Small spyware problem, worsening

bonsung · 07-09-2009, 10:29 PM

Hi, so I have this spyware virus that has been affecting my computer. My computer is a lot slower than usual, and also, google always redirects me to other sites. This virus is worsening and I need some help. Thank you. I'm not sure if I am supposed to post the GMER log or attach the file, but I decided to attach it. I was also told to use the RSIT instead of DDS because DDS didn't work for me. I'm not exactly sure if I'm doing this right too because DDS gives me 3 logs, but RSIT gives me 2. Please tell me if I did something wrong. Thanks. Attached is info.txt minimized and GMER log.

Here is the log for RSIT called log.txt maxamized:

Logfile of random's system information tool 1.06 (written by random/random)
Run by xadmin at 2009-07-09 20:23:33
Microsoft Windows XP Professional Service Pack 3
System drive C: has 21 GB (56%) free of 38 GB
Total RAM: 1006 MB (49% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:23:56 PM, on 7/9/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\S24EvMon.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\ZCfgSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\1XConfig.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\FixCamera.exe
C:\WINDOWS\tsnpstd3.exe
C:\WINDOWS\vsnpstd3.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\DOCUME~1\xadmin\LOCALS~1\Temp\ycbaq2.exe
C:\DOCUME~1\xadmin\LOCALS~1\Temp\ycbaq2.exe
C:\DOCUME~1\xadmin\LOCALS~1\Temp\system.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpohmr08.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\HP\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINDOWS\system32\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\HP\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\HP\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\HP\Digital Imaging\Bin\hpqSTE08.exe
C:\DOCUME~1\xadmin\LOCALS~1\Temp\ycbaq2.exe
C:\DOCUME~1\xadmin\LOCALS~1\Temp\lsass.exe
C:\DOCUME~1\xadmin\LOCALS~1\Temp\svchost.exe
C:\DOCUME~1\xadmin\LOCALS~1\Temp\spoolsv.exe
C:\DOCUME~1\xadmin\LOCALS~1\Temp\login.exe
C:\DOCUME~1\xadmin\LOCALS~1\Temp\notepad.exe
C:\DOCUME~1\xadmin\LOCALS~1\Temp\taskmgr.exe
C:\DOCUME~1\xadmin\LOCALS~1\Temp\setup.exe
C:\DOCUME~1\xadmin\LOCALS~1\Temp\mdm.exe
C:\DOCUME~1\xadmin\LOCALS~1\Temp\win.exe
C:\DOCUME~1\xadmin\LOCALS~1\Temp\install.exe
C:\DOCUME~1\xadmin\LOCALS~1\Temp\csrss.exe
C:\DOCUME~1\xadmin\LOCALS~1\Temp\winamp.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\xadmin\Desktop\RSIT.exe
C:\Program Files\trend micro\xadmin.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: C:\WINDOWS\system32\gsf83iujid.dll - {D76AB2A1-00F3-42BD-F434-00BBC39C8953} - C:\WINDOWS\system32\gsf83iujid.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [ZCfgSvc.exe] C:\WINDOWS\system32\ZCfgSvc.exe
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [FixCamera] C:\WINDOWS\FixCamera.exe
O4 - HKLM\..\Run: [tsnpstd3] C:\WINDOWS\tsnpstd3.exe
O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AdobeUpdater] "C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe"
O4 - HKCU\..\Run: [] C:\DOCUME~1\xadmin\LOCALS~1\Temp\ycbaq2.exe
O4 - HKCU\..\Run: [hsf7husjnfg98gi498aejhiugjkdg4] C:\DOCUME~1\xadmin\LOCALS~1\Temp\ycbaq2.exe
O4 - HKCU\..\Run: [Windows System Recover!] C:\DOCUME~1\xadmin\LOCALS~1\Temp\system.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {230C3D02-DA27-11D2-8612-00A0C93EEA3C} (SAXFile FileUpload ActiveX Control) - http://www.winkflash.com/photo/loaders/SAXFile.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.costcophotocenter.com/CostcoActivia.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/...toUploader.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1165821353333
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O22 - SharedTaskScheduler: rtasgvfu76ew8ndkfno94 - {D76AB2A1-00F3-42BD-F434-00BBC39C8953} - C:\WINDOWS\system32\gsf83iujid.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\system32\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\system32\S24EvMon.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--
End of file - 8907 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\FRU Task #Hewlett-Packard#hp psc 1200 series#1193638819.job
C:\WINDOWS\tasks\User_Feed_Synchronization-{8E76F419-D211-429D-96C6-7F178DB46BBE}.job
C:\WINDOWS\tasks\WGASetup.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D76AB2A1-00F3-42BD-F434-00BBC39C8953}]
C:\WINDOWS\system32\gsf83iujid.dll - C:\WINDOWS\system32\gsf83iujid.dll [2009-06-29 15000]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"=C:\WINDOWS\system32\igfxtray.exe [2005-09-20 94208]
"igfxhkcmd"=C:\WINDOWS\system32\hkcmd.exe [2005-09-20 77824]
"igfxpers"=C:\WINDOWS\system32\igfxpers.exe [2005-09-20 114688]
"ZCfgSvc.exe"=C:\WINDOWS\system32\ZCfgSvc.exe [2005-07-05 639040]
"PRONoMgr.exe"=C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe [2005-06-27 135168]
"DAEMON Tools"=C:\Program Files\DAEMON Tools\daemon.exe [2006-11-12 157592]
"ccApp"=C:\Program Files\Common Files\Symantec Shared\ccApp.exe [2006-07-19 52896]
"vptray"=C:\PROGRA~1\SYMANT~1\VPTray.exe [2006-09-27 125168]
"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]
"HP Software Update"=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2006-02-19 49152]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2007-06-29 286720]
"FixCamera"=C:\WINDOWS\FixCamera.exe [2007-02-10 20480]
"tsnpstd3"=C:\WINDOWS\tsnpstd3.exe [2007-03-10 270336]
"snpstd3"=C:\WINDOWS\vsnpstd3.exe [2006-09-19 827392]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-03-09 148888]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]
"AdobeUpdater"=C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe [2009-01-24 2356088]
""=C:\DOCUME~1\xadmin\LOCALS~1\Temp\ycbaq2.exe [2009-06-29 15001]
"hsf7husjnfg98gi498aejhiugjkdg4"=C:\DOCUME~1\xadmin\LOCALS~1\Temp\ycbaq2.exe [2009-06-29 15001]
"Windows System Recover!"=C:\DOCUME~1\xadmin\LOCALS~1\Temp\system.exe [2009-07-08 23557]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
hp psc 1000 series.lnk - C:\Program Files\HP\Digital Imaging\bin\hpohmr08.exe
hpoddt01.exe.lnk - C:\Program Files\HP\Digital Imaging\bin\hpotdd01.exe
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE
WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2005-09-20 135168]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]
C:\WINDOWS\system32\NavLogon.dll [2006-09-27 43760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Sebring]
C:\WINDOWS\system32\LgNotify.dll [2005-07-05 188482]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2008-09-06 241704]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\SharedTaskScheduler]
rtasgvfu76ew8ndkfno94 - {D76AB2A1-00F3-42BD-F434-00BBC39C8953} - C:\WINDOWS\system32\gsf83iujid.dll [2009-06-29 15000]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableRegistryTools"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0
"NoFolderOptions"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Common Files\AOL\Loader\aolload.exe"="C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Loader"
"C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe"="C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe"="C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"
"C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe"="C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"
"C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe"="C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe:*:Enabled:hpqnrs08.exe"
"C:\Program Files\AIM\aim.exe"="C:\Program Files\AIM\aim.exe:*:Enabled:AOL Instant Messenger"
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\Program Files\AIM6\aolsoftware.exe"="C:\Program Files\AIM6\aolsoftware.exe:*:Enabled:aolsoftware"
"C:\Program Files\Tencent\QQ Games\QQGames.exe"="C:\Program Files\Tencent\QQ Games\QQGames.exe:*:Enabled:QQ Games"
"C:\Program Files\Tencent\QQ Games\QQGamesD.exe"="C:\Program Files\Tencent\QQ Games\QQGamesD.exe:*:Enabled:QQ Games Downloader"
"C:\Program Files\Tencent\QQ Games\Update\Update.exe"="C:\Program Files\Tencent\QQ Games\Update\Update.exe:*:Enabled:QQ Games Updater"
"C:\Program Files\AIM6\aim6.exe"="C:\Program Files\AIM6\aim6.exe:*:Enabled:AIM"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0b7de210-bdab-11dd-a274-000cf15e9d2f}]
shell\AutoRun\command - E:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{66b1eec3-c4ce-11dd-a27e-000f1fb17570}]
shell\AutoRun\command - E:\LaunchU3.exe -a

======List of files/folders created in the last 1 months======

2009-07-09 20:23:33 ----D---- C:\rsit
2009-07-09 20:23:33 ----D---- C:\Program Files\trend micro
2009-07-03 12:12:51 ----A---- C:\WINDOWS\system32\33423487864511245187327687786451786451786451.exe
2009-07-03 12:12:50 ----A---- C:\WINDOWS\system32\32768127864511245187327687786451786451786451.exe
2009-07-03 12:12:42 ----A---- C:\WINDOWS\system32\27525247864511245187327687786451786451786451.exe
2009-06-29 18:33:31 ----A---- C:\WINDOWS\system32\2031649216268965566131078216268921626892162689.exe
2009-06-29 18:33:30 ----A---- C:\WINDOWS\system32\1966113216268965566131078216268921626892162689.exe
2009-06-29 18:33:28 ----SHD---- C:\WINDOWS\System Volume Information
2009-06-29 18:33:27 ----A---- C:\fwgl.exe
2009-06-29 18:33:20 ----A---- C:\WINDOWS\system32\gsf83iujid.dll
2009-06-29 18:32:29 ----A---- C:\WINDOWS\system32\wmmest.dll
2009-06-29 18:25:22 ----A---- C:\WINDOWS\expmodule.exe
2009-06-26 21:34:51 ----D---- C:\WINDOWS\ie8updates
2009-06-26 21:30:18 ----HDC---- C:\WINDOWS\ie8
2009-06-25 21:14:00 ----SHD---- C:\RECYCLER
2009-06-25 18:22:46 ----A---- C:\WINDOWS\system32\javaws.exe
2009-06-25 18:22:46 ----A---- C:\WINDOWS\system32\javaw.exe
2009-06-25 18:22:46 ----A---- C:\WINDOWS\system32\java.exe
2009-06-24 21:16:49 ----A---- C:\ComboFix.txt
2009-06-24 21:14:27 ----A---- C:\WINDOWS\system32\proquota.exe
2009-06-14 15:22:39 ----SD---- C:\ComboFix
2009-06-10 17:37:06 ----HDC---- C:\WINDOWS\$NtUninstallKB961501$
2009-06-10 17:36:43 ----HDC---- C:\WINDOWS\$NtUninstallKB969898$
2009-06-10 17:33:56 ----HDC---- C:\WINDOWS\$NtUninstallKB970238$
2009-06-10 17:32:32 ----HDC---- C:\WINDOWS\$NtUninstallKB968537$

