I need some help please.

Oganix99 · 10-31-2009, 02:44 PM

I have a virus/malware called Antivirus System Pro, I made a post In the networking forum ( I need some help please )because my Internet connection went out when I got the virus and I haven't been able to connect since.

Oh and btw these forums are Great! really infromative, and its nice to know whomever is helping me knows what their doing cuz I don't

Oganix99 · 11-01-2009, 09:17 PM

UPDATE/BUMP: Ok I finally got my internet connection working again. I tried installing AVG, Avira Antivi Personal, neither would Install so I tried Spyware Doctor with AntiVirus and was able to install and run a scan, It scanned upto 4% then froze, It found 5 threats and 39 infections, but couldn't remove anything.

I downloaded DDS to my desktop, but I can't run it because I think I may have a script blocker and Im not sure how to turn it off. any help would be greatly appriciated. thanks.

Ried · 11-02-2009, 09:59 AM

Hello Oganix99,

Run the required scans from Safe Mode. Be sure to run the gmer scan as well, and run it as outlined in our pre-posting topic.

Oganix99 · 11-02-2009, 03:28 PM

Hi Ried, This virus seems to be controlling everything or somthing, Nothing seems to work right. The DDS will open a block box for 2-3 seconds and then close. I ran the GMER.exe it was scanning for about an hour then disapeared now it has to startover. I ran them in safe mode and follow'd the directions.

Ried · 11-02-2009, 10:04 PM

See if this scanner will run for you...

Download rsit.exe and save it to your desktop.

Double click on RSIT.exe to run it.
Click Continue at the disclaimer screen.
Once it has finished, two logs will open. Please post the contents of both log.txt (<<will be maximized) and info.txt (<<will be minimized)

If you do not see the info.txt you can find it in the C:\rsit folder. Please attach that .txt

And we'll try another rootkit scanner.

Download RootRepeal from any of the links below:

http://download.bleepingcomputer.com...RootRepeal.exe
http://ad13.geekstogo.com/RootRepeal.exe
http://rootrepeal.psikotick.com/RootRepeal.exe

Extract RootRepeal.exe from the zip archive.
Open on your desktop.
Click the tab.
Click the button.
Check all boxes
Click Ok
Check the box for your main system drive (Usually C:), and click Ok.
Allow RootRepeal to run a scan of your system. This may take some time.
Once the scan completes, push the button. Save the log to your desktop, using a distinctive name, such as RootRepeal.txt. Include this report in your next reply, please.

Oganix99 · 11-03-2009, 03:35 PM

These ones don't seem to work either.

When I run RSIT right after I click 'continue' I get an Autoit Error: Line -1 Error Variable used without being declard. Click Ok everything closes.

I ran Rootrepeal it scanned for about 3 mins then disapeared and made a DAT file called ''settings'' that says You are attempting to open a file of type 'DAT FILE' These files are used by the operating system by various programs. editing or modifying them could damage your system. Click ok or cancel so I clicked Cancel. Now if I try to run Rootrepeal again I get an Error: Windows cannot access the specified device, path, or file. You may not have the appropriate permmisions to access the item.

Ried · 11-03-2009, 10:41 PM

Download rkill from any of the following links and save it to your desktop:

Rkill.com
Rkill.scr
Rkill.pif

If the one with the .com extension doesn't run for you, try the next one, etc.

After you run it, immediately run rsit.exe and RootRepeal. Please post those logs.

Oganix99 · 11-04-2009, 12:46 AM

Still can't get the DDS or RSIT to run, but I got a rootrepeal scan.

ROOTREPEAL (c) AD, 2007-2009
==================================================
Scan Start Time: 2009/11/03 21:38
Program Version: Version 1.3.5.0
Windows Version: Windows XP SP2
==================================================

Drivers
-------------------
Name: 1394BUS.SYS
Image Path: C:\WINDOWS\system32\DRIVERS\1394BUS.SYS
Address: 0xF772D000 Size: 53248 File Visible: - Signed: -
Status: -

Name: ACPI.sys
Image Path: ACPI.sys
Address: 0xF76BE000 Size: 187776 File Visible: - Signed: -
Status: -

Name: ACPI_HAL
Image Path: \Driver\ACPI_HAL
Address: 0x804D7000 Size: 2252800 File Visible: - Signed: -
Status: -

Name: ACPIEC.sys
Image Path: ACPIEC.sys
Address: 0xF7B29000 Size: 11648 File Visible: - Signed: -
Status: -

Name: afd.sys
Image Path: C:\WINDOWS\System32\drivers\afd.sys
Address: 0xF71C0000 Size: 138368 File Visible: - Signed: -
Status: -

Name: aliide.sys
Image Path: aliide.sys
Address: 0xF7C11000 Size: 5248 File Visible: - Signed: -
Status: -

Name: Apfiltr.sys
Image Path: C:\WINDOWS\system32\DRIVERS\Apfiltr.sys
Address: 0xF7496000 Size: 91712 File Visible: - Signed: -
Status: -

Name: atapi.sys
Image Path: atapi.sys
Address: 0xF7658000 Size: 95360 File Visible: - Signed: -
Status: -

Name: atiide.sys
Image Path: atiide.sys
Address: 0xF7C17000 Size: 5632 File Visible: - Signed: -
Status: -

Name: atisgkaf.sys
Image Path: atisgkaf.sys
Address: 0xF7B31000 Size: 13088 File Visible: - Signed: -
Status: -

Name: ATMFD.DLL
Image Path: C:\WINDOWS\System32\ATMFD.DLL
Address: 0xBFFA0000 Size: 286720 File Visible: - Signed: -
Status: -

Name: BATTC.SYS
Image Path: C:\WINDOWS\system32\DRIVERS\BATTC.SYS
Address: 0xF7B25000 Size: 16384 File Visible: - Signed: -
Status: -

Name: bcmwl5.sys
Image Path: C:\WINDOWS\system32\DRIVERS\bcmwl5.sys
Address: 0xF743B000 Size: 371712 File Visible: - Signed: -
Status: -

Name: Beep.SYS
Image Path: C:\WINDOWS\System32\Drivers\Beep.SYS
Address: 0xF7C2D000 Size: 4224 File Visible: - Signed: -
Status: -

Name: BOOTVID.dll
Image Path: C:\WINDOWS\system32\BOOTVID.dll
Address: 0xF7B1D000 Size: 12288 File Visible: - Signed: -
Status: -

Name: Cdfs.SYS
Image Path: C:\WINDOWS\System32\Drivers\Cdfs.SYS
Address: 0xF787D000 Size: 63744 File Visible: - Signed: -
Status: -

Name: cdrbsdrv.SYS
Image Path: C:\WINDOWS\System32\Drivers\cdrbsdrv.SYS
Address: 0xF7BC5000 Size: 12736 File Visible: - Signed: -
Status: -

Name: cdrom.sys
Image Path: C:\WINDOWS\system32\DRIVERS\cdrom.sys
Address: 0xF77AD000 Size: 49536 File Visible: - Signed: -
Status: -

Name: CLASSPNP.SYS
Image Path: C:\WINDOWS\system32\DRIVERS\CLASSPNP.SYS
Address: 0xF776D000 Size: 53248 File Visible: - Signed: -
Status: -

Name: compbatt.sys
Image Path: compbatt.sys
Address: 0xF7B21000 Size: 9344 File Visible: - Signed: -
Status: -

Name: disk.sys
Image Path: disk.sys
Address: 0xF775D000 Size: 36352 File Visible: - Signed: -
Status: -

Name: dump_atapi.sys
Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys
Address: 0xF70E6000 Size: 98304 File Visible: No Signed: -
Status: -

Name: dump_WMILIB.SYS
Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS
Address: 0xF7C3B000 Size: 8192 File Visible: No Signed: -
Status: -

Name: Dxapi.sys
Image Path: C:\WINDOWS\System32\drivers\Dxapi.sys
Address: 0xF7BED000 Size: 12288 File Visible: - Signed: -
Status: -

Name: dxg.sys
Image Path: C:\WINDOWS\System32\drivers\dxg.sys
Address: 0xBF9C3000 Size: 73728 File Visible: - Signed: -
Status: -

Name: dxgthk.sys
Image Path: C:\WINDOWS\System32\drivers\dxgthk.sys
Address: 0xF7CDE000 Size: 4096 File Visible: - Signed: -
Status: -

Name: fdc.sys
Image Path: C:\WINDOWS\system32\DRIVERS\fdc.sys
Address: 0xF7A0D000 Size: 27392 File Visible: - Signed: -
Status: -

Name: fltMgr.sys
Image Path: fltMgr.sys
Address: 0xF7638000 Size: 128896 File Visible: - Signed: -
Status: -

Name: framebuf.dll
Image Path: C:\WINDOWS\System32\framebuf.dll
Address: 0xBFF50000 Size: 12288 File Visible: - Signed: -
Status: -

Name: Fs_Rec.SYS
Image Path: C:\WINDOWS\System32\Drivers\Fs_Rec.SYS
Address: 0xF7C29000 Size: 7936 File Visible: - Signed: -
Status: -

Name: ftdisk.sys
Image Path: ftdisk.sys
Address: 0xF7670000 Size: 125056 File Visible: - Signed: -
Status: -

Name: GEARAspiWDM.sys
Image Path: C:\WINDOWS\SYSTEM32\DRIVERS\GEARAspiWDM.sys
Address: 0xF79E5000 Size: 28672 File Visible: - Signed: -
Status: -

Name: hal.dll
Image Path: C:\WINDOWS\system32\hal.dll
Address: 0x806FD000 Size: 134400 File Visible: - Signed: -
Status: -

Name: i8042prt.sys
Image Path: C:\WINDOWS\system32\DRIVERS\i8042prt.sys
Address: 0xF77CD000 Size: 52736 File Visible: - Signed: -
Status: -

Name: imapi.sys
Image Path: C:\WINDOWS\system32\DRIVERS\imapi.sys
Address: 0xF779D000 Size: 41856 File Visible: - Signed: -
Status: -

Name: intelide.sys
Image Path: intelide.sys
Address: 0xF7C15000 Size: 5504 File Visible: - Signed: -
Status: -

Name: ipnat.sys
Image Path: C:\WINDOWS\system32\DRIVERS\ipnat.sys
Address: 0xF720A000 Size: 134912 File Visible: - Signed: -
Status: -

Name: ipsec.sys
Image Path: C:\WINDOWS\system32\DRIVERS\ipsec.sys
Address: 0xF7283000 Size: 74752 File Visible: - Signed: -
Status: -

Name: isapnp.sys
Image Path: isapnp.sys
Address: 0xF770D000 Size: 35840 File Visible: - Signed: -
Status: -

Name: kbdclass.sys
Image Path: C:\WINDOWS\system32\DRIVERS\kbdclass.sys
Address: 0xF79ED000 Size: 24576 File Visible: - Signed: -
Status: -

Name: KDCOM.DLL
Image Path: C:\WINDOWS\system32\KDCOM.DLL
Address: 0xF7C0D000 Size: 8192 File Visible: - Signed: -
Status: -

Name: ks.sys
Image Path: C:\WINDOWS\system32\DRIVERS\ks.sys
Address: 0xF74AD000 Size: 143360 File Visible: - Signed: -
Status: -

Name: KSecDD.sys
Image Path: KSecDD.sys
Address: 0xF7621000 Size: 92544 File Visible: - Signed: -
Status: -

Name: mouclass.sys
Image Path: C:\WINDOWS\system32\DRIVERS\mouclass.sys
Address: 0xF79FD000 Size: 23040 File Visible: - Signed: -
Status: -

Name: MountMgr.sys
Image Path: MountMgr.sys
Address: 0xF773D000 Size: 42240 File Visible: - Signed: -
Status: -

Name: mrxsmb.sys
Image Path: C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
Address: 0xF7126000 Size: 453632 File Visible: - Signed: -
Status: -

Name: Msfs.SYS
Image Path: C:\WINDOWS\System32\Drivers\Msfs.SYS
Address: 0xF7A8D000 Size: 19072 File Visible: - Signed: -
Status: -

Name: msgpc.sys
Image Path: C:\WINDOWS\system32\DRIVERS\msgpc.sys
Address: 0xF780D000 Size: 35072 File Visible: - Signed: -
Status: -

Name: mssmbios.sys
Image Path: C:\WINDOWS\system32\DRIVERS\mssmbios.sys
Address: 0xF7BF1000 Size: 15488 File Visible: - Signed: -
Status: -

Name: Mup.sys
Image Path: Mup.sys
Address: 0xF754C000 Size: 107904 File Visible: - Signed: -
Status: -

Name: NDIS.sys
Image Path: NDIS.sys
Address: 0xF7567000 Size: 182912 File Visible: - Signed: -
Status: -

Name: ndistapi.sys
Image Path: C:\WINDOWS\system32\DRIVERS\ndistapi.sys
Address: 0xF7BDD000 Size: 9600 File Visible: - Signed: -
Status: -

Name: ndisuio.sys
Image Path: C:\WINDOWS\system32\DRIVERS\ndisuio.sys
Address: 0xF6E9A000 Size: 12928 File Visible: - Signed: -
Status: -

Name: ndiswan.sys
Image Path: C:\WINDOWS\system32\DRIVERS\ndiswan.sys
Address: 0xF73FC000 Size: 91776 File Visible: - Signed: -
Status: -

Name: NDProxy.SYS
Image Path: C:\WINDOWS\System32\Drivers\NDProxy.SYS
Address: 0xF783D000 Size: 38016 File Visible: - Signed: -
Status: -

Name: netbios.sys
Image Path: C:\WINDOWS\system32\DRIVERS\netbios.sys
Address: 0xF785D000 Size: 34560 File Visible: - Signed: -
Status: -

Name: netbt.sys
Image Path: C:\WINDOWS\system32\DRIVERS\netbt.sys
Address: 0xF71E2000 Size: 162816 File Visible: - Signed: -
Status: -

Name: Npfs.SYS
Image Path: C:\WINDOWS\System32\Drivers\Npfs.SYS
Address: 0xF7A9D000 Size: 30848 File Visible: - Signed: -
Status: -

Name: Ntfs.sys
Image Path: Ntfs.sys
Address: 0xF7594000 Size: 574464 File Visible: - Signed: -
Status: -

Name: ntoskrnl.exe
Image Path: C:\WINDOWS\system32\ntoskrnl.exe
Address: 0x804D7000 Size: 2252800 File Visible: - Signed: -
Status: -

Name: Null.SYS
Image Path: C:\WINDOWS\System32\Drivers\Null.SYS
Address: 0xF7DA1000 Size: 2944 File Visible: - Signed: -
Status: -

Name: ohci1394.sys
Image Path: ohci1394.sys
Address: 0xF771D000 Size: 61056 File Visible: - Signed: -
Status: -

Name: OPRGHDLR.SYS
Image Path: C:\WINDOWS\system32\DRIVERS\OPRGHDLR.SYS
Address: 0xF7CD6000 Size: 4096 File Visible: - Signed: -
Status: -

Name: PartMgr.sys
Image Path: PartMgr.sys
Address: 0xF7995000 Size: 18688 File Visible: - Signed: -
Status: -

Name: pci.sys
Image Path: pci.sys
Address: 0xF76AD000 Size: 68224 File Visible: - Signed: -
Status: -

Name: pciide.sys
Image Path: pciide.sys
Address: 0xF7CD5000 Size: 3328 File Visible: - Signed: -
Status: -

Name: PCIIDEX.SYS
Image Path: C:\WINDOWS\system32\DRIVERS\PCIIDEX.SYS
Address: 0xF798D000 Size: 28672 File Visible: - Signed: -
Status: -

Name: pcmcia.sys
Image Path: pcmcia.sys
Address: 0xF768F000 Size: 119936 File Visible: - Signed: -
Status: -

Name: pfc.sys
Image Path: C:\WINDOWS\system32\drivers\pfc.sys
Address: 0xF7BBD000 Size: 10368 File Visible: - Signed: -
Status: -

Name: PnpManager
Image Path: \Driver\PnpManager
Address: 0x804D7000 Size: 2252800 File Visible: - Signed: -
Status: -

Name: psched.sys
Image Path: C:\WINDOWS\system32\DRIVERS\psched.sys
Address: 0xF73EB000 Size: 69120 File Visible: - Signed: -
Status: -

Name: ptilink.sys
Image Path: C:\WINDOWS\system32\DRIVERS\ptilink.sys
Address: 0xF7A45000 Size: 17792 File Visible: - Signed: -
Status: -

Name: PxHelp20.sys
Image Path: PxHelp20.sys
Address: 0xF799D000 Size: 19936 File Visible: - Signed: -
Status: -

Name: rasacd.sys
Image Path: C:\WINDOWS\system32\DRIVERS\rasacd.sys
Address: 0xF7504000 Size: 8832 File Visible: - Signed: -
Status: -

Name: rasl2tp.sys
Image Path: C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
Address: 0xF77DD000 Size: 51328 File Visible: - Signed: -
Status: -

Name: raspppoe.sys
Image Path: C:\WINDOWS\system32\DRIVERS\raspppoe.sys
Address: 0xF77ED000 Size: 41472 File Visible: - Signed: -
Status: -

Name: raspptp.sys
Image Path: C:\WINDOWS\system32\DRIVERS\raspptp.sys
Address: 0xF77FD000 Size: 48384 File Visible: - Signed: -
Status: -

Name: raspti.sys
Image Path: C:\WINDOWS\system32\DRIVERS\raspti.sys
Address: 0xF7A55000 Size: 16512 File Visible: - Signed: -
Status: -

Name: RAW
Image Path: \FileSystem\RAW
Address: 0x804D7000 Size: 2252800 File Visible: - Signed: -
Status: -

Name: rdbss.sys
Image Path: C:\WINDOWS\system32\DRIVERS\rdbss.sys
Address: 0xF7195000 Size: 174592 File Visible: - Signed: -
Status: -

Name: RDPCDD.sys
Image Path: C:\WINDOWS\System32\DRIVERS\RDPCDD.sys
Address: 0xF7C31000 Size: 4224 File Visible: - Signed: -
Status: -

Name: redbook.sys
Image Path: C:\WINDOWS\system32\DRIVERS\redbook.sys
Address: 0xF77BD000 Size: 57472 File Visible: - Signed: -
Status: -

Name: rootrepeal[1].sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal[1].sys
Address: 0xF6CDE000 Size: 49152 File Visible: No Signed: -
Status: -

Name: serial.sys
Image Path: serial.sys
Address: 0xF777D000 Size: 64896 File Visible: - Signed: -
Status: -

Name: srv.sys
Image Path: C:\WINDOWS\system32\DRIVERS\srv.sys
Address: 0xF6BFC000 Size: 333184 File Visible: - Signed: -
Status: -

Name: swenum.sys
Image Path: C:\WINDOWS\system32\DRIVERS\swenum.sys
Address: 0xF7C1D000 Size: 4352 File Visible: - Signed: -
Status: -

Name: tcpip.sys
Image Path: C:\WINDOWS\system32\DRIVERS\tcpip.sys
Address: 0xF722B000 Size: 360320 File Visible: - Signed: -
Status: -

Name: TDI.SYS
Image Path: C:\WINDOWS\system32\DRIVERS\TDI.SYS
Address: 0xF7A35000 Size: 20480 File Visible: - Signed: -
Status: -

Name: termdd.sys
Image Path: C:\WINDOWS\system32\DRIVERS\termdd.sys
Address: 0xF781D000 Size: 40704 File Visible: - Signed: -
Status: -

Name: tiumflt.sys
Image Path: tiumflt.sys
Address: 0xF7B2D000 Size: 8448 File Visible: - Signed: -
Status: -

Name: update.sys
Image Path: C:\WINDOWS\system32\DRIVERS\update.sys
Address: 0xF7392000 Size: 364160 File Visible: - Signed: -
Status: -

