvmsxx.ini.vir
2007-09-28 17:35:18 A------- 640,513 C:\Qoobox\Quarantine\C\WINDOWS\system32\yidvwwxl.ini.vir
2007-09-29 03:47:31 A------- 640,633 C:\Qoobox\Quarantine\C\WINDOWS\system32\xqidudbw.ini.vir
2007-09-29 09:10:04 A------- 640,753 C:\Qoobox\Quarantine\C\WINDOWS\system32\ahpnbwde.ini.vir
2007-09-30 05:00:26 A------- 640,873 C:\Qoobox\Quarantine\C\WINDOWS\system32\evubqvyy.ini.vir
2007-09-30 11:29:19 A------- 640,984 C:\Qoobox\Quarantine\C\WINDOWS\system32\rfoccuwj.ini.vir
2007-09-30 15

12 A------- 641,233 C:\Qoobox\Quarantine\C\WINDOWS\system32\ydnbfjjr.ini.vir
2007-10-01 04:48:24 A------- 641,353 C:\Qoobox\Quarantine\C\WINDOWS\system32\dktayqrp.ini.vir
2007-10-01 07:07:01 A------- 636,591 C:\Qoobox\Quarantine\C\WINDOWS\system32\tfmeaxuu.ini.vir
2007-10-01 15:34:58 A------- 636,702 C:\Qoobox\Quarantine\C\WINDOWS\system32\rvnqpsya.ini.vir
2007-10-01 15:48:56 A------- 637,422 C:\Qoobox\Quarantine\C\WINDOWS\system32\pdxnssir.ini.vir
2007-10-02 11:11:43 A------- 637,662 C:\Qoobox\Quarantine\C\WINDOWS\system32\hxhjprlk.ini.vir
2007-10-02 15:47:11 A------- 637,782 C:\Qoobox\Quarantine\C\WINDOWS\system32\huchbvwr.ini.vir
2007-10-02 16:26:23 A------- 637,971 C:\Qoobox\Quarantine\C\WINDOWS\system32\xfqqbwbj.ini.vir
2007-10-03 04:47:48 A------- 638,142 C:\Qoobox\Quarantine\C\WINDOWS\system32\twbtgmhj.ini.vir
2007-10-03 05:42:34 A------- 638,211 C:\Qoobox\Quarantine\C\WINDOWS\system32\yytvusfg.ini.vir
2007-10-03 15:24:56 A------- 693,472 C:\Qoobox\Quarantine\C\WINDOWS\system32\ptviocug.ini.vir
2007-10-03 16:40:49 A------- 693,592 C:\Qoobox\Quarantine\C\WINDOWS\system32\hwcogfyh.ini.vir
2007-10-03 16:54:39 A------- 693,712 C:\Qoobox\Quarantine\C\WINDOWS\system32\cvakwipm.ini.vir
2007-10-03 19:30:43 A------- 694,021 C:\Qoobox\Quarantine\C\WINDOWS\system32\ghcuwlwr.ini.vir
2007-10-04 05:33:27 A------- 694,132 C:\Qoobox\Quarantine\C\WINDOWS\system32\ilqbfiwt.ini.vir
2007-10-04 15:54:29 A------- 694,252 C:\Qoobox\Quarantine\C\WINDOWS\system32\owqnmqpg.ini.vir
2007-10-04 16:48:20 A------- 694,390 C:\Qoobox\Quarantine\C\WINDOWS\system32\pfmanbrd.ini.vir
2007-10-05 05:13:02 A------- 694,519 C:\Qoobox\Quarantine\C\WINDOWS\system32\svhoifwj.ini.vir
2007-10-05 13:58:55 A------- 694,552 C:\Qoobox\Quarantine\C\WINDOWS\system32\eaxlplnb.ini.vir
2007-10-05 16:26:36 A------- 19,584 C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\megvtacw.dat.vir
2007-10-05 16:29:44 A------- 693,601 C:\Qoobox\Quarantine\C\WINDOWS\system32\mcgrqaaa.ini.vir
2007-10-06 04:30:09 A------- 693,781 C:\Qoobox\Quarantine\C\WINDOWS\system32\sswpryab.ini.vir
2007-10-06 16:32:51 A------- 693,532 C:\Qoobox\Quarantine\C\WINDOWS\system32\onkgntap.ini.vir
2007-10-06 18:24:13 A------- 693,661 C:\Qoobox\Quarantine\C\WINDOWS\system32\ndfgdmny.ini.vir
2007-10-06 19:34:05 A------- 693,781 C:\Qoobox\Quarantine\C\WINDOWS\system32\mwsojvbp.ini.vir
2007-10-07 05:35:27 A------- 693,901 C:\Qoobox\Quarantine\C\WINDOWS\system32\kbloffih.ini.vir
2007-10-07 15:58:32 A------- 694,012 C:\Qoobox\Quarantine\C\WINDOWS\system32\yuinbxvl.ini.vir
2007-10-08 04:28:34 A------- 694,072 C:\Qoobox\Quarantine\C\WINDOWS\system32\kfawedjr.ini.vir
2007-10-08 04:40:49 A------- 693,481 C:\Qoobox\Quarantine\C\WINDOWS\system32\osbsgkei.ini.vir
2007-10-08 12:43:02 A------- 693,601 C:\Qoobox\Quarantine\C\WINDOWS\system32\gaagmuav.ini.vir
2007-10-08 17:52:17 A------- 693,721 C:\Qoobox\Quarantine\C\WINDOWS\system32\cwvmgvfa.ini.vir
2007-10-08 19:39:09 A------- 693,841 C:\Qoobox\Quarantine\C\WINDOWS\system32\flhpakqu.ini.vir
2007-10-09 04:33:18 A------- 693,952 C:\Qoobox\Quarantine\C\WINDOWS\system32\lkyjoqci.ini.vir
2007-10-09 07:23:30 A------- 694,081 C:\Qoobox\Quarantine\C\WINDOWS\system32\cjfgpvas.ini.vir
2007-10-09 10:07:54 A------- 694,192 C:\Qoobox\Quarantine\C\WINDOWS\system32\btntbpsc.ini.vir
2007-10-09 12:47:56 A------- 694,312 C:\Qoobox\Quarantine\C\WINDOWS\system32\jdvtaybj.ini.vir
2007-10-09 13:21:10 A------- 694,501 C:\Qoobox\Quarantine\C\WINDOWS\system32\ktmasyqs.ini.vir
2007-10-09 15:33:08 A------- 694,612 C:\Qoobox\Quarantine\C\WINDOWS\system32\pokckpvv.ini.vir
2007-10-10 04:15:18 A------- 694,741 C:\Qoobox\Quarantine\C\WINDOWS\system32\rifdqcqh.ini.vir
2007-10-11 04:35:26 A------- 694,861 C:\Qoobox\Quarantine\C\WINDOWS\system32\pqcvdnaf.ini.vir
2007-10-11 14:36:29 A------- 694,981 C:\Qoobox\Quarantine\C\WINDOWS\system32\hxqksbld.ini.vir
2007-10-11 18:25:31 A------- 695,092 C:\Qoobox\Quarantine\C\WINDOWS\system32\byhilodc.ini.vir
2007-10-12 04:17:55 A------- 695,221 C:\Qoobox\Quarantine\C\WINDOWS\system32\wnqagpvm.ini.vir
2007-10-12 18:09:48 A------- 695,341 C:\Qoobox\Quarantine\C\WINDOWS\system32\hasqoiww.ini.vir
2007-10-23 15:02:15 A------- 693,532 C:\Qoobox\Quarantine\C\WINDOWS\system32\ejqpskkx.ini.vir
2007-10-23 17:22:54 A------- 693,592 C:\Qoobox\Quarantine\C\WINDOWS\system32\dklcxepi.ini.vir
2007-10-23 18:20:48 A------- 693,472 C:\Qoobox\Quarantine\C\WINDOWS\system32\lnajbhkb.ini.vir
2007-10-23 20:18:51 A------- 694,141 C:\Qoobox\Quarantine\C\WINDOWS\system32\jvsmknyg.ini.vir
2007-10-25 04:21:30 A------- 694,192 C:\Qoobox\Quarantine\C\WINDOWS\system32\ssohlmsf.ini.vir
2007-10-25 04:37:00 A------- 693,481 C:\Qoobox\Quarantine\C\WINDOWS\system32\iiuaujti.ini.vir
2007-10-25 15:14:27 A------- 693,601 C:\Qoobox\Quarantine\C\WINDOWS\system32\mtqjnfjs.ini.vir
2007-10-26 04:26:34 A------- 1,383,164 C:\Qoobox\Quarantine\C\WINDOWS\system32\dgwbqxot.ini.vir
2007-10-26 12:29:24 A------- 389,686 C:\Qoobox\Quarantine\C\WINDOWS\system32\ckhbyqxu.ini.vir
2007-10-27 04:38:36 A------- 389,806 C:\Qoobox\Quarantine\C\WINDOWS\system32\ccxbtjss.ini.vir
2007-10-27 07:02:15 A------- 389,926 C:\Qoobox\Quarantine\C\WINDOWS\system32\uyhmleso.ini.vir
2007-10-27 19:00:27 A------- 410,045 C:\Qoobox\Quarantine\C\WINDOWS\system32\qhwdjtvu.ini.vir
2007-10-28 05:38:23 A------- 408,538 C:\Qoobox\Quarantine\C\WINDOWS\system32\mkmqgkhr.ini.vir
2007-10-29 04:22:36 A------- 403,283 C:\Qoobox\Quarantine\C\WINDOWS\system32\mhtowqpl.ini.vir
2007-10-29 15:24:12 A------- 445,827 C:\Qoobox\Quarantine\C\WINDOWS\system32\lhhrylbe.ini.vir
2007-10-30 04:20:38 A------- 462,200 C:\Qoobox\Quarantine\C\WINDOWS\system32\ttutv.ini2.vir
2007-10-30 04:23:25 A------- 445,947 C:\Qoobox\Quarantine\C\WINDOWS\system32\wptkfcfb.ini.vir
2007-10-30 15:40:12 A------- 449,197 C:\Qoobox\Quarantine\C\WINDOWS\system32\bcwhpvka.ini.vir
2007-10-30 20:35:26 A------- 425,329 C:\Qoobox\Quarantine\C\WINDOWS\system32\mbeomupp.ini.vir
2007-10-31 04:43:13 A------- 424,763 C:\Qoobox\Quarantine\C\WINDOWS\system32\ppnbdtox.ini.vir
2008-11-07 12:46:35 A------- 570 C:\Qoobox\Quarantine\catchme.log
2008-11-07 12:50:49 A------- 6,626 C:\Qoobox\Quarantine\Registry_backups\tcpip.reg
2008-11-07 13:03:50 A------- 2 C:\Qoobox\Quarantine\Registry_backups\HKLM-Run-CFSServ.exe.reg.dat
2008-11-07 13:03:50 A------- 2 C:\Qoobox\Quarantine\Registry_backups\HKLM-Run-NDSTray.exe.reg.dat
2008-11-07 13:03:50 A------- 2 C:\Qoobox\Quarantine\Registry_backups\HKLM-Run-TFncKy.reg.dat
2008-11-07 13:04:00 A------- 512 C:\Qoobox\Quarantine\Registry_backups\Notify-efcbxvt.reg.dat
2008-11-07 13:04:00 A------- 570 C:\Qoobox\Quarantine\Registry_backups\Notify-awvvs.reg.dat
2008-11-07 13:04:00 A------- 570 C:\Qoobox\Quarantine\Registry_backups\Notify-ddayx.reg.dat
2008-11-07 13:04:00 A------- 570 C:\Qoobox\Quarantine\Registry_backups\Notify-gebyy.reg.dat
2008-11-07 13:04:00 A------- 570 C:\Qoobox\Quarantine\Registry_backups\Notify-mljji.reg.dat
2008-11-07 13:04:00 A------- 570 C:\Qoobox\Quarantine\Registry_backups\Notify-vtsts.reg.dat
2008-11-07 13:04:00 A------- 570 C:\Qoobox\Quarantine\Registry_backups\Notify-vtutt.reg.dat
2008-11-07 13:04:00 A------- 572 C:\Qoobox\Quarantine\Registry_backups\Notify-disknet.reg.dat
2008-11-13 09:18:20 A------- 95,661 C:\Qoobox\Quarantine\[4]-Submit_2008-11-13@9.18.zip
2008-11-13 09:18:35 A------- 9,675 C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\_megvtacw_.dat.zip
2008-11-13 09:18:37 A------- 583 C:\Qoobox\Quarantine\C\WINDOWS\system32\_dsoun_.dll.zip
2008-11-13 09:19:52 A------- 1,390 C:\Qoobox\Quarantine\Registry_backups\Legacy_EDPWOFVK.reg.dat
2008-11-13 09:19:52 A------- 7,096 C:\Qoobox\Quarantine\Registry_backups\Service_edpwofvk.reg.dat
2008-11-13 09:26:31 A------- 376 C:\Qoobox\Quarantine\Registry_backups\BHO-{10708868-CEF5-49E5-A211-A8339B8F7188}.reg.dat

tetonbob · 11-13-2008, 12:16 PM

Please visit this site:

http://www.bleepingcomputer.com/subm....php?channel=4
In the Link to topic where this file was requested: area, copy and paste this

http://www.techsupportforum.com/security-center/hijackthis-log-help/311548-downloader-delf-12-a.html#post1801403
In the Browse to the file you want to submit: area, copy and paste this

C:\Qoobox\Quarantine\[4]-Submit_2008-11-13@9.18.zip
Then click Send File.
Once it shows:

Quote:

Your file was successfully submitted. Please let the user helping you know that you have submitted the file.
Close the site and continue with the steps below.