======List of files/folders modified in the last 1 months======

2009-07-09 20:23:33 ----D---- C:\Program Files
2009-07-09 19:37:47 ----D---- C:\WINDOWS\temp
2009-07-09 19:37:36 ----D---- C:\WINDOWS
2009-07-09 00:14:43 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-07-08 23:00:34 ----SHD---- C:\WINDOWS\Installer
2009-07-08 22:56:25 ----HD---- C:\Config.Msi
2009-07-08 19:27:08 ----D---- C:\WINDOWS\system32\CatRoot2
2009-07-05 18:57:25 ----D---- C:\Program Files\Mozilla Firefox
2009-07-04 11:01:08 ----SHD---- C:\System Volume Information
2009-07-04 11:01:08 ----D---- C:\WINDOWS\system32\Restore
2009-07-03 12:13:17 ----D---- C:\WINDOWS\Prefetch
2009-07-03 12:12:51 ----D---- C:\WINDOWS\system32
2009-06-29 18:33:33 ----HD---- C:\WINDOWS\$hf_mig$
2009-06-26 21:45:44 ----SD---- C:\WINDOWS\Tasks
2009-06-26 21:39:17 ----HD---- C:\WINDOWS\inf
2009-06-26 21:38:33 ----D---- C:\WINDOWS\system32\en-US
2009-06-26 21:38:29 ----D---- C:\WINDOWS\Media
2009-06-26 21:38:28 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-06-26 21:38:28 ----D---- C:\WINDOWS\Help
2009-06-26 21:38:28 ----D---- C:\Program Files\Internet Explorer
2009-06-26 21:35:10 ----A---- C:\WINDOWS\imsins.BAK
2009-06-25 18:22:44 ----D---- C:\Program Files\Java
2009-06-24 21:15:19 ----A---- C:\WINDOWS\system.ini
2009-06-24 21:12:51 ----D---- C:\WINDOWS\system32\drivers
2009-06-24 21:12:51 ----D---- C:\WINDOWS\AppPatch
2009-06-24 21:12:42 ----D---- C:\Program Files\Common Files
2009-06-24 21:09:10 ----D---- C:\WINDOWS\system32\wbem
2009-06-24 20:47:09 ----D---- C:\WINDOWS\ERDNT
2009-06-14 15:24:35 ----D---- C:\Program Files\Starcraft
2009-06-13 19:56:34 ----A---- C:\WINDOWS\NeroDigital.ini
2009-06-13 10:35:46 ----D---- C:\Program Files\AIMTunes

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AFS2K;AFS2k; C:\WINDOWS\system32\drivers\AFS2K.sys [2004-10-07 35840]
R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys []
R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 36352]
R1 SAVRT;SAVRT; \??\C:\Program Files\Symantec AntiVirus\savrt.sys []
R1 SAVRTPEL;SAVRTPEL; \??\C:\Program Files\Symantec AntiVirus\Savrtpel.sys []
R1 SYMTDI;SYMTDI; C:\WINDOWS\System32\Drivers\SYMTDI.SYS [2006-08-07 195776]
R1 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2004-08-12 12032]
R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.2.0.3; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2006-12-11 17801]
R2 mdmxsdk;mdmxsdk; C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys [2004-03-17 13059]
R2 s24trans;WLAN Transport; C:\WINDOWS\system32\DRIVERS\s24trans.sys [2005-06-17 10970]
R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 bcm4sbxp;Broadcom 440x 10/100 Integrated Controller XP Driver; C:\WINDOWS\system32\DRIVERS\bcm4sbxp.sys [2004-05-26 44928]
R3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2008-04-13 13952]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys []
R3 HSF_DPV;HSF_DPV; C:\WINDOWS\system32\DRIVERS\HSF_DPV.SYS [2005-05-03 1033728]
R3 HSFHWICH;HSFHWICH; C:\WINDOWS\system32\DRIVERS\HSFHWICH.sys [2005-05-03 208384]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\ialmnt5.sys [2005-09-20 1302332]
R3 NAVENG;NAVENG; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20090102.006\naveng.sys []
R3 NAVEX15;NAVEX15; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20090102.006\navex15.sys []
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 pcouffin;VSO Software pcouffin; C:\WINDOWS\System32\Drivers\pcouffin.sys [2009-01-19 47360]
R3 STAC97;Audio Driver (WDM) - SigmaTel CODEC; C:\WINDOWS\system32\drivers\stac97.sys [2004-11-15 264440]
R3 SymEvent;SymEvent; \??\C:\Program Files\Symantec\SYMEVENT.SYS []
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Microsoft USB Standard Hub Driver; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 w70n51;Intel(R) PRO/Wireless 7100 Adapter Driver for Windows XP; C:\WINDOWS\system32\DRIVERS\w70n51.sys [2005-07-26 662400]
R3 winachsf;winachsf; C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys [2005-05-03 705408]
S3 a9qihmrf;a9qihmrf; C:\WINDOWS\system32\drivers\a9qihmrf.sys []
S3 catchme;catchme; \??\C:\DOCUME~1\xadmin\LOCALS~1\Temp\catchme.sys []
S3 CCDECODE;Closed Caption Decoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 EraserUtilDrvI7;EraserUtilDrvI7; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilDrvI7.sys []
S3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2006-01-31 49664]
S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2006-01-31 16496]
S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2006-01-31 21568]
S3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NAL;Nal Service ; \??\C:\WINDOWS\system32\Drivers\iqvw32.sys []
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 SNPSTD3;USB PC Camera (SNPSTD3); C:\WINDOWS\system32\DRIVERS\snpstd3.sys [2007-03-26 10252544]
S3 SPBBCDrv;SPBBCDrv; \??\C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys []
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 SYMREDRV;SYMREDRV; C:\WINDOWS\System32\Drivers\SYMREDRV.SYS [2006-08-07 24768]
S3 tifm;tifm; C:\WINDOWS\system32\drivers\tifm.sys [2006-07-21 55808]
S3 usbaudio;USB Audio Driver (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-13 60032]
S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WSTCODEC;World Standard Teletext Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 sr;System Restore Filter Driver; C:\WINDOWS\system32\DRIVERS\sr.sys [2008-04-13 73472]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ccSetMgr;Symantec Settings Manager; C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe [2006-07-19 169632]
R2 DefWatch;Symantec AntiVirus Definition Watcher; C:\Program Files\Symantec AntiVirus\DefWatch.exe [2006-09-27 31472]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-03-09 152984]
R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-20 322120]
R2 RegSrvc;RegSrvc; C:\WINDOWS\system32\RegSrvc.exe [2005-07-05 122880]
R2 S24EventMonitor;Spectrum24 Event Monitor; C:\WINDOWS\system32\S24EvMon.exe [2005-07-05 421955]
R2 Viewpoint Manager Service;Viewpoint Manager Service; C:\Program Files\Viewpoint\Common\ViewpointService.exe [2007-01-04 24652]
S2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2005-11-22 69632]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 ccEvtMgr;Symantec Event Manager; C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe [2006-07-19 192160]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 LiveUpdate;LiveUpdate; C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE [2006-08-25 2528960]
S3 NetSvc;Intel NCS NetService; C:\Program Files\Intel\NCS\Sync\NetSvc.exe [2003-04-29 139264]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 SavRoam;SAVRoam; C:\Program Files\Symantec AntiVirus\SavRoam.exe [2006-09-27 116464]
S3 SNDSrvc;Symantec Network Drivers Service; C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe [2006-08-07 214720]
S3 SPBBCSvc;Symantec SPBBCSvc; C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe [2006-04-11 1160848]
S3 Symantec AntiVirus;Symantec AntiVirus; C:\Program Files\Symantec AntiVirus\Rtvscan.exe [2006-09-27 1813232]
S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

**TheBruce1** · 07-12-2009, 09:28 AM

Hello and welcome to TSF

Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe.

========

Please follow all instructions and in which order they come, if you have any questions, please ask before proceeding. Its important that you follow this through until i give you the all clear.

Please DO NOT Attach logs to your posts unless you are advised to do so.

==========

Download ComboFix from one of these locations:

Link 1
Link 2
Link 3

* IMPORTANT !!! Place combofix.exe on your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.

Double click on combofix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed.

Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

The Windows recovery console will allow you to boot up into a special recovery mode that allows us to help you in the case that your computer has a problem after an attempted removal of malware.

With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal.

Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement.

ComboFix will now automatically install the Microsoft Windows Recovery Console onto your computer, which will show up as a new option when booting up your computer. Do not select the Microsoft Windows Recovery Console option when you start your computer unless requested to by a helper.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see a message that says:

The Recovery Console was successfully installed.

Click on Yes, to continue scanning for malware.

Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.

When finished, it shall produce a log for you. Post that log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

Please note that the forum is very busy and if I don't hear from you within three days this thread will be closed.

bonsung · 07-12-2009, 01:10 PM

Hey, so I tried to download Combo-Fix, but I can't for some reason. The 1st and 3rd link says when I click on it, page not found. The 2nd directs me to a virus forum site in Spanish. I was expecting a pop-up, but there isn't one. What shall I do? Thanks.

**TheBruce1** · 07-12-2009, 02:51 PM

Hello again

Quote:

The 1st and 3rd link says when I click on it, page not found. The 2nd directs me to a virus forum site in Spanish. I was expecting a pop-up, but there isn't one. What shall I do? Thanks.

Combofix was withdrawn, it has been restored and the links are now working.

bonsung · 07-12-2009, 04:53 PM

Hello, so I've run Combo-Fix and here is the log. Also, thank you very much for helping me.

Combo Fix log:

ComboFix 09-07-12.01 - xadmin 07/12/2009 15:28.9.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1006.519 [GMT -7:00]
Running from: c:\documents and settings\xadmin\Desktop\ComboFix.exe
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\xadmin\LOCALS~1\Temp\csrss.exe
c:\docume~1\xadmin\LOCALS~1\Temp\lsass.exe
c:\docume~1\xadmin\LOCALS~1\Temp\services.exe
c:\docume~1\xadmin\LOCALS~1\Temp\svchost.exe
c:\docume~1\xadmin\LOCALS~1\Temp\taskmgr.exe
c:\docume~1\xadmin\LOCALS~1\Temp\winlogon.exe
C:\fwgl.exe
c:\windows\expmodule.exe
c:\windows\Installer\1bb19.msi
c:\windows\system32\1966113216268965566131078216268921626892162689.exe
c:\windows\system32\2031649216268965566131078216268921626892162689.exe
c:\windows\system32\27525247864511245187327687786451786451786451.exe
c:\windows\system32\32768127864511245187327687786451786451786451.exe
c:\windows\system32\33423487864511245187327687786451786451786451.exe
c:\windows\system32\gsf83iujid.dll

Infected copy of c:\windows\system32\userinit.exe was found and disinfected
Restored copy from - c:\windows\ServicePackFiles\i386\userinit.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226ED}
-------\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226EE}

((((((((((((((((((((((((( Files Created from 2009-06-12 to 2009-07-12 )))))))))))))))))))))))))))))))
.