Name: USBD.SYS
Image Path: C:\WINDOWS\system32\DRIVERS\USBD.SYS
Address: 0xF7C21000 Size: 8192 File Visible: - Signed: -
Status: -

Name: usbehci.sys
Image Path: C:\WINDOWS\system32\DRIVERS\usbehci.sys
Address: 0xF7A15000 Size: 26624 File Visible: - Signed: -
Status: -

Name: usbhub.sys
Image Path: C:\WINDOWS\system32\DRIVERS\usbhub.sys
Address: 0xF782D000 Size: 57600 File Visible: - Signed: -
Status: -

Name: usbohci.sys
Image Path: C:\WINDOWS\system32\DRIVERS\usbohci.sys
Address: 0xF79CD000 Size: 17024 File Visible: - Signed: -
Status: -

Name: USBPORT.SYS
Image Path: C:\WINDOWS\system32\DRIVERS\USBPORT.SYS
Address: 0xF74D0000 Size: 143360 File Visible: - Signed: -
Status: -

Name: VETFDDNT.SYS
Image Path: C:\WINDOWS\System32\Drivers\VETFDDNT.SYS
Address: 0xF7510000 Size: 16128 File Visible: - Signed: -
Status: -

Name: vga.sys
Image Path: C:\WINDOWS\System32\drivers\vga.sys
Address: 0xF7A7D000 Size: 20992 File Visible: - Signed: -
Status: -

Name: viaide.sys
Image Path: viaide.sys
Address: 0xF7C13000 Size: 5376 File Visible: - Signed: -
Status: -

Name: VIDEOPRT.SYS
Image Path: C:\WINDOWS\System32\drivers\VIDEOPRT.SYS
Address: 0xF72B6000 Size: 81920 File Visible: - Signed: -
Status: -

Name: VolSnap.sys
Image Path: VolSnap.sys
Address: 0xF774D000 Size: 52352 File Visible: - Signed: -
Status: -

Name: watchdog.sys
Image Path: C:\WINDOWS\System32\watchdog.sys
Address: 0xF7AE5000 Size: 20480 File Visible: - Signed: -
Status: -

Name: Win32k
Image Path: \Driver\Win32k
Address: 0xBF800000 Size: 1847296 File Visible: - Signed: -
Status: -

Name: win32k.sys
Image Path: C:\WINDOWS\System32\win32k.sys
Address: 0xBF800000 Size: 1847296 File Visible: - Signed: -
Status: -

Name: win32k.sys:1
Image Path: C:\WINDOWS\win32k.sys:1
Address: 0xF7AED000 Size: 20480 File Visible: No Signed: -
Status: -

Name: win32k.sys:2
Image Path: C:\WINDOWS\win32k.sys:2
Address: 0xF72FA000 Size: 61440 File Visible: No Signed: -
Status: -

Name: wmiacpi.sys
Image Path: C:\WINDOWS\system32\DRIVERS\wmiacpi.sys
Address: 0xF7BAD000 Size: 8832 File Visible: - Signed: -
Status: -

Name: WMILIB.SYS
Image Path: C:\WINDOWS\system32\DRIVERS\WMILIB.SYS
Address: 0xF7C0F000 Size: 8192 File Visible: - Signed: -
Status: -

Name: WMIxWDM
Image Path: \Driver\WMIxWDM
Address: 0x804D7000 Size: 2252800 File Visible: - Signed: -
Status: -

Ried · 11-04-2009, 06:52 AM

Please save this file to your desktop. Double-click on it to run a scan. When it's finished, there will be a log called Win32kDiag.txt on your desktop. Please open it with notepad and post the contents here.

Oganix99 · 11-04-2009, 03:08 PM

Running from: C:\Documents and Settings\Office Depot\Desktop\Win32kDiag.exe

Log file at : C:\Documents and Settings\Office Depot\Desktop\Win32kDiag.txt

WARNING: Could not get backup privileges!

Searching 'C:\WINDOWS'...

Found mount point : C:\WINDOWS\addins\addins

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP107.tmp\ZAP107.tmp

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP11F.tmp\ZAP11F.tmp

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP191.tmp\ZAP191.tmp

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP236.tmp\ZAP236.tmp

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP292.tmp\ZAP292.tmp

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP319.tmp\ZAP319.tmp

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP345.tmp\ZAP345.tmp

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP35A.tmp\ZAP35A.tmp

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP370.tmp\ZAP370.tmp

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\assembly\temp\temp

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\assembly\tmp\tmp

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Config\Config

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Connection Wizard\Connection Wizard

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Debug\UserMode\UserMode

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Help\SBSI\Training\WXPPer\Cbz\Cbz

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Help\SBSI\Training\WXPPer\Lib\Lib

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Help\SBSI\Training\WXPPer\Wave\Wave

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\ime\chsime\applets\applets

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\ime\CHTIME\Applets\Applets

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\ime\imejp\applets\applets

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\ime\imejp98\imejp98

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\ime\imjp8_1\applets\applets

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\ime\imkr6_1\applets\applets

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\ime\imkr6_1\dicts\dicts

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\ime\shared\res\res

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\0DC1503A46F231838AD88BCDDC8E8F7C\3.2.30729\3.2.30729

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\DC3BF90CC0D3D2F398A9A6D1762F70F3\2.2.30729\2.2.30729

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\java\classes\classes

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\java\trustlib\trustlib

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Temporary ASP.NET Files\Bind Logs\Bind Logs

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files\Temporary ASP.NET Files

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Minidump\Minidump

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\msapps\msinfo\msinfo

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\mui\mui

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\pchealth\ERRORREP\QHEADLES\QHEADLES

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\pchealth\ERRORREP\QSIGNOFF\QSIGNOFF

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\pchealth\helpctr\BATCH\BATCH

Mount point destination : \Device\__max++>\^

Cannot access: C:\WINDOWS\pchealth\helpctr\binaries\HelpSvc.exe

[1] 2004-08-03 22:00:00 743936 C:\WINDOWS\pchealth\helpctr\binaries\HelpSvc.exe ()

[1] 2008-04-13 14:12:21 744448 C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\helpsvc.exe (Microsoft Corporation)

Ried · 11-04-2009, 08:23 PM

Click Start->Run, and copy-paste the following bolded text into the Run box, and click OK.

"%userprofile%\desktop\win32kdiag.exe" -f -r

When it's finished, there will be a log called Win32kDiag.txt on your desktop. I'll need to see that in your next reply.

=====================================================================

Download OTL to your desktop.

Double click the icon to start the tool.

Click Run Scan and let the program run uninterrupted.
When the scan is complete, two text files will be created, OTL.Txt <- this one will be opened in Notepad and Extras.txt, on Desktop.

Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of OTL.Txt and the Extras.txt in your next reply.

Oganix99 · 11-04-2009, 10:59 PM

ok here's there Win32kDiag.txt

Running from: C:\Documents and Settings\Office Depot\desktop\win32kdiag.exe

Log file at : C:\Documents and Settings\Office Depot\Desktop\Win32kDiag.txt

Removing all found mount points.

Attempting to reset file permissions.

WARNING: Could not get backup privileges!

Searching 'C:\WINDOWS'...

Found mount point : C:\WINDOWS\addins\addins

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\addins\addins

Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP107.tmp\ZAP107.tmp

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP107.tmp\ZAP107.tmp

Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP11F.tmp\ZAP11F.tmp

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP11F.tmp\ZAP11F.tmp

Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP191.tmp\ZAP191.tmp

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP191.tmp\ZAP191.tmp

Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP236.tmp\ZAP236.tmp

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP236.tmp\ZAP236.tmp

Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP292.tmp\ZAP292.tmp

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP292.tmp\ZAP292.tmp

Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP319.tmp\ZAP319.tmp

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP319.tmp\ZAP319.tmp

Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP345.tmp\ZAP345.tmp

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP345.tmp\ZAP345.tmp

Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP35A.tmp\ZAP35A.tmp

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP35A.tmp\ZAP35A.tmp

Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP370.tmp\ZAP370.tmp

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP370.tmp\ZAP370.tmp

Found mount point : C:\WINDOWS\assembly\temp\temp

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\assembly\temp\temp

Found mount point : C:\WINDOWS\assembly\tmp\tmp

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\assembly\tmp\tmp

Found mount point : C:\WINDOWS\Config\Config

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\Config\Config

Found mount point : C:\WINDOWS\Connection Wizard\Connection Wizard

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\Connection Wizard\Connection Wizard

Found mount point : C:\WINDOWS\Debug\UserMode\UserMode

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\Debug\UserMode\UserMode

Found mount point : C:\WINDOWS\Help\SBSI\Training\WXPPer\Cbz\Cbz

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\Help\SBSI\Training\WXPPer\Cbz\Cbz

Found mount point : C:\WINDOWS\Help\SBSI\Training\WXPPer\Lib\Lib

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\Help\SBSI\Training\WXPPer\Lib\Lib

Found mount point : C:\WINDOWS\Help\SBSI\Training\WXPPer\Wave\Wave

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\Help\SBSI\Training\WXPPer\Wave\Wave

Found mount point : C:\WINDOWS\ime\chsime\applets\applets

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\ime\chsime\applets\applets

Found mount point : C:\WINDOWS\ime\CHTIME\Applets\Applets

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\ime\CHTIME\Applets\Applets

Found mount point : C:\WINDOWS\ime\imejp\applets\applets

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\ime\imejp\applets\applets

Found mount point : C:\WINDOWS\ime\imejp98\imejp98

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\ime\imejp98\imejp98

Found mount point : C:\WINDOWS\ime\imjp8_1\applets\applets

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\ime\imjp8_1\applets\applets

Found mount point : C:\WINDOWS\ime\imkr6_1\applets\applets

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\ime\imkr6_1\applets\applets

Found mount point : C:\WINDOWS\ime\imkr6_1\dicts\dicts

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\ime\imkr6_1\dicts\dicts

Found mount point : C:\WINDOWS\ime\shared\res\res

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\ime\shared\res\res

Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\0DC1503A46F231838AD88BCDDC8E8F7C\3.2.30729\3.2.30729

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\0DC1503A46F231838AD88BCDDC8E8F7C\3.2.30729\3.2.30729

Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\DC3BF90CC0D3D2F398A9A6D1762F70F3\2.2.30729\2.2.30729

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\DC3BF90CC0D3D2F398A9A6D1762F70F3\2.2.30729\2.2.30729

Found mount point : C:\WINDOWS\java\classes\classes

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\java\classes\classes

Found mount point : C:\WINDOWS\java\trustlib\trustlib

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\java\trustlib\trustlib

Found mount point : C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Temporary ASP.NET Files\Bind Logs\Bind Logs

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Temporary ASP.NET Files\Bind Logs\Bind Logs

Found mount point : C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files\Temporary ASP.NET Files

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files\Temporary ASP.NET Files

Found mount point : C:\WINDOWS\Minidump\Minidump

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\Minidump\Minidump

Found mount point : C:\WINDOWS\msapps\msinfo\msinfo

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\msapps\msinfo\msinfo

Found mount point : C:\WINDOWS\mui\mui

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\mui\mui

Found mount point : C:\WINDOWS\pchealth\ERRORREP\QHEADLES\QHEADLES

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\pchealth\ERRORREP\QHEADLES\QHEADLES

Found mount point : C:\WINDOWS\pchealth\ERRORREP\QSIGNOFF\QSIGNOFF

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\pchealth\ERRORREP\QSIGNOFF\QSIGNOFF

Found mount point : C:\WINDOWS\pchealth\helpctr\BATCH\BATCH

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\pchealth\helpctr\BATCH\BATCH

Cannot access: C:\WINDOWS\pchealth\helpctr\binaries\HelpSvc.exe

Attempting to restore permissions of : C:\WINDOWS\pchealth\helpctr\binaries\HelpSvc.exe

Found mount point : C:\WINDOWS\pchealth\helpctr\Config\CheckPoint\CheckPoint

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\pchealth\helpctr\Config\CheckPoint\CheckPoint

Found mount point : C:\WINDOWS\pchealth\helpctr\Config\News\News

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\pchealth\helpctr\Config\News\News

Found mount point : C:\WINDOWS\pchealth\helpctr\HelpFiles\HelpFiles

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\pchealth\helpctr\HelpFiles\HelpFiles

Found mount point : C:\WINDOWS\pchealth\helpctr\InstalledSKUs\InstalledSKUs

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\pchealth\helpctr\InstalledSKUs\InstalledSKUs

Found mount point : C:\WINDOWS\pchealth\helpctr\System\DFS\DFS

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\pchealth\helpctr\System\DFS\DFS

Found mount point : C:\WINDOWS\pchealth\helpctr\Temp\Temp

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\pchealth\helpctr\Temp\Temp

Found mount point : C:\WINDOWS\PIF\PIF

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\PIF\PIF

Found mount point : C:\WINDOWS\Registration\CRMLog\CRMLog

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\Registration\CRMLog\CRMLog

Found mount point : C:\WINDOWS\security\logs\logs

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\security\logs\logs

Found mount point : C:\WINDOWS\SoftwareDistribution\AuthCabs\Downloaded\Downloaded

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\SoftwareDistribution\AuthCabs\Downloaded\Downloaded

Found mount point : C:\WINDOWS\SoftwareDistribution\Download\355f788b6de8a3ec79e9aa172e6317f1\backup\backup

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\SoftwareDistribution\Download\355f788b6de8a3ec79e9aa172e6317f1\backup\backup

Found mount point : C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\asms\10\policy\policy

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\asms\10\policy\policy

Found mount point : C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\asms\51\msft\msft

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\asms\51\msft\msft

Found mount point : C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\asms\51\policy\msft\msft

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\asms\51\policy\msft\msft

Found mount point : C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\asms\52\msft\msft

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\asms\52\msft\msft

Found mount point : C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\asms\52\policy\msft\msft

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\asms\52\policy\msft\msft

Found mount point : C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\asms\60\msft\msft

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\asms\60\msft\msft

Found mount point : C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\asms\70\70

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\asms\70\70

Found mount point : C:\WINDOWS\Sun\Java\Deployment\Deployment

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\Sun\Java\Deployment\Deployment

Found mount point : C:\WINDOWS\SxsCaPendDel\SxsCaPendDel

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\SxsCaPendDel\SxsCaPendDel

Cannot access: C:\WINDOWS\system32\eventlog.dll

Attempting to restore permissions of : C:\WINDOWS\system32\eventlog.dll

[1] 2008-04-13 14:11:53 56320 C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\eventlog.dll (Microsoft Corporation)

[1] 2004-08-03 22:00:00 61952 C:\WINDOWS\system32\eventlog.dll ()

[2] 2004-08-03 22:00:00 55808 C:\WINDOWS\system32\logevent.dll (Microsoft Corporation)

Cannot access: C:\WINDOWS\system32\wbem\wmiprvse.exe

Attempting to restore permissions of : C:\WINDOWS\system32\wbem\wmiprvse.exe

Found mount point : C:\WINDOWS\Temp\History\Results\Results

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\Temp\History\Results\Results

Found mount point : C:\WINDOWS\Temp\RtSigs\Data\Data

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\Temp\RtSigs\Data\Data

Found mount point : C:\WINDOWS\WinSxS\InstallTemp\InstallTemp

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\WinSxS\InstallTemp\InstallTemp

Found mount point : C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700

Found mount point : C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303

Found mount point : C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05

Finished!

Oganix99 · 11-05-2009, 12:02 AM

I can't get anything else to work even when I use rkill, I can't even delete the .exe's so I can redownload them. Just trying to navigate to this thread is a pain.

Ried · 11-05-2009, 12:04 AM

Alright, we'll proceed. It will require more than 1 round to clean the system. Please stay with me until given the 'all clear' even if symptoms seem to abate.

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT- Save ComboFix.exe to your Desktop

====================================================

Disable your AntiVirus and AntiSpyware applications as they will interfere with our tools and the removal. If you are unable to access them, run ComboFix from Safe Mode if available.

====================================================

Double click on combofix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply for further review along with an update on system behavior.

Oganix99 · 11-05-2009, 04:50 PM

The combofix ran pretty smoothly heres the log.txt, already its alot faster and no popups yet and im in normal mode. everything seems normal right now.

ComboFix 09-11-05.01 - Office Depot 11/05/2009 13:24.1.2 - NTFSx86
Running from: c:\documents and settings\Office Depot\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\OFFICE~1\LOCALS~1\Temp\lsass.exe
c:\docume~1\OFFICE~1\LOCALS~1\Temp\services.exe
c:\docume~1\OFFICE~1\LOCALS~1\Temp\svchost.exe
c:\docume~1\OFFICE~1\LOCALS~1\Temp\taskmgr.exe
c:\docume~1\OFFICE~1\LOCALS~1\Temp\winlogon.exe
c:\documents and settings\All Users\Start Menu\HP Image Zone .lnk
C:\dsiqvib.exe
C:\ldvx.exe
c:\program files\keowdt
c:\program files\keowdt\quylsysguard.exe
c:\recycler\S-1-5-21-1653677040-3176959921-2912167393-1003
c:\recycler\S-1-5-21-1708537768-308236825-839522115-1003
c:\windows\syssvc.exe
c:\windows\system32\~.exe
c:\windows\system32\bazabezi.dll
c:\windows\system32\bisevona.exe
c:\windows\system32\dulupuhu.dll
c:\windows\system32\duvafiyi.exe
c:\windows\system32\godamuwe.dll
c:\windows\system32\iehelper.dll
c:\windows\system32\jevaziji.dll
c:\windows\system32\kafidevo.exe
c:\windows\system32\lenisako.dll
c:\windows\system32\lsp.dll
c:\windows\system32\meruyuva.dll
c:\windows\system32\monekuho.dll
c:\windows\system32\mupapupe.dll
c:\windows\system32\nawonane.dll
c:\windows\system32\pipuduse.exe
c:\windows\system32\pizatoro.dll
c:\windows\system32\tasasifu.dll
c:\windows\system32\tipifipo.dll
c:\windows\system32\vayuhowa.dll
c:\windows\system32\vtwd8.dll
c:\windows\system32\yirozoyi.dll
c:\windows\Temp\3393674608.exe

Infected copy of c:\windows\system32\eventlog.dll was found and disinfected
Restored copy from - c:\windows\system32\logevent.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226ED}

((((((((((((((((((((((((( Files Created from 2009-10-05 to 2009-11-05 )))))))))))))))))))))))))))))))
.