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

Download the latest version of Java Runtime Environment (JRE) 6 and save it to your desktop.
Scroll down to where it says "Java SE Runtime Environment (JRE) 6 Update 10. The Java SE Runtime Environment (JRE) allows end-users to run Java applications."
Click the "Download" button to the right.
Select the Windows platform from the dropdown menu.
Read the License Agreement and then check the box that says: "Accept License Agreement". Click on Continue.The page will refresh.
Click on the link to download Windows Offline Installation and save the file to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java(TM) 6) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u10-windows-i586-p.exe to install the newest version.

After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
- On the General tab, under Temporary Internet Files, click the Settings button.
- Next, click on the Delete Files button
- There are two options in the window to clear the cache - Leave BOTH Checked
  - Applications and Applets
    Trace and Log Files
- Click OK on Delete Temporary Files Window
  Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
- Click OK to leave the Temporary Files Window
- Click OK to leave the Java Control Panel.

---------------------------------------------------------------------------------------------

Please perform this online scan to help look for remnants

Establish an internet connection & perform an online scan with Firefox or Internet Explorer at Kaspersky Online Scanner

**Note**

To optimize scanning time and produce a more sensible report for review:

Close any open programs
Turn off the real time scanner of any existing antivirus program while performing the online scan.

Click Accept, when prompted to download and install the program files and database of malware definitions.

Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.
Once the update is complete, click on Settings. Uncheck Mail databases.
Next, click on My Computer under the green Scan bar to the left to start the scan.
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
Click View scan report at the bottom.
Click the Save Report As... button.
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply.

---------------------------------------------------------------------------------------------

How is the machine behaving now?

paul.hunt · 11-13-2008, 12:56 PM

Quote:

Originally Posted by tetonbob

Please visit this site:
http://www.bleepingcomputer.com/subm....php?channel=4
In the Link to topic where this file was requested: area, copy and paste this

http://www.techsupportforum.com/secu...ml#post1801403
In the Browse to the file you want to submit: area, copy and paste this

C:\Qoobox\Quarantine\[4]-Submit_2008-11-13@9.18.zip

"File not found"

Quote:

Originally Posted by tetonbob

How is the machine behaving now?

I haven't seen a warning lately about finding Delf. Looks like we are making progress. Thank you.

I have not yet performed the other tasks due to the error above (in case they need to be done in order).

tetonbob · 11-13-2008, 01:49 PM

File not found??

C:\Qoobox\Quarantine\[4]-Submit_2008-11-13@9.18.zip is in the quarantined files.txt log

Did you paste that exact file name into the box?

Have a look and see if it's present at the above location. Do not open it, just let me know. Or, use the Browse button on the upload page, instead of copy/pasting the file path.

It's possible that AVG jumped it now that it's unhooked.

paul.hunt · 11-13-2008, 02:31 PM

Quote:

Originally Posted by tetonbob

File not found??

C:\Qoobox\Quarantine\[4]-Submit_2008-11-13@9.18.zip is in the quarantined files.txt log

Did you paste that exact file name into the box?

Yes, I did.

Quote:

Originally Posted by tetonbob

Have a look and see if it's present at the above location. Do not open it, just let me know.

Nope. Just folders C and Registry_backups, plus file catchme.log

Quote:

Originally Posted by tetonbob

Or, use the Browse button on the upload page, instead of copy/pasting the file path.

Yeah. I had tried that, too.

tetonbob · 11-13-2008, 02:48 PM

OK, thanks.

See if these two will upload, they are the files I'm interested in uploading

C:\Qoobox\Quarantine\C\WINDOWS\system32\_dsoun_.dll.zip

C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\_megvtacw_.dat.zip

You'll have to do one per attempt at the same site.

If still no joy, I'll thank you for trying, and ask that you carry on.

paul.hunt · 11-13-2008, 03:24 PM

Quote:

Originally Posted by tetonbob

OK, thanks.

See if these two will upload, they are the files I'm interested in uploading

C:\Qoobox\Quarantine\C\WINDOWS\system32\_dsoun_.dll.zip

Done.

Quote:

Originally Posted by tetonbob

C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\_megvtacw_.dat.zip

Not found.

Quote:

Originally Posted by tetonbob

If still no joy, I'll thank you for trying, and ask that you carry on.

So shall I continue with the other cleanup steps, Bob?

Thank you for all your efforts.

tetonbob · 11-13-2008, 05:02 PM

Yes, please do carry on.

paul.hunt · 11-13-2008, 07:46 PM

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Thursday, November 13, 2008
Operating System: Microsoft Windows XP Home Edition Service Pack 2 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Thursday, November 13, 2008 18:50:55
Records in database: 1383528
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\

Scan statistics:
Files scanned: 48864
Threat name: 5
Infected objects: 8
Suspicious objects: 2
Duration of the scan: 00:53:12

File name / Threat name / Threats count
C:\Documents and Settings\Ben\Application Data\Sun\Java\Deployment\cache\6.0\14\467e7c0e-1a036d7b Infected: Trojan-Downloader.Java.Agent.f 1
C:\Documents and Settings\Ben\Application Data\Sun\Java\Deployment\cache\6.0\45\30b71c2d-782ff8bb Infected: Trojan-Downloader.Java.Agent.f 1
C:\Documents and Settings\Ben\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmsecman.jar-69ee0e0e-452a431a.zip Infected: Trojan-Downloader.Java.Agent.f 1
C:\Documents and Settings\Ben\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmsecman.jar-6b26dca8-6b00924f.zip Infected: Trojan-Downloader.Java.Agent.f 1
C:\Documents and Settings\Ben\Local Settings\Application Data\Identities\{A54E442D-9A28-4C94-9ACC-E76D7B307E52}\Microsoft\Outlook Express\Deleted Items.dbx Suspicious: Trojan-Spy.HTML.Fraud.gen 1
C:\Documents and Settings\Ben\Local Settings\Application Data\Identities\{A54E442D-9A28-4C94-9ACC-E76D7B307E52}\Microsoft\Outlook Express\Inbox.dbx Suspicious: Trojan-Spy.HTML.Fraud.gen 1
C:\Program Files\SpyNoMore\SNM.exe Infected: not-a-virus:FraudTool.Win32.SpyNoMore.e 1
C:\RECYCLER\S-1-5-21-23880383-3852450314-236532993-1008\Dc8.exe Infected: not-a-virus:FraudTool.Win32.SpyNoMore.e 1
C:\WINDOWS\system32\drivers\ejibrwms.sys Infected: Trojan.Win32.BHO.gy 1
C:\WINDOWS\system32\drivers\megvtacw.sys Infected: Rootkit.Win32.Agent.iy 1

The selected area was scanned.

tetonbob · 11-13-2008, 07:55 PM

SpyNoMore used to be on SpywarWarrior's Rogueware list, but is no longer. Kaspersky still shows it as a FraudTool. I'd not use it, myself, but that's your choice.

I'd like to try to collect a couple more of those files Kaspersky found.

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

---------------------------------------------------------------------------------------------

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.

Open notepad and copy/paste the text in the quotebox below into it:

Quote:

http://www.techsupportforum.com/security-center/hijackthis-log-help/311548-downloader-delf-12-a.html#post1802297

File::
C:\Documents and Settings\Ben\Application Data\Sun\Java\Deployment\cache\6.0\14\467e7c0e-1a036d7b
C:\Documents and Settings\Ben\Application Data\Sun\Java\Deployment\cache\6.0\45\30b71c2d-782ff8bb
C:\Documents and Settings\Ben\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmsecman.jar-69ee0e0e-452a431a.zip
C:\Documents and Settings\Ben\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmsecman.jar-6b26dca8-6b00924f.zip

Collect::
C:\WINDOWS\system32\drivers\ejibrwms.sys
C:\WINDOWS\system32\drivers\megvtacw.sys

Save this as CFScript.txt

Referring to the picture above, drag CFScript.txt into ComboFix.exe

Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.
When finished, it shall produce a log for you. Post that log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

When ComboFix finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture a file to submit for analysis.

Ensure you are connected to the internet and click OK. A browser will open. Simply follow the instructions to copy/paste/send the requested file. If it does not, post the Quarantined_files.txt again.
Ensure your AntiVirus and AntiSpyware applications are re-enabled. A reboot should have done this.

---------------------------------------------------------------------------------------------

How is the machine behaving?

paul.hunt · 11-14-2008, 09:37 AM

Quote:

Originally Posted by tetonbob

SpyNoMore used to be on SpywarWarrior's Rogueware list, but is no longer. Kaspersky still shows it as a FraudTool. I'd not use it, myself, but that's your choice.

Removed

Quote:

Originally Posted by tetonbob

I'd like to try to collect a couple more of those files Kaspersky found.

Submitted

Quote:

Originally Posted by tetonbob

How is the machine behaving?

Looks good.

tetonbob · 11-14-2008, 09:51 AM

Great, thanks for uploading the file.

Kaspersky also identified suspicious mails in Outlook Express Inbox and Deleted items. Unfortunately, it does not give the specific mail item. You may want to empty the Deleted Items box, and review carefully the Inbox, and delete anything suspicious without clicking on any links, or opening any attachments.

Other than that, your logs appear clean.You should be good to go. We still have a few items to address.

Go to

-> Run -> copy/paste in the following single line command & click OK

combofix /u

This will uninstall ComboFix. It will also implement some cleanup procedures and reset System Restore points.

I noticed that your version of Spybot Search & Destroy is quite outdated at version 1.4. Spybot S&D is now at version 1.6 You should update versions. As it's not current, it won't offer you the same level of protection as a current version would.

http://www.spybot.com/en/spybotsd/index.html

http://www.spybot.com/en/faq/56.html

Now that your system is clean, to help protect your computer in the future I recommend that you follow these steps and look into the following free programs:

Microsoft Windows Update - http://www.windowsupdate.com
Visit regularly. This will ensure your computer always has the latest security updates. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
SpywareBlaster to help prevent spyware from installing in the first place.
- Install & update SpywareBlaster with the latest definitions.
  After you have updated, click the button - enable protection for all unprotected items
Winpatrol

Winpatrol is heuristic protection program, meaning it looks for patterns in codes that work like malware. It also takes a snapshot of your system's critical resources and alerts you to any changes that may occur without you knowing. You can read more about Winpatrol's features here.

You can get a free copy of Winpatrol or use the Plus version for more features.