2009-07-10 03:23 . 2009-07-10 03:23 -------- d-----w- C:\rsit
2009-07-10 03:23 . 2009-07-10 03:23 -------- d-----w- c:\program files\trend micro
2009-06-30 01:33 . 2009-06-30 01:33 -------- d-sh--w- c:\windows\System Volume Information
2009-06-30 01:32 . 2009-07-11 17:06 13826 ----a-w- c:\windows\system32\wmmest.dll
2009-06-27 05:57 . 2009-06-27 05:57 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2009-06-27 04:45 . 2009-06-27 04:45 -------- d-sh--w- c:\documents and settings\xadmin\IECompatCache
2009-06-27 04:42 . 2009-06-27 04:42 -------- d-sh--w- c:\documents and settings\xadmin\PrivacIE
2009-06-27 04:40 . 2009-06-27 04:40 -------- d-sh--w- c:\documents and settings\xadmin\IETldCache
2009-06-27 04:34 . 2009-06-27 04:34 -------- d-----w- c:\windows\ie8updates
2009-06-27 04:30 . 2009-06-27 04:32 -------- dc-h--w- c:\windows\ie8
2009-06-27 04:28 . 2009-06-02 10:12 102912 -c----w- c:\windows\system32\dllcache\iecompat.dll
2009-06-27 04:28 . 2009-04-30 21:22 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2009-06-27 04:28 . 2009-04-30 21:22 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2009-06-26 01:21 . 2009-06-26 01:21 152576 ----a-w- c:\documents and settings\xadmin\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-06-25 04:14 . 2008-04-14 00:12 50176 -c--a-w- c:\windows\system32\dllcache\proquota.exe
2009-06-25 04:14 . 2008-04-14 00:12 50176 ----a-w- c:\windows\system32\proquota.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-26 01:22 . 2009-01-14 01:31 -------- d-----w- c:\program files\Java
2009-06-26 00:55 . 2006-12-15 04:24 64432 ----a-w- c:\documents and settings\xadmin\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-14 22:24 . 2008-08-03 01:51 -------- d-----w- c:\program files\Starcraft
2009-06-13 17:35 . 2009-05-30 03:24 -------- d-----w- c:\program files\AIMTunes
2009-05-30 03:26 . 2009-05-30 03:21 -------- d-----w- c:\program files\AIM6
2009-05-30 03:25 . 2009-04-14 04:20 -------- d-----w- c:\documents and settings\All Users\Application Data\Tencent
2009-05-30 03:25 . 2009-04-14 04:19 5946704 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\aimqqgames\QQSetup65.exe
2009-05-30 03:24 . 2009-04-14 04:18 1144808 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\aimtunes\AIMTunes.exe
2009-05-30 03:13 . 2009-05-30 03:13 169 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.1\setup.exe
2009-05-30 03:13 . 2009-05-30 03:13 1178096 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.1\AIMinst.exe
2009-05-30 03:13 . 2009-05-30 03:13 15920 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.1\ocpchk.dll
2009-05-30 03:13 . 2009-05-30 03:12 579248 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.1\muinst.exe
2009-05-30 03:12 . 2009-05-30 03:12 46640 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.1\chckampx.dll
2009-05-30 03:12 . 2009-05-30 03:12 409640 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.1\vwpt.exe
2009-05-30 03:12 . 2009-05-30 03:12 87600 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.1\AOLFirewallMgr.dll
2009-05-30 03:12 . 2009-05-30 03:11 560784 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.1\AIMLang.exe
2009-05-30 03:12 . 2009-05-30 03:11 228912 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.1\migrator.exe
2009-05-30 03:12 . 2009-05-30 03:11 94256 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.1\instph.dll
2009-05-30 03:10 . 2006-12-20 18:40 -------- d-----w- c:\documents and settings\All Users\Application Data\AOL Downloads
2009-05-30 03:10 . 2009-05-30 03:10 168872 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\TRITON_CA_2.2.19.1\stmninst.exe
2009-05-30 03:09 . 2009-05-30 03:09 100432 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\TRITON_CA_2.2.19.1\aod.exe
2009-05-30 03:09 . 2009-05-30 03:09 44448 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\TRITON_CA_2.2.19.1\instopts.exe
2009-05-30 03:09 . 2009-05-30 03:09 13904 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\TRITON_CA_2.2.19.1\imappver.dll
2009-05-30 03:09 . 2009-05-30 03:09 601152 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\TRITON_CA_2.2.19.1\ampx.exe
2009-05-30 03:09 . 2009-05-30 03:09 80976 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\TRITON_CA_2.2.19.1\ProgUpd.dll
2009-05-30 03:09 . 2009-05-30 03:09 81176 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\TRITON_CA_2.2.19.1\alsetup.exe
2009-05-23 03:13 . 2009-05-23 03:13 -------- d-----w- c:\program files\Common Files\Software Update Utility
2009-05-23 03:11 . 2009-05-23 03:11 -------- d-----w- c:\documents and settings\All Users\Application Data\AIM
2009-05-23 03:10 . 2006-12-20 18:46 -------- d-----w- c:\documents and settings\All Users\Application Data\AOL
2009-05-13 05:15 . 2004-08-12 13:33 915456 ----a-w- c:\windows\system32\wininet.dll
2009-05-07 15:32 . 2004-08-12 13:21 345600 ----a-w- c:\windows\system32\localspl.dll
2009-04-17 12:26 . 2004-08-12 13:33 1847168 ----a-w- c:\windows\system32\win32k.sys
2009-04-15 14:51 . 2004-08-12 13:27 585216 ----a-w- c:\windows\system32\rpcrt4.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"AdobeUpdater"="c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2009-01-25 2356088]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
"ZCfgSvc.exe"="c:\windows\system32\ZCfgSvc.exe" [2005-07-05 639040]
"PRONoMgr.exe"="c:\program files\Intel\NCS\PROSet\PRONoMgr.exe" [2005-06-27 135168]
"DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2006-11-12 157592]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2006-07-20 52896]
"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2006-09-28 125168]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-06-29 286720]
"FixCamera"="c:\windows\FixCamera.exe" [2007-02-10 20480]
"tsnpstd3"="c:\windows\tsnpstd3.exe" [2007-03-10 270336]
"snpstd3"="c:\windows\vsnpstd3.exe" [2006-09-19 827392]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]
hp psc 1000 series.lnk - c:\program files\HP\Digital Imaging\bin\hpohmr08.exe [2002-12-2 147456]
hpoddt01.exe.lnk - c:\program files\HP\Digital Imaging\bin\hpotdd01.exe [2002-12-2 40960]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2006-12-16 118784]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSetActiveDesktop"= 1 (0x1)
"NoActiveDesktopChanges"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Sebring]
2005-07-05 09:33 188482 ----a-w- c:\windows\system32\LgNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\AIM\\aim.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\AIM6\\aolsoftware.exe"=
"c:\\Program Files\\Tencent\\QQ Games\\QQGames.exe"=
"c:\\Program Files\\Tencent\\QQ Games\\QQGamesD.exe"=
"c:\\Program Files\\Tencent\\QQ Games\\Update\\Update.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=

R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [1/11/2007 8:33 PM 24652]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [6/17/2009 2:10 PM 101936]
S3 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [9/27/2006 9:33 PM 116464]

--- Other Services/Drivers In Memory ---

*Deregistered* - EraserUtilDrvI7

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-07-09 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 20:42]

2008-04-13 c:\windows\Tasks\FRU Task 2002-12-03 04:38ewlett-Packard2002-12-03 04:38p psc 1200 series84887B468ABA3F57D76752217D5938688025EB21193638819.job
- c:\program files\HP\Digital Imaging\Bin\hpqfrucl.exe [2002-12-03 03:38]

2009-07-12 c:\windows\Tasks\User_Feed_Synchronization-{8E76F419-D211-429D-96C6-7F178DB46BBE}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 11:31]

2009-07-12 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-04-10 05:18]
.
.
------- Supplementary Scan -------
.
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\xadmin\Application Data\Mozilla\Firefox\Profiles\48d47s85.default\
FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=tb50fftrie7&query=
FF - prefs.js: browser.search.selectedEngine - AIM Search
FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=tb50fftrab&query=
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
FF - user.js: protocol-handler.warn-external.dnUpdate - false
FF - user.js: browser.sessionstore.resume_from_crash - false
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-12 15:37
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(936)
c:\windows\system32\LgNotify.dll

- - - - - - - > 'explorer.exe'(1432)
c:\windows\system32\WININET.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\S24EvMon.exe
c:\program files\Common Files\Symantec Shared\ccSetMgr.exe
c:\program files\Symantec AntiVirus\DefWatch.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\RegSrvc.exe
c:\program files\Viewpoint\Viewpoint Manager\ViewMgr.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\1XConfig.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\HP\Digital Imaging\bin\hpoevm08.exe
c:\program files\HP\Digital Imaging\bin\hposts08.exe
c:\program files\HP\Digital Imaging\bin\hpqste08.exe
.
**************************************************************************
.
Completion time: 2009-07-12 15:44 - machine was rebooted
ComboFix-quarantined-files.txt 2009-07-12 22:43
ComboFix2.txt 2009-06-25 04:16

Pre-Run: 22,443,601,920 bytes free
Post-Run: 22,488,854,528 bytes free

226 --- E O F --- 2009-06-11 00:37

**TheBruce1** · 07-12-2009, 05:18 PM

Hello again

Please follow all instructions and in which order they come, if you have any questions, please ask before proceeding. Its important that you follow this through until i give you the all clear.

Please go to: VirusTotal

In the middle of the page you'll find a "Browse" button.

Click the "Browse" button and browse to this file in RED:

c:\windows\system32\wmmest.dll
Click "Open".
Then click the "Send File" button at the bottom of the VirusTotal page.
This will scan the file. Please be patient.
Once scanned, copy and paste the results in your next reply.

=========

Click > Start > Control Panel > Add or Remove Programs and uninstall the following programs :

Viewpoint Media Player<---Viewpoint is considered as foistware instead of malware since it is installed without users approval but doesn't spy or do anything "bad". This will change from what we know in 2006 read this article: http://www.clickz.com/news/article.php/3561546

Additional Information Here

Viewpoint Manager<---This program is used to update the Viewpoint Media Player. This program does not do anything bad such as deliver ads or spy on you, but it is considered foistware as it is installed without your consent through programs like AOl, AIM, Compuserve, etc.

========

JAVA OUTDATED

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

Download the latest version of Java Runtime Environment (JRE) 6 and save it to your desktop.
Scroll down to where it says "Java Runtime Environment (JRE) 6 Update 14. The Java SE Runtime Environment (JRE) allows end-users to run Java applications."
Click the "Download" button to the right.
Select the Windows platform from the dropdown menu.
Read the License Agreement and then check the box that says: "Accept License Agreement". Click on Continue.The page will refresh.
Click on the link to download Windows Offline Installation and save the file to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u14-windows-i586-p.exe to install the newest version.