2009-11-03 22:17 . 2009-11-03 22:17 -------- d-----w- C:\rsit
2009-11-03 05:22 . 2009-11-03 05:22 -------- d-----w- c:\documents and settings\All Users\Application Data\CA
2009-11-03 05:22 . 2009-11-03 05:22 -------- d-----w- c:\program files\CA
2009-11-02 20:58 . 2009-11-05 23:31 -------- d--h--w- c:\windows\PIF
2009-11-02 09:31 . 2009-11-02 09:31 -------- d-----w- c:\documents and settings\Office Depot\Application Data\Malwarebytes
2009-11-02 09:30 . 2009-09-11 00:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-11-02 09:30 . 2009-11-03 06:16 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-11-02 09:30 . 2009-11-02 09:30 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-11-02 09:30 . 2009-09-11 00:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-11-02 03:54 . 2009-11-02 04:28 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-11-02 02:44 . 2009-11-02 02:44 -------- d-----w- c:\documents and settings\Office Depot\Application Data\AVG8
2009-10-26 05:03 . 2009-10-26 05:03 54992 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-10-25 05:44 . 2009-10-25 06:28 -------- d-----w- c:\documents and settings\All Users\Application Data\06723220
2009-10-25 05:44 . 2009-10-25 05:44 274 ----a-w- c:\documents and settings\All Users\Application Data\06723220\06723220.bat
2009-10-25 05:36 . 2009-11-05 23:13 0 ----a-r- c:\windows\win32k.sys
2009-10-25 05:35 . 2009-10-25 05:35 79360 ----a-w- C:\vyiy.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-05 23:34 . 2006-03-10 08:53 13568 ----a-w- c:\windows\system32\drivers\USBCRFT.SYS
2009-11-05 23:17 . 2004-11-19 02:09 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-11-02 03:09 . 2008-10-30 03:52 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2009-11-02 03:06 . 2008-10-30 03:52 -------- d-----w- c:\program files\AVG
2009-09-11 14:33 . 2004-08-04 08:00 133632 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-04 20:45 . 2004-08-04 08:00 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-08-29 07:36 . 2004-08-04 08:00 832512 ----a-w- c:\windows\system32\wininet.dll
2009-08-29 07:36 . 2004-08-04 08:00 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-08-29 07:36 . 2004-08-04 08:00 17408 ------w- c:\windows\system32\corpol.dll
2009-08-26 08:16 . 2004-08-04 08:00 247326 ----a-w- c:\windows\system32\strmdll.dll
2009-08-16 05:45 . 2005-07-11 21:13 54992 ----a-w- c:\documents and settings\Office Depot\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-07-28 19:23 . 2009-07-28 19:23 1052192 --sha-w- c:\windows\system32\bisoloku.exe
2009-08-02 21:50 . 2009-08-02 21:50 91648 --sha-w- c:\windows\system32\bubedena.dll
2009-08-02 21:50 . 2009-08-02 21:50 39424 --sha-w- c:\windows\system32\famavebe.dll
2009-08-05 22:49 . 2009-08-05 22:49 92160 --sha-w- c:\windows\system32\gilavofi.dll
2009-08-03 22:13 . 2009-08-03 22:13 39424 --sha-w- c:\windows\system32\jenupiso.dll
2009-08-05 22:49 . 2009-08-05 22:49 45056 --sha-w- c:\windows\system32\lutayesi.dll
2009-08-05 22:49 . 2009-08-05 22:49 39424 --sha-w- c:\windows\system32\newuwiyo.dll
2009-08-04 21:52 . 2009-08-04 21:52 45056 --sha-w- c:\windows\system32\pebuhewe.dll
2009-08-05 22:49 . 2009-08-05 22:49 199680 --sha-w- c:\windows\system32\varigisu.exe
2009-08-04 21:52 . 2009-08-04 21:52 39424 --sha-w- c:\windows\system32\zumijasa.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2003-10-08 159744]
"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2004-03-01 200766]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-12 49152]
"cctray"="c:\program files\CA\CA Internet Security Suite\cctray\cctray.exe" [2009-11-03 177392]
"AGRSMMSG"="AGRSMMSG.exe" - c:\windows\AGRSMMSG.exe [2004-08-24 88363]
"ATIModeChange"="Ati2mdxx.exe" - c:\windows\system32\Ati2mdxx.exe [2001-09-04 28672]
"CICache"="CICache.exe" - c:\windows\CICache.exe [2002-09-05 24576]
"Dit"="Dit.exe" - c:\windows\Dit.exe [2004-04-27 86016]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-11 282624]
HP Image Zone Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2005-5-11 73728]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0SsiEfr.e

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\usmt\\migwiz.exe"=

R3 CardReaderFilter;Card Reader Filter;c:\windows\system32\Drivers\USBCRFT.SYS [2009-11-05 13568]
S0 atiide;atiide;c:\windows\system32\DRIVERS\atiide.sys [2004-04-14 5632]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - MBR
*Deregistered* - mbr
.
Contents of the 'Scheduled Tasks' folder
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr7/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: &Yahoo! Search - file:///c:\program files\Yahoo!\Common/ycsrch.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
IE: Yahoo! &Dictionary - file:///c:\program files\Yahoo!\Common/ycdict.htm
IE: Yahoo! &Maps - file:///c:\program files\Yahoo!\Common/ycmap.htm
IE: Yahoo! &SMS - file:///c:\program files\Yahoo!\Common/ycsms.htm
TCP: {76920A34-B57E-4465-9816-D63D82B65DA3} = 77.74.48.113
.
- - - - ORPHANS REMOVED - - - -

BHO-{6b3e0dd0-ea91-41b7-93c2-f1c289fb020f} - dulupuhu.dll
BHO-{A2234B15-23F2-42AD-F4E4-00AAC39C0004} - c:\windows\system32\vtwd8.dll
WebBrowser-{08FCF7E3-5F7D-444E-8554-76A516EB3C6C} - (no file)
WebBrowser-{4F802BCF-44AA-4C28-935A-CBEDC24B5375} - (no file)
WebBrowser-{07AA283A-43D7-4CBE-A064-32A21112D94D} - (no file)
HKLM-Run-tofobeful - c:\windows\system32\meruyuva.dll
HKLM-Run-dukawovedi - vayuhowa.dll
SharedTaskScheduler-{A2234B15-23F2-42AD-F4E4-00AAC39C0004} - c:\windows\system32\vtwd8.dll
SharedTaskScheduler-{6b7b2f3b-e0bf-4988-9db4-36daf39a0d77} - c:\windows\system32\meruyuva.dll
SharedTaskScheduler-{c34e2202-ad18-4f9a-888e-1204b6721b5f} - c:\windows\system32\meruyuva.dll
SharedTaskScheduler-{4486e005-f169-4e90-8708-2aec2ca64d31} - c:\windows\system32\meruyuva.dll
SharedTaskScheduler-{70eedf3b-91dc-4673-8e96-8e48c23eed69} - c:\windows\system32\meruyuva.dll
SharedTaskScheduler-{55a025d9-c69c-4a89-8217-440012589b4b} - c:\windows\system32\meruyuva.dll
SharedTaskScheduler-{d8682a43-fdfb-46e4-b8b3-dffc9b0e9abc} - c:\windows\system32\meruyuva.dll
SSODL-nenavojop-{6b7b2f3b-e0bf-4988-9db4-36daf39a0d77} - c:\windows\system32\meruyuva.dll
SSODL-tujukilas-{c34e2202-ad18-4f9a-888e-1204b6721b5f} - c:\windows\system32\meruyuva.dll
SSODL-zasukajel-{4486e005-f169-4e90-8708-2aec2ca64d31} - c:\windows\system32\meruyuva.dll
SSODL-hojezobuz-{70eedf3b-91dc-4673-8e96-8e48c23eed69} - c:\windows\system32\meruyuva.dll
SSODL-seguzatuw-{55a025d9-c69c-4a89-8217-440012589b4b} - c:\windows\system32\meruyuva.dll
SSODL-yomojojib-{d8682a43-fdfb-46e4-b8b3-dffc9b0e9abc} - c:\windows\system32\meruyuva.dll

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-05 13:34
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe????????0?3?5?2??????? ???B???????????????B? ??????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(440)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(2700)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Apoint2K\Apntex.exe
c:\program files\HP\Digital Imaging\bin\hpqimzone.exe
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
c:\program files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
c:\program files\CA\CA Internet Security Suite\ccprovsp.exe
.
**************************************************************************
.
Completion time: 2009-11-05 13:41 - machine was rebooted
ComboFix-quarantined-files.txt 2009-11-05 23:41

Pre-Run: 25,329,725,440 bytes free
Post-Run: 25,827,270,656 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - 819281027611CF092F5ED24404034225

tetonbob · 11-05-2009, 05:58 PM

Hello, Oganix99

Ried will be away from the PC for a while, so I'll be looking after your thread.

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

---------------------------------------------------------------------------------------------

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.

Open notepad and copy/paste the text in the quotebox below into it:

Code:

http://www.techsupportforum.com/security-center/virus-trojan-spyware-help/427472-i-need-some-help-please.html
Folder::
c:\documents and settings\All Users\Application Data\06723220
File::
c:\windows\win32k.sys
Collect::
C:\vyiy.exe
c:\windows\system32\bisoloku.exe
c:\windows\system32\bubedena.dll
c:\windows\system32\famavebe.dll
c:\windows\system32\gilavofi.dll
c:\windows\system32\jenupiso.dll
c:\windows\system32\lutayesi.dll
c:\windows\system32\newuwiyo.dll
c:\windows\system32\pebuhewe.dll
c:\windows\system32\varigisu.exe
c:\windows\system32\zumijasa.dll
Comment::
End Copy Here

Save this as CFScript.txt

Referring to the picture above, drag CFScript.txt into ComboFix.exe

ComboFix may request an update; please allow it.
Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.
When finished, it shall produce a log for you. Post that log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

**Note**

When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.
- Ensure you are connected to the internet and click OK on the message box.
Please let me know if the file was successfully submitted . Thanks.

------------------------------------------------------
Ensure your AntiVirus and AntiSpyware applications are re-enabled.

---------------------------------------------------------------------------------------------

Please go to Start > Run and copy/paste the following, then press Enter:

C:\QooBox\Add-Remove Programs.txt

A text file should open. Please post the contents of that file in your next reply.

Oganix99 · 11-06-2009, 09:51 PM

Hi tetonbob, heres the add-remove programs txt

5600
5600_Help
5600Trb
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Media Player
Adobe Reader 8.1.2
Agere Systems AC'97 Modem
AiO_Scan
AiOSoftware
ATI Display Driver
BufferChm
BUSlink USB-Flash Driver
CA Anti-Spam
CA Internet Security Suite
CA Personal Firewall
CameraMate Real-Time Video Driver
CameraMate Real-Time Video for Flash
CCleaner (remove only)
CP_AtenaShokunin1Config
CP_CalendarTemplates1
CP_Package_Basic1
CP_Package_Variety1
CP_Package_Variety2
CP_Package_Variety3
CP_Panorama1Config
Critical Update for Windows Media Player 11 (KB959772)
CueTour
CustomerResearchQFolder
Destinations
DeviceFunctionQFolder
DeviceManagementQFolder
DocProc
DocumentViewer
DocumentViewerQFolder
ESPN Java Check
eSupportQFolder
Fax
FullDPAppQFolder
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB914440)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB926239)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
HP Document Viewer 5.3
HP Extended Capabilities 5.3
HP Help and Support
HP Image Zone 5.3
HP Imaging Device Functions 5.3
HP PSC & OfficeJet 5.3.B
HP Software Update
HP Solution Center & Imaging Support Tools 5.3
HPProductAssistant
HpSdpAppCoreApp
InstantShareDevices
J2SE Runtime Environment 5.0 Update 4
Java 2 Runtime Environment, SE v1.4.2_05
Java(TM) 6 Update 3
Macromedia Flash Player
MarketResearch
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB953297)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft User-Mode Driver Framework Feature Pack 1.0
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
NewCopy
PanoStandAlone
PCI 1620 Cardbus Controller and Software
PhotoGallery
ProductContext
RandMap
Readme
Scan
ScannerCopy
Security Update for CAPICOM (KB931906)
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 7 (KB969897)
Security Update for Windows Internet Explorer 7 (KB972260)
Security Update for Windows Internet Explorer 7 (KB974455)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB911565)
Security Update for Windows Media Player 9 (KB917734)
Security Update for Windows Media Player 9 (KB936782)
Security Update for Windows XP (KB883939)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896422)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB896688)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899588)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB903235)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB905915)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB908531)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912812)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913446)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB916281)
Security Update for Windows XP (KB917159)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB918899)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920214)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922760)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923694)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925454)
Security Update for Windows XP (KB925486)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928090)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB929969)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931768)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933566)
Security Update for Windows XP (KB933729)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB937143)
Security Update for Windows XP (KB938127)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB938829)
Security Update for Windows XP (KB939653)
Security Update for Windows XP (KB941202)
Security Update for Windows XP (KB941568)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB941644)
Security Update for Windows XP (KB941693)
Security Update for Windows XP (KB942615)
Security Update for Windows XP (KB943055)
Security Update for Windows XP (KB943460)
Security Update for Windows XP (KB943485)
Security Update for Windows XP (KB944653)
Security Update for Windows XP (KB945553)
Security Update for Windows XP (KB946026)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB948590)
Security Update for Windows XP (KB948881)
Security Update for Windows XP (KB950749)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958470)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
SkinsHP1
SolutionCenter
Sonic_PrimoSDK
Sony USB Driver
Status
TI1620/1520
TrayApp
Unload
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 7 (KB976749)
Update for Windows XP (KB894391)
Update for Windows XP (KB896727)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB904942)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB925720)
Update for Windows XP (KB927891)
Update for Windows XP (KB929338)
Update for Windows XP (KB930916)
Update for Windows XP (KB931836)
Update for Windows XP (KB932823-v3)
Update for Windows XP (KB933360)
Update for Windows XP (KB936357)
Update for Windows XP (KB938828)
Update for Windows XP (KB942763)
Update for Windows XP (KB942840)
Update for Windows XP (KB946627)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB973815)
USB-IDE Bridge Driver
USB Compact Flash Reader
Viewpoint Media Player
WebFldrs XP
WebReg
Windows Genuine Advantage v1.3.0254.0
Windows Imaging Component
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Hotfix - KB873333
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB887742
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890175
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB890923
Windows XP Hotfix - KB891781
Windows XP Hotfix - KB893066
Windows XP Hotfix - KB893086
WinRAR archiver
Yahoo! extras
Yahoo! Internet Mail
Yahoo! Toolbar

Oganix99 · 11-06-2009, 09:53 PM

and heres the combofix txt
ComboFix 09-11-05.01 - Office Depot 11/06/2009 16:37.2.2 - NTFSx86
Running from: c:\documents and settings\Office Depot\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Office Depot\Desktop\CFScript.txt
FW: CA Personal Firewall *enabled* {14CB4B80-8E52-45EA-905E-67C1267B4160}
* Created a new restore point

FILE ::
"c:\windows\win32k.sys"

file zipped: c:\windows\system32\bisoloku.exe
file zipped: c:\windows\system32\gilavofi.dll
file zipped: c:\windows\system32\varigisu.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\06723220
c:\documents and settings\All Users\Application Data\06723220\06723220.bat
c:\windows\system32\bisoloku.exe
c:\windows\system32\gilavofi.dll
c:\windows\system32\varigisu.exe
c:\windows\win32k.sys

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226ED}

((((((((((((((((((((((((( Files Created from 2009-10-07 to 2009-11-07 )))))))))))))))))))))))))))))))
.

2009-11-06 07:10 . 2009-11-06 16:25 -------- d-----w- c:\windows\CAVTemp
2009-11-06 06:08 . 2009-11-07 02:28 -------- d-----w- c:\documents and settings\All Users\Application Data\CA
2009-11-06 06:08 . 2009-11-06 06:08 -------- d-----w- c:\program files\CA
2009-11-03 22:17 . 2009-11-03 22:17 -------- d-----w- C:\rsit
2009-11-02 20:58 . 2009-11-05 23:31 -------- d--h--w- c:\windows\PIF
2009-11-02 09:31 . 2009-11-02 09:31 -------- d-----w- c:\documents and settings\Office Depot\Application Data\Malwarebytes
2009-11-02 03:54 . 2009-11-02 04:28 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-11-02 02:44 . 2009-11-02 02:44 -------- d-----w- c:\documents and settings\Office Depot\Application Data\AVG8
2009-10-26 05:03 . 2009-10-26 05:03 54992 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-07 02:47 . 2006-03-10 08:53 13568 ----a-w- c:\windows\system32\drivers\USBCRFT.SYS
2009-11-07 02:46 . 2009-11-06 07:44 64 ----a-w- c:\windows\system32\drivers\kmxcfg.u2k7
2009-11-07 02:46 . 2009-11-06 07:44 64 ----a-w- c:\windows\system32\drivers\kmxcfg.u2k6
2009-11-07 02:46 . 2009-11-06 07:44 64 ----a-w- c:\windows\system32\drivers\kmxcfg.u2k5
2009-11-07 02:46 . 2009-11-06 07:44 64 ----a-w- c:\windows\system32\drivers\kmxcfg.u2k4
2009-11-07 02:46 . 2009-11-06 07:44 64 ----a-w- c:\windows\system32\drivers\kmxcfg.u2k3
2009-11-07 02:46 . 2009-11-06 07:44 64 ----a-w- c:\windows\system32\drivers\kmxcfg.u2k2
2009-11-07 02:46 . 2009-11-06 07:44 64 ----a-w- c:\windows\system32\drivers\kmxcfg.u2k1
2009-11-07 02:46 . 2009-11-06 07:44 43342 ----a-w- c:\windows\system32\drivers\kmxcfg.u2k0
2009-11-05 23:17 . 2004-11-19 02:09 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-11-02 03:09 . 2008-10-30 03:52 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2009-11-02 03:06 . 2008-10-30 03:52 -------- d-----w- c:\program files\AVG
2009-09-11 14:33 . 2004-08-04 08:00 133632 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-04 20:45 . 2004-08-04 08:00 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-08-29 07:36 . 2004-08-04 08:00 832512 ------w- c:\windows\system32\wininet.dll
2009-08-29 07:36 . 2004-08-04 08:00 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-08-29 07:36 . 2004-08-04 08:00 17408 ------w- c:\windows\system32\corpol.dll
2009-08-26 08:16 . 2004-08-04 08:00 247326 ----a-w- c:\windows\system32\strmdll.dll
2009-08-16 05:45 . 2005-07-11 21:13 54992 ----a-w- c:\documents and settings\Office Depot\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((( SnapShot@2009-11-05_23.34.47 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-05-18 23:30 . 2007-05-18 23:30 79368 c:\windows\system32\UmxWNP.dll
+ 2008-06-25 05:08 . 2008-06-25 05:08 93712 c:\windows\system32\drivers\KmxStart.sys
+ 2008-06-25 05:08 . 2008-06-25 05:08 66576 c:\windows\system32\drivers\KmxSbx.sys
+ 2008-06-25 05:08 . 2008-06-25 05:08 45584 c:\windows\system32\drivers\KmxFile.sys
+ 2008-06-25 05:08 . 2008-06-25 05:08 88816 c:\windows\system32\drivers\KmxCfg.sys
+ 2008-06-25 05:08 . 2008-06-25 05:08 63504 c:\windows\system32\drivers\KmxAgent.sys
+ 2009-11-06 06:10 . 2009-11-06 06:10 10134 c:\windows\Installer\{BDBAAB1B-B364-465E-931D-4E2E2F0E609A}\ARPPRODUCTICON.exe
+ 2008-06-25 05:10 . 2008-06-25 05:10 256528 c:\windows\system32\UmxSbxw.dll
+ 2008-06-25 05:10 . 2008-06-25 05:10 117264 c:\windows\system32\UmxSbxExw.dll
+ 2008-06-25 05:08 . 2008-06-25 05:08 115216 c:\windows\system32\drivers\KmxFw.sys
+ 2008-06-25 05:08 . 2008-06-25 05:08 134648 c:\windows\system32\drivers\KmxCF.sys
+ 2009-11-05 23:52 . 2009-05-26 11:40 382840 c:\windows\ie7updates\KB976749-IE7\spuninst\updspapi.dll
+ 2009-11-05 23:52 . 2009-05-26 11:40 231288 c:\windows\ie7updates\KB976749-IE7\spuninst\spuninst.exe
+ 2009-11-06 06:10 . 2009-11-06 06:10 1233920 c:\windows\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9818.0_x-ww_8ff50c5d\msxml4.dll
- 2004-08-04 08:00 . 2009-08-29 07:36 3598336 c:\windows\system32\mshtml.dll
+ 2004-08-04 08:00 . 2009-10-21 04:08 3598336 c:\windows\system32\mshtml.dll
+ 2006-05-19 15:08 . 2009-10-21 04:08 3598336 c:\windows\system32\dllcache\mshtml.dll
- 2006-05-19 15:08 . 2009-08-29 07:36 3598336 c:\windows\system32\dllcache\mshtml.dll
+ 2009-11-06 06:10 . 2009-11-06 06:10 3694592 c:\windows\Installer\fcc2c.msi
+ 2009-11-05 23:52 . 2009-08-29 07:36 3598336 c:\windows\ie7updates\KB976749-IE7\mshtml.dll
- 2009-11-03 05:23 . 2009-11-03 05:35 10273280 c:\windows\Installer\{BDBAAB1B-B364-465E-931D-4E2E2F0E609A}\{0224555E-5D1F-4E42-948E-474DE4E6A311}\CAPF.msi
+ 2009-11-03 05:23 . 2009-11-06 06:09 10273280 c:\windows\Installer\{BDBAAB1B-B364-465E-931D-4E2E2F0E609A}\{0224555E-5D1F-4E42-948E-474DE4E6A311}\CAPF.msi
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2003-10-08 159744]
"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2004-03-01 200766]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-12 49152]
"cctray"="c:\program files\CA\CA Internet Security Suite\cctray\cctray.exe" [2009-11-06 177392]
"QOELOADER"="c:\program files\CA\CA Internet Security Suite\CA Anti-Spam\QSP-5.1.18.0\QOELoader.exe" [2009-11-06 14088]
"cafwc"="c:\program files\CA\CA Internet Security Suite\CA Personal Firewall\cafw.exe" [2009-11-06 1193200]
"capfasem"="c:\program files\CA\CA Internet Security Suite\CA Personal Firewall\capfasem.exe" [2009-11-06 173296]
"capfupgrade"="c:\program files\CA\CA Internet Security Suite\CA Personal Firewall\capfupgrade.exe" [2009-11-06 259312]
"AGRSMMSG"="AGRSMMSG.exe" - c:\windows\AGRSMMSG.exe [2004-08-24 88363]
"ATIModeChange"="Ati2mdxx.exe" - c:\windows\system32\Ati2mdxx.exe [2001-09-04 28672]
"CICache"="CICache.exe" - c:\windows\CICache.exe [2002-09-05 24576]
"Dit"="Dit.exe" - c:\windows\Dit.exe [2004-04-27 86016]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-11 282624]
HP Image Zone Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2005-5-11 73728]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PFW]
2007-05-18 23:30 79368 ----a-w- c:\windows\system32\UmxWNP.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0SsiEfr.e