You can read Winpatrol's FAQ if you run into problems.
MVPS HOST FILE
The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites form serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer.
- Download Host.zip to your desktop.
- From your Desktop right-click (hosts.zip) and select:
  Extract All from the menu.
- Click Next, click Next, select the option:
  "Show Extracted files", click Finish
- This will open the newly created hosts folder on your Desktop.
- Double-click on the included mvps.bat file, this will rename the existing HOSTS file to HOSTS.MVP, then it will copy the included updated HOSTS file to the correct location on your machine.
- Once updated you should see another prompt that the task was completed.
ANTIVIRUS SOFTWARE
It is very important that you have anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future. It is imperative that you update your antivirus software at least once a week (even more if you wish). If you do not update your antivirus software then it will not be able to catch new malware that may have come out.

Do not install more than one AntiVirus program because they will conflict with each other.
FIREWALL
Using a third-party firewall will allow you to give/deny access for applications that want to go online. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. A tutorial on Firewalls and a listing of some available ones can be found here

Do not install more than one firewall program because they will conflict with each other.

Scan here http://secunia.com/software_inspector/ for out of date & vulnerable common applications on your computer

Here are some additional utilities that will further enhance your safety.

http://www.trillian.cc ? Trillian or http://www.miranda-im.com ? Miranda-IM - These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN)
http://www.aumha.org/downloads/erunt-setup.exe - ERUNT - A useful freeware utility for users of Windows 2000/XP//Vista. It's made up of two parts - ERUNT & NTREGOPT.

ERUNT will create daily complete backups of your computer's Registry. Whilst System Restore does the same thing, a corrupt registry file may prevent Windows from booting & this effectively renders disables System Restore. With ERUNT, you're able to restore the damaged Registry.

NTREGOPT works by recreating each registry hive "from scratch", thus removing any slack space that may be left from previously modified or deleted keys. In other words, it compacts the Registry to a small size which allows Windows to load & perform faster.

In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles

If you want to fight back the Malware Writers that have made your life a misery, please take a look here and read what you can do against it.

Please respond to this thread one more time so we can mark this thread as resolved.

11-10-2008, 05:51 PM	#1 (permalink)
paul.hunt Registered User Join Date: Nov 2008 Posts: 14 OS: Windows XP Home SP2	Downloader.Delf.12.AN AVG Free 8.0 tells me I have this trojan in C:\Windows\system32\dsoun.dll. I have directed AVG to both quarantine and heal. I have run Spybot, AdAware, ComboFix, SpyNoMore. The trojan keeps reappearing. Windows XP Home SP2 Dell Dimension 5150 I have downloaded and run gmer and dds and am ready to attach those logs. Thanks, Paul

11-12-2008, 05:09 PM	#4 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,254 OS: 2000 Pro; XP Pro; XP Home	Re: Downloader.Delf.12.AN It seems as though you've run ComboFix recently also. Please post the log located at C:\ComboFix.txt __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009