After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
- On the General tab, under Temporary Internet Files, click the Settings button.
- Next, click on the Delete Files button
- There are two options in the window to clear the cache - Leave BOTH Checked
  - Applications and Applets
    Trace and Log Files
- Click OK on Delete Temporary Files Window
  Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
- Click OK to leave the Temporary Files Window
- Click OK to leave the Java Control Panel.

=========

Download ATF-Cleaner by Atribune to your desktop.

Double-click ATF Cleaner.exe to open it

Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.

If you have Firefox installed:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

If you have Opera installed:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Click Exit on the Main menu to close the program.

========

Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner

Click Accept, when prompted to download and install the program files and database of malware definitions.

Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.
Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
Click View scan report at the bottom.
Click the Save Report As... button.
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply.

**Note**

This animation will guide you through the process:

To optimize scanning time and produce a more sensible report for review:

Close any open programs.
Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.

Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.

========
Logs Required
VirusTotal Scan Result
Kaspersky Scan Report

An update on how your system is running.

bonsung · 07-12-2009, 10:34 PM

Hey, so the redirecting to other websites problem seems to have been fixed, but the computer itself still seems kind of slow. The Kaspesky Scan Report is attached.

This is the VirusTotal Scan Result:

Antivirus Version Last Update Result
a-squared 4.5.0.18 2009.07.13 Trojan-Downloader.Win32.Small!IK
AhnLab-V3 5.0.0.2 2009.07.13 Win-Trojan/Downloader.13826
AntiVir 7.9.0.204 2009.07.12 BDS/Small.UU
Antiy-AVL 2.0.3.1 2009.07.10 -
Authentium 5.1.2.4 2009.07.12 W32/Bongler-based!Maximus
Avast 4.8.1335.0 2009.07.12 Win32:Trojan-gen {Other}
AVG 8.5.0.387 2009.07.12 Agent2.LFQ
BitDefender 7.2 2009.07.13 Trojan.Generic.2009952
CAT-QuickHeal 10.00 2009.07.10 Backdoor.Small.uu
ClamAV 0.94.1 2009.07.13 -
Comodo 1632 2009.07.13 Backdoor.Win32.Small.uu
DrWeb 5.0.0.12182 2009.07.13 Trojan.DownLoader.origin
eSafe 7.0.17.0 2009.07.12 -
eTrust-Vet 31.6.6608 2009.07.10 -
F-Prot 4.4.4.56 2009.07.12 W32/Bongler-based!Maximus
F-Secure 8.0.14470.0 2009.07.13 Backdoor.Win32.Small.uu
Fortinet 3.120.0.0 2009.07.12 W32/Small.UU!tr.bdr
GData 19 2009.07.13 Trojan.Generic.2009952
Ikarus T3.1.1.64.0 2009.07.13 Trojan-Downloader.Win32.Small
Jiangmin 11.0.706 2009.07.12 -
K7AntiVirus 7.10.790 2009.07.11 Backdoor.Win32.Small.uu
Kaspersky 7.0.0.125 2009.07.13 Backdoor.Win32.Small.uu
McAfee 5674 2009.07.12 Generic.dx!js
McAfee+Artemis 5674 2009.07.12 Generic.dx!js
McAfee-GW-Edition 6.8.5 2009.07.12 Heuristic.LooksLike.Trojan.Backdoor.Small.L
Microsoft 1.4803 2009.07.12 -
NOD32 4237 2009.07.12 a variant of Win32/Agent.BCXC
Norman 6.01.09 2009.07.10 -
nProtect 2009.1.8.0 2009.07.13 Backdoor/W32.Small.13826
Panda 10.0.0.14 2009.07.12 Trj/CI.A
PCTools 4.4.2.0 2009.07.11 -
Prevx 3.0 2009.07.13 High Risk Worm
Rising 21.38.00.00 2009.07.13 -
Sophos 4.43.0 2009.07.13 -
Sunbelt 3.2.1858.2 2009.07.12 -
Symantec 1.4.4.12 2009.07.13 Trojan Horse
TheHacker 6.3.4.3.366 2009.07.12 Backdoor/Small.uu
TrendMicro 8.950.0.1094 2009.07.13 -
VBA32 3.12.10.8 2009.07.12 Backdoor.Win32.Small.uu
ViRobot 2009.7.13.1832 2009.07.13 Trojan.Win32.Downloader.13826.F
VirusBuster 4.6.5.0 2009.07.12 Backdoor.Small.CDED
Additional information
File size: 13826 bytes
MD5...: a3fbabb7fb33eeb2d9e0e0555ceac62e
SHA1..: 75dce4913562a5824543e8bed50efa22616a7db3
SHA256: 84112466f7e295d08ab8841540964f22615c2e1a9c04d38d1afdd8d7cd19771b
ssdeep: 192:JAmM1OkAUpUavbGtlM+Idtk7QLofAYMH2cYqOo8IDXfvd/cZbZyV:JAmdUUa
vCtWLEDxyYPILfvd/cZ9yV

PEiD..: -
TrID..: File type identification
-
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0xe29
timedatestamp.....: 0x4a28c8d5 (Fri Jun 05 07:27:17 2009)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x400 0x2a22 0x2c00 5.46 ac348371cfffc586ae9cc8dc0cd36d0c
.data 0x3000 0x386 0x400 3.70 45d4ea897c489755b28a74db2294817e
.reloc 0x3400 0x12c 0x200 3.54 1350561ae957306de17f5628426d4dc9

( 2 imports )
> WSOCK32.dll: -, -, -, -, -, -, -, -, -
> KERNEL32.dll: WriteFile, LoadLibraryA, GetFileSize, CreateToolhelp32Snapshot, Process32First, OpenProcess, TerminateProcess, Process32Next, lstrcmpiA, GetModuleHandleA, lstrlenA, lstrcatA, lstrcpyA, CloseHandle, CreateFileA, Sleep, GetProcAddress

( 0 exports )

PDFiD.: -
RDS...: NSRL Reference Data Set
-
Prevx info: <a href='http://info.prevx.com/aboutprogramtext.asp?PX5=2BF411EE0293E654368600378F4E320087FE8E55' target='_blank'>http://info.prevx.com/aboutprogramte...4E320087FE8E55</a>

**TheBruce1** · 07-13-2009, 03:47 AM

Hello again

Please copy/paste logs into your reply, no need to attach.

There are files in Norton Quarantine folder, you can purge these by following instructions Here.

The others that Kaspersky detected we can remove before we conclude.

========

Open notepad and copy/paste the text in the quotebox below into it:

Code:

File::
c:\windows\system32\wmmest.dll
c:\program files\Mozilla Firefox\plugins\npViewpoint.dll

DirLook::
c:\windows\System Volume Information

Folder::
c:\documents and settings\xadmin\Application Data\Sun\Java\jre1.6.0_13
c:\program files\Viewpoint

Firefox::
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll

Driver::
Viewpoint Manager Service

Save this as CFscript

Refering to the picture above, drag CFscript into ComboFix.exe

Follow the prompts, and post the resulting log, C:\ComboFix.txt

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

Warning:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

bonsung · 07-13-2009, 06:13 PM

So I tried to remove the files in Norton Quarantine folder, and the site says, "Quarantine purge must be configured for each individual client or server from the program window and cannot be configured from within the Symantec System Center." I'm not sure what the program window is. Can you tell me, please? Thanks.

**TheBruce1** · 07-14-2009, 03:49 AM

Carry on with the rest of the instructions, we can deal with the Symantec issue later.

bonsung · 07-14-2009, 06:54 PM

Ok, so this is the CFscript log:

ComboFix 09-07-14.07 - xadmin 07/14/2009 17:43.11.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1006.568 [GMT -7:00]
Running from: c:\documents and settings\xadmin\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\xadmin\Desktop\CFscript.txt
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}

FILE ::
"c:\program files\Mozilla Firefox\plugins\npViewpoint.dll"
"c:\windows\system32\wmmest.dll"
.

((((((((((((((((((((((((( Files Created from 2009-06-15 to 2009-07-15 )))))))))))))))))))))))))))))))
.

2009-07-13 00:31 . 2009-07-13 00:31 -------- d-----w- c:\program files\Java
2009-07-10 03:23 . 2009-07-10 03:23 -------- d-----w- C:\rsit
2009-07-10 03:23 . 2009-07-10 03:23 -------- d-----w- c:\program files\trend micro
2009-06-30 01:33 . 2009-06-30 01:33 -------- d-sh--w- c:\windows\System Volume Information
2009-06-27 05:57 . 2009-06-27 05:57 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2009-06-27 04:45 . 2009-06-27 04:45 -------- d-sh--w- c:\documents and settings\xadmin\IECompatCache
2009-06-27 04:42 . 2009-06-27 04:42 -------- d-sh--w- c:\documents and settings\xadmin\PrivacIE
2009-06-27 04:40 . 2009-06-27 04:40 -------- d-sh--w- c:\documents and settings\xadmin\IETldCache
2009-06-27 04:34 . 2009-06-27 04:34 -------- d-----w- c:\windows\ie8updates
2009-06-27 04:30 . 2009-06-27 04:32 -------- dc-h--w- c:\windows\ie8
2009-06-27 04:28 . 2009-06-02 10:12 102912 -c----w- c:\windows\system32\dllcache\iecompat.dll
2009-06-27 04:28 . 2009-04-30 21:22 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2009-06-27 04:28 . 2009-04-30 21:22 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2009-06-25 04:14 . 2008-04-14 00:12 50176 -c--a-w- c:\windows\system32\dllcache\proquota.exe
2009-06-25 04:14 . 2008-04-14 00:12 50176 ----a-w- c:\windows\system32\proquota.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-13 00:31 . 2009-01-14 01:31 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-07-12 23:54 . 2006-12-20 18:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Viewpoint
2009-07-12 23:54 . 2007-01-19 04:49 -------- d-----w- c:\documents and settings\xadmin\Application Data\Viewpoint
2009-06-26 00:55 . 2006-12-15 04:24 64432 ----a-w- c:\documents and settings\xadmin\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-14 22:24 . 2008-08-03 01:51 -------- d-----w- c:\program files\Starcraft
2009-06-13 17:35 . 2009-05-30 03:24 -------- d-----w- c:\program files\AIMTunes
2009-05-30 03:26 . 2009-05-30 03:21 -------- d-----w- c:\program files\AIM6
2009-05-30 03:25 . 2009-04-14 04:20 -------- d-----w- c:\documents and settings\All Users\Application Data\Tencent
2009-05-30 03:25 . 2009-04-14 04:19 5946704 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\aimqqgames\QQSetup65.exe
2009-05-30 03:24 . 2009-04-14 04:18 1144808 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\aimtunes\AIMTunes.exe
2009-05-30 03:13 . 2009-05-30 03:13 169 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.1\setup.exe
2009-05-30 03:13 . 2009-05-30 03:13 1178096 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.1\AIMinst.exe
2009-05-30 03:13 . 2009-05-30 03:13 15920 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.1\ocpchk.dll
2009-05-30 03:13 . 2009-05-30 03:12 579248 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.1\muinst.exe
2009-05-30 03:12 . 2009-05-30 03:12 46640 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.1\chckampx.dll
2009-05-30 03:12 . 2009-05-30 03:12 409640 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.1\vwpt.exe
2009-05-30 03:12 . 2009-05-30 03:12 87600 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.1\AOLFirewallMgr.dll
2009-05-30 03:12 . 2009-05-30 03:11 560784 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.1\AIMLang.exe
2009-05-30 03:12 . 2009-05-30 03:11 228912 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.1\migrator.exe
2009-05-30 03:12 . 2009-05-30 03:11 94256 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.1\instph.dll
2009-05-30 03:10 . 2006-12-20 18:40 -------- d-----w- c:\documents and settings\All Users\Application Data\AOL Downloads
2009-05-30 03:10 . 2009-05-30 03:10 168872 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\TRITON_CA_2.2.19.1\stmninst.exe
2009-05-30 03:09 . 2009-05-30 03:09 100432 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\TRITON_CA_2.2.19.1\aod.exe
2009-05-30 03:09 . 2009-05-30 03:09 44448 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\TRITON_CA_2.2.19.1\instopts.exe
2009-05-30 03:09 . 2009-05-30 03:09 13904 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\TRITON_CA_2.2.19.1\imappver.dll
2009-05-30 03:09 . 2009-05-30 03:09 601152 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\TRITON_CA_2.2.19.1\ampx.exe
2009-05-30 03:09 . 2009-05-30 03:09 80976 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\TRITON_CA_2.2.19.1\ProgUpd.dll
2009-05-30 03:09 . 2009-05-30 03:09 81176 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\TRITON_CA_2.2.19.1\alsetup.exe
2009-05-23 03:13 . 2009-05-23 03:13 -------- d-----w- c:\program files\Common Files\Software Update Utility
2009-05-23 03:11 . 2009-05-23 03:11 -------- d-----w- c:\documents and settings\All Users\Application Data\AIM
2009-05-23 03:10 . 2006-12-20 18:46 -------- d-----w- c:\documents and settings\All Users\Application Data\AOL
2009-05-13 05:15 . 2004-08-12 13:33 915456 ----a-w- c:\windows\system32\wininet.dll
2009-05-07 15:32 . 2004-08-12 13:21 345600 ----a-w- c:\windows\system32\localspl.dll
2009-04-17 12:26 . 2004-08-12 13:33 1847168 ----a-w- c:\windows\system32\win32k.sys
2009-04-25 21:25 . 2008-11-24 00:32 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
---- Directory of c:\windows\System Volume Information ----