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\CA Personal Firewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\usmt\\migwiz.exe"=

R3 CardReaderFilter;Card Reader Filter;c:\windows\system32\Drivers\USBCRFT.SYS [2009-11-07 13568]
S0 atiide;atiide;c:\windows\system32\DRIVERS\atiide.sys [2004-04-14 5632]
S0 KmxStart;KmxStart;c:\windows\System32\DRIVERS\kmxstart.sys [2008-06-25 93712]
S1 KmxAgent;KmxAgent;c:\windows\system32\DRIVERS\kmxagent.sys [2008-06-25 63504]
S1 KmxFile;KmxFile;c:\windows\system32\DRIVERS\KmxFile.sys [2008-06-25 45584]
S1 KmxFw;KmxFw;c:\windows\system32\DRIVERS\kmxfw.sys [2008-06-25 115216]
S2 KmxCF;KmxCF;c:\windows\system32\DRIVERS\KmxCF.sys [2008-06-25 134648]
S2 KmxSbx;KmxSbx;c:\windows\system32\DRIVERS\KmxSbx.sys [2008-06-25 66576]
S2 UmxAgent;HIPS Event Manager;c:\program files\CA\SharedComponents\HIPSEngine\UmxAgent.exe [2007-10-18 1010192]
S2 UmxCfg;HIPS Configuration Interpreter;c:\program files\CA\SharedComponents\HIPSEngine\UmxCfg.exe [2007-10-18 801296]
S2 UmxPol;HIPS Policy Manager;c:\program files\CA\SharedComponents\HIPSEngine\UmxPol.exe [2008-06-25 281104]
S3 KmxCfg;KmxCfg;c:\windows\system32\DRIVERS\kmxcfg.sys [2008-06-25 88816]

--- Other Services/Drivers In Memory ---

*Deregistered* - mbr
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr7/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: &Yahoo! Search - file:///c:\program files\Yahoo!\Common/ycsrch.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
IE: Yahoo! &Dictionary - file:///c:\program files\Yahoo!\Common/ycdict.htm
IE: Yahoo! &Maps - file:///c:\program files\Yahoo!\Common/ycmap.htm
IE: Yahoo! &SMS - file:///c:\program files\Yahoo!\Common/ycsms.htm
TCP: {76920A34-B57E-4465-9816-D63D82B65DA3} = 77.74.48.113
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-06 16:47
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe????????0?3?5?2??????? ???B???????????????B? ??????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(444)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\UmxWnp.Dll

- - - - - - - > 'explorer.exe'(140)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\program files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\wscntfy.exe
c:\program files\CA\CA Internet Security Suite\CA Personal Firewall\capfsem.exe
c:\program files\Apoint2K\Apntex.exe
c:\program files\CA\CA Internet Security Suite\ccprovsp.exe
c:\program files\HP\Digital Imaging\bin\hpqimzone.exe
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
c:\program files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
.
**************************************************************************
.
Completion time: 2009-11-07 16:53 - machine was rebooted
ComboFix-quarantined-files.txt 2009-11-07 02:53
ComboFix2.txt 2009-11-05 23:41

Pre-Run: 24,767,418,368 bytes free
Post-Run: 24,747,069,440 bytes free

- - End Of File - - 24F26CF84FAE1B7FC390672E277F9A33

tetonbob · 11-06-2009, 09:56 PM

Hi again -

It doesn't seem as though the files I wanted to collect were uploaded. Let's do this, please.

Please go to Start > Run and copy/paste the following, then press Enter:

C:\QooBox\ComboFix-quarantined-files.txt

Post the contents of the logfile which will open.

Oganix99 · 11-06-2009, 10:04 PM

2009-11-07 02:37:25 . 2009-11-07 02:37:27 1,062,770 ----a-w- C:\Qoobox\Quarantine\[4]-Submit_2009-11-06_16.37.17.zip
2009-11-05 23:40:37 . 2009-11-05 23:40:37 373 ----a-w- C:\Qoobox\Quarantine\Registry_backups\SSODL-yomojojib-{d8682a43-fdfb-46e4-b8b3-dffc9b0e9abc}.reg.dat
2009-11-05 23:40:37 . 2009-11-05 23:40:37 373 ----a-w- C:\Qoobox\Quarantine\Registry_backups\SSODL-seguzatuw-{55a025d9-c69c-4a89-8217-440012589b4b}.reg.dat
2009-11-05 23:40:37 . 2009-11-05 23:40:37 373 ----a-w- C:\Qoobox\Quarantine\Registry_backups\SSODL-hojezobuz-{70eedf3b-91dc-4673-8e96-8e48c23eed69}.reg.dat
2009-11-05 23:40:37 . 2009-11-05 23:40:37 373 ----a-w- C:\Qoobox\Quarantine\Registry_backups\SSODL-zasukajel-{4486e005-f169-4e90-8708-2aec2ca64d31}.reg.dat
2009-11-05 23:40:37 . 2009-11-05 23:40:37 373 ----a-w- C:\Qoobox\Quarantine\Registry_backups\SSODL-tujukilas-{c34e2202-ad18-4f9a-888e-1204b6721b5f}.reg.dat
2009-11-05 23:40:36 . 2009-11-05 23:40:36 373 ----a-w- C:\Qoobox\Quarantine\Registry_backups\SSODL-nenavojop-{6b7b2f3b-e0bf-4988-9db4-36daf39a0d77}.reg.dat
2009-11-05 23:40:34 . 2009-11-05 23:40:34 374 ----a-w- C:\Qoobox\Quarantine\Registry_backups\SharedTaskScheduler-{d8682a43-fdfb-46e4-b8b3-dffc9b0e9abc}.reg.dat
2009-11-05 23:40:34 . 2009-11-05 23:40:34 374 ----a-w- C:\Qoobox\Quarantine\Registry_backups\SharedTaskScheduler-{55a025d9-c69c-4a89-8217-440012589b4b}.reg.dat
2009-11-05 23:40:34 . 2009-11-05 23:40:34 374 ----a-w- C:\Qoobox\Quarantine\Registry_backups\SharedTaskScheduler-{70eedf3b-91dc-4673-8e96-8e48c23eed69}.reg.dat
2009-11-05 23:40:34 . 2009-11-05 23:40:34 374 ----a-w- C:\Qoobox\Quarantine\Registry_backups\SharedTaskScheduler-{4486e005-f169-4e90-8708-2aec2ca64d31}.reg.dat
2009-11-05 23:40:34 . 2009-11-05 23:40:34 374 ----a-w- C:\Qoobox\Quarantine\Registry_backups\SharedTaskScheduler-{c34e2202-ad18-4f9a-888e-1204b6721b5f}.reg.dat
2009-11-05 23:40:34 . 2009-11-05 23:40:34 374 ----a-w- C:\Qoobox\Quarantine\Registry_backups\SharedTaskScheduler-{6b7b2f3b-e0bf-4988-9db4-36daf39a0d77}.reg.dat
2009-11-05 23:40:33 . 2009-11-05 23:40:33 464 ----a-w- C:\Qoobox\Quarantine\Registry_backups\SharedTaskScheduler-{A2234B15-23F2-42AD-F4E4-00AAC39C0004}.reg.dat
2009-11-05 23:40:27 . 2009-11-05 23:40:27 129 ----a-w- C:\Qoobox\Quarantine\Registry_backups\HKLM-Run-dukawovedi.reg.dat
2009-11-05 23:40:25 . 2009-11-05 23:40:25 150 ----a-w- C:\Qoobox\Quarantine\Registry_backups\HKLM-Run-tofobeful.reg.dat
2009-11-05 23:40:23 . 2009-11-05 23:40:23 171 ----a-w- C:\Qoobox\Quarantine\Registry_backups\WebBrowser-{07AA283A-43D7-4CBE-A064-32A21112D94D}.reg.dat
2009-11-05 23:40:23 . 2009-11-05 23:40:23 171 ----a-w- C:\Qoobox\Quarantine\Registry_backups\WebBrowser-{4F802BCF-44AA-4C28-935A-CBEDC24B5375}.reg.dat
2009-11-05 23:40:23 . 2009-11-05 23:40:23 171 ----a-w- C:\Qoobox\Quarantine\Registry_backups\WebBrowser-{08FCF7E3-5F7D-444E-8554-76A516EB3C6C}.reg.dat
2009-11-05 23:40:22 . 2009-11-05 23:40:22 444 ----a-w- C:\Qoobox\Quarantine\Registry_backups\BHO-{A2234B15-23F2-42AD-F4E4-00AAC39C0004}.reg.dat
2009-11-05 23:40:21 . 2009-11-05 23:40:22 351 ----a-w- C:\Qoobox\Quarantine\Registry_backups\BHO-{6b3e0dd0-ea91-41b7-93c2-f1c289fb020f}.reg.dat
2009-11-05 23:28:06 . 2009-11-07 02:43:24 1,046 ----a-w- C:\Qoobox\Quarantine\Registry_backups\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226ED}.reg.dat
2009-11-05 23:28:01 . 2009-11-07 02:43:11 6,218 ----a-w- C:\Qoobox\Quarantine\Registry_backups\tcpip.reg
2009-11-05 23:21:06 . 2009-11-07 02:35:20 153 ----a-w- C:\Qoobox\Quarantine\catchme.log
2009-11-05 22:49:45 . 2009-11-05 22:49:45 2,713 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\duvafiyi.exe.vir
2009-10-25 05:44:17 . 2009-10-25 05:44:17 274 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users\Application Data\06723220\06723220.bat.vir
2009-10-25 05:36:17 . 2009-11-05 23:13:59 0 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\win32k.sys.vir
2009-10-25 05:35:48 . 2009-10-25 05:35:49 31,232 ----a-w- C:\Qoobox\Quarantine\C\dsiqvib.exe.vir
2009-10-25 05:35:01 . 2009-10-25 05:35:03 291,840 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\~.exe.vir
2009-08-05 22:49:35 . 2009-08-05 22:49:35 199,680 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\varigisu.exe.vir
2009-08-05 22:49:34 . 2009-08-05 22:49:34 92,160 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\gilavofi.dll.vir
2009-08-04 21:52:43 . 2009-08-04 21:52:43 60,928 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\tasasifu.dll.vir
2009-08-03 22:13:01 . 2009-08-03 22:13:01 61,440 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\lenisako.dll.vir
2009-08-03 22:13:00 . 2009-08-03 22:13:00 91,648 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\mupapupe.dll.vir
2009-08-02 01:52:09 . 2009-08-02 01:52:09 39,424 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\yirozoyi.dll.vir
2009-07-28 19:23:18 . 2009-07-28 19:23:18 1,052,192 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\bisoloku.exe.vir
2009-07-28 19:23:18 . 2009-07-28 19:23:18 91,136 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\tipifipo.dll.vir
2009-07-26 03:00:04 . 2009-07-26 03:00:04 54,272 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\jevaziji.dll.vir
2009-07-26 03:00:04 . 2009-07-26 03:00:04 1,011,749 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\pipuduse.exe.vir
2006-06-22 00:16:54 . 2006-06-22 00:16:54 898 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users\Start Menu\HP Image Zone .lnk.vir

10-31-2009, 02:44 PM	#1 (permalink)
Oganix99 Registered User Join Date: Oct 2009 Posts: 24 OS: xp	I need some help please. I have a virus/malware called Antivirus System Pro, I made a post In the networking forum ( I need some help please )because my Internet connection went out when I got the virus and I haven't been able to connect since. Oh and btw these forums are Great! really infromative, and its nice to know whomever is helping me knows what their doing cuz I don't Last edited by Oganix99; 10-31-2009 at 02:46 PM.

11-01-2009, 09:17 PM	#2 (permalink)
Oganix99 Registered User Join Date: Oct 2009 Posts: 24 OS: xp	Re: I need some help please. UPDATE/BUMP: Ok I finally got my internet connection working again. I tried installing AVG, Avira Antivi Personal, neither would Install so I tried Spyware Doctor with AntiVirus and was able to install and run a scan, It scanned upto 4% then froze, It found 5 threats and 39 infections, but couldn't remove anything. I downloaded DDS to my desktop, but I can't run it because I think I may have a script blocker and Im not sure how to turn it off. any help would be greatly appriciated. thanks.

11-02-2009, 09:59 AM	#3 (permalink)
Ried Assistant Manager, TSF Academy; Moderator/Analyst Security Team Join Date: Jan 2005 Location: Ohio Posts: 27,112 OS: WinXP and Vista	Re: I need some help please. Hello Oganix99, Run the required scans from Safe Mode. Be sure to run the gmer scan as well, and run it as outlined in our pre-posting topic. __________________ Member of ASAP since 2005 Member of UNITE since 2006 "It is one life whether we spend it laughing or weeping." "Take the time to laugh--it is the music of the soul."

11-02-2009, 03:28 PM	#4 (permalink)
Oganix99 Registered User Join Date: Oct 2009 Posts: 24 OS: xp	Re: I need some help please. Hi Ried, This virus seems to be controlling everything or somthing, Nothing seems to work right. The DDS will open a block box for 2-3 seconds and then close. I ran the GMER.exe it was scanning for about an hour then disapeared now it has to startover. I ran them in safe mode and follow'd the directions. Last edited by Oganix99; 11-02-2009 at 03:29 PM.

11-02-2009, 10:04 PM	#5 (permalink)
Ried Assistant Manager, TSF Academy; Moderator/Analyst Security Team Join Date: Jan 2005 Location: Ohio Posts: 27,112 OS: WinXP and Vista	Re: I need some help please. See if this scanner will run for you... Download rsit.exe and save it to your desktop. Double click on RSIT.exe to run it. Click Continue at the disclaimer screen. Once it has finished, two logs will open. Please post the contents of both log.txt (<<will be maximized) and info.txt (<<will be minimized) If you do not see the info.txt you can find it in the C:\rsit folder. Please attach that .txt And we'll try another rootkit scanner. Download RootRepeal from any of the links below: http://download.bleepingcomputer.com...RootRepeal.exe http://ad13.geekstogo.com/RootRepeal.exe http://rootrepeal.psikotick.com/RootRepeal.exe Extract RootRepeal.exe from the zip archive. Open on your desktop. Click the tab. Click the button. Check all boxes Click Ok Check the box for your main system drive (Usually C:), and click Ok. Allow RootRepeal to run a scan of your system. This may take some time. Once the scan completes, push the button. Save the log to your desktop, using a distinctive name, such as RootRepeal.txt. Include this report in your next reply, please. __________________ Member of ASAP since 2005 Member of UNITE since 2006 "It is one life whether we spend it laughing or weeping." "Take the time to laugh--it is the music of the soul."

11-03-2009, 03:35 PM	#6 (permalink)
Oganix99 Registered User Join Date: Oct 2009 Posts: 24 OS: xp	Re: I need some help please. These ones don't seem to work either. When I run RSIT right after I click 'continue' I get an Autoit Error: Line -1 Error Variable used without being declard. Click Ok everything closes. I ran Rootrepeal it scanned for about 3 mins then disapeared and made a DAT file called ''settings'' that says You are attempting to open a file of type 'DAT FILE' These files are used by the operating system by various programs. editing or modifying them could damage your system. Click ok or cancel so I clicked Cancel. Now if I try to run Rootrepeal again I get an Error: Windows cannot access the specified device, path, or file. You may not have the appropriate permmisions to access the item.

11-03-2009, 10:41 PM	#7 (permalink)
Ried Assistant Manager, TSF Academy; Moderator/Analyst Security Team Join Date: Jan 2005 Location: Ohio Posts: 27,112 OS: WinXP and Vista	Re: I need some help please. Download rkill from any of the following links and save it to your desktop: Rkill.com Rkill.scr Rkill.pif If the one with the .com extension doesn't run for you, try the next one, etc. After you run it, immediately run rsit.exe and RootRepeal. Please post those logs. __________________ Member of ASAP since 2005 Member of UNITE since 2006 "It is one life whether we spend it laughing or weeping." "Take the time to laugh--it is the music of the soul."