11-12-2008, 06:47 PM	#5 (permalink)
paul.hunt Registered User Join Date: Nov 2008 Posts: 14 OS: Windows XP Home SP2	Re: Downloader.Delf.12.AN combofix.txt: ComboFix 08-11-06.01 - Ben 2008-11-07 12:48:05.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.649 [GMT -5:00] Running from: c:\documents and settings\Ben\Desktop\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\Amy\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML c:\windows\cookies.ini c:\windows\Fonts\ntp2.ini c:\windows\IE4 Error Log.txt c:\windows\system32\acbeg.bak1 c:\windows\system32\acbeg.ini c:\windows\system32\ahpnbwde.ini c:\windows\system32\amkyuqnf.ini c:\windows\system32\antnkkbd.ini c:\windows\system32\arjkvtmn.ini c:\windows\system32\atgddgcl.ini c:\windows\system32\auibnnqp.ini c:\windows\system32\bblhduyx.ini c:\windows\system32\bcwhpvka.ini c:\windows\system32\beopcdmp.ini c:\windows\system32\bgycaavl.ini c:\windows\system32\bkqjmhnw.ini c:\windows\system32\blbtxcym.ini c:\windows\system32\bllaytwx.ini c:\windows\system32\bnmlcwdk.ini c:\windows\system32\bpfwibor.ini c:\windows\system32\bsknvmfr.ini c:\windows\system32\bszip.dll c:\windows\system32\btntbpsc.ini c:\windows\system32\bxmxkdnk.ini c:\windows\system32\byahvyka.ini c:\windows\system32\byhilodc.ini c:\windows\system32\byrtolog.ini c:\windows\system32\byycmgkk.ini c:\windows\system32\ccxbtjss.ini c:\windows\system32\cequojch.ini c:\windows\system32\cgfofexj.ini c:\windows\system32\cilhhrtp.ini c:\windows\system32\cjfgpvas.ini c:\windows\system32\ckhbyqxu.ini c:\windows\system32\ckiqmtdg.ini c:\windows\system32\cplufkie.ini c:\windows\system32\cuygccbi.ini c:\windows\system32\cvakwipm.ini c:\windows\system32\cwvmgvfa.ini c:\windows\system32\cxrjbiwi.ini c:\windows\system32\dgwbqxot.ini c:\windows\system32\dklcxepi.ini c:\windows\system32\dktayqrp.ini c:\windows\system32\dqyqxydx.ini c:\windows\system32\drurvbtp.ini c:\windows\system32\dsvrehts.ini c:\windows\system32\dvsfolbl.ini c:\windows\system32\dxxlqgif.ini c:\windows\system32\eaefagjm.ini c:\windows\system32\eaxlplnb.ini c:\windows\system32\edbednjr.ini c:\windows\system32\eijvkysq.ini c:\windows\system32\ejqpskkx.ini c:\windows\system32\elpcfemt.ini c:\windows\system32\eoilwagg.ini c:\windows\system32\etnaqabs.ini c:\windows\system32\evubqvyy.ini c:\windows\system32\excdsrdw.ini c:\windows\system32\faldqfww.ini c:\windows\system32\famnyrbc.ini c:\windows\system32\fismdcrv.ini c:\windows\system32\flhpakqu.ini c:\windows\system32\frubmasf.ini c:\windows\system32\fubqlajw.ini c:\windows\system32\fwivoeiy.ini c:\windows\system32\gaagmuav.ini c:\windows\system32\ggjxcluj.ini c:\windows\system32\ghciopak.ini c:\windows\system32\ghcuwlwr.ini c:\windows\system32\ghqjjueg.ini c:\windows\system32\gpfqmqaq.ini c:\windows\system32\gpjsgdxl.ini c:\windows\system32\grvtedld.ini c:\windows\system32\gwbpsalt.ini c:\windows\system32\gxirfijt.ini c:\windows\system32\hasqoiww.ini c:\windows\system32\heobduki.ini c:\windows\system32\hfxwfyhs.ini c:\windows\system32\hhllyhgg.ini c:\windows\system32\hhqrlysi.ini c:\windows\system32\hhuncrqf.ini c:\windows\system32\huchbvwr.ini c:\windows\system32\hwcogfyh.ini c:\windows\system32\hxhjprlk.ini c:\windows\system32\hxqksbld.ini c:\windows\system32\hyjuelux.ini c:\windows\system32\icmerwba.ini c:\windows\system32\icyxdhbx.ini c:\windows\system32\ieubelin.ini c:\windows\system32\iiuaujti.ini c:\windows\system32\ijjlm.bak1 c:\windows\system32\ijjlm.bak2 c:\windows\system32\ijjlm.ini c:\windows\system32\ijjlm.ini2 c:\windows\system32\ijjlm.tmp c:\windows\system32\ilqbfiwt.ini c:\windows\system32\inmmrcnd.ini c:\windows\system32\iqnoyrak.ini c:\windows\system32\iufmridd.ini c:\windows\system32\ivndlnwv.ini c:\windows\system32\iywkjxcp.ini c:\windows\system32\jafylfnd.ini c:\windows\system32\japricsx.ini c:\windows\system32\jdvtaybj.ini c:\windows\system32\jiuydpsb.ini c:\windows\system32\jnhoyvwt.ini c:\windows\system32\jnsjcgeh.ini c:\windows\system32\jsdigevb.ini c:\windows\system32\jvsmknyg.ini c:\windows\system32\jylusoip.ini c:\windows\system32\jynjqcqx.ini c:\windows\system32\kbfyyotu.ini c:\windows\system32\kbloffih.ini c:\windows\system32\kfawedjr.ini c:\windows\system32\kgcrljuw.ini c:\windows\system32\knecteqm.ini c:\windows\system32\knpqkkhk.ini c:\windows\system32\korepldf.ini c:\windows\system32\kpksouci.ini c:\windows\system32\kqgkdrhm.ini c:\windows\system32\ktmasyqs.ini c:\windows\system32\kyqonued.ini c:\windows\system32\latoskxh.ini c:\windows\system32\latsujun.ini c:\windows\system32\lhhrylbe.ini c:\windows\system32\ljbxpxni.ini c:\windows\system32\lkcnonhh.ini c:\windows\system32\lkyjoqci.ini c:\windows\system32\llgyyyxm.ini c:\windows\system32\lnajbhkb.ini c:\windows\system32\logrvxwj.ini c:\windows\system32\lojxqlxy.ini c:\windows\system32\lrqxumpg.ini c:\windows\system32\mabjhcgd.ini c:\windows\system32\mbeomupp.ini c:\windows\system32\mcgrqaaa.ini c:\windows\system32\mcrh.tmp c:\windows\system32\mhtowqpl.ini c:\windows\system32\mkmqgkhr.ini c:\windows\system32\mksseugp.ini c:\windows\system32\mrpvbynd.ini c:\windows\system32\mtqjnfjs.ini c:\windows\system32\mwsojvbp.ini c:\windows\system32\nbphwaxe.ini c:\windows\system32\ncifgyrs.ini c:\windows\system32\ndfgdmny.ini c:\windows\system32\nekkftsi.ini c:\windows\system32\nhsapfem.ini c:\windows\system32\njjyioeh.ini c:\windows\system32\nlgqpebf.ini c:\windows\system32\noattktw.ini c:\windows\system32\nrrwlyyh.ini c:\windows\system32\nsiqtilb.ini c:\windows\system32\nsiruoif.ini c:\windows\system32\nsogahle.ini c:\windows\system32\nsyppxgd.ini c:\windows\system32\obdkirjq.ini c:\windows\system32\ohykmfci.ini c:\windows\system32\oigujvfl.ini c:\windows\system32\onkgntap.ini c:\windows\system32\osbsgkei.ini c:\windows\system32\osfulmhk.ini c:\windows\system32\oticfytr.ini c:\windows\system32\owqnmqpg.ini c:\windows\system32\oxjqsgqn.ini c:\windows\system32\oxvufqex.ini c:\windows\system32\oyhllxlm.ini c:\windows\system32\pdxnssir.ini c:\windows\system32\pfmanbrd.ini c:\windows\system32\pjljwtuq.ini c:\windows\system32\pmffsnne.ini c:\windows\system32\pokckpvv.ini c:\windows\system32\ppnbdtox.ini c:\windows\system32\pptxujtl.ini c:\windows\system32\pqcvdnaf.ini c:\windows\system32\prfgopgo.ini c:\windows\system32\ptviocug.ini c:\windows\system32\pubmnpcx.ini c:\windows\system32\pvamfnwh.ini c:\windows\system32\qcrretne.ini c:\windows\system32\qcvooudx.ini c:\windows\system32\qevgldsa.ini c:\windows\system32\qhwdjtvu.ini c:\windows\system32\qrnnbond.ini c:\windows\system32\qupkylky.ini c:\windows\system32\qxdflprp.ini c:\windows\system32\rfoccuwj.ini c:\windows\system32\rguuruke.ini c:\windows\system32\rifdqcqh.ini c:\windows\system32\rimfogio.ini c:\windows\system32\rimwcnoy.ini c:\windows\system32\rlgmdjno.ini c:\windows\system32\rluqnboq.ini c:\windows\system32\rqnkkjcn.ini c:\windows\system32\rvnqpsya.ini c:\windows\system32\sahcbpap.ini c:\windows\system32\sfdbjthe.ini c:\windows\system32\sfyxqlww.ini c:\windows\system32\sgdipqui.ini c:\windows\system32\shdokogx.ini c:\windows\system32\shnykbag.ini c:\windows\system32\sjturrip.ini c:\windows\system32\smhrfnkk.ini c:\windows\system32\snxnfleq.ini c:\windows\system32\sqyutwqc.ini c:\windows\system32\ssohlmsf.ini c:\windows\system32\sswpryab.ini c:\windows\system32\ststv.bak1 c:\windows\system32\ststv.ini c:\windows\system32\svhoifwj.ini c:\windows\system32\svvwa.bak1 c:\windows\system32\svvwa.bak2 c:\windows\system32\svvwa.ini c:\windows\system32\svvwa.tmp c:\windows\system32\svvwa.tmp2 c:\windows\system32\tfmeaxuu.ini c:\windows\system32\tlwadjsx.ini c:\windows\system32\tpomyvll.ini c:\windows\system32\ttutv.bak1 c:\windows\system32\ttutv.bak2 c:\windows\system32\ttutv.ini c:\windows\system32\ttutv.ini2 c:\windows\system32\ttutv.tmp c:\windows\system32\twbtgmhj.ini c:\windows\system32\twlirdvr.ini c:\windows\system32\twqiogta.ini c:\windows\system32\tywdinkq.ini c:\windows\system32\upnnaibf.ini c:\windows\system32\utglaxis.ini c:\windows\system32\utwkjpiw.ini c:\windows\system32\uyhmleso.ini c:\windows\system32\vdxqnmau.ini c:\windows\system32\vgsmlkih.ini c:\windows\system32\vlygiruy.ini c:\windows\system32\vsdrcomw.ini c:\windows\system32\wljxcxci.ini c:\windows\system32\wnqagpvm.ini c:\windows\system32\woyvmsxx.ini c:\windows\system32\wptkfcfb.ini c:\windows\system32\wxrxnaum.ini c:\windows\system32\xeuymqje.ini c:\windows\system32\xfqqbwbj.ini c:\windows\system32\xgbqhths.ini c:\windows\system32\xgtxkixy.ini c:\windows\system32\xgxjaoll.ini c:\windows\system32\xibsheiu.ini c:\windows\system32\xmrjdtmv.ini c:\windows\system32\xnmcvhca.ini c:\windows\system32\xqidudbw.ini c:\windows\system32\xrfbrdyy.ini c:\windows\system32\xyadd.bak1 c:\windows\system32\xyadd.ini c:\windows\system32\ybkxfgdx.ini c:\windows\system32\ydnbfjjr.ini c:\windows\system32\yfcwhoht.ini c:\windows\system32\yiafxhmm.ini c:\windows\system32\yidvwwxl.ini c:\windows\system32\yonjcpnv.ini c:\windows\system32\yuinbxvl.ini c:\windows\system32\ywpgtmgo.ini c:\windows\system32\yyjssuxw.ini c:\windows\system32\yytvusfg.ini . ((((((((((((((((((((((((( Files Created from 2008-10-07 to 2008-11-07 ))))))))))))))))))))))))))))))) . 2008-11-06 09:56 . 2008-11-06 13:17 <DIR> d--h----- C:\$AVG8.VAULT$ 2008-11-06 09:52 . 2008-11-07 12:37 <DIR> d-------- c:\windows\system32\drivers\Avg 2008-11-06 09:52 . 2008-11-06 09:59 <DIR> d-------- c:\documents and settings\Ben\Application Data\AVGTOOLBAR 2008-11-06 09:52 . 2008-11-06 09:52 97,928 --a------ c:\windows\system32\drivers\avgldx86.sys 2008-11-06 09:52 . 2008-11-06 09:52 10,520 --a------ c:\windows\system32\avgrsstx.dll 2008-11-06 09:51 . 2008-11-06 09:51 <DIR> d-------- c:\program files\AVG 2008-11-06 09:51 . 2008-11-06 09:51 <DIR> d-------- c:\documents and settings\All Users\Application Data\avg8 2008-11-06 09:51 . 2008-11-06 09:51 76,040 --a------ c:\windows\system32\drivers\avgtdix.sys 2008-11-06 09:30 . 2004-08-03 23:08 31,616 --a------ c:\windows\system32\drivers\usbccgp.sys 2008-11-06 09:30 . 2004-08-03 23:08 31,616 --a------ c:\windows\system32\dllcache\usbccgp.sys 2008-11-06 09:30 . 2004-08-04 00:56 21,504 --a------ c:\windows\system32\hidserv.dll 2008-11-06 09:30 . 2004-08-04 00:56 21,504 --a------ c:\windows\system32\dllcache\hidserv.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-06 14:48 --------- d-----w c:\documents and settings\All Users\Application Data\McAfee.com 2008-11-03 01:49 --------- d-----w c:\documents and settings\Ben\Application Data\AdobeUM 2007-04-29 14:29 800,272 ----a-w c:\documents and settings\Ben\ppctl.dll 2007-08-24 23:27 1,135 --sh--w c:\windows\Fonts\ntp2.ini2 2007-02-18 19:41 88 --sh--r c:\windows\system32\D47D29D109.sys 2007-02-18 19:41 3,350 --sha-w c:\windows\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{10708868-CEF5-49E5-A211-A8339B8F7188}] 2008-03-10 17:21 98048 --a------ c:\windows\system32\dsoun.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "igfxtray"="c:\windows\system32\igfxtray.exe" [2005-10-14 94208] "igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-10-14 77824] "igfxpers"="c:\windows\system32\igfxpers.exe" [2005-10-14 114688] "SunJavaUpdateSched"="c:\program files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-11-19 32881] "DMXLauncher"="c:\program files\Dell\Media Experience\DMXLauncher.exe" [2005-10-05 94208] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-06-14 98304] "ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 249856] "ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 81920] "Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-09-03 29744] "EPSON Stylus Photo 820 Series (Copy 1)"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S0EIC1.EXE" [2002-04-10 74240] "MSKDetectorExe"="c:\program files\McAfee\SpamKiller\MSKDetct.exe" [2006-11-07 1121280] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-08-26 185896] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-11-06 1234712] "SigmatelSysTrayApp"="stsystra.exe" [2005-03-22 c:\windows\stsystra.exe] c:\documents and settings\LocalService\Start Menu\Programs\Startup\ updtpcps.bat [2003-02-27 39] c:\documents and settings\NetworkService\Start Menu\Programs\Startup\ updtpcps.bat [2003-02-27 39] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Acrobat Assistant.lnk - c:\program files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-05-15 217193] Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-10-20 113664] Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-06-14 24576] QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2004-11-11 806912] Service Manager.lnk - c:\program files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2005-05-03 81920] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Real\\RealPlayer\\realplay.exe"= "c:\\Program Files\\AVG\\AVG8\\avgemc.exe"= "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"= R0 edpwofvk;edpwofvk;c:\windows\system32\drivers\megvtacw.dat [ ] R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-11-06 97928] R2 AdobeActiveFileMonitor;Adobe Active File Monitor;c:\program files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe [2004-10-20 98304] R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-11-06 875288] R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-11-06 231704] R2 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2008-11-06 76040] R2 PhotoshopElementsDeviceConnect;Photoshop Elements Device Connect;c:\program files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe [2004-10-20 118784] S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2008-09-03 29744] S3 PPCtlPriv;PPCtlPriv;c:\program files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe [ ] . Contents of the 'Scheduled Tasks' folder 2008-10-31 c:\windows\Tasks\McAfee.com Scan for Viruses - My Computer (DH08H5B1-Amy).job - c:\program files\mcafee.com\vso\mcmnhdlr.exe [] . - - - - ORPHANS REMOVED - - - - Notify-awvvs - c:\windows\system32\awvvs.dll Notify-ddayx - c:\windows\system32\ddayx.dll Notify-disknet - c:\windows\fonts\disknet.dll Notify-gebyy - c:\windows\system32\gebyy.dll Notify-mljji - c:\windows\system32\mljji.dll Notify-vtsts - c:\windows\system32\vtsts.dll Notify-vtutt - c:\windows\system32\vtutt.dll Notify-efcbxvt - efcbxvt.dll . ------- Supplementary Scan ------- . FireFox -: Profile - c:\documents and settings\Ben\Application Data\Mozilla\Firefox\Profiles\zelqwdyd.default\ FF -: plugin - c:\program files\Adobe\Acrobat 6.0\Reader\browser\nppdf32.dll FF -: plugin - c:\program files\Java\j2re1.4.2_03\bin\NPJava11.dll FF -: plugin - c:\program files\Java\j2re1.4.2_03\bin\NPJava12.dll FF -: plugin - c:\program files\Java\j2re1.4.2_03\bin\NPJava13.dll FF -: plugin - c:\program files\Java\j2re1.4.2_03\bin\NPJava14.dll FF -: plugin - c:\program files\Java\j2re1.4.2_03\bin\NPJava32.dll FF -: plugin - c:\program files\Java\j2re1.4.2_03\bin\NPJPI142_03.dll FF -: plugin - c:\program files\Java\j2re1.4.2_03\bin\NPOJI610.dll FF -: plugin - c:\program files\Mozilla Firefox\plugins\npGoogleGadgetPluginFirefoxWin.dll FF -: plugin - c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll . ************************************************************************ catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-07 13:01:29 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ********************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\edpwofvk] "ImagePath"="system32\drivers\megvtacw.dat" . ------------------------ Other Running Processes ------------------------ . c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE c:\program files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe c:\windows\system32\wdfmgr.exe c:\program files\AVG\AVG8\avgrsx.exe . ************************************************************************ . Completion time: 2008-11-07 13:04:22 - machine was rebooted ComboFix-quarantined-files.txt 2008-11-07 18:04:16 Pre-Run: 56,067,465,216 bytes free Post-Run: 58,160,807,936 bytes free 398 --- E O F --- 2008-10-25 02:37:56

11-13-2008, 08:08 AM	#8 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,254 OS: 2000 Pro; XP Pro; XP Home	Re: Downloader.Delf.12.AN Please go to Start > Run and copy/paste the following, then press Enter: C:\QooBox\ComboFix-quarantined-files.txt Post the contents of the logfile which will open. __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009