((((((((((((((((((((((((((((( SnapShot@2009-07-12_22.37.24 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-14 23:21 . 2009-07-14 23:21 16384 c:\windows\temp\Perflib_Perfdata_248.dat
- 2009-06-26 01:22 . 2009-03-09 12:19 148888 c:\windows\system32\javaws.exe
+ 2009-07-13 00:31 . 2009-07-13 00:31 148888 c:\windows\system32\javaws.exe
+ 2009-07-13 00:31 . 2009-07-13 00:31 144792 c:\windows\system32\javaw.exe
- 2009-06-26 01:22 . 2009-03-09 12:19 144792 c:\windows\system32\javaw.exe
+ 2009-07-13 00:31 . 2009-07-13 00:31 144792 c:\windows\system32\java.exe
- 2009-06-26 01:22 . 2009-03-09 12:19 144792 c:\windows\system32\java.exe
+ 2009-07-13 00:31 . 2009-07-13 00:31 1563648 c:\windows\Installer\7449d.msi
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"AdobeUpdater"="c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2009-01-25 2356088]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
"ZCfgSvc.exe"="c:\windows\system32\ZCfgSvc.exe" [2005-07-05 639040]
"PRONoMgr.exe"="c:\program files\Intel\NCS\PROSet\PRONoMgr.exe" [2005-06-27 135168]
"DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2006-11-12 157592]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2006-07-20 52896]
"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2006-09-28 125168]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-06-29 286720]
"FixCamera"="c:\windows\FixCamera.exe" [2007-02-10 20480]
"tsnpstd3"="c:\windows\tsnpstd3.exe" [2007-03-10 270336]
"snpstd3"="c:\windows\vsnpstd3.exe" [2006-09-19 827392]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-13 148888]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]
hp psc 1000 series.lnk - c:\program files\HP\Digital Imaging\bin\hpohmr08.exe [2002-12-2 147456]
hpoddt01.exe.lnk - c:\program files\HP\Digital Imaging\bin\hpotdd01.exe [2002-12-2 40960]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2006-12-16 118784]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSetActiveDesktop"= 1 (0x1)
"NoActiveDesktopChanges"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Sebring]
2005-07-05 09:33 188482 ----a-w- c:\windows\system32\LgNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\AIM\\aim.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\AIM6\\aolsoftware.exe"=
"c:\\Program Files\\Tencent\\QQ Games\\QQGames.exe"=
"c:\\Program Files\\Tencent\\QQ Games\\QQGamesD.exe"=
"c:\\Program Files\\Tencent\\QQ Games\\Update\\Update.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [6/17/2009 2:10 PM 101936]
S3 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [9/27/2006 9:33 PM 116464]

--- Other Services/Drivers In Memory ---

*Deregistered* - EraserUtilDrvI7

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-07-09 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 20:42]

2008-04-13 c:\windows\Tasks\FRU Task 2002-12-03 04:38ewlett-Packard2002-12-03 04:38p psc 1200 series84887B468ABA3F57D76752217D5938688025EB21193638819.job
- c:\program files\HP\Digital Imaging\Bin\hpqfrucl.exe [2002-12-03 03:38]

2009-07-14 c:\windows\Tasks\User_Feed_Synchronization-{8E76F419-D211-429D-96C6-7F178DB46BBE}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 11:31]

2009-07-14 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-04-10 05:18]
.
.
------- Supplementary Scan -------
.
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\xadmin\Application Data\Mozilla\Firefox\Profiles\48d47s85.default\
FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=tb50fftrie7&query=
FF - prefs.js: browser.search.selectedEngine - AIM Search
FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=tb50fftrab&query=

---- FIREFOX POLICIES ----
FF - user.js: protocol-handler.warn-external.dnUpdate - false
FF - user.js: browser.sessionstore.resume_from_crash - false
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-14 17:49
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(924)
c:\windows\system32\LgNotify.dll
c:\windows\system32\igfxdev.dll

- - - - - - - > 'explorer.exe'(2772)
c:\windows\system32\WININET.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2009-07-15 17:52
ComboFix-quarantined-files.txt 2009-07-15 00:51
ComboFix2.txt 2009-07-13 23:39
ComboFix3.txt 2009-07-12 22:44
ComboFix4.txt 2009-06-25 04:16

Pre-Run: 22,389,460,992 bytes free
Post-Run: 22,351,568,896 bytes free

202 --- E O F --- 2009-06-11 00:37

**TheBruce1** · 07-15-2009, 04:42 AM

Hello again

Quote:

So I tried to remove the files in Norton Quarantine folder, and the site says, "Quarantine purge must be configured for each individual client or server from the program window and cannot be configured from within the Symantec System Center." I'm not sure what the program window is. Can you tell me, please? Thanks.

Since you are running a Corporate Edition of Symantec, which should really be used in a Corporate enviroment and not a home pc, you can try to delete the entries in the quarantine folder manually, do not delete the quarantine folder.

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine<---Inside this folder

You should also take a look at the user manual.

========

Delete these files in blue.

c:\documents and settings\All Users\Application Data\Viewpoint
c:\documents and settings\xadmin\Application Data\Viewpoint

==========

Open notepad and copy/paste the text in the quotebox below:
(don't forget to copy and paste REGEDIT4)

Quote:

REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000000

Save the file as "Fix.reg". Make sure to save it with the quotes. Choose to "Save type as - All Files"
It should look like this:

Double click on the Fix.reg file and choose Yes to merge/add it to the registry. You may delete the file afterwards.

=========

You don't seem to have a firewall program installed. Using a firewall will allow you to give/deny access for applications that want to go online. Select one of these, or another of your choice:

==========

If there are no further issues, continue below.

==========

Delete RSIT from your desktop, you may keep ATF-Cleaner if you wish...otherwise delete from desktop.

Also delete this folder.

C:\rsit

==========

Well done, your logs are clean.

Click start>run>type(or copy/paste command into run box):

ComboFix /u

Click ok.

============

Clear IE7 cookies

*On the Internet Explorer 7 Tools menu, click Internet Options. The Internet Options box should open to the General tab.
*On the General tab, in the Browsing History, click the Delete button. This will delete all the files that are currently stored in your cache [that includes cookies too].
*Click OK, and then click OK again.

Clear Firefox cookies/cache

• Select "Tools"
• Select "Options".
• Select "Privacy".
• In "Settings" window put the check mark for Cookies,Cache,Browsing history and any others you want.
• Click OK.
• In Private area click "Clear Now".

-------------------------------------------------------------------------------------------

MICROSOFT UPDATES

1.Click Start,Run, type sysdm.cpl, and then press OK.
2.Click the Automatic Updates tab, and then click to select one of the following options. We recommend that you select the Automatic (recommended).

Microsoft updates are released every second Tuesday of each month,what is called "Patch Tuesday".

------------------------------------------------------------------------------------------

Useful Information and Programs to keep you safe.

WOT Free helps you avoid disingenuous Internet content by allowing you to learn from others' experiences. WOT shows you website reputations on your browser, telling you how much other users trust a website. This helps you make better decisions while browsing and avoid phishing, malware, and other types of fraud. Reputations can also be added to web search results, Gmail, Wikipedia, and other selected sites.

WOT reputations are computed mainly from user testimonies. Sharing your knowledge with others is just a click away, without ever having to leave the site. We also collect data from hundreds of other sources (including PhishTank) to quickly warn you of emerging threats. Currently, WOT knows over 12 million websites.

For Internet Explorer users:
WOT for IE

--------------------------------------------------------------------------------------

Alternate Browsers
Try the following free alternate browsers rather than Internet Explorer
Avant
Firefox
Opera
K-Meleon

------------------------------------------------------------------------------------------

Free Antispyware Products
SuperAntiSpyware
Malwarebytes ' Anti-Malware

SpywareBlaster to help prevent spyware from installing in the first place.

Install & update SpywareBlaster with the latest definitions.
After you have updated, click the button - enable protection for all unprotected items

------------------------------------------------------------------

The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer. Note that if you use a company provided HOSTS file you should not use the MVPS HOSTS file.

If your having trouble downloading & extracting,see link below for guidance:
http://www.mvps.org/winhelp2002/hosts2.htm

Once you have extracted the host file,double click on it and a new window will open.