11-04-2009, 12:46 AM	#8 (permalink)
Oganix99 Registered User Join Date: Oct 2009 Posts: 24 OS: xp	Re: I need some help please. Still can't get the DDS or RSIT to run, but I got a rootrepeal scan. ROOTREPEAL (c) AD, 2007-2009 ================================================== Scan Start Time: 2009/11/03 21:38 Program Version: Version 1.3.5.0 Windows Version: Windows XP SP2 ================================================== Drivers ------------------- Name: 1394BUS.SYS Image Path: C:\WINDOWS\system32\DRIVERS\1394BUS.SYS Address: 0xF772D000 Size: 53248 File Visible: - Signed: - Status: - Name: ACPI.sys Image Path: ACPI.sys Address: 0xF76BE000 Size: 187776 File Visible: - Signed: - Status: - Name: ACPI_HAL Image Path: \Driver\ACPI_HAL Address: 0x804D7000 Size: 2252800 File Visible: - Signed: - Status: - Name: ACPIEC.sys Image Path: ACPIEC.sys Address: 0xF7B29000 Size: 11648 File Visible: - Signed: - Status: - Name: afd.sys Image Path: C:\WINDOWS\System32\drivers\afd.sys Address: 0xF71C0000 Size: 138368 File Visible: - Signed: - Status: - Name: aliide.sys Image Path: aliide.sys Address: 0xF7C11000 Size: 5248 File Visible: - Signed: - Status: - Name: Apfiltr.sys Image Path: C:\WINDOWS\system32\DRIVERS\Apfiltr.sys Address: 0xF7496000 Size: 91712 File Visible: - Signed: - Status: - Name: atapi.sys Image Path: atapi.sys Address: 0xF7658000 Size: 95360 File Visible: - Signed: - Status: - Name: atiide.sys Image Path: atiide.sys Address: 0xF7C17000 Size: 5632 File Visible: - Signed: - Status: - Name: atisgkaf.sys Image Path: atisgkaf.sys Address: 0xF7B31000 Size: 13088 File Visible: - Signed: - Status: - Name: ATMFD.DLL Image Path: C:\WINDOWS\System32\ATMFD.DLL Address: 0xBFFA0000 Size: 286720 File Visible: - Signed: - Status: - Name: BATTC.SYS Image Path: C:\WINDOWS\system32\DRIVERS\BATTC.SYS Address: 0xF7B25000 Size: 16384 File Visible: - Signed: - Status: - Name: bcmwl5.sys Image Path: C:\WINDOWS\system32\DRIVERS\bcmwl5.sys Address: 0xF743B000 Size: 371712 File Visible: - Signed: - Status: - Name: Beep.SYS Image Path: C:\WINDOWS\System32\Drivers\Beep.SYS Address: 0xF7C2D000 Size: 4224 File Visible: - Signed: - Status: - Name: BOOTVID.dll Image Path: C:\WINDOWS\system32\BOOTVID.dll Address: 0xF7B1D000 Size: 12288 File Visible: - Signed: - Status: - Name: Cdfs.SYS Image Path: C:\WINDOWS\System32\Drivers\Cdfs.SYS Address: 0xF787D000 Size: 63744 File Visible: - Signed: - Status: - Name: cdrbsdrv.SYS Image Path: C:\WINDOWS\System32\Drivers\cdrbsdrv.SYS Address: 0xF7BC5000 Size: 12736 File Visible: - Signed: - Status: - Name: cdrom.sys Image Path: C:\WINDOWS\system32\DRIVERS\cdrom.sys Address: 0xF77AD000 Size: 49536 File Visible: - Signed: - Status: - Name: CLASSPNP.SYS Image Path: C:\WINDOWS\system32\DRIVERS\CLASSPNP.SYS Address: 0xF776D000 Size: 53248 File Visible: - Signed: - Status: - Name: compbatt.sys Image Path: compbatt.sys Address: 0xF7B21000 Size: 9344 File Visible: - Signed: - Status: - Name: disk.sys Image Path: disk.sys Address: 0xF775D000 Size: 36352 File Visible: - Signed: - Status: - Name: dump_atapi.sys Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys Address: 0xF70E6000 Size: 98304 File Visible: No Signed: - Status: - Name: dump_WMILIB.SYS Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS Address: 0xF7C3B000 Size: 8192 File Visible: No Signed: - Status: - Name: Dxapi.sys Image Path: C:\WINDOWS\System32\drivers\Dxapi.sys Address: 0xF7BED000 Size: 12288 File Visible: - Signed: - Status: - Name: dxg.sys Image Path: C:\WINDOWS\System32\drivers\dxg.sys Address: 0xBF9C3000 Size: 73728 File Visible: - Signed: - Status: - Name: dxgthk.sys Image Path: C:\WINDOWS\System32\drivers\dxgthk.sys Address: 0xF7CDE000 Size: 4096 File Visible: - Signed: - Status: - Name: fdc.sys Image Path: C:\WINDOWS\system32\DRIVERS\fdc.sys Address: 0xF7A0D000 Size: 27392 File Visible: - Signed: - Status: - Name: fltMgr.sys Image Path: fltMgr.sys Address: 0xF7638000 Size: 128896 File Visible: - Signed: - Status: - Name: framebuf.dll Image Path: C:\WINDOWS\System32\framebuf.dll Address: 0xBFF50000 Size: 12288 File Visible: - Signed: - Status: - Name: Fs_Rec.SYS Image Path: C:\WINDOWS\System32\Drivers\Fs_Rec.SYS Address: 0xF7C29000 Size: 7936 File Visible: - Signed: - Status: - Name: ftdisk.sys Image Path: ftdisk.sys Address: 0xF7670000 Size: 125056 File Visible: - Signed: - Status: - Name: GEARAspiWDM.sys Image Path: C:\WINDOWS\SYSTEM32\DRIVERS\GEARAspiWDM.sys Address: 0xF79E5000 Size: 28672 File Visible: - Signed: - Status: - Name: hal.dll Image Path: C:\WINDOWS\system32\hal.dll Address: 0x806FD000 Size: 134400 File Visible: - Signed: - Status: - Name: i8042prt.sys Image Path: C:\WINDOWS\system32\DRIVERS\i8042prt.sys Address: 0xF77CD000 Size: 52736 File Visible: - Signed: - Status: - Name: imapi.sys Image Path: C:\WINDOWS\system32\DRIVERS\imapi.sys Address: 0xF779D000 Size: 41856 File Visible: - Signed: - Status: - Name: intelide.sys Image Path: intelide.sys Address: 0xF7C15000 Size: 5504 File Visible: - Signed: - Status: - Name: ipnat.sys Image Path: C:\WINDOWS\system32\DRIVERS\ipnat.sys Address: 0xF720A000 Size: 134912 File Visible: - Signed: - Status: - Name: ipsec.sys Image Path: C:\WINDOWS\system32\DRIVERS\ipsec.sys Address: 0xF7283000 Size: 74752 File Visible: - Signed: - Status: - Name: isapnp.sys Image Path: isapnp.sys Address: 0xF770D000 Size: 35840 File Visible: - Signed: - Status: - Name: kbdclass.sys Image Path: C:\WINDOWS\system32\DRIVERS\kbdclass.sys Address: 0xF79ED000 Size: 24576 File Visible: - Signed: - Status: - Name: KDCOM.DLL Image Path: C:\WINDOWS\system32\KDCOM.DLL Address: 0xF7C0D000 Size: 8192 File Visible: - Signed: - Status: - Name: ks.sys Image Path: C:\WINDOWS\system32\DRIVERS\ks.sys Address: 0xF74AD000 Size: 143360 File Visible: - Signed: - Status: - Name: KSecDD.sys Image Path: KSecDD.sys Address: 0xF7621000 Size: 92544 File Visible: - Signed: - Status: - Name: mouclass.sys Image Path: C:\WINDOWS\system32\DRIVERS\mouclass.sys Address: 0xF79FD000 Size: 23040 File Visible: - Signed: - Status: - Name: MountMgr.sys Image Path: MountMgr.sys Address: 0xF773D000 Size: 42240 File Visible: - Signed: - Status: - Name: mrxsmb.sys Image Path: C:\WINDOWS\system32\DRIVERS\mrxsmb.sys Address: 0xF7126000 Size: 453632 File Visible: - Signed: - Status: - Name: Msfs.SYS Image Path: C:\WINDOWS\System32\Drivers\Msfs.SYS Address: 0xF7A8D000 Size: 19072 File Visible: - Signed: - Status: - Name: msgpc.sys Image Path: C:\WINDOWS\system32\DRIVERS\msgpc.sys Address: 0xF780D000 Size: 35072 File Visible: - Signed: - Status: - Name: mssmbios.sys Image Path: C:\WINDOWS\system32\DRIVERS\mssmbios.sys Address: 0xF7BF1000 Size: 15488 File Visible: - Signed: - Status: - Name: Mup.sys Image Path: Mup.sys Address: 0xF754C000 Size: 107904 File Visible: - Signed: - Status: - Name: NDIS.sys Image Path: NDIS.sys Address: 0xF7567000 Size: 182912 File Visible: - Signed: - Status: - Name: ndistapi.sys Image Path: C:\WINDOWS\system32\DRIVERS\ndistapi.sys Address: 0xF7BDD000 Size: 9600 File Visible: - Signed: - Status: - Name: ndisuio.sys Image Path: C:\WINDOWS\system32\DRIVERS\ndisuio.sys Address: 0xF6E9A000 Size: 12928 File Visible: - Signed: - Status: - Name: ndiswan.sys Image Path: C:\WINDOWS\system32\DRIVERS\ndiswan.sys Address: 0xF73FC000 Size: 91776 File Visible: - Signed: - Status: - Name: NDProxy.SYS Image Path: C:\WINDOWS\System32\Drivers\NDProxy.SYS Address: 0xF783D000 Size: 38016 File Visible: - Signed: - Status: - Name: netbios.sys Image Path: C:\WINDOWS\system32\DRIVERS\netbios.sys Address: 0xF785D000 Size: 34560 File Visible: - Signed: - Status: - Name: netbt.sys Image Path: C:\WINDOWS\system32\DRIVERS\netbt.sys Address: 0xF71E2000 Size: 162816 File Visible: - Signed: - Status: - Name: Npfs.SYS Image Path: C:\WINDOWS\System32\Drivers\Npfs.SYS Address: 0xF7A9D000 Size: 30848 File Visible: - Signed: - Status: - Name: Ntfs.sys Image Path: Ntfs.sys Address: 0xF7594000 Size: 574464 File Visible: - Signed: - Status: - Name: ntoskrnl.exe Image Path: C:\WINDOWS\system32\ntoskrnl.exe Address: 0x804D7000 Size: 2252800 File Visible: - Signed: - Status: - Name: Null.SYS Image Path: C:\WINDOWS\System32\Drivers\Null.SYS Address: 0xF7DA1000 Size: 2944 File Visible: - Signed: - Status: - Name: ohci1394.sys Image Path: ohci1394.sys Address: 0xF771D000 Size: 61056 File Visible: - Signed: - Status: - Name: OPRGHDLR.SYS Image Path: C:\WINDOWS\system32\DRIVERS\OPRGHDLR.SYS Address: 0xF7CD6000 Size: 4096 File Visible: - Signed: - Status: - Name: PartMgr.sys Image Path: PartMgr.sys Address: 0xF7995000 Size: 18688 File Visible: - Signed: - Status: - Name: pci.sys Image Path: pci.sys Address: 0xF76AD000 Size: 68224 File Visible: - Signed: - Status: - Name: pciide.sys Image Path: pciide.sys Address: 0xF7CD5000 Size: 3328 File Visible: - Signed: - Status: - Name: PCIIDEX.SYS Image Path: C:\WINDOWS\system32\DRIVERS\PCIIDEX.SYS Address: 0xF798D000 Size: 28672 File Visible: - Signed: - Status: - Name: pcmcia.sys Image Path: pcmcia.sys Address: 0xF768F000 Size: 119936 File Visible: - Signed: - Status: - Name: pfc.sys Image Path: C:\WINDOWS\system32\drivers\pfc.sys Address: 0xF7BBD000 Size: 10368 File Visible: - Signed: - Status: - Name: PnpManager Image Path: \Driver\PnpManager Address: 0x804D7000 Size: 2252800 File Visible: - Signed: - Status: - Name: psched.sys Image Path: C:\WINDOWS\system32\DRIVERS\psched.sys Address: 0xF73EB000 Size: 69120 File Visible: - Signed: - Status: - Name: ptilink.sys Image Path: C:\WINDOWS\system32\DRIVERS\ptilink.sys Address: 0xF7A45000 Size: 17792 File Visible: - Signed: - Status: - Name: PxHelp20.sys Image Path: PxHelp20.sys Address: 0xF799D000 Size: 19936 File Visible: - Signed: - Status: - Name: rasacd.sys Image Path: C:\WINDOWS\system32\DRIVERS\rasacd.sys Address: 0xF7504000 Size: 8832 File Visible: - Signed: - Status: - Name: rasl2tp.sys Image Path: C:\WINDOWS\system32\DRIVERS\rasl2tp.sys Address: 0xF77DD000 Size: 51328 File Visible: - Signed: - Status: - Name: raspppoe.sys Image Path: C:\WINDOWS\system32\DRIVERS\raspppoe.sys Address: 0xF77ED000 Size: 41472 File Visible: - Signed: - Status: - Name: raspptp.sys Image Path: C:\WINDOWS\system32\DRIVERS\raspptp.sys Address: 0xF77FD000 Size: 48384 File Visible: - Signed: - Status: - Name: raspti.sys Image Path: C:\WINDOWS\system32\DRIVERS\raspti.sys Address: 0xF7A55000 Size: 16512 File Visible: - Signed: - Status: - Name: RAW Image Path: \FileSystem\RAW Address: 0x804D7000 Size: 2252800 File Visible: - Signed: - Status: - Name: rdbss.sys Image Path: C:\WINDOWS\system32\DRIVERS\rdbss.sys Address: 0xF7195000 Size: 174592 File Visible: - Signed: - Status: - Name: RDPCDD.sys Image Path: C:\WINDOWS\System32\DRIVERS\RDPCDD.sys Address: 0xF7C31000 Size: 4224 File Visible: - Signed: - Status: - Name: redbook.sys Image Path: C:\WINDOWS\system32\DRIVERS\redbook.sys Address: 0xF77BD000 Size: 57472 File Visible: - Signed: - Status: - Name: rootrepeal[1].sys Image Path: C:\WINDOWS\system32\drivers\rootrepeal[1].sys Address: 0xF6CDE000 Size: 49152 File Visible: No Signed: - Status: - Name: serial.sys Image Path: serial.sys Address: 0xF777D000 Size: 64896 File Visible: - Signed: - Status: - Name: srv.sys Image Path: C:\WINDOWS\system32\DRIVERS\srv.sys Address: 0xF6BFC000 Size: 333184 File Visible: - Signed: - Status: - Name: swenum.sys Image Path: C:\WINDOWS\system32\DRIVERS\swenum.sys Address: 0xF7C1D000 Size: 4352 File Visible: - Signed: - Status: - Name: tcpip.sys Image Path: C:\WINDOWS\system32\DRIVERS\tcpip.sys Address: 0xF722B000 Size: 360320 File Visible: - Signed: - Status: - Name: TDI.SYS Image Path: C:\WINDOWS\system32\DRIVERS\TDI.SYS Address: 0xF7A35000 Size: 20480 File Visible: - Signed: - Status: - Name: termdd.sys Image Path: C:\WINDOWS\system32\DRIVERS\termdd.sys Address: 0xF781D000 Size: 40704 File Visible: - Signed: - Status: - Name: tiumflt.sys Image Path: tiumflt.sys Address: 0xF7B2D000 Size: 8448 File Visible: - Signed: - Status: - Name: update.sys Image Path: C:\WINDOWS\system32\DRIVERS\update.sys Address: 0xF7392000 Size: 364160 File Visible: - Signed: - Status: - Name: USBD.SYS Image Path: C:\WINDOWS\system32\DRIVERS\USBD.SYS Address: 0xF7C21000 Size: 8192 File Visible: - Signed: - Status: - Name: usbehci.sys Image Path: C:\WINDOWS\system32\DRIVERS\usbehci.sys Address: 0xF7A15000 Size: 26624 File Visible: - Signed: - Status: - Name: usbhub.sys Image Path: C:\WINDOWS\system32\DRIVERS\usbhub.sys Address: 0xF782D000 Size: 57600 File Visible: - Signed: - Status: - Name: usbohci.sys Image Path: C:\WINDOWS\system32\DRIVERS\usbohci.sys Address: 0xF79CD000 Size: 17024 File Visible: - Signed: - Status: - Name: USBPORT.SYS Image Path: C:\WINDOWS\system32\DRIVERS\USBPORT.SYS Address: 0xF74D0000 Size: 143360 File Visible: - Signed: - Status: - Name: VETFDDNT.SYS Image Path: C:\WINDOWS\System32\Drivers\VETFDDNT.SYS Address: 0xF7510000 Size: 16128 File Visible: - Signed: - Status: - Name: vga.sys Image Path: C:\WINDOWS\System32\drivers\vga.sys Address: 0xF7A7D000 Size: 20992 File Visible: - Signed: - Status: - Name: viaide.sys Image Path: viaide.sys Address: 0xF7C13000 Size: 5376 File Visible: - Signed: - Status: - Name: VIDEOPRT.SYS Image Path: C:\WINDOWS\System32\drivers\VIDEOPRT.SYS Address: 0xF72B6000 Size: 81920 File Visible: - Signed: - Status: - Name: VolSnap.sys Image Path: VolSnap.sys Address: 0xF774D000 Size: 52352 File Visible: - Signed: - Status: - Name: watchdog.sys Image Path: C:\WINDOWS\System32\watchdog.sys Address: 0xF7AE5000 Size: 20480 File Visible: - Signed: - Status: - Name: Win32k Image Path: \Driver\Win32k Address: 0xBF800000 Size: 1847296 File Visible: - Signed: - Status: - Name: win32k.sys Image Path: C:\WINDOWS\System32\win32k.sys Address: 0xBF800000 Size: 1847296 File Visible: - Signed: - Status: - Name: win32k.sys:1 Image Path: C:\WINDOWS\win32k.sys:1 Address: 0xF7AED000 Size: 20480 File Visible: No Signed: - Status: - Name: win32k.sys:2 Image Path: C:\WINDOWS\win32k.sys:2 Address: 0xF72FA000 Size: 61440 File Visible: No Signed: - Status: - Name: wmiacpi.sys Image Path: C:\WINDOWS\system32\DRIVERS\wmiacpi.sys Address: 0xF7BAD000 Size: 8832 File Visible: - Signed: - Status: - Name: WMILIB.SYS Image Path: C:\WINDOWS\system32\DRIVERS\WMILIB.SYS Address: 0xF7C0F000 Size: 8192 File Visible: - Signed: - Status: - Name: WMIxWDM Image Path: \Driver\WMIxWDM Address: 0x804D7000 Size: 2252800 File Visible: - Signed: - Status: - Last edited by Oganix99; 11-04-2009 at 12:52 AM.

11-04-2009, 06:52 AM	#9 (permalink)
Ried Assistant Manager, TSF Academy; Moderator/Analyst Security Team Join Date: Jan 2005 Location: Ohio Posts: 27,112 OS: WinXP and Vista	Re: I need some help please. Please save this file to your desktop. Double-click on it to run a scan. When it's finished, there will be a log called Win32kDiag.txt on your desktop. Please open it with notepad and post the contents here. __________________ Member of ASAP since 2005 Member of UNITE since 2006 "It is one life whether we spend it laughing or weeping." "Take the time to laugh--it is the music of the soul."