11-13-2008, 10:06 AM	#9 (permalink)
paul.hunt Registered User Join Date: Nov 2008 Posts: 14 OS: Windows XP Home SP2	Re: Downloader.Delf.12.AN 2000-10-27 16:23:18 A------- 50,688 C:\Qoobox\Quarantine\C\WINDOWS\system32\BSZIP.DLL.vir 2006-07-09 18:56:19 A------- 53 C:\Qoobox\Quarantine\C\Documents and Settings\Amy\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML.vir 2006-09-14 17:11:46 A------- 3,310 C:\Qoobox\Quarantine\C\WINDOWS\IE4 Error Log.txt.vir 2007-04-26 12:14:28 A------- 1,402,424 C:\Qoobox\Quarantine\C\WINDOWS\system32\acbeg.ini.vir 2007-04-26 12:14:43 A------- 1,402,038 C:\Qoobox\Quarantine\C\WINDOWS\system32\acbeg.bak1.vir 2007-04-27 15:54:31 A------- 1,252,559 C:\Qoobox\Quarantine\C\WINDOWS\system32\svvwa.bak1.vir 2007-04-28 16:27:47 A------- 1,353,307 C:\Qoobox\Quarantine\C\WINDOWS\system32\svvwa.bak2.vir 2007-04-28 17:47:45 A------- 1,259,575 C:\Qoobox\Quarantine\C\WINDOWS\system32\svvwa.tmp.vir 2007-04-28 17:50:10 A------- 1,246,499 C:\Qoobox\Quarantine\C\WINDOWS\system32\svvwa.ini.vir 2007-05-03 15:50:06 A------- 1,463,664 C:\Qoobox\Quarantine\C\WINDOWS\system32\iufmridd.ini.vir 2007-05-05 19:08:18 A------- 1,463,124 C:\Qoobox\Quarantine\C\WINDOWS\system32\obdkirjq.ini.vir 2007-05-05 21:23:56 A------- 1,461,459 C:\Qoobox\Quarantine\C\WINDOWS\system32\pmffsnne.ini.vir 2007-05-06 06:32:43 A------- 1,462,719 C:\Qoobox\Quarantine\C\WINDOWS\system32\pptxujtl.ini.vir 2007-05-08 08:41:29 A------- 1,436,569 C:\Qoobox\Quarantine\C\WINDOWS\system32\lojxqlxy.ini.vir 2007-05-08 15:38:07 A------- 1,356,874 C:\Qoobox\Quarantine\C\WINDOWS\system32\svvwa.tmp2.vir 2007-05-08 17:38:53 A------- 2,112,171 C:\Qoobox\Quarantine\C\WINDOWS\system32\ijjlm.bak1.vir 2007-05-09 17:58:13 A------- 2,111,148 C:\Qoobox\Quarantine\C\WINDOWS\system32\ijjlm.bak2.vir 2007-05-10 11:36:51 A------- 1,550,267 C:\Qoobox\Quarantine\C\WINDOWS\system32\ijjlm.tmp.vir 2007-05-10 11:39:42 A------- 1,506,944 C:\Qoobox\Quarantine\C\WINDOWS\system32\ijjlm.ini.vir 2007-05-10 14:28:43 A------- 1,462,662 C:\Qoobox\Quarantine\C\WINDOWS\system32\eoilwagg.ini.vir 2007-05-14 11:19:45 A------- 1,431,757 C:\Qoobox\Quarantine\C\WINDOWS\system32\iywkjxcp.ini.vir 2007-05-15 06:52:04 A------- 1,466,012 C:\Qoobox\Quarantine\C\WINDOWS\system32\ohykmfci.ini.vir 2007-05-16 16:30:43 A------- 1,461,522 C:\Qoobox\Quarantine\C\WINDOWS\system32\smhrfnkk.ini.vir 2007-05-16 16:35:45 A------- 1,450,593 C:\Qoobox\Quarantine\C\WINDOWS\system32\nsiqtilb.ini.vir 2007-05-17 15:34:31 A------- 963 C:\Qoobox\Quarantine\C\WINDOWS\Fonts\ntp2.ini.vir 2007-05-18 04:30:33 A------- 1,062,520 C:\Qoobox\Quarantine\C\WINDOWS\system32\jnsjcgeh.ini.vir 2007-05-18 04:32:36 A------- 1,077,124 C:\Qoobox\Quarantine\C\WINDOWS\system32\ghqjjueg.ini.vir 2007-05-18 13:47:30 A------- 1,087,161 C:\Qoobox\Quarantine\C\WINDOWS\system32\nsyppxgd.ini.vir 2007-05-18 16:11:16 A------- 143 C:\Qoobox\Quarantine\C\WINDOWS\system32\mcrh.tmp.vir 2007-05-18 16:14:57 A------- 833,162 C:\Qoobox\Quarantine\C\WINDOWS\system32\yfcwhoht.ini.vir 2007-05-19 11:11:33 A------- 1,092,231 C:\Qoobox\Quarantine\C\WINDOWS\system32\yonjcpnv.ini.vir 2007-05-19 11:19:54 A------- 1,084,910 C:\Qoobox\Quarantine\C\WINDOWS\system32\oxvufqex.ini.vir 2007-05-21 16:14:29 A------- 831,977 C:\Qoobox\Quarantine\C\WINDOWS\system32\twlirdvr.ini.vir 2007-05-22 08:03:36 A------- 1,100,817 C:\Qoobox\Quarantine\C\WINDOWS\system32\grvtedld.ini.vir 2007-06-01 12:09:22 A------- 1,101,736 C:\Qoobox\Quarantine\C\WINDOWS\system32\edbednjr.ini.vir 2007-06-03 08:50:20 A------- 1,101,198 C:\Qoobox\Quarantine\C\WINDOWS\system32\excdsrdw.ini.vir 2007-06-03 12:28:23 A------- 1,101,540 C:\Qoobox\Quarantine\C\WINDOWS\system32\gwbpsalt.ini.vir 2007-06-03 18:01:11 A------- 1,067,167 C:\Qoobox\Quarantine\C\WINDOWS\system32\dxxlqgif.ini.vir 2007-06-04 12:25:46 A------- 965,959 C:\Qoobox\Quarantine\C\WINDOWS\system32\faldqfww.ini.vir 2007-06-09 08:04:46 A------- 970,852 C:\Qoobox\Quarantine\C\WINDOWS\system32\rguuruke.ini.vir 2007-06-10 04:46:42 A------- 970,791 C:\Qoobox\Quarantine\C\WINDOWS\system32\tlwadjsx.ini.vir 2007-06-11 10:45:59 A------- 1,893,659 C:\Qoobox\Quarantine\C\WINDOWS\system32\gpfqmqaq.ini.vir 2007-06-11 12:58:26 A------- 1,889,021 C:\Qoobox\Quarantine\C\WINDOWS\system32\xgbqhths.ini.vir 2007-06-11 14:17:23 A------- 1,883,410 C:\Qoobox\Quarantine\C\WINDOWS\system32\kqgkdrhm.ini.vir 2007-06-11 16:33:01 A------- 1,882,296 C:\Qoobox\Quarantine\C\WINDOWS\system32\fismdcrv.ini.vir 2007-06-11 17:41:14 A------- 1,879,273 C:\Qoobox\Quarantine\C\WINDOWS\system32\llgyyyxm.ini.vir 2007-06-12 04:12:15 A------- 1,873,477 C:\Qoobox\Quarantine\C\WINDOWS\system32\hhuncrqf.ini.vir 2007-06-12 07:53:18 A------- 2,120,010 C:\Qoobox\Quarantine\C\WINDOWS\system32\ijjlm.ini2.vir 2007-06-12 08:02:04 A------- 1,757,725 C:\Qoobox\Quarantine\C\WINDOWS\system32\hyjuelux.ini.vir 2007-06-12 12:55:25 A------- 1,752,487 C:\Qoobox\Quarantine\C\WINDOWS\system32\lrqxumpg.ini.vir 2007-06-12 15:16:38 A------- 1,834,783 C:\Qoobox\Quarantine\C\WINDOWS\system32\bkqjmhnw.ini.vir 2007-06-12 16:28:29 A------- 1,834,903 C:\Qoobox\Quarantine\C\WINDOWS\system32\nlgqpebf.ini.vir 2007-06-13 04:51:50 A------- 1,835,022 C:\Qoobox\Quarantine\C\WINDOWS\system32\pubmnpcx.ini.vir 2007-06-13 0640 A------- 1,835,141 C:\Qoobox\Quarantine\C\WINDOWS\system32\vlygiruy.ini.vir 2007-06-13 14:35:17 A------- 1,835,263 C:\Qoobox\Quarantine\C\WINDOWS\system32\shnykbag.ini.vir 2007-06-13 15:40:36 A------- 1,835,383 C:\Qoobox\Quarantine\C\WINDOWS\system32\xgxjaoll.ini.vir 2007-06-13 17:58:10 A------- 1,835,503 C:\Qoobox\Quarantine\C\WINDOWS\system32\mabjhcgd.ini.vir 2007-06-14 04:29:18 A------- 1,835,623 C:\Qoobox\Quarantine\C\WINDOWS\system32\ggjxcluj.ini.vir 2007-06-14 05:37:09 A------- 1,835,742 C:\Qoobox\Quarantine\C\WINDOWS\system32\bxmxkdnk.ini.vir 2007-06-14 06:56:01 A------- 1,835,863 C:\Qoobox\Quarantine\C\WINDOWS\system32\qxdflprp.ini.vir 2007-06-14 07:21:04 A------- 1,835,983 C:\Qoobox\Quarantine\C\WINDOWS\system32\utglaxis.ini.vir 2007-06-14 14:45:42 A------- 1,836,163 C:\Qoobox\Quarantine\C\WINDOWS\system32\heobduki.ini.vir 2007-06-15 04:36:29 A------- 1,836,522 C:\Qoobox\Quarantine\C\WINDOWS\system32\bpfwibor.ini.vir 2007-06-15 14:16:26 A------- 1,836,642 C:\Qoobox\Quarantine\C\WINDOWS\system32\rimwcnoy.ini.vir 2007-06-15 17:01:42 A------- 1,836,763 C:\Qoobox\Quarantine\C\WINDOWS\system32\dsvrehts.ini.vir 2007-06-15 17:44:01 A------- 1,836,883 C:\Qoobox\Quarantine\C\WINDOWS\system32\logrvxwj.ini.vir 2007-06-15 17:55:34 A------- 1,836,025 C:\Qoobox\Quarantine\C\WINDOWS\system32\lkcnonhh.ini.vir 2007-06-15 18:27:57 A------- 1,836,146 C:\Qoobox\Quarantine\C\WINDOWS\system32\jsdigevb.ini.vir 2007-06-16 03:38:57 A------- 1,836,265 C:\Qoobox\Quarantine\C\WINDOWS\system32\arjkvtmn.ini.vir 2007-06-16 09:09:30 A------- 1,836,385 C:\Qoobox\Quarantine\C\WINDOWS\system32\beopcdmp.ini.vir 2007-06-16 14:49:04 A------- 1,836,505 C:\Qoobox\Quarantine\C\WINDOWS\system32\nbphwaxe.ini.vir 2007-06-16 15:57:47 A------- 1,836,625 C:\Qoobox\Quarantine\C\WINDOWS\system32\sfyxqlww.ini.vir 2007-06-17 05:42:16 A------- 1,836,745 C:\Qoobox\Quarantine\C\WINDOWS\system32\yyjssuxw.ini.vir 2007-06-17 10:14:03 A------- 1,831,863 C:\Qoobox\Quarantine\C\WINDOWS\system32\icmerwba.ini.vir 2007-06-17 13:37:26 A------- 1,831,698 C:\Qoobox\Quarantine\C\WINDOWS\system32\etnaqabs.ini.vir 2007-06-17 15:11:30 A------- 1,831,818 C:\Qoobox\Quarantine\C\WINDOWS\system32\bllaytwx.ini.vir 2007-06-17 18:12:12 A------- 1,831,939 C:\Qoobox\Quarantine\C\WINDOWS\system32\qupkylky.ini.vir 2007-06-18 04:08:52 A------- 1,831,599 C:\Qoobox\Quarantine\C\WINDOWS\system32\jnhoyvwt.ini.vir 2007-06-18 09:24:56 A------- 1,831,720 C:\Qoobox\Quarantine\C\WINDOWS\system32\latsujun.ini.vir 2007-06-18 14:36:05 A------- 1,831,839 C:\Qoobox\Quarantine\C\WINDOWS\system32\bsknvmfr.ini.vir 2007-06-18 16:54:30 A------- 1,831,958 C:\Qoobox\Quarantine\C\WINDOWS\system32\kyqonued.ini.vir 2007-06-19 07:54:51 A------- 898,716 C:\Qoobox\Quarantine\C\WINDOWS\system32\cequojch.ini.vir 2007-06-19 11:21:07 A------- 898,849 C:\Qoobox\Quarantine\C\WINDOWS\system32\byrtolog.ini.vir 2007-06-19 14:31:18 A------- 898,968 C:\Qoobox\Quarantine\C\WINDOWS\system32\vdxqnmau.ini.vir 2007-06-19 16:30:25 A------- 902,465 C:\Qoobox\Quarantine\C\WINDOWS\system32\drurvbtp.ini.vir 2007-06-19 18:12:06 A------- 902,584 C:\Qoobox\Quarantine\C\WINDOWS\system32\mksseugp.ini.vir 2007-06-20 04:24:13 A------- 902,510 C:\Qoobox\Quarantine\C\WINDOWS\system32\snxnfleq.ini.vir 2007-06-20 09:27:01 A------- 901,241 C:\Qoobox\Quarantine\C\WINDOWS\system32\sfdbjthe.ini.vir 2007-06-20 11:08:20 A------- 868,144 C:\Qoobox\Quarantine\C\WINDOWS\system32\rimfogio.ini.vir 2007-07-14 12:52:02 A------- 1,971,618 C:\Qoobox\Quarantine\C\WINDOWS\system32\ststv.ini.vir 2007-07-14 12:52:24 A------- 1,947,574 C:\Qoobox\Quarantine\C\WINDOWS\system32\ststv.bak1.vir 2007-07-14 12:58:17 A------- 1,186,020 C:\Qoobox\Quarantine\C\WINDOWS\system32\oxjqsgqn.ini.vir 2007-08-07 18:02:24 A------- 1,782,015 