Double-click on mvps.batand follow the prompts

---------------------------------------------------------------

Winpatrol - Download and install the free version of Winpatrol. A tutorial for this product is located here:
Using Winpatrol to protect your computer.

----------------------------------------

SnoopFree is a programme that informs you when another programme is wanting to log your keystrokes or read your screen.Only for XP users.

Update all these programs regularly. Without regular updates you will not be protected when new malicious programs are released.

==============================================

Secunia PSI is a programme that will alert you to vulnerabilities and outdated programs you have installed, such as Java, Flash Player and many more.

It can also alert you if you have not installed the latest patches from Microsoft.

==============================================

Also, please take a look at this well written article:

PC Safety and Security--What Do I Need?

**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.

Please reply to this thread once more, as we may mark this as resolved, thanks.

bonsung · 07-15-2009, 07:22 PM

Ok, thanks so much, you helped a ton!

**TheBruce1** · 07-16-2009, 04:05 AM

Glad we could help, take care

07-12-2009, 09:28 AM	#2 (permalink)
TheBruce1 Moderator, Analyst, Security Team Join Date: Oct 2006 Location: Dùn Èideann,Scotland. Posts: 5,093 OS: XP	Re: Small spyware problem, worsening Hello and welcome to TSF Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe. ======== Please follow all instructions and in which order they come, if you have any questions, please ask before proceeding. Its important that you follow this through until i give you the all clear. Please DO NOT Attach logs to your posts unless you are advised to do so. ========== Download ComboFix from one of these locations: Link 1 Link 2 Link 3 * IMPORTANT !!! Place combofix.exe on your Desktop Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix. Double click on combofix.exe & follow the prompts. As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures. The Windows recovery console will allow you to boot up into a special recovery mode that allows us to help you in the case that your computer has a problem after an attempted removal of malware. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement. ComboFix will now automatically install the Microsoft Windows Recovery Console onto your computer, which will show up as a new option when booting up your computer. Do not select the Microsoft Windows Recovery Console option when you start your computer unless requested to by a helper. Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see a message that says: The Recovery Console was successfully installed. Click on Yes, to continue scanning for malware. Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal. When finished, it shall produce a log for you. Post that log in your next reply Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall. Please note that the forum is very busy and if I don't hear from you within three days this thread will be closed. __________________ Member of ASAP since 2007 Member of UNITE since 2008 Notice to BT customers BT to dump Phorm, see Here for more information. No DPI If we have helped you in anyway, please consider Donating

07-12-2009, 01:10 PM	#3 (permalink)
bonsung Registered User Join Date: Jun 2009 Posts: 9 OS: xp	Re: Small spyware problem, worsening Hey, so I tried to download Combo-Fix, but I can't for some reason. The 1st and 3rd link says when I click on it, page not found. The 2nd directs me to a virus forum site in Spanish. I was expecting a pop-up, but there isn't one. What shall I do? Thanks.

07-12-2009, 04:53 PM	#5 (permalink)
bonsung Registered User Join Date: Jun 2009 Posts: 9 OS: xp	Re: Small spyware problem, worsening Hello, so I've run Combo-Fix and here is the log. Also, thank you very much for helping me. Combo Fix log: ComboFix 09-07-12.01 - xadmin 07/12/2009 15:28.9.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1006.519 [GMT -7:00] Running from: c:\documents and settings\xadmin\Desktop\ComboFix.exe AV: Symantec AntiVirus Corporate Edition On-access scanning disabled (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\docume~1\xadmin\LOCALS~1\Temp\csrss.exe c:\docume~1\xadmin\LOCALS~1\Temp\lsass.exe c:\docume~1\xadmin\LOCALS~1\Temp\services.exe c:\docume~1\xadmin\LOCALS~1\Temp\svchost.exe c:\docume~1\xadmin\LOCALS~1\Temp\taskmgr.exe c:\docume~1\xadmin\LOCALS~1\Temp\winlogon.exe C:\fwgl.exe c:\windows\expmodule.exe c:\windows\Installer\1bb19.msi c:\windows\system32\1966113216268965566131078216268921626892162689.exe c:\windows\system32\2031649216268965566131078216268921626892162689.exe c:\windows\system32\27525247864511245187327687786451786451786451.exe c:\windows\system32\32768127864511245187327687786451786451786451.exe c:\windows\system32\33423487864511245187327687786451786451786451.exe c:\windows\system32\gsf83iujid.dll Infected copy of c:\windows\system32\userinit.exe was found and disinfected Restored copy from - c:\windows\ServicePackFiles\i386\userinit.exe . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226ED} -------\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226EE} ((((((((((((((((((((((((( Files Created from 2009-06-12 to 2009-07-12 ))))))))))))))))))))))))))))))) . 2009-07-10 03:23 . 2009-07-10 03:23 -------- d-----w- C:\rsit 2009-07-10 03:23 . 2009-07-10 03:23 -------- d-----w- c:\program files\trend micro 2009-06-30 01:33 . 2009-06-30 01:33 -------- d-sh--w- c:\windows\System Volume Information 2009-06-30 01:32 . 2009-07-11 17:06 13826 ----a-w- c:\windows\system32\wmmest.dll 2009-06-27 05:57 . 2009-06-27 05:57 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache 2009-06-27 04:45 . 2009-06-27 04:45 -------- d-sh--w- c:\documents and settings\xadmin\IECompatCache 2009-06-27 04:42 . 2009-06-27 04:42 -------- d-sh--w- c:\documents and settings\xadmin\PrivacIE 2009-06-27 04:40 . 2009-06-27 04:40 -------- d-sh--w- c:\documents and settings\xadmin\IETldCache 2009-06-27 04:34 . 2009-06-27 04:34 -------- d-----w- c:\windows\ie8updates 2009-06-27 04:30 . 2009-06-27 04:32 -------- dc-h--w- c:\windows\ie8 2009-06-27 04:28 . 2009-06-02 10:12 102912 -c----w- c:\windows\system32\dllcache\iecompat.dll 2009-06-27 04:28 . 2009-04-30 21:22 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll 2009-06-27 04:28 . 2009-04-30 21:22 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll 2009-06-26 01:21 . 2009-06-26 01:21 152576 ----a-w- c:\documents and settings\xadmin\Application Data\Sun\Java\jre1.6.0_13\lzma.dll 2009-06-25 04:14 . 2008-04-14 00:12 50176 -c--a-w- c:\windows\system32\dllcache\proquota.exe 2009-06-25 04:14 . 2008-04-14 00:12 50176 ----a-w- c:\windows\system32\proquota.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-06-26 01:22 . 2009-01-14 01:31 -------- d-----w- c:\program files\Java 2009-06-26 00:55 . 2006-12-15 04:24 64432 ----a-w- c:\documents and settings\xadmin\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-06-14 22:24 . 2008-08-03 01:51 -------- d-----w- c:\program files\Starcraft 2009-06-13 17:35 . 2009-05-30 03:24 -------- d-----w- c:\program files\AIMTunes 2009-05-30 03:26 . 2009-05-30 03:21 -------- d-----w- c:\program files\AIM6 2009-05-30 03:25 . 2009-04-14 04:20 -------- d-----w- c:\documents and settings\All Users\Application Data\Tencent 2009-05-30 03:25 . 2009-04-14 04:19 5946704 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\aimqqgames\QQSetup65.exe 2009-05-30 03:24 . 2009-04-14 04:18 1144808 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\aimtunes\AIMTunes.exe 2009-05-30 03:13 . 2009-05-30 03:13 169 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.1\setup.exe 2009-05-30 03:13 . 2009-05-30 03:13 1178096 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.1\AIMinst.exe 2009-05-30 03:13 . 2009-05-30 03:13 15920 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.1\ocpchk.dll 2009-05-30 03:13 . 2009-05-30 03:12 579248 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.1\muinst.exe 2009-05-30 03:12 . 2009-05-30 03:12 46640 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.1\chckampx.dll 2009-05-30 03:12 . 2009-05-30 03:12 409640 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.1\vwpt.exe 2009-05-30 03:12 . 2009-05-30 03:12 87600 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.1\AOLFirewallMgr.dll 2009-05-30 03:12 . 2009-05-30 03:11 560784 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.1\AIMLang.exe 2009-05-30 03:12 . 2009-05-30 03:11 228912 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.1\migrator.exe 2009-05-30 03:12 . 2009-05-30 03:11 94256 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.1\instph.dll 2009-05-30 03:10 . 2006-12-20 18:40 -------- d-----w- c:\documents and settings\All Users\Application Data\AOL Downloads 2009-05-30 03:10 . 2009-05-30 03:10 168872 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\TRITON_CA_2.2.19.1\stmninst.exe 2009-05-30 03:09 . 2009-05-30 03:09 100432 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\TRITON_CA_2.2.19.1\aod.exe 2009-05-30 03:09 . 2009-05-30 03:09 44448 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\TRITON_CA_2.2.19.1\instopts.exe 2009-05-30 03:09 . 2009-05-30 03:09 13904 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\TRITON_CA_2.2.19.1\imappver.dll 2009-05-30 03:09 . 2009-05-30 03:09 601152 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\TRITON_CA_2.2.19.1\ampx.exe 2009-05-30 03:09 . 2009-05-30 03:09 80976 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\TRITON_CA_2.2.19.1\ProgUpd.dll 2009-05-30 03:09 . 2009-05-30 03:09 81176 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\TRITON_CA_2.2.19.1\alsetup.exe 2009-05-23 03:13 . 2009-05-23 03:13 -------- d-----w- c:\program files\Common Files\Software Update Utility 2009-05-23 03:11 . 2009-05-23 03:11 -------- d-----w- c:\documents and settings\All Users\Application Data\AIM 2009-05-23 03:10 . 2006-12-20 18:46 -------- d-----w- c:\documents and settings\All Users\Application Data\AOL 2009-05-13 05:15 . 2004-08-12 13:33 915456 ----a-w- c:\windows\system32\wininet.dll 2009-05-07 15:32 . 2004-08-12 13:21 345600 ----a-w- c:\windows\system32\localspl.dll 2009-04-17 12:26 . 2004-08-12 13:33 1847168 ----a-w- c:\windows\system32\win32k.sys 2009-04-15 14:51 . 2004-08-12 13:27 585216 ----a-w- c:\windows\system32\rpcrt4.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "AdobeUpdater"="c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2009-01-25 2356088] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208] "igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824] "igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688] "ZCfgSvc.exe"="c:\windows\system32\ZCfgSvc.exe" [2005-07-05 639040] "PRONoMgr.exe"="c:\program files\Intel\NCS\PROSet\PRONoMgr.exe" [2005-06-27 135168] "DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2006-11-12 157592] "ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2006-07-20 52896] "vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2006-09-28 125168] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-06-29 286720] "FixCamera"="c:\windows\FixCamera.exe" [2007-02-10 20480] "tsnpstd3"="c:\windows\tsnpstd3.exe" [2007-03-10 270336] "snpstd3"="c:\windows\vsnpstd3.exe" [2006-09-19 827392] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888] c:\documents and settings\All Users\Start Menu\Programs\Startup\ HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472] hp psc 1000 series.lnk - c:\program files\HP\Digital Imaging\bin\hpohmr08.exe [2002-12-2 147456] hpoddt01.exe.lnk - c:\program files\HP\Digital Imaging\bin\hpotdd01.exe [2002-12-2 40960] Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588] WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2006-12-16 118784] [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoSetActiveDesktop"= 1 (0x1) "NoActiveDesktopChanges"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Sebring] 2005-07-05 09:33 188482 ----a-w- c:\windows\system32\LgNotify.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"= "c:\\Program Files\\AIM\\aim.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "c:\\Program Files\\AIM6\\aolsoftware.exe"= "c:\\Program Files\\Tencent\\QQ Games\\QQGames.exe"= "c:\\Program Files\\Tencent\\QQ Games\\QQGamesD.exe"= "c:\\Program Files\\Tencent\\QQ Games\\Update\\Update.exe"= "c:\\Program Files\\AIM6\\aim6.exe"= R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [1/11/2007 8:33 PM 24652] R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [6/17/2009 2:10 PM 101936] S3 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [9/27/2006 9:33 PM 116464] --- Other Services/Drivers In Memory --- Deregistered - EraserUtilDrvI7 [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] "c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP . Contents of the 'Scheduled Tasks' folder 2009-07-09 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 20:42] 2008-04-13 c:\windows\Tasks\FRU Task 2002-12-03 04:38ewlett-Packard2002-12-03 04:38p psc 1200 series84887B468ABA3F57D76752217D5938688025EB21193638819.job - c:\program files\HP\Digital Imaging\Bin\hpqfrucl.exe [2002-12-03 03:38] 2009-07-12 c:\windows\Tasks\User_Feed_Synchronization-{8E76F419-D211-429D-96C6-7F178DB46BBE}.job - c:\windows\system32\msfeedssync.exe [2006-10-17 11:31] 2009-07-12 c:\windows\Tasks\WGASetup.job - c:\windows\system32\KB905474\wgasetup.exe [2009-04-10 05:18] . . ------- Supplementary Scan ------- . IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\xadmin\Application Data\Mozilla\Firefox\Profiles\48d47s85.default\ FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=tb50fftrie7&query= FF - prefs.js: browser.search.selectedEngine - AIM Search FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=tb50fftrab&query= FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} ---- FIREFOX POLICIES ---- FF - user.js: protocol-handler.warn-external.dnUpdate - false FF - user.js: browser.sessionstore.resume_from_crash - false . ************************************************************************ catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-07-12 15:37 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ********************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(936) c:\windows\system32\LgNotify.dll - - - - - - - > 'explorer.exe'(1432) c:\windows\system32\WININET.dll c:\progra~1\WINDOW~2\wmpband.dll c:\windows\system32\ieframe.dll c:\windows\system32\webcheck.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Other Running Processes ------------------------ . c:\windows\system32\S24EvMon.exe c:\program files\Common Files\Symantec Shared\ccSetMgr.exe c:\program files\Symantec AntiVirus\DefWatch.exe c:\program files\Java\jre6\bin\jqs.exe c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE c:\windows\system32\RegSrvc.exe c:\program files\Viewpoint\Viewpoint Manager\ViewMgr.exe c:\windows\system32\wscntfy.exe c:\windows\system32\1XConfig.exe c:\windows\system32\igfxsrvc.exe c:\program files\HP\Digital Imaging\bin\hpoevm08.exe c:\program files\HP\Digital Imaging\bin\hposts08.exe c:\program files\HP\Digital Imaging\bin\hpqste08.exe . ************************************************************************ . Completion time: 2009-07-12 15:44 - machine was rebooted ComboFix-quarantined-files.txt 2009-07-12 22:43 ComboFix2.txt 2009-06-25 04:16 Pre-Run: 22,443,601,920 bytes free Post-Run: 22,488,854,528 bytes free 226 --- E O F --- 2009-06-11 00:37