11-04-2009, 03:08 PM	#10 (permalink)
Oganix99 Registered User Join Date: Oct 2009 Posts: 24 OS: xp	Re: I need some help please. Running from: C:\Documents and Settings\Office Depot\Desktop\Win32kDiag.exe Log file at : C:\Documents and Settings\Office Depot\Desktop\Win32kDiag.txt WARNING: Could not get backup privileges! Searching 'C:\WINDOWS'... Found mount point : C:\WINDOWS\addins\addins Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP107.tmp\ZAP107.tmp Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP11F.tmp\ZAP11F.tmp Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP191.tmp\ZAP191.tmp Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP236.tmp\ZAP236.tmp Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP292.tmp\ZAP292.tmp Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP319.tmp\ZAP319.tmp Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP345.tmp\ZAP345.tmp Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP35A.tmp\ZAP35A.tmp Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP370.tmp\ZAP370.tmp Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\assembly\temp\temp Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\assembly\tmp\tmp Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\Config\Config Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\Connection Wizard\Connection Wizard Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\Debug\UserMode\UserMode Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\Help\SBSI\Training\WXPPer\Cbz\Cbz Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\Help\SBSI\Training\WXPPer\Lib\Lib Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\Help\SBSI\Training\WXPPer\Wave\Wave Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\ime\chsime\applets\applets Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\ime\CHTIME\Applets\Applets Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\ime\imejp\applets\applets Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\ime\imejp98\imejp98 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\ime\imjp8_1\applets\applets Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\ime\imkr6_1\applets\applets Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\ime\imkr6_1\dicts\dicts Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\ime\shared\res\res Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\0DC1503A46F231838AD88BCDDC8E8F7C\3.2.30729\3.2.30729 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\DC3BF90CC0D3D2F398A9A6D1762F70F3\2.2.30729\2.2.30729 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\java\classes\classes Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\java\trustlib\trustlib Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Temporary ASP.NET Files\Bind Logs\Bind Logs Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files\Temporary ASP.NET Files Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\Minidump\Minidump Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\msapps\msinfo\msinfo Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\mui\mui Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\pchealth\ERRORREP\QHEADLES\QHEADLES Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\pchealth\ERRORREP\QSIGNOFF\QSIGNOFF Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\pchealth\helpctr\BATCH\BATCH Mount point destination : \Device\__max++>\^ Cannot access: C:\WINDOWS\pchealth\helpctr\binaries\HelpSvc.exe [1] 2004-08-03 22:00:00 743936 C:\WINDOWS\pchealth\helpctr\binaries\HelpSvc.exe () [1] 2008-04-13 14:12:21 744448 C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\helpsvc.exe (Microsoft Corporation)

11-04-2009, 08:23 PM	#11 (permalink)
Ried Assistant Manager, TSF Academy; Moderator/Analyst Security Team Join Date: Jan 2005 Location: Ohio Posts: 27,112 OS: WinXP and Vista	Re: I need some help please. Click Start->Run, and copy-paste the following bolded text into the Run box, and click OK. "%userprofile%\desktop\win32kdiag.exe" -f -r When it's finished, there will be a log called Win32kDiag.txt on your desktop. I'll need to see that in your next reply. ===================================================================== Download OTL to your desktop. Double click the icon to start the tool. Click Run Scan and let the program run uninterrupted. When the scan is complete, two text files will be created, OTL.Txt <- this one will be opened in Notepad and Extras.txt, on Desktop. Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of OTL.Txt and the Extras.txt in your next reply. __________________ Member of ASAP since 2005 Member of UNITE since 2006 "It is one life whether we spend it laughing or weeping." "Take the time to laugh--it is the music of the soul."

11-04-2009, 10:59 PM	#12 (permalink)
Oganix99 Registered User Join Date: Oct 2009 Posts: 24 OS: xp	Re: I need some help please. ok here's there Win32kDiag.txt Running from: C:\Documents and Settings\Office Depot\desktop\win32kdiag.exe Log file at : C:\Documents and Settings\Office Depot\Desktop\Win32kDiag.txt Removing all found mount points. Attempting to reset file permissions. WARNING: Could not get backup privileges! Searching 'C:\WINDOWS'... Found mount point : C:\WINDOWS\addins\addins Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\addins\addins Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP107.tmp\ZAP107.tmp Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP107.tmp\ZAP107.tmp Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP11F.tmp\ZAP11F.tmp Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP11F.tmp\ZAP11F.tmp Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP191.tmp\ZAP191.tmp Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP191.tmp\ZAP191.tmp Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP236.tmp\ZAP236.tmp Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP236.tmp\ZAP236.tmp Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP292.tmp\ZAP292.tmp Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP292.tmp\ZAP292.tmp Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP319.tmp\ZAP319.tmp Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP319.tmp\ZAP319.tmp Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP345.tmp\ZAP345.tmp Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP345.tmp\ZAP345.tmp Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP35A.tmp\ZAP35A.tmp Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP35A.tmp\ZAP35A.tmp Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP370.tmp\ZAP370.tmp Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP370.tmp\ZAP370.tmp Found mount point : C:\WINDOWS\assembly\temp\temp Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\assembly\temp\temp Found mount point : C:\WINDOWS\assembly\tmp\tmp Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\assembly\tmp\tmp Found mount point : C:\WINDOWS\Config\Config Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\Config\Config Found mount point : C:\WINDOWS\Connection Wizard\Connection Wizard Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\Connection Wizard\Connection Wizard Found mount point : C:\WINDOWS\Debug\UserMode\UserMode Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\Debug\UserMode\UserMode Found mount point : C:\WINDOWS\Help\SBSI\Training\WXPPer\Cbz\Cbz Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\Help\SBSI\Training\WXPPer\Cbz\Cbz Found mount point : C:\WINDOWS\Help\SBSI\Training\WXPPer\Lib\Lib Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\Help\SBSI\Training\WXPPer\Lib\Lib Found mount point : C:\WINDOWS\Help\SBSI\Training\WXPPer\Wave\Wave Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\Help\SBSI\Training\WXPPer\Wave\Wave Found mount point : C:\WINDOWS\ime\chsime\applets\applets Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\ime\chsime\applets\applets Found mount point : C:\WINDOWS\ime\CHTIME\Applets\Applets Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\ime\CHTIME\Applets\Applets Found mount point : C:\WINDOWS\ime\imejp\applets\applets Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\ime\imejp\applets\applets Found mount point : C:\WINDOWS\ime\imejp98\imejp98 Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\ime\imejp98\imejp98 Found mount point : C:\WINDOWS\ime\imjp8_1\applets\applets Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\ime\imjp8_1\applets\applets Found mount point : C:\WINDOWS\ime\imkr6_1\applets\applets Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\ime\imkr6_1\applets\applets Found mount point : C:\WINDOWS\ime\imkr6_1\dicts\dicts Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\ime\imkr6_1\dicts\dicts Found mount point : C:\WINDOWS\ime\shared\res\res Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\ime\shared\res\res Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\0DC1503A46F231838AD88BCDDC8E8F7C\3.2.30729\3.2.30729 Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\0DC1503A46F231838AD88BCDDC8E8F7C\3.2.30729\3.2.30729 Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\DC3BF90CC0D3D2F398A9A6D1762F70F3\2.2.30729\2.2.30729 Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\DC3BF90CC0D3D2F398A9A6D1762F70F3\2.2.30729\2.2.30729 Found mount point : C:\WINDOWS\java\classes\classes Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\java\classes\classes Found mount point : C:\WINDOWS\java\trustlib\trustlib Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\java\trustlib\trustlib Found mount point : C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Temporary ASP.NET Files\Bind Logs\Bind Logs Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Temporary ASP.NET Files\Bind Logs\Bind Logs Found mount point : C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files\Temporary ASP.NET Files Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files\Temporary ASP.NET Files Found mount point : C:\WINDOWS\Minidump\Minidump Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\Minidump\Minidump Found mount point : C:\WINDOWS\msapps\msinfo\msinfo Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\msapps\msinfo\msinfo Found mount point : C:\WINDOWS\mui\mui Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\mui\mui Found mount point : C:\WINDOWS\pchealth\ERRORREP\QHEADLES\QHEADLES Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\pchealth\ERRORREP\QHEADLES\QHEADLES Found mount point : C:\WINDOWS\pchealth\ERRORREP\QSIGNOFF\QSIGNOFF Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\pchealth\ERRORREP\QSIGNOFF\QSIGNOFF Found mount point : C:\WINDOWS\pchealth\helpctr\BATCH\BATCH Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\pchealth\helpctr\BATCH\BATCH Cannot access: C:\WINDOWS\pchealth\helpctr\binaries\HelpSvc.exe Attempting to restore permissions of : C:\WINDOWS\pchealth\helpctr\binaries\HelpSvc.exe Found mount point : C:\WINDOWS\pchealth\helpctr\Config\CheckPoint\CheckPoint Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\pchealth\helpctr\Config\CheckPoint\CheckPoint Found mount point : C:\WINDOWS\pchealth\helpctr\Config\News\News Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\pchealth\helpctr\Config\News\News Found mount point : C:\WINDOWS\pchealth\helpctr\HelpFiles\HelpFiles Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\pchealth\helpctr\HelpFiles\HelpFiles Found mount point : C:\WINDOWS\pchealth\helpctr\InstalledSKUs\InstalledSKUs Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\pchealth\helpctr\InstalledSKUs\InstalledSKUs Found mount point : C:\WINDOWS\pchealth\helpctr\System\DFS\DFS Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\pchealth\helpctr\System\DFS\DFS Found mount point : C:\WINDOWS\pchealth\helpctr\Temp\Temp Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\pchealth\helpctr\Temp\Temp Found mount point : C:\WINDOWS\PIF\PIF Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\PIF\PIF Found mount point : C:\WINDOWS\Registration\CRMLog\CRMLog Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\Registration\CRMLog\CRMLog Found mount point : C:\WINDOWS\security\logs\logs Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\security\logs\logs Found mount point : C:\WINDOWS\SoftwareDistribution\AuthCabs\Downloaded\Downloaded Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\SoftwareDistribution\AuthCabs\Downloaded\Downloaded Found mount point : C:\WINDOWS\SoftwareDistribution\Download\355f788b6de8a3ec79e9aa172e6317f1\backup\backup Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\SoftwareDistribution\Download\355f788b6de8a3ec79e9aa172e6317f1\backup\backup Found mount point : C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\asms\10\policy\policy Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\asms\10\policy\policy Found mount point : C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\asms\51\msft\msft Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\asms\51\msft\msft Found mount point : C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\asms\51\policy\msft\msft Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\asms\51\policy\msft\msft Found mount point : C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\asms\52\msft\msft Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\asms\52\msft\msft Found mount point : C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\asms\52\policy\msft\msft Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\asms\52\policy\msft\msft Found mount point : C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\asms\60\msft\msft Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\asms\60\msft\msft Found mount point : C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\asms\70\70 Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\asms\70\70 Found mount point : C:\WINDOWS\Sun\Java\Deployment\Deployment Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\Sun\Java\Deployment\Deployment Found mount point : C:\WINDOWS\SxsCaPendDel\SxsCaPendDel Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\SxsCaPendDel\SxsCaPendDel Cannot access: C:\WINDOWS\system32\eventlog.dll Attempting to restore permissions of : C:\WINDOWS\system32\eventlog.dll [1] 2008-04-13 14:11:53 56320 C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\eventlog.dll (Microsoft Corporation) [1] 2004-08-03 22:00:00 61952 C:\WINDOWS\system32\eventlog.dll () [2] 2004-08-03 22:00:00 55808 C:\WINDOWS\system32\logevent.dll (Microsoft Corporation) Cannot access: C:\WINDOWS\system32\wbem\wmiprvse.exe Attempting to restore permissions of : C:\WINDOWS\system32\wbem\wmiprvse.exe Found mount point : C:\WINDOWS\Temp\History\Results\Results Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\Temp\History\Results\Results Found mount point : C:\WINDOWS\Temp\RtSigs\Data\Data Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\Temp\RtSigs\Data\Data Found mount point : C:\WINDOWS\WinSxS\InstallTemp\InstallTemp Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\WinSxS\InstallTemp\InstallTemp Found mount point : C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700 Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700 Found mount point : C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303 Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303 Found mount point : C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05 Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05 Finished!

11-05-2009, 12:02 AM	#13 (permalink)
Oganix99 Registered User Join Date: Oct 2009 Posts: 24 OS: xp	Re: I need some help please. I can't get anything else to work even when I use rkill, I can't even delete the .exe's so I can redownload them. Just trying to navigate to this thread is a pain.

11-05-2009, 12:04 AM	#14 (permalink)
Ried Assistant Manager, TSF Academy; Moderator/Analyst Security Team Join Date: Jan 2005 Location: Ohio Posts: 27,112 OS: WinXP and Vista	Re: I need some help please. Alright, we'll proceed. It will require more than 1 round to clean the system. Please stay with me until given the 'all clear' even if symptoms seem to abate. Download ComboFix from one of these locations: Link 1 Link 2 * IMPORTANT- Save ComboFix.exe to your Desktop ==================================================== Disable your AntiVirus and AntiSpyware applications as they will interfere with our tools and the removal. If you are unable to access them, run ComboFix from Safe Mode if available. ==================================================== Double click on combofix.exe & follow the prompts. As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware. Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console. Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures. Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message: Click on Yes, to continue scanning for malware. When finished, it shall produce a log for you. Please include the C:\ComboFix.txt** in your next reply for further review along with an update on system behavior. __________________ Member of ASAP since 2005 Member of UNITE since 2006 "It is one life whether we spend it laughing or weeping." "Take the time to laugh--it is the music of the soul."

11-05-2009, 04:50 PM	#15 (permalink)
Oganix99 Registered User Join Date: Oct 2009 Posts: 24 OS: xp	Re: I need some help please. The combofix ran pretty smoothly heres the log.txt, already its alot faster and no popups yet and im in normal mode. everything seems normal right now. ComboFix 09-11-05.01 - Office Depot 11/05/2009 13:24.1.2 - NTFSx86 Running from: c:\documents and settings\Office Depot\Desktop\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\docume~1\OFFICE~1\LOCALS~1\Temp\lsass.exe c:\docume~1\OFFICE~1\LOCALS~1\Temp\services.exe c:\docume~1\OFFICE~1\LOCALS~1\Temp\svchost.exe c:\docume~1\OFFICE~1\LOCALS~1\Temp\taskmgr.exe c:\docume~1\OFFICE~1\LOCALS~1\Temp\winlogon.exe c:\documents and settings\All Users\Start Menu\HP Image Zone .lnk C:\dsiqvib.exe C:\ldvx.exe c:\program files\keowdt c:\program files\keowdt\quylsysguard.exe c:\recycler\S-1-5-21-1653677040-3176959921-2912167393-1003 c:\recycler\S-1-5-21-1708537768-308236825-839522115-1003 c:\windows\syssvc.exe c:\windows\system32\~.exe c:\windows\system32\bazabezi.dll c:\windows\system32\bisevona.exe c:\windows\system32\dulupuhu.dll c:\windows\system32\duvafiyi.exe c:\windows\system32\godamuwe.dll c:\windows\system32\iehelper.dll c:\windows\system32\jevaziji.dll c:\windows\system32\kafidevo.exe c:\windows\system32\lenisako.dll c:\windows\system32\lsp.dll c:\windows\system32\meruyuva.dll c:\windows\system32\monekuho.dll c:\windows\system32\mupapupe.dll c:\windows\system32\nawonane.dll c:\windows\system32\pipuduse.exe c:\windows\system32\pizatoro.dll c:\windows\system32\tasasifu.dll c:\windows\system32\tipifipo.dll c:\windows\system32\vayuhowa.dll c:\windows\system32\vtwd8.dll c:\windows\system32\yirozoyi.dll c:\windows\Temp\3393674608.exe Infected copy of c:\windows\system32\eventlog.dll was found and disinfected Restored copy from - c:\windows\system32\logevent.dll . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226ED} ((((((((((((((((((((((((( Files Created from 2009-10-05 to 2009-11-05 ))))))))))))))))))))))))))))))) . 2009-11-03 22:17 . 2009-11-03 22:17 -------- d-----w- C:\rsit 2009-11-03 05:22 . 2009-11-03 05:22 -------- d-----w- c:\documents and settings\All Users\Application Data\CA 2009-11-03 05:22 . 2009-11-03 05:22 -------- d-----w- c:\program files\CA 2009-11-02 20:58 . 2009-11-05 23:31 -------- d--h--w- c:\windows\PIF 2009-11-02 09:31 . 2009-11-02 09:31 -------- d-----w- c:\documents and settings\Office Depot\Application Data\Malwarebytes 2009-11-02 09:30 . 2009-09-11 00:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-11-02 09:30 . 2009-11-03 06:16 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-11-02 09:30 . 2009-11-02 09:30 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2009-11-02 09:30 . 2009-09-11 00:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-11-02 03:54 . 2009-11-02 04:28 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP 2009-11-02 02:44 . 2009-11-02 02:44 -------- d-----w- c:\documents and settings\Office Depot\Application Data\AVG8 2009-10-26 05:03 . 2009-10-26 05:03 54992 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-10-25 05:44 . 2009-10-25 06:28 -------- d-----w- c:\documents and settings\All Users\Application Data\06723220 2009-10-25 05:44 . 2009-10-25 05:44 274 ----a-w- c:\documents and settings\All Users\Application Data\06723220\06723220.bat 2009-10-25 05:36 . 2009-11-05 23:13 0 ----a-r- c:\windows\win32k.sys 2009-10-25 05:35 . 2009-10-25 05:35 79360 ----a-w- C:\vyiy.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-11-05 23:34 . 2006-03-10 08:53 13568 ----a-w- c:\windows\system32\drivers\USBCRFT.SYS 2009-11-05 23:17 . 2004-11-19 02:09 -------- d-----w- c:\program files\Common Files\Symantec Shared 2009-11-02 03:09 . 2008-10-30 03:52 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8 2009-11-02 03:06 . 2008-10-30 03:52 -------- d-----w- c:\program files\AVG 2009-09-11 14:33 . 2004-08-04 08:00 133632 ----a-w- c:\windows\system32\msv1_0.dll 2009-09-04 20:45 . 2004-08-04 08:00 58880 ----a-w- c:\windows\system32\msasn1.dll 2009-08-29 07:36 . 2004-08-04 08:00 832512 ----a-w- c:\windows\system32\wininet.dll 2009-08-29 07:36 . 2004-08-04 08:00 78336 ----a-w- c:\windows\system32\ieencode.dll 2009-08-29 07:36 . 2004-08-04 08:00 17408 ------w- c:\windows\system32\corpol.dll 2009-08-26 08:16 . 2004-08-04 08:00 247326 ----a-w- c:\windows\system32\strmdll.dll 2009-08-16 05:45 . 2005-07-11 21:13 54992 ----a-w- c:\documents and settings\Office Depot\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-07-28 19:23 . 2009-07-28 19:23 1052192 --sha-w- c:\windows\system32\bisoloku.exe 2009-08-02 21:50 . 2009-08-02 21:50 91648 --sha-w- c:\windows\system32\bubedena.dll 2009-08-02 21:50 . 2009-08-02 21:50 39424 --sha-w- c:\windows\system32\famavebe.dll 2009-08-05 22:49 . 2009-08-05 22:49 92160 --sha-w- c:\windows\system32\gilavofi.dll 2009-08-03 22:13 . 2009-08-03 22:13 39424 --sha-w- c:\windows\system32\jenupiso.dll 2009-08-05 22:49 . 2009-08-05 22:49 45056 --sha-w- c:\windows\system32\lutayesi.dll 2009-08-05 22:49 . 2009-08-05 22:49 39424 --sha-w- c:\windows\system32\newuwiyo.dll 2009-08-04 21:52 . 2009-08-04 21:52 45056 --sha-w- c:\windows\system32\pebuhewe.dll 2009-08-05 22:49 . 2009-08-05 22:49 199680 --sha-w- c:\windows\system32\varigisu.exe 2009-08-04 21:52 . 2009-08-04 21:52 39424 --sha-w- c:\windows\system32\zumijasa.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Apoint"="c:\program files\Apoint2K\Apoint.exe" [2003-10-08 159744] "Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2004-03-01 200766] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-12 49152] "cctray"="c:\program files\CA\CA Internet Security Suite\cctray\cctray.exe" [2009-11-03 177392] "AGRSMMSG"="AGRSMMSG.exe" - c:\windows\AGRSMMSG.exe [2004-08-24 88363] "ATIModeChange"="Ati2mdxx.exe" - c:\windows\system32\Ati2mdxx.exe [2001-09-04 28672] "CICache"="CICache.exe" - c:\windows\CICache.exe [2002-09-05 24576] "Dit"="Dit.exe" - c:\windows\Dit.exe [2004-04-27 86016] c:\documents and settings\All Users\Start Menu\Programs\Startup\ HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-11 282624] HP Image Zone Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2005-5-11 73728] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk \0SsiEfr.e [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\WINDOWS\\system32\\usmt\\migwiz.exe"= R3 CardReaderFilter;Card Reader Filter;c:\windows\system32\Drivers\USBCRFT.SYS [2009-11-05 13568] S0 atiide;atiide;c:\windows\system32\DRIVERS\atiide.sys [2004-04-14 5632] --- Other Services/Drivers In Memory --- NewlyCreated* - MBR Deregistered - mbr . Contents of the 'Scheduled Tasks' folder . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.yahoo.com/ uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr7/http://www.yahoo.com/ext/search/search.html uInternet Connection Wizard,ShellNext = iexplore uSearchURL,(Default) = hxxp://www.google.com/keyword/%s IE: &Yahoo! Search - file:///c:\program files\Yahoo!\Common/ycsrch.htm IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 IE: Yahoo! &Dictionary - file:///c:\program files\Yahoo!\Common/ycdict.htm IE: Yahoo! &Maps - file:///c:\program files\Yahoo!\Common/ycmap.htm IE: Yahoo! &SMS - file:///c:\program files\Yahoo!\Common/ycsms.htm TCP: {76920A34-B57E-4465-9816-D63D82B65DA3} = 77.74.48.113 . - - - - ORPHANS REMOVED - - - - BHO-{6b3e0dd0-ea91-41b7-93c2-f1c289fb020f} - dulupuhu.dll BHO-{A2234B15-23F2-42AD-F4E4-00AAC39C0004} - c:\windows\system32\vtwd8.dll WebBrowser-{08FCF7E3-5F7D-444E-8554-76A516EB3C6C} - (no file) WebBrowser-{4F802BCF-44AA-4C28-935A-CBEDC24B5375} - (no file) WebBrowser-{07AA283A-43D7-4CBE-A064-32A21112D94D} - (no file) HKLM-Run-tofobeful - c:\windows\system32\meruyuva.dll HKLM-Run-dukawovedi - vayuhowa.dll SharedTaskScheduler-{A2234B15-23F2-42AD-F4E4-00AAC39C0004} - c:\windows\system32\vtwd8.dll SharedTaskScheduler-{6b7b2f3b-e0bf-4988-9db4-36daf39a0d77} - c:\windows\system32\meruyuva.dll SharedTaskScheduler-{c34e2202-ad18-4f9a-888e-1204b6721b5f} - c:\windows\system32\meruyuva.dll SharedTaskScheduler-{4486e005-f169-4e90-8708-2aec2ca64d31} - c:\windows\system32\meruyuva.dll SharedTaskScheduler-{70eedf3b-91dc-4673-8e96-8e48c23eed69} - c:\windows\system32\meruyuva.dll SharedTaskScheduler-{55a025d9-c69c-4a89-8217-440012589b4b} - c:\windows\system32\meruyuva.dll SharedTaskScheduler-{d8682a43-fdfb-46e4-b8b3-dffc9b0e9abc} - c:\windows\system32\meruyuva.dll SSODL-nenavojop-{6b7b2f3b-e0bf-4988-9db4-36daf39a0d77} - c:\windows\system32\meruyuva.dll SSODL-tujukilas-{c34e2202-ad18-4f9a-888e-1204b6721b5f} - c:\windows\system32\meruyuva.dll SSODL-zasukajel-{4486e005-f169-4e90-8708-2aec2ca64d31} - c:\windows\system32\meruyuva.dll SSODL-hojezobuz-{70eedf3b-91dc-4673-8e96-8e48c23eed69} - c:\windows\system32\meruyuva.dll SSODL-seguzatuw-{55a025d9-c69c-4a89-8217-440012589b4b} - c:\windows\system32\meruyuva.dll SSODL-yomojojib-{d8682a43-fdfb-46e4-b8b3-dffc9b0e9abc} - c:\windows\system32\meruyuva.dll *********************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-11-05 13:34 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe????????0?3?5?2??????? ???B???????????????B? ?????? scanning hidden files ... scan completed successfully hidden files: 0 ********************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(440) c:\windows\system32\Ati2evxx.dll - - - - - - - > 'explorer.exe'(2700) c:\windows\system32\WININET.dll c:\windows\system32\ieframe.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Other Running Processes ------------------------ . c:\windows\system32\Ati2evxx.exe c:\windows\system32\wscntfy.exe c:\windows\system32\Ati2evxx.exe c:\program files\Apoint2K\Apntex.exe c:\program files\HP\Digital Imaging\bin\hpqimzone.exe c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe c:\program files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe c:\program files\CA\CA Internet Security Suite\ccprovsp.exe . ************************************************************************ . Completion time: 2009-11-05 13:41 - machine was rebooted ComboFix-quarantined-files.txt 2009-11-05 23:41 Pre-Run: 25,329,725,440 bytes free Post-Run: 25,827,270,656 bytes free WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect - - End Of File - - 819281027611CF092F5ED24404034225