C:\Qoobox\Quarantine\C\WINDOWS\system32\xyadd.ini.vir 2007-08-07 18:02:45 A------- 1,758,297 C:\Qoobox\Quarantine\C\WINDOWS\system32\xyadd.bak1.vir 2007-09-05 10:51:11 A------- 411,542 C:\Qoobox\Quarantine\C\WINDOWS\system32\ttutv.bak1.vir 2007-09-06 04:25:05 A------- 409,391 C:\Qoobox\Quarantine\C\WINDOWS\system32\ttutv.bak2.vir 2007-09-06 04:30:50 A------- 739,036 C:\Qoobox\Quarantine\C\WINDOWS\system32\knpqkkhk.ini.vir 2007-09-06 08:28:33 A------- 3,049 C:\Qoobox\Quarantine\C\WINDOWS\cookies.ini.vir 2007-09-07 04:46:03 A------- 637,051 C:\Qoobox\Quarantine\C\WINDOWS\system32\oyhllxlm.ini.vir 2007-09-07 04:46:06 A------- 2,050,898 C:\Qoobox\Quarantine\C\WINDOWS\system32\ttutv.tmp.vir 2007-09-07 04:56:49 A------- 6,442 C:\Qoobox\Quarantine\C\WINDOWS\system32\ttutv.ini.vir 2007-09-07 05:00:03 A------- 637,230 C:\Qoobox\Quarantine\C\WINDOWS\system32\jylusoip.ini.vir 2007-09-07 10:02:01 A------- 637,342 C:\Qoobox\Quarantine\C\WINDOWS\system32\hfxwfyhs.ini.vir 2007-09-07 10:29:16 A------- 637,650 C:\Qoobox\Quarantine\C\WINDOWS\system32\icyxdhbx.ini.vir 2007-09-07 15:40:16 A------- 637,762 C:\Qoobox\Quarantine\C\WINDOWS\system32\yiafxhmm.ini.vir 2007-09-07 17:54:32 A------- 637,890 C:\Qoobox\Quarantine\C\WINDOWS\system32\tywdinkq.ini.vir 2007-09-07 18:26:57 A------- 638,011 C:\Qoobox\Quarantine\C\WINDOWS\system32\ncifgyrs.ini.vir 2007-09-08 04:42:08 A------- 638,122 C:\Qoobox\Quarantine\C\WINDOWS\system32\cilhhrtp.ini.vir 2007-09-08 12:00:40 A------- 638,242 C:\Qoobox\Quarantine\C\WINDOWS\system32\vsdrcomw.ini.vir 2007-09-08 15:54:45 A------- 638,371 C:\Qoobox\Quarantine\C\WINDOWS\system32\kpksouci.ini.vir 2007-09-08 16:19:11 A------- 638,490 C:\Qoobox\Quarantine\C\WINDOWS\system32\wljxcxci.ini.vir 2007-09-08 17:41:53 A------- 638,671 C:\Qoobox\Quarantine\C\WINDOWS\system32\cplufkie.ini.vir 2007-09-09 05:42:15 A------- 638,782 C:\Qoobox\Quarantine\C\WINDOWS\system32\kgcrljuw.ini.vir 2007-09-09 11:58:49 A------- 638,910 C:\Qoobox\Quarantine\C\WINDOWS\system32\ckiqmtdg.ini.vir 2007-09-09 15:14:08 A------- 639,031 C:\Qoobox\Quarantine\C\WINDOWS\system32\osfulmhk.ini.vir 2007-09-09 16:18:17 A------- 639,151 C:\Qoobox\Quarantine\C\WINDOWS\system32\gpjsgdxl.ini.vir 2007-09-09 16:54:07 A------- 639,262 C:\Qoobox\Quarantine\C\WINDOWS\system32\wxrxnaum.ini.vir 2007-09-10 04:29:16 A------- 639,391 C:\Qoobox\Quarantine\C\WINDOWS\system32\bblhduyx.ini.vir 2007-09-10 0937 A------- 639,510 C:\Qoobox\Quarantine\C\WINDOWS\system32\fubqlajw.ini.vir 2007-09-10 11:41:17 A------- 639,691 C:\Qoobox\Quarantine\C\WINDOWS\system32\kbfyyotu.ini.vir 2007-09-10 15:26:26 A------- 639,802 C:\Qoobox\Quarantine\C\WINDOWS\system32\qevgldsa.ini.vir 2007-09-10 17:22:36 A------- 639,921 C:\Qoobox\Quarantine\C\WINDOWS\system32\nhsapfem.ini.vir 2007-09-10 18:54:06 A------- 640,051 C:\Qoobox\Quarantine\C\WINDOWS\system32\antnkkbd.ini.vir 2007-09-11 04:09:37 A------- 640,291 C:\Qoobox\Quarantine\C\WINDOWS\system32\pvamfnwh.ini.vir 2007-09-11 10:12:30 A------- 640,470 C:\Qoobox\Quarantine\C\WINDOWS\system32\sjturrip.ini.vir 2007-09-11 13:52:25 A------- 640,651 C:\Qoobox\Quarantine\C\WINDOWS\system32\atgddgcl.ini.vir 2007-09-11 16:51:02 A------- 640,762 C:\Qoobox\Quarantine\C\WINDOWS\system32\utwkjpiw.ini.vir 2007-09-11 20:28:26 A------- 640,899 C:\Qoobox\Quarantine\C\WINDOWS\system32\xrfbrdyy.ini.vir 2007-09-12 04:20:45 A------- 641,070 C:\Qoobox\Quarantine\C\WINDOWS\system32\eaefagjm.ini.vir 2007-09-12 08:49:35 A------- 641,182 C:\Qoobox\Quarantine\C\WINDOWS\system32\ljbxpxni.ini.vir 2007-09-12 10:16:17 A------- 641,302 C:\Qoobox\Quarantine\C\WINDOWS\system32\rlgmdjno.ini.vir 2007-09-12 12:17:44 A------- 641,430 C:\Qoobox\Quarantine\C\WINDOWS\system32\qrnnbond.ini.vir 2007-09-12 13:44:01 A------- 636,609 C:\Qoobox\Quarantine\C\WINDOWS\system32\pjljwtuq.ini.vir 2007-09-12 18:40:37 A------- 636,789 C:\Qoobox\Quarantine\C\WINDOWS\system32\auibnnqp.ini.vir 2007-09-13 04:28:16 A------- 636,909 C:\Qoobox\Quarantine\C\WINDOWS\system32\ghciopak.ini.vir 2007-09-13 05:12:22 A------- 637,020 C:\Qoobox\Quarantine\C\WINDOWS\system32\shdokogx.ini.vir 2007-09-13 13:19:50 A------- 637,148 C:\Qoobox\Quarantine\C\WINDOWS\system32\iqnoyrak.ini.vir 2007-09-13 18:16:20 A------- 637,260 C:\Qoobox\Quarantine\C\WINDOWS\system32\nrrwlyyh.ini.vir 2007-09-14 04:41:36 A------- 637,449 C:\Qoobox\Quarantine\C\WINDOWS\system32\ivndlnwv.ini.vir 2007-09-14 10:32:05 A------- 637,577 C:\Qoobox\Quarantine\C\WINDOWS\system32\oticfytr.ini.vir 2007-09-14 12:25:19 A------- 637,679 C:\Qoobox\Quarantine\C\WINDOWS\system32\sahcbpap.ini.vir 2007-09-14 14:57:14 A------- 637,809 C:\Qoobox\Quarantine\C\WINDOWS\system32\xmrjdtmv.ini.vir 2007-09-14 16:08:55 A------- 637,929 C:\Qoobox\Quarantine\C\WINDOWS\system32\gxirfijt.ini.vir 2007-09-14 16:59:16 A------- 638,049 C:\Qoobox\Quarantine\C\WINDOWS\system32\sqyutwqc.ini.vir 2007-09-14 18:25:48 A------- 638,228 C:\Qoobox\Quarantine\C\WINDOWS\system32\rluqnboq.ini.vir 2007-09-15 04:31:09 A------- 638,367 C:\Qoobox\Quarantine\C\WINDOWS\system32\prfgopgo.ini.vir 2007-09-15 06:37:28 A------- 638,460 C:\Qoobox\Quarantine\C\WINDOWS\system32\jynjqcqx.ini.vir 2007-09-15 06:50:15 A------- 638,588 C:\Qoobox\Quarantine\C\WINDOWS\system32\cgfofexj.ini.vir 2007-09-15 14:50:37 A------- 638,709 C:\Qoobox\Quarantine\C\WINDOWS\system32\dqyqxydx.ini.vir 2007-09-15 16:36:05 A------- 638,828 C:\Qoobox\Quarantine\C\WINDOWS\system32\xgtxkixy.ini.vir 2007-09-15 18:19:47 A------- 638,948 C:\Qoobox\Quarantine\C\WINDOWS\system32\nekkftsi.ini.vir 2007-09-16 04:48:11 A------- 639,068 C:\Qoobox\Quarantine\C\WINDOWS\system32\bnmlcwdk.ini.vir 2007-09-16 07:38:11 A------- 639,189 C:\Qoobox\Quarantine\C\WINDOWS\system32\elpcfemt.ini.vir 2007-09-16 13:29:00 A------- 639,309 C:\Qoobox\Quarantine\C\WINDOWS\system32\jiuydpsb.ini.vir 2007-09-16 1851 A------- 639,420 C:\Qoobox\Quarantine\C\WINDOWS\system32\famnyrbc.ini.vir 2007-09-17 04:22:46 A------- 639,558 C:\Qoobox\Quarantine\C\WINDOWS\system32\bgycaavl.ini.vir 2007-09-17 08:20:03 A------- 639,728 C:\Qoobox\Quarantine\C\WINDOWS\system32\cuygccbi.ini.vir 2007-09-17 13:42:04 A------- 639,858 C:\Qoobox\Quarantine\C\WINDOWS\system32\jafylfnd.ini.vir 2007-09-18 04:32:49 A------- 639,969 C:\Qoobox\Quarantine\C\WINDOWS\system32\xibsheiu.ini.vir 2007-09-18 07:44:16 A------- 640,089 C:\Qoobox\Quarantine\C\WINDOWS\system32\upnnaibf.ini.vir 2007-09-18 17:53:03 A------- 640,209 C:\Qoobox\Quarantine\C\WINDOWS\system32\byahvyka.ini.vir 2007-09-18 18:18:05 A------- 640,329 C:\Qoobox\Quarantine\C\WINDOWS\system32\inmmrcnd.ini.vir 2007-09-19 03:30:01 A------- 640,399 C:\Qoobox\Quarantine\C\WINDOWS\system32\hhllyhgg.ini.vir 2007-09-19 11:59:22 A------- 640,568 C:\Qoobox\Quarantine\C\WINDOWS\system32\tpomyvll.ini.vir 2007-09-19 19:07:26 A------- 640,688 C:\Qoobox\Quarantine\C\WINDOWS\system32\vgsmlkih.ini.vir 2007-09-20 04:17:09 A------- 640,808 C:\Qoobox\Quarantine\C\WINDOWS\system32\fwivoeiy.ini.vir 2007-09-20 09:07:16 A------- 640,920 C:\Qoobox\Quarantine\C\WINDOWS\system32\hhqrlysi.ini.vir 2007-09-20 13:31:40 A------- 636,613 C:\Qoobox\Quarantine\C\WINDOWS\system32\amkyuqnf.ini.vir 2007-09-20 14:47:41 A------- 636,724 C:\Qoobox\Quarantine\C\WINDOWS\system32\nsogahle.ini.vir 2007-09-20 15:01:36 A------- 636,862 C:\Qoobox\Quarantine\C\WINDOWS\system32\oigujvfl.ini.vir 2007-09-21 04:29:51 A------- 637,042 C:\Qoobox\Quarantine\C\WINDOWS\system32\knecteqm.ini.vir 2007-09-21 06:53:35 A------- 637,153 C:\Qoobox\Quarantine\C\WINDOWS\system32\ywpgtmgo.ini.vir 2007-09-21 13:04:47 A------- 637,273 C:\Qoobox\Quarantine\C\WINDOWS\system32\noattktw.ini.vir 2007-09-22 03:24:20 A------- 637,393 C:\Qoobox\Quarantine\C\WINDOWS\system32\blbtxcym.ini.vir 2007-09-22 14:08:23 A------- 637,513 C:\Qoobox\Quarantine\C\WINDOWS\system32\eijvkysq.ini.vir 2007-09-22 20:47:55 A------- 637,624 C:\Qoobox\Quarantine\C\WINDOWS\system32\frubmasf.ini.vir 2007-09-23 04:49:17 A------- 637,753 C:\Qoobox\Quarantine\C\WINDOWS\system32\latoskxh.ini.vir 2007-09-23 19:02:30 A------- 637,873 C:\Qoobox\Quarantine\C\WINDOWS\system32\rqnkkjcn.ini.vir 2007-09-24 0426 A------- 638,053 C:\Qoobox\Quarantine\C\WINDOWS\system32\dvsfolbl.ini.vir 2007-09-25 04:16:24 A------- 638,173 C:\Qoobox\Quarantine\C\WINDOWS\system32\mrpvbynd.ini.vir 2007-09-25 08:42:38 A------- 638,284 C:\Qoobox\Quarantine\C\WINDOWS\system32\ybkxfgdx.ini.vir 2007-09-25 11:53:48 A------- 638,413 C:\Qoobox\Quarantine\C\WINDOWS\system32\japricsx.ini.vir 2007-09-25 13:02:36 A------- 638,533 C:\Qoobox\Quarantine\C\WINDOWS\system32\korepldf.ini.vir 2007-09-25 14:16:37 A------- 638,722 C:\Qoobox\Quarantine\C\WINDOWS\system32\byycmgkk.ini.vir 2007-09-26 04:21:09 A------- 638,842 C:\Qoobox\Quarantine\C\WINDOWS\system32\twqiogta.ini.vir 2007-09-26 11:32:46 A------- 639,013 C:\Qoobox\Quarantine\C\WINDOWS\system32\qcvooudx.ini.vir 2007-09-26 13:17:37 A------- 98,048 C:\Qoobox\Quarantine\C\WINDOWS\system32\dsoun.dll.vir 2007-09-26 13:22:46 A------- 639,133 C:\Qoobox\Quarantine\C\WINDOWS\system32\nsiruoif.ini.vir 2007-09-26 18:53:00 A------- 639,313 