07-12-2009, 05:18 PM	#6 (permalink)
TheBruce1 Moderator, Analyst, Security Team Join Date: Oct 2006 Location: Dùn Èideann,Scotland. Posts: 5,093 OS: XP	Re: Small spyware problem, worsening Hello again Please follow all instructions and in which order they come, if you have any questions, please ask before proceeding. Its important that you follow this through until i give you the all clear. Please go to: VirusTotal In the middle of the page you'll find a "Browse" button. Click the "Browse" button and browse to this file in RED: c:\windows\system32\wmmest.dll Click "Open". Then click the "Send File" button at the bottom of the VirusTotal page. This will scan the file. Please be patient. Once scanned, copy and paste the results in your next reply. ========= Click > Start > Control Panel > Add or Remove Programs and uninstall the following programs : Viewpoint Media Player<---Viewpoint is considered as foistware instead of malware since it is installed without users approval but doesn't spy or do anything "bad". This will change from what we know in 2006 read this article: http://www.clickz.com/news/article.php/3561546 Additional Information Here Viewpoint Manager<---This program is used to update the Viewpoint Media Player. This program does not do anything bad such as deliver ads or spy on you, but it is considered foistware as it is installed without your consent through programs like AOl, AIM, Compuserve, etc. ======== JAVA OUTDATED Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update. Download the latest version of Java Runtime Environment (JRE) 6 and save it to your desktop. Scroll down to where it says "Java Runtime Environment (JRE) 6 Update 14. The Java SE Runtime Environment (JRE) allows end-users to run Java applications." Click the "Download" button to the right. Select the Windows platform from the dropdown menu. Read the License Agreement and then check the box that says: "Accept License Agreement". Click on Continue.The page will refresh. Click on the link to download Windows Offline Installation and save the file to your desktop. Close any programs you may have running - especially your web browser. Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java. Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name. Click the Remove or Change/Remove button. Repeat as many times as necessary to remove each Java versions. Reboot your computer once all Java components are removed. Then from your desktop double-click on jre-6u14-windows-i586-p.exe to install the newest version. After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup) On the General tab, under Temporary Internet Files, click the Settings button. Next, click on the Delete Files button There are two options in the window to clear the cache - Leave BOTH Checked Applications and Applets Trace and Log Files Click OK on Delete Temporary Files Window Note: This deletes ALL the Downloaded Applications and Applets from the CACHE. Click OK to leave the Temporary Files Window Click OK to leave the Java Control Panel. ========= Download ATF-Cleaner by Atribune to your desktop. Double-click ATF Cleaner.exe to open it Under Main choose: Windows Temp Current User Temp All Users Temp Cookies Temporary Internet Files Prefetch Java Cache The other boxes are optional Then click the Empty Selected button. If you have Firefox installed: Click Firefox at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click NO at the prompt. If you have Opera installed: Click Opera at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click NO at the prompt. Click Exit on the Main menu to close the program. ======== Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner Click Accept, when prompted to download and install the program files and database of malware definitions. Click Run at the Security prompt. The program will then begin downloading and installing and will also update the database. Please be patient as this can take several minutes. Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan. Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it. Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined. Click View scan report at the bottom. Click the Save Report As... button. Click the Save as Text button to save the file to your desktop so that you may post it in your next reply. Note This animation will guide you through the process: To optimize scanning time and produce a more sensible report for review: Close any open programs. Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan. Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%. ======== Logs Required VirusTotal Scan Result Kaspersky Scan Report An update on how your system is running. __________________ Member of ASAP since 2007 Member of UNITE since 2008 Notice to BT customers BT to dump Phorm, see Here for more information. No DPI If we have helped you in anyway, please consider Donating

07-13-2009, 03:47 AM	#8 (permalink)
TheBruce1 Moderator, Analyst, Security Team Join Date: Oct 2006 Location: Dùn Èideann,Scotland. Posts: 5,093 OS: XP	Re: Small spyware problem, worsening Hello again Please copy/paste logs into your reply, no need to attach. There are files in Norton Quarantine folder, you can purge these by following instructions Here. The others that Kaspersky detected we can remove before we conclude. ======== Open notepad and copy/paste the text in the quotebox below into it: Code: File:: c:\windows\system32\wmmest.dll c:\program files\Mozilla Firefox\plugins\npViewpoint.dll DirLook:: c:\windows\System Volume Information Folder:: c:\documents and settings\xadmin\Application Data\Sun\Java\jre1.6.0_13 c:\program files\Viewpoint Firefox:: FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll Driver:: Viewpoint Manager Service Save this as CFscript Refering to the picture above, drag CFscript into ComboFix.exe Follow the prompts, and post the resulting log, C:\ComboFix.txt Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system. Warning: Do not mouseclick combofix's window whilst it's running. That may cause it to stall __________________ Member of ASAP since 2007 Member of UNITE since 2008 Notice to BT customers BT to dump Phorm, see Here for more information. No DPI If we have helped you in anyway, please consider Donating

07-13-2009, 06:13 PM	#9 (permalink)
bonsung Registered User Join Date: Jun 2009 Posts: 9 OS: xp	Re: Small spyware problem, worsening So I tried to remove the files in Norton Quarantine folder, and the site says, "Quarantine purge must be configured for each individual client or server from the program window and cannot be configured from within the Symantec System Center." I'm not sure what the program window is. Can you tell me, please? Thanks.

07-14-2009, 03:49 AM	#10 (permalink)
TheBruce1 Moderator, Analyst, Security Team Join Date: Oct 2006 Location: Dùn Èideann,Scotland. Posts: 5,093 OS: XP	Re: Small spyware problem, worsening Carry on with the rest of the instructions, we can deal with the Symantec issue later. __________________ Member of ASAP since 2007 Member of UNITE since 2008 Notice to BT customers BT to dump Phorm, see Here for more information. No DPI If we have helped you in anyway, please consider Donating