11-05-2009, 05:58 PM	#16 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,795 OS: 2000 Pro; XP Pro; XP Home	Re: I need some help please. Hello, Oganix99 Ried will be away from the PC for a while, so I'll be looking after your thread. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. --------------------------------------------------------------------------------------------- Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix. Open notepad and copy/paste the text in the quotebox below into it: Code: http://www.techsupportforum.com/security-center/virus-trojan-spyware-help/427472-i-need-some-help-please.html Folder:: c:\documents and settings\All Users\Application Data\06723220 File:: c:\windows\win32k.sys Collect:: C:\vyiy.exe c:\windows\system32\bisoloku.exe c:\windows\system32\bubedena.dll c:\windows\system32\famavebe.dll c:\windows\system32\gilavofi.dll c:\windows\system32\jenupiso.dll c:\windows\system32\lutayesi.dll c:\windows\system32\newuwiyo.dll c:\windows\system32\pebuhewe.dll c:\windows\system32\varigisu.exe c:\windows\system32\zumijasa.dll Comment:: End Copy Here Save this as CFScript.txt Referring to the picture above, drag CFScript.txt into ComboFix.exe ComboFix may request an update; please allow it. Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal. When finished, it shall produce a log for you. Post that log in your next reply Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall. Note When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture files to submit for analysis. Ensure you are connected to the internet and click OK on the message box. Please let me know if the file was successfully submitted . Thanks. ------------------------------------------------------ Ensure your AntiVirus and AntiSpyware applications are re-enabled. --------------------------------------------------------------------------------------------- Please go to Start > Run and copy/paste the following, then press Enter: C:\QooBox\Add-Remove Programs.txt A text file should open. Please post the contents of that file in your next reply. __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009

11-06-2009, 09:51 PM	#17 (permalink)
Oganix99 Registered User Join Date: Oct 2009 Posts: 24 OS: xp	Re: I need some help please. Hi tetonbob, heres the add-remove programs txt 5600 5600_Help 5600Trb Adobe AIR Adobe Flash Player 10 ActiveX Adobe Media Player Adobe Reader 8.1.2 Agere Systems AC'97 Modem AiO_Scan AiOSoftware ATI Display Driver BufferChm BUSlink USB-Flash Driver CA Anti-Spam CA Internet Security Suite CA Personal Firewall CameraMate Real-Time Video Driver CameraMate Real-Time Video for Flash CCleaner (remove only) CP_AtenaShokunin1Config CP_CalendarTemplates1 CP_Package_Basic1 CP_Package_Variety1 CP_Package_Variety2 CP_Package_Variety3 CP_Panorama1Config Critical Update for Windows Media Player 11 (KB959772) CueTour CustomerResearchQFolder Destinations DeviceFunctionQFolder DeviceManagementQFolder DocProc DocumentViewer DocumentViewerQFolder ESPN Java Check eSupportQFolder Fax FullDPAppQFolder Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) Hotfix for Windows Internet Explorer 7 (KB947864) Hotfix for Windows Media Format 11 SDK (KB929399) Hotfix for Windows Media Player 11 (KB939683) Hotfix for Windows XP (KB914440) Hotfix for Windows XP (KB915865) Hotfix for Windows XP (KB926239) Hotfix for Windows XP (KB952287) Hotfix for Windows XP (KB954550-v5) Hotfix for Windows XP (KB961118) Hotfix for Windows XP (KB970653-v3) HP Document Viewer 5.3 HP Extended Capabilities 5.3 HP Help and Support HP Image Zone 5.3 HP Imaging Device Functions 5.3 HP PSC & OfficeJet 5.3.B HP Software Update HP Solution Center & Imaging Support Tools 5.3 HPProductAssistant HpSdpAppCoreApp InstantShareDevices J2SE Runtime Environment 5.0 Update 4 Java 2 Runtime Environment, SE v1.4.2_05 Java(TM) 6 Update 3 Macromedia Flash Player MarketResearch Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Security Update (KB953297) Microsoft .NET Framework 2.0 Service Pack 2 Microsoft .NET Framework 3.0 Service Pack 2 Microsoft .NET Framework 3.5 SP1 Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Internationalized Domain Names Mitigation APIs Microsoft National Language Support Downlevel APIs Microsoft User-Mode Driver Framework Feature Pack 1.0 MSXML 4.0 SP2 (KB927978) MSXML 4.0 SP2 (KB936181) MSXML 4.0 SP2 (KB954430) NewCopy PanoStandAlone PCI 1620 Cardbus Controller and Software PhotoGallery ProductContext RandMap Readme Scan ScannerCopy Security Update for CAPICOM (KB931906) Security Update for Step By Step Interactive Training (KB898458) Security Update for Step By Step Interactive Training (KB923723) Security Update for Windows Internet Explorer 7 (KB938127) Security Update for Windows Internet Explorer 7 (KB942615) Security Update for Windows Internet Explorer 7 (KB944533) Security Update for Windows Internet Explorer 7 (KB950759) Security Update for Windows Internet Explorer 7 (KB953838) Security Update for Windows Internet Explorer 7 (KB956390) Security Update for Windows Internet Explorer 7 (KB958215) Security Update for Windows Internet Explorer 7 (KB960714) Security Update for Windows Internet Explorer 7 (KB961260) Security Update for Windows Internet Explorer 7 (KB963027) Security Update for Windows Internet Explorer 7 (KB969897) Security Update for Windows Internet Explorer 7 (KB972260) Security Update for Windows Internet Explorer 7 (KB974455) Security Update for Windows Media Player (KB911564) Security Update for Windows Media Player (KB952069) Security Update for Windows Media Player (KB954155) Security Update for Windows Media Player (KB968816) Security Update for Windows Media Player (KB973540) Security Update for Windows Media Player 11 (KB936782) Security Update for Windows Media Player 11 (KB954154) Security Update for Windows Media Player 6.4 (KB925398) Security Update for Windows Media Player 9 (KB911565) Security Update for Windows Media Player 9 (KB917734) Security Update for Windows Media Player 9 (KB936782) Security Update for Windows XP (KB883939) Security Update for Windows XP (KB890046) Security Update for Windows XP (KB893756) Security Update for Windows XP (KB896358) Security Update for Windows XP (KB896422) Security Update for Windows XP (KB896423) Security Update for Windows XP (KB896424) Security Update for Windows XP (KB896428) Security Update for Windows XP (KB896688) Security Update for Windows XP (KB899587) Security Update for Windows XP (KB899588) Security Update for Windows XP (KB899591) Security Update for Windows XP (KB900725) Security Update for Windows XP (KB901017) Security Update for Windows XP (KB901214) Security Update for Windows XP (KB902400) Security Update for Windows XP (KB903235) Security Update for Windows XP (KB904706) Security Update for Windows XP (KB905414) Security Update for Windows XP (KB905749) Security Update for Windows XP (KB905915) Security Update for Windows XP (KB908519) Security Update for Windows XP (KB908531) Security Update for Windows XP (KB911562) Security Update for Windows XP (KB911567) Security Update for Windows XP (KB911927) Security Update for Windows XP (KB912812) Security Update for Windows XP (KB912919) Security Update for Windows XP (KB913446) Security Update for Windows XP (KB913580) Security Update for Windows XP (KB914388) Security Update for Windows XP (KB914389) Security Update for Windows XP (KB916281) Security Update for Windows XP (KB917159) Security Update for Windows XP (KB917344) Security Update for Windows XP (KB917422) Security Update for Windows XP (KB917953) Security Update for Windows XP (KB918118) Security Update for Windows XP (KB918439) Security Update for Windows XP (KB918899) Security Update for Windows XP (KB919007) Security Update for Windows XP (KB920213) Security Update for Windows XP (KB920214) Security Update for Windows XP (KB920670) Security Update for Windows XP (KB920683) Security Update for Windows XP (KB920685) Security Update for Windows XP (KB921398) Security Update for Windows XP (KB921503) Security Update for Windows XP (KB921883) Security Update for Windows XP (KB922616) Security Update for Windows XP (KB922760) Security Update for Windows XP (KB922819) Security Update for Windows XP (KB923191) Security Update for Windows XP (KB923414) Security Update for Windows XP (KB923561) Security Update for Windows XP (KB923689) Security Update for Windows XP (KB923694) Security Update for Windows XP (KB923980) Security Update for Windows XP (KB924191) Security Update for Windows XP (KB924270) Security Update for Windows XP (KB924496) Security Update for Windows XP (KB924667) Security Update for Windows XP (KB925454) Security Update for Windows XP (KB925486) Security Update for Windows XP (KB925902) Security Update for Windows XP (KB926255) Security Update for Windows XP (KB926436) Security Update for Windows XP (KB927779) Security Update for Windows XP (KB927802) Security Update for Windows XP (KB928090) Security Update for Windows XP (KB928255) Security Update for Windows XP (KB928843) Security Update for Windows XP (KB929123) Security Update for Windows XP (KB929969) Security Update for Windows XP (KB930178) Security Update for Windows XP (KB931261) Security Update for Windows XP (KB931768) Security Update for Windows XP (KB931784) Security Update for Windows XP (KB932168) Security Update for Windows XP (KB933566) Security Update for Windows XP (KB933729) Security Update for Windows XP (KB935839) Security Update for Windows XP (KB935840) Security Update for Windows XP (KB936021) Security Update for Windows XP (KB937143) Security Update for Windows XP (KB938127) Security Update for Windows XP (KB938464) Security Update for Windows XP (KB938829) Security Update for Windows XP (KB939653) Security Update for Windows XP (KB941202) Security Update for Windows XP (KB941568) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB941644) Security Update for Windows XP (KB941693) Security Update for Windows XP (KB942615) Security Update for Windows XP (KB943055) Security Update for Windows XP (KB943460) Security Update for Windows XP (KB943485) Security Update for Windows XP (KB944653) Security Update for Windows XP (KB945553) Security Update for Windows XP (KB946026) Security Update for Windows XP (KB946648) Security Update for Windows XP (KB948590) Security Update for Windows XP (KB948881) Security Update for Windows XP (KB950749) Security Update for Windows XP (KB950760) Security Update for Windows XP (KB950762) Security Update for Windows XP (KB950974) Security Update for Windows XP (KB951066) Security Update for Windows XP (KB951376-v2) Security Update for Windows XP (KB951376) Security Update for Windows XP (KB951698) Security Update for Windows XP (KB951748) Security Update for Windows XP (KB952004) Security Update for Windows XP (KB952954) Security Update for Windows XP (KB953839) Security Update for Windows XP (KB954211) Security Update for Windows XP (KB954600) Security Update for Windows XP (KB955069) Security Update for Windows XP (KB956391) Security Update for Windows XP (KB956572) Security Update for Windows XP (KB956802) Security Update for Windows XP (KB956803) Security Update for Windows XP (KB956841) Security Update for Windows XP (KB956844) Security Update for Windows XP (KB957095) Security Update for Windows XP (KB957097) Security Update for Windows XP (KB958470) Security Update for Windows XP (KB958644) Security Update for Windows XP (KB958687) Security Update for Windows XP (KB958690) Security Update for Windows XP (KB958869) Security Update for Windows XP (KB959426) Security Update for Windows XP (KB960225) Security Update for Windows XP (KB960715) Security Update for Windows XP (KB960803) Security Update for Windows XP (KB960859) Security Update for Windows XP (KB961371) Security Update for Windows XP (KB961373) Security Update for Windows XP (KB961501) Security Update for Windows XP (KB968537) Security Update for Windows XP (KB969059) Security Update for Windows XP (KB969898) Security Update for Windows XP (KB970238) Security Update for Windows XP (KB971486) Security Update for Windows XP (KB971557) Security Update for Windows XP (KB971633) Security Update for Windows XP (KB971657) Security Update for Windows XP (KB971961) Security Update for Windows XP (KB973346) Security Update for Windows XP (KB973354) Security Update for Windows XP (KB973507) Security Update for Windows XP (KB973525) Security Update for Windows XP (KB973869) Security Update for Windows XP (KB974112) Security Update for Windows XP (KB974571) Security Update for Windows XP (KB975025) Security Update for Windows XP (KB975467) SkinsHP1 SolutionCenter Sonic_PrimoSDK Sony USB Driver Status TI1620/1520 TrayApp Unload Update for Microsoft .NET Framework 3.5 SP1 (KB963707) Update for Windows Internet Explorer 7 (KB976749) Update for Windows XP (KB894391) Update for Windows XP (KB896727) Update for Windows XP (KB898461) Update for Windows XP (KB900485) Update for Windows XP (KB904942) Update for Windows XP (KB910437) Update for Windows XP (KB911280) Update for Windows XP (KB916595) Update for Windows XP (KB920872) Update for Windows XP (KB922582) Update for Windows XP (KB925720) Update for Windows XP (KB927891) Update for Windows XP (KB929338) Update for Windows XP (KB930916) Update for Windows XP (KB931836) Update for Windows XP (KB932823-v3) Update for Windows XP (KB933360) Update for Windows XP (KB936357) Update for Windows XP (KB938828) Update for Windows XP (KB942763) Update for Windows XP (KB942840) Update for Windows XP (KB946627) Update for Windows XP (KB951072-v2) Update for Windows XP (KB955839) Update for Windows XP (KB967715) Update for Windows XP (KB968389) Update for Windows XP (KB973815) USB-IDE Bridge Driver USB Compact Flash Reader Viewpoint Media Player WebFldrs XP WebReg Windows Genuine Advantage v1.3.0254.0 Windows Imaging Component Windows Installer 3.1 (KB893803) Windows Internet Explorer 7 Windows Media Format 11 runtime Windows Media Player 11 Windows XP Hotfix - KB873333 Windows XP Hotfix - KB873339 Windows XP Hotfix - KB885250 Windows XP Hotfix - KB885835 Windows XP Hotfix - KB885836 Windows XP Hotfix - KB886185 Windows XP Hotfix - KB887472 Windows XP Hotfix - KB887742 Windows XP Hotfix - KB888113 Windows XP Hotfix - KB888302 Windows XP Hotfix - KB890175 Windows XP Hotfix - KB890859 Windows XP Hotfix - KB890923 Windows XP Hotfix - KB891781 Windows XP Hotfix - KB893066 Windows XP Hotfix - KB893086 WinRAR archiver Yahoo! extras Yahoo! Internet Mail Yahoo! Toolbar