C:\Qoobox\Quarantine\C\WINDOWS\system32\sgdipqui.ini.vir 2007-09-27 08:49:17 A------- 639,493 C:\Qoobox\Quarantine\C\WINDOWS\system32\njjyioeh.ini.vir 2007-09-27 13:33:41 A------- 639,613 C:\Qoobox\Quarantine\C\WINDOWS\system32\xeuymqje.ini.vir 2007-09-27 15:33:45 A------- 639,733 C:\Qoobox\Quarantine\C\WINDOWS\system32\ieubelin.ini.vir 2007-09-27 16:41:09 A------- 639,853 C:\Qoobox\Quarantine\C\WINDOWS\system32\xnmcvhca.ini.vir 2007-09-28 04:11:58 A------- 640,033 C:\Qoobox\Quarantine\C\WINDOWS\system32\cxrjbiwi.ini.vir 2007-09-28 12:55:41 A------- 640,213 C:\Qoobox\Quarantine\C\WINDOWS\system32\qcrretne.ini.vir 2007-09-28 16:54:43 A------- 640,324 C:\Qoobox\Quarantine\C\WINDOWS\system32\woyvmsxx.ini.vir 2007-09-28 17:35:18 A------- 640,513 C:\Qoobox\Quarantine\C\WINDOWS\system32\yidvwwxl.ini.vir 2007-09-29 03:47:31 A------- 640,633 C:\Qoobox\Quarantine\C\WINDOWS\system32\xqidudbw.ini.vir 2007-09-29 09:10:04 A------- 640,753 C:\Qoobox\Quarantine\C\WINDOWS\system32\ahpnbwde.ini.vir 2007-09-30 05:00:26 A------- 640,873 C:\Qoobox\Quarantine\C\WINDOWS\system32\evubqvyy.ini.vir 2007-09-30 11:29:19 A------- 640,984 C:\Qoobox\Quarantine\C\WINDOWS\system32\rfoccuwj.ini.vir 2007-09-30 1512 A------- 641,233 C:\Qoobox\Quarantine\C\WINDOWS\system32\ydnbfjjr.ini.vir 2007-10-01 04:48:24 A------- 641,353 C:\Qoobox\Quarantine\C\WINDOWS\system32\dktayqrp.ini.vir 2007-10-01 07:07:01 A------- 636,591 C:\Qoobox\Quarantine\C\WINDOWS\system32\tfmeaxuu.ini.vir 2007-10-01 15:34:58 A------- 636,702 C:\Qoobox\Quarantine\C\WINDOWS\system32\rvnqpsya.ini.vir 2007-10-01 15:48:56 A------- 637,422 C:\Qoobox\Quarantine\C\WINDOWS\system32\pdxnssir.ini.vir 2007-10-02 11:11:43 A------- 637,662 C:\Qoobox\Quarantine\C\WINDOWS\system32\hxhjprlk.ini.vir 2007-10-02 15:47:11 A------- 637,782 C:\Qoobox\Quarantine\C\WINDOWS\system32\huchbvwr.ini.vir 2007-10-02 16:26:23 A------- 637,971 C:\Qoobox\Quarantine\C\WINDOWS\system32\xfqqbwbj.ini.vir 2007-10-03 04:47:48 A------- 638,142 C:\Qoobox\Quarantine\C\WINDOWS\system32\twbtgmhj.ini.vir 2007-10-03 05:42:34 A------- 638,211 C:\Qoobox\Quarantine\C\WINDOWS\system32\yytvusfg.ini.vir 2007-10-03 15:24:56 A------- 693,472 C:\Qoobox\Quarantine\C\WINDOWS\system32\ptviocug.ini.vir 2007-10-03 16:40:49 A------- 693,592 C:\Qoobox\Quarantine\C\WINDOWS\system32\hwcogfyh.ini.vir 2007-10-03 16:54:39 A------- 693,712 C:\Qoobox\Quarantine\C\WINDOWS\system32\cvakwipm.ini.vir 2007-10-03 19:30:43 A------- 694,021 C:\Qoobox\Quarantine\C\WINDOWS\system32\ghcuwlwr.ini.vir 2007-10-04 05:33:27 A------- 694,132 C:\Qoobox\Quarantine\C\WINDOWS\system32\ilqbfiwt.ini.vir 2007-10-04 15:54:29 A------- 694,252 C:\Qoobox\Quarantine\C\WINDOWS\system32\owqnmqpg.ini.vir 2007-10-04 16:48:20 A------- 694,390 C:\Qoobox\Quarantine\C\WINDOWS\system32\pfmanbrd.ini.vir 2007-10-05 05:13:02 A------- 694,519 C:\Qoobox\Quarantine\C\WINDOWS\system32\svhoifwj.ini.vir 2007-10-05 13:58:55 A------- 694,552 C:\Qoobox\Quarantine\C\WINDOWS\system32\eaxlplnb.ini.vir 2007-10-05 16:26:36 A------- 19,584 C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\megvtacw.dat.vir 2007-10-05 16:29:44 A------- 693,601 C:\Qoobox\Quarantine\C\WINDOWS\system32\mcgrqaaa.ini.vir 2007-10-06 04:30:09 A------- 693,781 C:\Qoobox\Quarantine\C\WINDOWS\system32\sswpryab.ini.vir 2007-10-06 16:32:51 A------- 693,532 C:\Qoobox\Quarantine\C\WINDOWS\system32\onkgntap.ini.vir 2007-10-06 18:24:13 A------- 693,661 C:\Qoobox\Quarantine\C\WINDOWS\system32\ndfgdmny.ini.vir 2007-10-06 19:34:05 A------- 693,781 C:\Qoobox\Quarantine\C\WINDOWS\system32\mwsojvbp.ini.vir 2007-10-07 05:35:27 A------- 693,901 C:\Qoobox\Quarantine\C\WINDOWS\system32\kbloffih.ini.vir 2007-10-07 15:58:32 A------- 694,012 C:\Qoobox\Quarantine\C\WINDOWS\system32\yuinbxvl.ini.vir 2007-10-08 04:28:34 A------- 694,072 C:\Qoobox\Quarantine\C\WINDOWS\system32\kfawedjr.ini.vir 2007-10-08 04:40:49 A------- 693,481 C:\Qoobox\Quarantine\C\WINDOWS\system32\osbsgkei.ini.vir 2007-10-08 12:43:02 A------- 693,601 C:\Qoobox\Quarantine\C\WINDOWS\system32\gaagmuav.ini.vir 2007-10-08 17:52:17 A------- 693,721 C:\Qoobox\Quarantine\C\WINDOWS\system32\cwvmgvfa.ini.vir 2007-10-08 19:39:09 A------- 693,841 C:\Qoobox\Quarantine\C\WINDOWS\system32\flhpakqu.ini.vir 2007-10-09 04:33:18 A------- 693,952 C:\Qoobox\Quarantine\C\WINDOWS\system32\lkyjoqci.ini.vir 2007-10-09 07:23:30 A------- 694,081 C:\Qoobox\Quarantine\C\WINDOWS\system32\cjfgpvas.ini.vir 2007-10-09 10:07:54 A------- 694,192 C:\Qoobox\Quarantine\C\WINDOWS\system32\btntbpsc.ini.vir 2007-10-09 12:47:56 A------- 694,312 C:\Qoobox\Quarantine\C\WINDOWS\system32\jdvtaybj.ini.vir 2007-10-09 13:21:10 A------- 694,501 C:\Qoobox\Quarantine\C\WINDOWS\system32\ktmasyqs.ini.vir 2007-10-09 15:33:08 A------- 694,612 C:\Qoobox\Quarantine\C\WINDOWS\system32\pokckpvv.ini.vir 2007-10-10 04:15:18 A------- 694,741 C:\Qoobox\Quarantine\C\WINDOWS\system32\rifdqcqh.ini.vir 2007-10-11 04:35:26 A------- 694,861 C:\Qoobox\Quarantine\C\WINDOWS\system32\pqcvdnaf.ini.vir 2007-10-11 14:36:29 A------- 694,981 C:\Qoobox\Quarantine\C\WINDOWS\system32\hxqksbld.ini.vir 2007-10-11 18:25:31 A------- 695,092 C:\Qoobox\Quarantine\C\WINDOWS\system32\byhilodc.ini.vir 2007-10-12 04:17:55 A------- 695,221 C:\Qoobox\Quarantine\C\WINDOWS\system32\wnqagpvm.ini.vir 2007-10-12 18:09:48 A------- 695,341 C:\Qoobox\Quarantine\C\WINDOWS\system32\hasqoiww.ini.vir 2007-10-23 15:02:15 A------- 693,532 C:\Qoobox\Quarantine\C\WINDOWS\system32\ejqpskkx.ini.vir 2007-10-23 17:22:54 A------- 693,592 C:\Qoobox\Quarantine\C\WINDOWS\system32\dklcxepi.ini.vir 2007-10-23 18:20:48 A------- 693,472 C:\Qoobox\Quarantine\C\WINDOWS\system32\lnajbhkb.ini.vir 2007-10-23 20:18:51 A------- 694,141 C:\Qoobox\Quarantine\C\WINDOWS\system32\jvsmknyg.ini.vir 2007-10-25 04:21:30 A------- 694,192 C:\Qoobox\Quarantine\C\WINDOWS\system32\ssohlmsf.ini.vir 2007-10-25 04:37:00 A------- 693,481 C:\Qoobox\Quarantine\C\WINDOWS\system32\iiuaujti.ini.vir 2007-10-25 15:14:27 A------- 693,601 C:\Qoobox\Quarantine\C\WINDOWS\system32\mtqjnfjs.ini.vir 2007-10-26 04:26:34 A------- 1,383,164 C:\Qoobox\Quarantine\C\WINDOWS\system32\dgwbqxot.ini.vir 2007-10-26 12:29:24 A------- 389,686 C:\Qoobox\Quarantine\C\WINDOWS\system32\ckhbyqxu.ini.vir 2007-10-27 04:38:36 A------- 389,806 C:\Qoobox\Quarantine\C\WINDOWS\system32\ccxbtjss.ini.vir 2007-10-27 07:02:15 A------- 389,926 C:\Qoobox\Quarantine\C\WINDOWS\system32\uyhmleso.ini.vir 2007-10-27 19:00:27 A------- 410,045 C:\Qoobox\Quarantine\C\WINDOWS\system32\qhwdjtvu.ini.vir 2007-10-28 05:38:23 A------- 408,538 C:\Qoobox\Quarantine\C\WINDOWS\system32\mkmqgkhr.ini.vir 2007-10-29 04:22:36 A------- 403,283 C:\Qoobox\Quarantine\C\WINDOWS\system32\mhtowqpl.ini.vir 2007-10-29 15:24:12 A------- 445,827 C:\Qoobox\Quarantine\C\WINDOWS\system32\lhhrylbe.ini.vir 2007-10-30 04:20:38 A------- 462,200 C:\Qoobox\Quarantine\C\WINDOWS\system32\ttutv.ini2.vir 2007-10-30 04:23:25 A------- 445,947 C:\Qoobox\Quarantine\C\WINDOWS\system32\wptkfcfb.ini.vir 2007-10-30 15:40:12 A------- 449,197 C:\Qoobox\Quarantine\C\WINDOWS\system32\bcwhpvka.ini.vir 2007-10-30 20:35:26 A------- 425,329 C:\Qoobox\Quarantine\C\WINDOWS\system32\mbeomupp.ini.vir 2007-10-31 04:43:13 A------- 424,763 C:\Qoobox\Quarantine\C\WINDOWS\system32\ppnbdtox.ini.vir 2008-11-07 12:46:35 A------- 570 C:\Qoobox\Quarantine\catchme.log 2008-11-07 12:50:49 A------- 6,626 C:\Qoobox\Quarantine\Registry_backups\tcpip.reg 2008-11-07 13:03:50 A------- 2 C:\Qoobox\Quarantine\Registry_backups\HKLM-Run-CFSServ.exe.reg.dat 2008-11-07 13:03:50 A------- 2 C:\Qoobox\Quarantine\Registry_backups\HKLM-Run-NDSTray.exe.reg.dat 2008-11-07 13:03:50 A------- 2 C:\Qoobox\Quarantine\Registry_backups\HKLM-Run-TFncKy.reg.dat 2008-11-07 13:04:00 A------- 512 C:\Qoobox\Quarantine\Registry_backups\Notify-efcbxvt.reg.dat 2008-11-07 13:04:00 A------- 570 C:\Qoobox\Quarantine\Registry_backups\Notify-awvvs.reg.dat 2008-11-07 13:04:00 A------- 570 C:\Qoobox\Quarantine\Registry_backups\Notify-ddayx.reg.dat 2008-11-07 13:04:00 A------- 570 C:\Qoobox\Quarantine\Registry_backups\Notify-gebyy.reg.dat 2008-11-07 13:04:00 A------- 570 C:\Qoobox\Quarantine\Registry_backups\Notify-mljji.reg.dat 2008-11-07 13:04:00 A------- 570 C:\Qoobox\Quarantine\Registry_backups\Notify-vtsts.reg.dat 2008-11-07 13:04:00 A------- 570 C:\Qoobox\Quarantine\Registry_backups\Notify-vtutt.reg.dat 2008-11-07 13:04:00 A------- 572 C:\Qoobox\Quarantine\Registry_backups\Notify-disknet.reg.dat 2008-11-13 09:18:20 A------- 95,661 C:\Qoobox\Quarantine\[4]-Submit_2008-11-13@9.18.zip 2008-11-13 09:18:35 A------- 9,675 C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\_megvtacw_.dat.zip 2008-11-13 09:18:37 A------- 583 C:\Qoobox\Quarantine\C\WINDOWS\system32\_dsoun_.dll.zip 2008-11-13 09:19:52 A------- 1,390 C:\Qoobox\Quarantine\Registry_backups\Legacy_EDPWOFVK.reg.dat 2008-11-13 09:19:52 A------- 7,096 C:\Qoobox\Quarantine\Registry_backups\Service_edpwofvk.reg.dat 2008-11-13 09:26:31 A------- 376 C:\Qoobox\Quarantine\Registry_backups\BHO-{10708868-CEF5-49E5-A211-A8339B8F7188}.reg.dat