07-14-2009, 06:54 PM	#11 (permalink)
bonsung Registered User Join Date: Jun 2009 Posts: 9 OS: xp	Re: Small spyware problem, worsening Ok, so this is the CFscript log: ComboFix 09-07-14.07 - xadmin 07/14/2009 17:43.11.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1006.568 [GMT -7:00] Running from: c:\documents and settings\xadmin\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\xadmin\Desktop\CFscript.txt AV: Symantec AntiVirus Corporate Edition On-access scanning disabled (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C} FILE :: "c:\program files\Mozilla Firefox\plugins\npViewpoint.dll" "c:\windows\system32\wmmest.dll" . ((((((((((((((((((((((((( Files Created from 2009-06-15 to 2009-07-15 ))))))))))))))))))))))))))))))) . 2009-07-13 00:31 . 2009-07-13 00:31 -------- d-----w- c:\program files\Java 2009-07-10 03:23 . 2009-07-10 03:23 -------- d-----w- C:\rsit 2009-07-10 03:23 . 2009-07-10 03:23 -------- d-----w- c:\program files\trend micro 2009-06-30 01:33 . 2009-06-30 01:33 -------- d-sh--w- c:\windows\System Volume Information 2009-06-27 05:57 . 2009-06-27 05:57 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache 2009-06-27 04:45 . 2009-06-27 04:45 -------- d-sh--w- c:\documents and settings\xadmin\IECompatCache 2009-06-27 04:42 . 2009-06-27 04:42 -------- d-sh--w- c:\documents and settings\xadmin\PrivacIE 2009-06-27 04:40 . 2009-06-27 04:40 -------- d-sh--w- c:\documents and settings\xadmin\IETldCache 2009-06-27 04:34 . 2009-06-27 04:34 -------- d-----w- c:\windows\ie8updates 2009-06-27 04:30 . 2009-06-27 04:32 -------- dc-h--w- c:\windows\ie8 2009-06-27 04:28 . 2009-06-02 10:12 102912 -c----w- c:\windows\system32\dllcache\iecompat.dll 2009-06-27 04:28 . 2009-04-30 21:22 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll 2009-06-27 04:28 . 2009-04-30 21:22 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll 2009-06-25 04:14 . 2008-04-14 00:12 50176 -c--a-w- c:\windows\system32\dllcache\proquota.exe 2009-06-25 04:14 . 2008-04-14 00:12 50176 ----a-w- c:\windows\system32\proquota.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-07-13 00:31 . 2009-01-14 01:31 410984 ----a-w- c:\windows\system32\deploytk.dll 2009-07-12 23:54 . 2006-12-20 18:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Viewpoint 2009-07-12 23:54 . 2007-01-19 04:49 -------- d-----w- c:\documents and settings\xadmin\Application Data\Viewpoint 2009-06-26 00:55 . 2006-12-15 04:24 64432 ----a-w- c:\documents and settings\xadmin\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-06-14 22:24 . 2008-08-03 01:51 -------- d-----w- c:\program files\Starcraft 2009-06-13 17:35 . 2009-05-30 03:24 -------- d-----w- c:\program files\AIMTunes 2009-05-30 03:26 . 2009-05-30 03:21 -------- d-----w- c:\program files\AIM6 2009-05-30 03:25 . 2009-04-14 04:20 -------- d-----w- c:\documents and settings\All Users\Application Data\Tencent 2009-05-30 03:25 . 2009-04-14 04:19 5946704 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\aimqqgames\QQSetup65.exe 2009-05-30 03:24 . 2009-04-14 04:18 1144808 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\aimtunes\AIMTunes.exe 2009-05-30 03:13 . 2009-05-30 03:13 169 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.1\setup.exe 2009-05-30 03:13 . 2009-05-30 03:13 1178096 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.1\AIMinst.exe 2009-05-30 03:13 . 2009-05-30 03:13 15920 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.1\ocpchk.dll 2009-05-30 03:13 . 2009-05-30 03:12 579248 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.1\muinst.exe 2009-05-30 03:12 . 2009-05-30 03:12 46640 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.1\chckampx.dll 2009-05-30 03:12 . 2009-05-30 03:12 409640 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.1\vwpt.exe 2009-05-30 03:12 . 2009-05-30 03:12 87600 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.1\AOLFirewallMgr.dll 2009-05-30 03:12 . 2009-05-30 03:11 560784 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.1\AIMLang.exe 2009-05-30 03:12 . 2009-05-30 03:11 228912 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.1\migrator.exe 2009-05-30 03:12 . 2009-05-30 03:11 94256 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.1\instph.dll 2009-05-30 03:10 . 2006-12-20 18:40 -------- d-----w- c:\documents and settings\All Users\Application Data\AOL Downloads 2009-05-30 03:10 . 2009-05-30 03:10 168872 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\TRITON_CA_2.2.19.1\stmninst.exe 2009-05-30 03:09 . 2009-05-30 03:09 100432 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\TRITON_CA_2.2.19.1\aod.exe 2009-05-30 03:09 . 2009-05-30 03:09 44448 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\TRITON_CA_2.2.19.1\instopts.exe 2009-05-30 03:09 . 2009-05-30 03:09 13904 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\TRITON_CA_2.2.19.1\imappver.dll 2009-05-30 03:09 . 2009-05-30 03:09 601152 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\TRITON_CA_2.2.19.1\ampx.exe 2009-05-30 03:09 . 2009-05-30 03:09 80976 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\TRITON_CA_2.2.19.1\ProgUpd.dll 2009-05-30 03:09 . 2009-05-30 03:09 81176 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\TRITON_CA_2.2.19.1\alsetup.exe 2009-05-23 03:13 . 2009-05-23 03:13 -------- d-----w- c:\program files\Common Files\Software Update Utility 2009-05-23 03:11 . 2009-05-23 03:11 -------- d-----w- c:\documents and settings\All Users\Application Data\AIM 2009-05-23 03:10 . 2006-12-20 18:46 -------- d-----w- c:\documents and settings\All Users\Application Data\AOL 2009-05-13 05:15 . 2004-08-12 13:33 915456 ----a-w- c:\windows\system32\wininet.dll 2009-05-07 15:32 . 2004-08-12 13:21 345600 ----a-w- c:\windows\system32\localspl.dll 2009-04-17 12:26 . 2004-08-12 13:33 1847168 ----a-w- c:\windows\system32\win32k.sys 2009-04-25 21:25 . 2008-11-24 00:32 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll . (((((((((((((((((((((((((((((((((((((((((((( Look ))))))))))))))))))))))))))))))))))))))))))))))))))))))))) . ---- Directory of c:\windows\System Volume Information ---- ((((((((((((((((((((((((((((( SnapShot@2009-07-12_22.37.24 ))))))))))))))))))))))))))))))))))))))))) . + 2009-07-14 23:21 . 2009-07-14 23:21 16384 c:\windows\temp\Perflib_Perfdata_248.dat - 2009-06-26 01:22 . 2009-03-09 12:19 148888 c:\windows\system32\javaws.exe + 2009-07-13 00:31 . 2009-07-13 00:31 148888 c:\windows\system32\javaws.exe + 2009-07-13 00:31 . 2009-07-13 00:31 144792 c:\windows\system32\javaw.exe - 2009-06-26 01:22 . 2009-03-09 12:19 144792 c:\windows\system32\javaw.exe + 2009-07-13 00:31 . 2009-07-13 00:31 144792 c:\windows\system32\java.exe - 2009-06-26 01:22 . 2009-03-09 12:19 144792 c:\windows\system32\java.exe + 2009-07-13 00:31 . 2009-07-13 00:31 1563648 c:\windows\Installer\7449d.msi . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "AdobeUpdater"="c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2009-01-25 2356088] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208] "igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824] "igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688] "ZCfgSvc.exe"="c:\windows\system32\ZCfgSvc.exe" [2005-07-05 639040] "PRONoMgr.exe"="c:\program files\Intel\NCS\PROSet\PRONoMgr.exe" [2005-06-27 135168] "DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2006-11-12 157592] "ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2006-07-20 52896] "vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2006-09-28 125168] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-06-29 286720] "FixCamera"="c:\windows\FixCamera.exe" [2007-02-10 20480] "tsnpstd3"="c:\windows\tsnpstd3.exe" [2007-03-10 270336] "snpstd3"="c:\windows\vsnpstd3.exe" [2006-09-19 827392] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-13 148888] c:\documents and settings\All Users\Start Menu\Programs\Startup\ HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472] hp psc 1000 series.lnk - c:\program files\HP\Digital Imaging\bin\hpohmr08.exe [2002-12-2 147456] hpoddt01.exe.lnk - c:\program files\HP\Digital Imaging\bin\hpotdd01.exe [2002-12-2 40960] Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588] WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2006-12-16 118784] [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoSetActiveDesktop"= 1 (0x1) "NoActiveDesktopChanges"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Sebring] 2005-07-05 09:33 188482 ----a-w- c:\windows\system32\LgNotify.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"= "c:\\Program Files\\AIM\\aim.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "c:\\Program Files\\AIM6\\aolsoftware.exe"= "c:\\Program Files\\Tencent\\QQ Games\\QQGames.exe"= "c:\\Program Files\\Tencent\\QQ Games\\QQGamesD.exe"= "c:\\Program Files\\Tencent\\QQ Games\\Update\\Update.exe"= "c:\\Program Files\\AIM6\\aim6.exe"= R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [6/17/2009 2:10 PM 101936] S3 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [9/27/2006 9:33 PM 116464] --- Other Services/Drivers In Memory --- Deregistered - EraserUtilDrvI7 [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] "c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP . Contents of the 'Scheduled Tasks' folder 2009-07-09 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 20:42] 2008-04-13 c:\windows\Tasks\FRU Task 2002-12-03 04:38ewlett-Packard2002-12-03 04:38p psc 1200 series84887B468ABA3F57D76752217D5938688025EB21193638819.job - c:\program files\HP\Digital Imaging\Bin\hpqfrucl.exe [2002-12-03 03:38] 2009-07-14 c:\windows\Tasks\User_Feed_Synchronization-{8E76F419-D211-429D-96C6-7F178DB46BBE}.job - c:\windows\system32\msfeedssync.exe [2006-10-17 11:31] 2009-07-14 c:\windows\Tasks\WGASetup.job - c:\windows\system32\KB905474\wgasetup.exe [2009-04-10 05:18] . . ------- Supplementary Scan ------- . IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\xadmin\Application Data\Mozilla\Firefox\Profiles\48d47s85.default\ FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=tb50fftrie7&query= FF - prefs.js: browser.search.selectedEngine - AIM Search FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=tb50fftrab&query= ---- FIREFOX POLICIES ---- FF - user.js: protocol-handler.warn-external.dnUpdate - false FF - user.js: browser.sessionstore.resume_from_crash - false . ************************************************************************ catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-07-14 17:49 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************ . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(924) c:\windows\system32\LgNotify.dll c:\windows\system32\igfxdev.dll - - - - - - - > 'explorer.exe'(2772) c:\windows\system32\WININET.dll c:\progra~1\WINDOW~2\wmpband.dll c:\windows\system32\ieframe.dll c:\windows\system32\webcheck.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . Completion time: 2009-07-15 17:52 ComboFix-quarantined-files.txt 2009-07-15 00:51 ComboFix2.txt 2009-07-13 23:39 ComboFix3.txt 2009-07-12 22:44 ComboFix4.txt 2009-06-25 04:16 Pre-Run: 22,389,460,992 bytes free Post-Run: 22,351,568,896 bytes free 202 --- E O F --- 2009-06-11 00:37

07-15-2009, 07:22 PM	#13 (permalink)
bonsung Registered User Join Date: Jun 2009 Posts: 9 OS: xp	Re: Small spyware problem, worsening Ok, thanks so much, you helped a ton!

07-16-2009, 04:05 AM	#14 (permalink)
TheBruce1 Moderator, Analyst, Security Team Join Date: Oct 2006 Location: Dùn Èideann,Scotland. Posts: 5,093 OS: XP	Re: Small spyware problem, worsening Glad we could help, take care __________________ Member of ASAP since 2007 Member of UNITE since 2008 Notice to BT customers BT to dump Phorm, see Here for more information. No DPI If we have helped you in anyway, please consider Donating