11-06-2009, 09:53 PM	#18 (permalink)
Oganix99 Registered User Join Date: Oct 2009 Posts: 24 OS: xp	Re: I need some help please. and heres the combofix txt ComboFix 09-11-05.01 - Office Depot 11/06/2009 16:37.2.2 - NTFSx86 Running from: c:\documents and settings\Office Depot\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\Office Depot\Desktop\CFScript.txt FW: CA Personal Firewall enabled {14CB4B80-8E52-45EA-905E-67C1267B4160} * Created a new restore point FILE :: "c:\windows\win32k.sys" file zipped: c:\windows\system32\bisoloku.exe file zipped: c:\windows\system32\gilavofi.dll file zipped: c:\windows\system32\varigisu.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\All Users\Application Data\06723220 c:\documents and settings\All Users\Application Data\06723220\06723220.bat c:\windows\system32\bisoloku.exe c:\windows\system32\gilavofi.dll c:\windows\system32\varigisu.exe c:\windows\win32k.sys . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226ED} ((((((((((((((((((((((((( Files Created from 2009-10-07 to 2009-11-07 ))))))))))))))))))))))))))))))) . 2009-11-06 07:10 . 2009-11-06 16:25 -------- d-----w- c:\windows\CAVTemp 2009-11-06 06:08 . 2009-11-07 02:28 -------- d-----w- c:\documents and settings\All Users\Application Data\CA 2009-11-06 06:08 . 2009-11-06 06:08 -------- d-----w- c:\program files\CA 2009-11-03 22:17 . 2009-11-03 22:17 -------- d-----w- C:\rsit 2009-11-02 20:58 . 2009-11-05 23:31 -------- d--h--w- c:\windows\PIF 2009-11-02 09:31 . 2009-11-02 09:31 -------- d-----w- c:\documents and settings\Office Depot\Application Data\Malwarebytes 2009-11-02 03:54 . 2009-11-02 04:28 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP 2009-11-02 02:44 . 2009-11-02 02:44 -------- d-----w- c:\documents and settings\Office Depot\Application Data\AVG8 2009-10-26 05:03 . 2009-10-26 05:03 54992 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-11-07 02:47 . 2006-03-10 08:53 13568 ----a-w- c:\windows\system32\drivers\USBCRFT.SYS 2009-11-07 02:46 . 2009-11-06 07:44 64 ----a-w- c:\windows\system32\drivers\kmxcfg.u2k7 2009-11-07 02:46 . 2009-11-06 07:44 64 ----a-w- c:\windows\system32\drivers\kmxcfg.u2k6 2009-11-07 02:46 . 2009-11-06 07:44 64 ----a-w- c:\windows\system32\drivers\kmxcfg.u2k5 2009-11-07 02:46 . 2009-11-06 07:44 64 ----a-w- c:\windows\system32\drivers\kmxcfg.u2k4 2009-11-07 02:46 . 2009-11-06 07:44 64 ----a-w- c:\windows\system32\drivers\kmxcfg.u2k3 2009-11-07 02:46 . 2009-11-06 07:44 64 ----a-w- c:\windows\system32\drivers\kmxcfg.u2k2 2009-11-07 02:46 . 2009-11-06 07:44 64 ----a-w- c:\windows\system32\drivers\kmxcfg.u2k1 2009-11-07 02:46 . 2009-11-06 07:44 43342 ----a-w- c:\windows\system32\drivers\kmxcfg.u2k0 2009-11-05 23:17 . 2004-11-19 02:09 -------- d-----w- c:\program files\Common Files\Symantec Shared 2009-11-02 03:09 . 2008-10-30 03:52 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8 2009-11-02 03:06 . 2008-10-30 03:52 -------- d-----w- c:\program files\AVG 2009-09-11 14:33 . 2004-08-04 08:00 133632 ----a-w- c:\windows\system32\msv1_0.dll 2009-09-04 20:45 . 2004-08-04 08:00 58880 ----a-w- c:\windows\system32\msasn1.dll 2009-08-29 07:36 . 2004-08-04 08:00 832512 ------w- c:\windows\system32\wininet.dll 2009-08-29 07:36 . 2004-08-04 08:00 78336 ----a-w- c:\windows\system32\ieencode.dll 2009-08-29 07:36 . 2004-08-04 08:00 17408 ------w- c:\windows\system32\corpol.dll 2009-08-26 08:16 . 2004-08-04 08:00 247326 ----a-w- c:\windows\system32\strmdll.dll 2009-08-16 05:45 . 2005-07-11 21:13 54992 ----a-w- c:\documents and settings\Office Depot\Local Settings\Application Data\GDIPFONTCACHEV1.DAT . ((((((((((((((((((((((((((((( SnapShot@2009-11-05_23.34.47 ))))))))))))))))))))))))))))))))))))))))) . + 2007-05-18 23:30 . 2007-05-18 23:30 79368 c:\windows\system32\UmxWNP.dll + 2008-06-25 05:08 . 2008-06-25 05:08 93712 c:\windows\system32\drivers\KmxStart.sys + 2008-06-25 05:08 . 2008-06-25 05:08 66576 c:\windows\system32\drivers\KmxSbx.sys + 2008-06-25 05:08 . 2008-06-25 05:08 45584 c:\windows\system32\drivers\KmxFile.sys + 2008-06-25 05:08 . 2008-06-25 05:08 88816 c:\windows\system32\drivers\KmxCfg.sys + 2008-06-25 05:08 . 2008-06-25 05:08 63504 c:\windows\system32\drivers\KmxAgent.sys + 2009-11-06 06:10 . 2009-11-06 06:10 10134 c:\windows\Installer\{BDBAAB1B-B364-465E-931D-4E2E2F0E609A}\ARPPRODUCTICON.exe + 2008-06-25 05:10 . 2008-06-25 05:10 256528 c:\windows\system32\UmxSbxw.dll + 2008-06-25 05:10 . 2008-06-25 05:10 117264 c:\windows\system32\UmxSbxExw.dll + 2008-06-25 05:08 . 2008-06-25 05:08 115216 c:\windows\system32\drivers\KmxFw.sys + 2008-06-25 05:08 . 2008-06-25 05:08 134648 c:\windows\system32\drivers\KmxCF.sys + 2009-11-05 23:52 . 2009-05-26 11:40 382840 c:\windows\ie7updates\KB976749-IE7\spuninst\updspapi.dll + 2009-11-05 23:52 . 2009-05-26 11:40 231288 c:\windows\ie7updates\KB976749-IE7\spuninst\spuninst.exe + 2009-11-06 06:10 . 2009-11-06 06:10 1233920 c:\windows\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9818.0_x-ww_8ff50c5d\msxml4.dll - 2004-08-04 08:00 . 2009-08-29 07:36 3598336 c:\windows\system32\mshtml.dll + 2004-08-04 08:00 . 2009-10-21 04:08 3598336 c:\windows\system32\mshtml.dll + 2006-05-19 15:08 . 2009-10-21 04:08 3598336 c:\windows\system32\dllcache\mshtml.dll - 2006-05-19 15:08 . 2009-08-29 07:36 3598336 c:\windows\system32\dllcache\mshtml.dll + 2009-11-06 06:10 . 2009-11-06 06:10 3694592 c:\windows\Installer\fcc2c.msi + 2009-11-05 23:52 . 2009-08-29 07:36 3598336 c:\windows\ie7updates\KB976749-IE7\mshtml.dll - 2009-11-03 05:23 . 2009-11-03 05:35 10273280 c:\windows\Installer\{BDBAAB1B-B364-465E-931D-4E2E2F0E609A}\{0224555E-5D1F-4E42-948E-474DE4E6A311}\CAPF.msi + 2009-11-03 05:23 . 2009-11-06 06:09 10273280 c:\windows\Installer\{BDBAAB1B-B364-465E-931D-4E2E2F0E609A}\{0224555E-5D1F-4E42-948E-474DE4E6A311}\CAPF.msi . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Apoint"="c:\program files\Apoint2K\Apoint.exe" [2003-10-08 159744] "Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2004-03-01 200766] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-12 49152] "cctray"="c:\program files\CA\CA Internet Security Suite\cctray\cctray.exe" [2009-11-06 177392] "QOELOADER"="c:\program files\CA\CA Internet Security Suite\CA Anti-Spam\QSP-5.1.18.0\QOELoader.exe" [2009-11-06 14088] "cafwc"="c:\program files\CA\CA Internet Security Suite\CA Personal Firewall\cafw.exe" [2009-11-06 1193200] "capfasem"="c:\program files\CA\CA Internet Security Suite\CA Personal Firewall\capfasem.exe" [2009-11-06 173296] "capfupgrade"="c:\program files\CA\CA Internet Security Suite\CA Personal Firewall\capfupgrade.exe" [2009-11-06 259312] "AGRSMMSG"="AGRSMMSG.exe" - c:\windows\AGRSMMSG.exe [2004-08-24 88363] "ATIModeChange"="Ati2mdxx.exe" - c:\windows\system32\Ati2mdxx.exe [2001-09-04 28672] "CICache"="CICache.exe" - c:\windows\CICache.exe [2002-09-05 24576] "Dit"="Dit.exe" - c:\windows\Dit.exe [2004-04-27 86016] c:\documents and settings\All Users\Start Menu\Programs\Startup\ HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-11 282624] HP Image Zone Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2005-5-11 73728] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PFW] 2007-05-18 23:30 79368 ----a-w- c:\windows\system32\UmxWNP.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk \0SsiEfr.e [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\CA Personal Firewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\WINDOWS\\system32\\usmt\\migwiz.exe"= R3 CardReaderFilter;Card Reader Filter;c:\windows\system32\Drivers\USBCRFT.SYS [2009-11-07 13568] S0 atiide;atiide;c:\windows\system32\DRIVERS\atiide.sys [2004-04-14 5632] S0 KmxStart;KmxStart;c:\windows\System32\DRIVERS\kmxstart.sys [2008-06-25 93712] S1 KmxAgent;KmxAgent;c:\windows\system32\DRIVERS\kmxagent.sys [2008-06-25 63504] S1 KmxFile;KmxFile;c:\windows\system32\DRIVERS\KmxFile.sys [2008-06-25 45584] S1 KmxFw;KmxFw;c:\windows\system32\DRIVERS\kmxfw.sys [2008-06-25 115216] S2 KmxCF;KmxCF;c:\windows\system32\DRIVERS\KmxCF.sys [2008-06-25 134648] S2 KmxSbx;KmxSbx;c:\windows\system32\DRIVERS\KmxSbx.sys [2008-06-25 66576] S2 UmxAgent;HIPS Event Manager;c:\program files\CA\SharedComponents\HIPSEngine\UmxAgent.exe [2007-10-18 1010192] S2 UmxCfg;HIPS Configuration Interpreter;c:\program files\CA\SharedComponents\HIPSEngine\UmxCfg.exe [2007-10-18 801296] S2 UmxPol;HIPS Policy Manager;c:\program files\CA\SharedComponents\HIPSEngine\UmxPol.exe [2008-06-25 281104] S3 KmxCfg;KmxCfg;c:\windows\system32\DRIVERS\kmxcfg.sys [2008-06-25 88816] --- Other Services/Drivers In Memory --- Deregistered* - mbr . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.yahoo.com/ uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr7/http://www.yahoo.com/ext/search/search.html uInternet Connection Wizard,ShellNext = iexplore uSearchURL,(Default) = hxxp://www.google.com/keyword/%s IE: &Yahoo! Search - file:///c:\program files\Yahoo!\Common/ycsrch.htm IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 IE: Yahoo! &Dictionary - file:///c:\program files\Yahoo!\Common/ycdict.htm IE: Yahoo! &Maps - file:///c:\program files\Yahoo!\Common/ycmap.htm IE: Yahoo! &SMS - file:///c:\program files\Yahoo!\Common/ycsms.htm TCP: {76920A34-B57E-4465-9816-D63D82B65DA3} = 77.74.48.113 . *********************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-11-06 16:47 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe????????0?3?5?2??????? ???B???????????????B? ?????? scanning hidden files ... scan completed successfully hidden files: 0 ********************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(444) c:\windows\system32\Ati2evxx.dll c:\windows\system32\UmxWnp.Dll - - - - - - - > 'explorer.exe'(140) c:\windows\system32\WININET.dll c:\windows\system32\ieframe.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Other Running Processes ------------------------ . c:\windows\system32\Ati2evxx.exe c:\program files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe c:\windows\system32\Ati2evxx.exe c:\windows\system32\wscntfy.exe c:\program files\CA\CA Internet Security Suite\CA Personal Firewall\capfsem.exe c:\program files\Apoint2K\Apntex.exe c:\program files\CA\CA Internet Security Suite\ccprovsp.exe c:\program files\HP\Digital Imaging\bin\hpqimzone.exe c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe c:\program files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe . ************************************************************************ . Completion time: 2009-11-07 16:53 - machine was rebooted ComboFix-quarantined-files.txt 2009-11-07 02:53 ComboFix2.txt 2009-11-05 23:41 Pre-Run: 24,767,418,368 bytes free Post-Run: 24,747,069,440 bytes free - - End Of File - - 24F26CF84FAE1B7FC390672E277F9A33

11-06-2009, 09:56 PM	#19 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,795 OS: 2000 Pro; XP Pro; XP Home	Re: I need some help please. Hi again - It doesn't seem as though the files I wanted to collect were uploaded. Let's do this, please. Please go to Start > Run and copy/paste the following, then press Enter: C:\QooBox\ComboFix-quarantined-files.txt Post the contents of the logfile which will open. __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009

11-06-2009, 10:04 PM	#20 (permalink)
Oganix99 Registered User Join Date: Oct 2009 Posts: 24 OS: xp	Re: I need some help please. 2009-11-07 02:37:25 . 2009-11-07 02:37:27 1,062,770 ----a-w- C:\Qoobox\Quarantine\[4]-Submit_2009-11-06_16.37.17.zip 2009-11-05 23:40:37 . 2009-11-05 23:40:37 373 ----a-w- C:\Qoobox\Quarantine\Registry_backups\SSODL-yomojojib-{d8682a43-fdfb-46e4-b8b3-dffc9b0e9abc}.reg.dat 2009-11-05 23:40:37 . 2009-11-05 23:40:37 373 ----a-w- C:\Qoobox\Quarantine\Registry_backups\SSODL-seguzatuw-{55a025d9-c69c-4a89-8217-440012589b4b}.reg.dat 2009-11-05 23:40:37 . 2009-11-05 23:40:37 373 ----a-w- C:\Qoobox\Quarantine\Registry_backups\SSODL-hojezobuz-{70eedf3b-91dc-4673-8e96-8e48c23eed69}.reg.dat 2009-11-05 23:40:37 . 2009-11-05 23:40:37 373 ----a-w- C:\Qoobox\Quarantine\Registry_backups\SSODL-zasukajel-{4486e005-f169-4e90-8708-2aec2ca64d31}.reg.dat 2009-11-05 23:40:37 . 2009-11-05 23:40:37 373 ----a-w- C:\Qoobox\Quarantine\Registry_backups\SSODL-tujukilas-{c34e2202-ad18-4f9a-888e-1204b6721b5f}.reg.dat 2009-11-05 23:40:36 . 2009-11-05 23:40:36 373 ----a-w- C:\Qoobox\Quarantine\Registry_backups\SSODL-nenavojop-{6b7b2f3b-e0bf-4988-9db4-36daf39a0d77}.reg.dat 2009-11-05 23:40:34 . 2009-11-05 23:40:34 374 ----a-w- C:\Qoobox\Quarantine\Registry_backups\SharedTaskScheduler-{d8682a43-fdfb-46e4-b8b3-dffc9b0e9abc}.reg.dat 2009-11-05 23:40:34 . 2009-11-05 23:40:34 374 ----a-w- C:\Qoobox\Quarantine\Registry_backups\SharedTaskScheduler-{55a025d9-c69c-4a89-8217-440012589b4b}.reg.dat 2009-11-05 23:40:34 . 2009-11-05 23:40:34 374 ----a-w- C:\Qoobox\Quarantine\Registry_backups\SharedTaskScheduler-{70eedf3b-91dc-4673-8e96-8e48c23eed69}.reg.dat 2009-11-05 23:40:34 . 2009-11-05 23:40:34 374 ----a-w- C:\Qoobox\Quarantine\Registry_backups\SharedTaskScheduler-{4486e005-f169-4e90-8708-2aec2ca64d31}.reg.dat 2009-11-05 23:40:34 . 2009-11-05 23:40:34 374 ----a-w- C:\Qoobox\Quarantine\Registry_backups\SharedTaskScheduler-{c34e2202-ad18-4f9a-888e-1204b6721b5f}.reg.dat 2009-11-05 23:40:34 . 2009-11-05 23:40:34 374 ----a-w- C:\Qoobox\Quarantine\Registry_backups\SharedTaskScheduler-{6b7b2f3b-e0bf-4988-9db4-36daf39a0d77}.reg.dat 2009-11-05 23:40:33 . 2009-11-05 23:40:33 464 ----a-w- C:\Qoobox\Quarantine\Registry_backups\SharedTaskScheduler-{A2234B15-23F2-42AD-F4E4-00AAC39C0004}.reg.dat 2009-11-05 23:40:27 . 2009-11-05 23:40:27 129 ----a-w- C:\Qoobox\Quarantine\Registry_backups\HKLM-Run-dukawovedi.reg.dat 2009-11-05 23:40:25 . 2009-11-05 23:40:25 150 ----a-w- C:\Qoobox\Quarantine\Registry_backups\HKLM-Run-tofobeful.reg.dat 2009-11-05 23:40:23 . 2009-11-05 23:40:23 171 ----a-w- C:\Qoobox\Quarantine\Registry_backups\WebBrowser-{07AA283A-43D7-4CBE-A064-32A21112D94D}.reg.dat 2009-11-05 23:40:23 . 2009-11-05 23:40:23 171 ----a-w- C:\Qoobox\Quarantine\Registry_backups\WebBrowser-{4F802BCF-44AA-4C28-935A-CBEDC24B5375}.reg.dat 2009-11-05 23:40:23 . 2009-11-05 23:40:23 171 ----a-w- C:\Qoobox\Quarantine\Registry_backups\WebBrowser-{08FCF7E3-5F7D-444E-8554-76A516EB3C6C}.reg.dat 2009-11-05 23:40:22 . 2009-11-05 23:40:22 444 ----a-w- C:\Qoobox\Quarantine\Registry_backups\BHO-{A2234B15-23F2-42AD-F4E4-00AAC39C0004}.reg.dat 2009-11-05 23:40:21 . 2009-11-05 23:40:22 351 ----a-w- C:\Qoobox\Quarantine\Registry_backups\BHO-{6b3e0dd0-ea91-41b7-93c2-f1c289fb020f}.reg.dat 2009-11-05 23:28:06 . 2009-11-07 02:43:24 1,046 ----a-w- C:\Qoobox\Quarantine\Registry_backups\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226ED}.reg.dat 2009-11-05 23:28:01 . 2009-11-07 02:43:11 6,218 ----a-w- C:\Qoobox\Quarantine\Registry_backups\tcpip.reg 2009-11-05 23:21:06 . 2009-11-07 02:35:20 153 ----a-w- C:\Qoobox\Quarantine\catchme.log 2009-11-05 22:49:45 . 2009-11-05 22:49:45 2,713 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\duvafiyi.exe.vir 2009-10-25 05:44:17 . 2009-10-25 05:44:17 274 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users\Application Data\06723220\06723220.bat.vir 2009-10-25 05:36:17 . 2009-11-05 23:13:59 0 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\win32k.sys.vir 2009-10-25 05:35:48 . 2009-10-25 05:35:49 31,232 ----a-w- C:\Qoobox\Quarantine\C\dsiqvib.exe.vir 2009-10-25 05:35:01 . 2009-10-25 05:35:03 291,840 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\~.exe.vir 2009-08-05 22:49:35 . 2009-08-05 22:49:35 199,680 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\varigisu.exe.vir 2009-08-05 22:49:34 . 2009-08-05 22:49:34 92,160 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\gilavofi.dll.vir 2009-08-04 21:52:43 . 2009-08-04 21:52:43 60,928 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\tasasifu.dll.vir 2009-08-03 22:13:01 . 2009-08-03 22:13:01 61,440 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\lenisako.dll.vir 2009-08-03 22:13:00 . 2009-08-03 22:13:00 91,648 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\mupapupe.dll.vir 2009-08-02 01:52:09 . 2009-08-02 01:52:09 39,424 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\yirozoyi.dll.vir 2009-07-28 19:23:18 . 2009-07-28 19:23:18 1,052,192 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\bisoloku.exe.vir 2009-07-28 19:23:18 . 2009-07-28 19:23:18 91,136 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\tipifipo.dll.vir 2009-07-26 03:00:04 . 2009-07-26 03:00:04 54,272 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\jevaziji.dll.vir 2009-07-26 03:00:04 . 2009-07-26 03:00:04 1,011,749 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\pipuduse.exe.vir 2006-06-22 00:16:54 . 2006-06-22 00:16:54 898 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users\Start Menu\HP Image Zone .lnk.vir