11-13-2008, 01:49 PM	#12 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,254 OS: 2000 Pro; XP Pro; XP Home	Re: Downloader.Delf.12.AN File not found?? C:\Qoobox\Quarantine\[4]-Submit_2008-11-13@9.18.zip is in the quarantined files.txt log Did you paste that exact file name into the box? Have a look and see if it's present at the above location. Do not open it, just let me know. Or, use the Browse button on the upload page, instead of copy/pasting the file path. It's possible that AVG jumped it now that it's unhooked. __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009 Last edited by tetonbob; 11-13-2008 at 01:51 PM.

11-13-2008, 02:48 PM	#14 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,254 OS: 2000 Pro; XP Pro; XP Home	Re: Downloader.Delf.12.AN OK, thanks. See if these two will upload, they are the files I'm interested in uploading C:\Qoobox\Quarantine\C\WINDOWS\system32\_dsoun_.dll.zip C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\_megvtacw_.dat.zip You'll have to do one per attempt at the same site. If still no joy, I'll thank you for trying, and ask that you carry on. __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009

11-13-2008, 05:02 PM	#16 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,254 OS: 2000 Pro; XP Pro; XP Home	Re: Downloader.Delf.12.AN Yes, please do carry on. __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009

11-13-2008, 07:46 PM	#17 (permalink)
paul.hunt Registered User Join Date: Nov 2008 Posts: 14 OS: Windows XP Home SP2	Re: Downloader.Delf.12.AN -------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER 7 REPORT Thursday, November 13, 2008 Operating System: Microsoft Windows XP Home Edition Service Pack 2 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Thursday, November 13, 2008 18:50:55 Records in database: 1383528 -------------------------------------------------------------------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: C:\ D:\ Scan statistics: Files scanned: 48864 Threat name: 5 Infected objects: 8 Suspicious objects: 2 Duration of the scan: 00:53:12 File name / Threat name / Threats count C:\Documents and Settings\Ben\Application Data\Sun\Java\Deployment\cache\6.0\14\467e7c0e-1a036d7b Infected: Trojan-Downloader.Java.Agent.f 1 C:\Documents and Settings\Ben\Application Data\Sun\Java\Deployment\cache\6.0\45\30b71c2d-782ff8bb Infected: Trojan-Downloader.Java.Agent.f 1 C:\Documents and Settings\Ben\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmsecman.jar-69ee0e0e-452a431a.zip Infected: Trojan-Downloader.Java.Agent.f 1 C:\Documents and Settings\Ben\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmsecman.jar-6b26dca8-6b00924f.zip Infected: Trojan-Downloader.Java.Agent.f 1 C:\Documents and Settings\Ben\Local Settings\Application Data\Identities\{A54E442D-9A28-4C94-9ACC-E76D7B307E52}\Microsoft\Outlook Express\Deleted Items.dbx Suspicious: Trojan-Spy.HTML.Fraud.gen 1 C:\Documents and Settings\Ben\Local Settings\Application Data\Identities\{A54E442D-9A28-4C94-9ACC-E76D7B307E52}\Microsoft\Outlook Express\Inbox.dbx Suspicious: Trojan-Spy.HTML.Fraud.gen 1 C:\Program Files\SpyNoMore\SNM.exe Infected: not-a-virus:FraudTool.Win32.SpyNoMore.e 1 C:\RECYCLER\S-1-5-21-23880383-3852450314-236532993-1008\Dc8.exe Infected: not-a-virus:FraudTool.Win32.SpyNoMore.e 1 C:\WINDOWS\system32\drivers\ejibrwms.sys Infected: Trojan.Win32.BHO.gy 1 C:\WINDOWS\system32\drivers\megvtacw.sys Infected: Rootkit.Win32.Agent.iy 1 The selected area was scanned.

11-14-2008, 09:51 AM	#20 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,254 OS: 2000 Pro; XP Pro; XP Home	Re: Downloader.Delf.12.AN Great, thanks for uploading the file. Kaspersky also identified suspicious mails in Outlook Express Inbox and Deleted items. Unfortunately, it does not give the specific mail item. You may want to empty the Deleted Items box, and review carefully the Inbox, and delete anything suspicious without clicking on any links, or opening any attachments. Other than that, your logs appear clean.You should be good to go. We still have a few items to address. Go to -> Run -> copy/paste in the following single line command & click OK combofix /u This will uninstall ComboFix. It will also implement some cleanup procedures and reset System Restore points. I noticed that your version of Spybot Search & Destroy is quite outdated at version 1.4. Spybot S&D is now at version 1.6 You should update versions. As it's not current, it won't offer you the same level of protection as a current version would. http://www.spybot.com/en/spybotsd/index.html http://www.spybot.com/en/faq/56.html Now that your system is clean, to help protect your computer in the future I recommend that you follow these steps and look into the following free programs: Microsoft Windows Update - http://www.windowsupdate.com Visit regularly. This will ensure your computer always has the latest security updates. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates. SpywareBlaster to help prevent spyware from installing in the first place. Install & update SpywareBlaster with the latest definitions. After you have updated, click the button - enable protection for all unprotected items Winpatrol Winpatrol is heuristic protection program, meaning it looks for patterns in codes that work like malware. It also takes a snapshot of your system's critical resources and alerts you to any changes that may occur without you knowing. You can read more about Winpatrol's features here. You can get a free copy of Winpatrol or use the Plus version for more features. You can read Winpatrol's FAQ if you run into problems. MVPS HOST FILE The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites form serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer. Download Host.zip to your desktop. From your Desktop right-click (hosts.zip) and select: Extract All from the menu. Click Next, click Next, select the option: "Show Extracted files", click Finish This will open the newly created hosts folder on your Desktop. Double-click on the included mvps.bat file, this will rename the existing HOSTS file to HOSTS.MVP, then it will copy the included updated HOSTS file to the correct location on your machine. Once updated you should see another prompt that the task was completed. ANTIVIRUS SOFTWARE It is very important that you have anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future. It is imperative that you update your antivirus software at least once a week (even more if you wish). If you do not update your antivirus software then it will not be able to catch new malware that may have come out. Do not install more than one AntiVirus program because they will conflict with each other. FIREWALL Using a third-party firewall will allow you to give/deny access for applications that want to go online. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. A tutorial on Firewalls and a listing of some available ones can be found here Do not install more than one firewall program because they will conflict with each other. Scan here http://secunia.com/software_inspector/ for out of date & vulnerable common applications on your computer Here are some additional utilities that will further enhance your safety. http://www.trillian.cc ? Trillian or http://www.miranda-im.com ? Miranda-IM - These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN) http://www.aumha.org/downloads/erunt-setup.exe - ERUNT - A useful freeware utility for users of Windows 2000/XP//Vista. It's made up of two parts - ERUNT & NTREGOPT. ERUNT will create daily complete backups of your computer's Registry. Whilst System Restore does the same thing, a corrupt registry file may prevent Windows from booting & this effectively renders disables System Restore. With ERUNT, you're able to restore the damaged Registry. NTREGOPT works by recreating each registry hive "from scratch", thus removing any slack space that may be left from previously modified or deleted keys. In other words, it compacts the Registry to a small size which allows Windows to load & perform faster. In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles HOW DID I GET INFECTED IN THE FIRST PLACE? MAKING INTERNET EXPLORER SAFER If you want to fight back the Malware Writers that have made your life a misery, please take a look here and read what you can do against it. Please respond to this thread one more time so we can mark this thread as resolved. __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009