Tech Support Forum banner
Status
Not open for further replies.
1 - 3 of 3 Posts

·
Registered
Joined
·
6 Posts
Discussion Starter · #1 ·
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:24:30 PM, on 5/27/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\BitComet\BitComet.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q106&bd=pavilion&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [BM1725a549] Rundll32.exe "C:\WINDOWS\system32\gfvuqqes.dll",s
O4 - HKLM\..\Run: [141696d5] rundll32.exe "C:\WINDOWS\system32\hxckwbnd.dll",b
O4 - HKCU\..\Run: [BitComet] "C:\Program Files\BitComet\BitComet.exe" /tray
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9c.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q106&bd=pavilion&pf=laptop
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {B3E32D88-8E7F-468F-B0E2-3A300FD4A82C} (Enlite 2.x Simulation Engine Installer) - http://myitlab.pearsoned.com/Pegasus/Modules/SIMIntegration/Resources/ax/stub.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~4\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe (file missing)
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\Shared\hpqwmi.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton Protection Center Service (NSCService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE (file missing)
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe (file missing)

--
End of file - 6585 bytes
 

·
Registered
Joined
·
6 Posts
Discussion Starter · #2 ·
Start Time= Tue 05/27/2008 20:13:06.45

QuickScan did not find any signs of infected files

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2008-05-27 15:08:18 2624 ( A.... ) "C:\WINDOWS\system32\hbhqrdth.exe"
2008-05-27 15:02:26 95808 ( A.... ) "C:\WINDOWS\system32\hxckwbnd.dll"
2008-05-27 15:02:18 102976 ( A.... ) "C:\WINDOWS\system32\gfvuqqes.dll"
2008-05-27 15:00:22 102976 ( A.... ) "C:\WINDOWS\system32\xykebrbd.dll"
2008-05-27 14:59:24 100928 ( A.... ) "C:\WINDOWS\system32\ppnjxwsi.dll"
2008-05-22 21:31:54 3648 ( A.... ) "C:\WINDOWS\system32\ibnbcvjs.dll"
2008-05-22 21:29:06 100928 ( A.... ) "C:\WINDOWS\system32\fapyncly.dll"
2008-05-19 22:19:00 92224 ( ..... ) "C:\WINDOWS\system32\emlkahvo.dll"
2008-05-19 22:16:00 2112 ( A.... ) "C:\WINDOWS\system32\udshgett.exe"
2008-05-19 22:13:06 100928 ( A.... ) "C:\WINDOWS\system32\jyumthlq.dll"
2008-05-19 22:13:00 100928 ( A.... ) "C:\WINDOWS\system32\fhjsolgb.dll"
2008-05-17 22:30:36 ( .D... ) "C:\Program Files\MSBuild"
2008-05-17 22:30:04 ( .D... ) "C:\Program Files\Microsoft Visual Studio"
2008-05-17 22:30:02 ( .D... ) "C:\Program Files\Common Files\DESIGNER"
2008-05-17 22:28:42 ( .D... ) "C:\Program Files\Microsoft.NET"
2008-05-17 15:29:20 ( .D... ) "C:\Program Files\Trend Micro"
2008-05-17 15:15:52 ( .D... ) "C:\Program Files\WinRAR"
2008-05-17 15:10:20 100928 ( A.... ) "C:\WINDOWS\system32\aalqgjfc.dll"
2008-05-17 15:10:16 2112 ( A.... ) "C:\WINDOWS\system32\bgnlyfrj.exe"
2008-05-17 15:08:26 100928 ( A.... ) "C:\WINDOWS\system32\vqdornol.dll"
2008-05-17 15:08:20 3648 ( A.... ) "C:\WINDOWS\system32\cxeacgrd.dll"
2008-05-15 01:39:48 106560 ( A.... ) "C:\WINDOWS\system32\xsfpaing.dll"
2008-05-15 01:36:48 105024 ( A.... ) "C:\WINDOWS\system32\qjkpnuup.dll"
2008-05-15 01:33:50 105024 ( A.... ) "C:\WINDOWS\system32\cusoeeja.dll"
2008-05-15 00:42:48 2112 ( A.... ) "C:\WINDOWS\system32\hvkwetdi.exe"
2008-05-15 00:39:48 106560 ( A.... ) "C:\WINDOWS\system32\yipdmwja.dll"
2008-05-15 00:33:48 105024 ( A.... ) "C:\WINDOWS\system32\wwtluaxr.dll"
2008-05-15 00:30:48 105024 ( A.... ) "C:\WINDOWS\system32\dsywijvx.dll"
2008-05-14 23:39:48 106560 ( A.... ) "C:\WINDOWS\system32\nhqylkyw.dll"
2008-05-14 23:36:48 2112 ( A.... ) "C:\WINDOWS\system32\bqpcvnrt.exe"
2008-05-14 23:30:48 105024 ( A.... ) "C:\WINDOWS\system32\vxqtaeyt.dll"
2008-05-14 23:27:48 105024 ( A.... ) "C:\WINDOWS\system32\kjtnxkmx.dll"
2008-05-14 22:38:28 106560 ( A.... ) "C:\WINDOWS\system32\lvnpjixl.dll"
2008-05-14 22:29:18 2112 ( A.... ) "C:\WINDOWS\system32\msyyusju.exe"
2008-05-14 22:26:40 105024 ( A.... ) "C:\WINDOWS\system32\tmqytnjx.dll"
2008-05-14 22:23:40 105024 ( A.... ) "C:\WINDOWS\system32\ligodtmu.dll"
2008-05-14 21:29:40 2112 ( A.... ) "C:\WINDOWS\system32\xwgngyyc.exe"
2008-05-14 21:26:50 106560 ( A.... ) "C:\WINDOWS\system32\peoqmovy.dll"
2008-05-14 21:25:36 96832 ( A.... ) "C:\WINDOWS\system32\apnjibtj.dll"
2008-05-14 21:25:30 105024 ( A.... ) "C:\WINDOWS\system32\svnvywob.dll"
2008-05-14 21:22:36 106560 ( A.... ) "C:\WINDOWS\system32\irqpktak.dll"
2008-05-14 21:22:36 2112 ( A.... ) "C:\WINDOWS\system32\mtlqytoh.exe"
2008-05-14 21:22:30 105024 ( A.... ) "C:\WINDOWS\system32\ivgslbnv.dll"
2008-05-14 21:12:12 ( .D... ) "C:\Program Files\office 2007"
2008-05-14 20:31:30 106560 ( A.... ) "C:\WINDOWS\system32\djqmtkvg.dll"
2008-05-14 20:25:30 2112 ( A.... ) "C:\WINDOWS\system32\ubkiirmn.exe"
2008-05-14 20:22:30 105024 ( A.... ) "C:\WINDOWS\system32\vwukfybh.dll"
2008-05-14 20:19:30 105024 ( A.... ) "C:\WINDOWS\system32\tuuuakpw.dll"
2008-05-14 20:17:50 105024 ( A.... ) "C:\WINDOWS\system32\sdaftcvf.dll"
2008-05-14 19:31:30 2112 ( A.... ) "C:\WINDOWS\system32\brqaoody.exe"
2008-05-14 19:28:42 106560 ( A.... ) "C:\WINDOWS\system32\nwsglcxo.dll"
2008-05-14 19:28:24 106560 ( A.... ) "C:\WINDOWS\system32\ukuhgccx.dll"
2008-05-14 19:25:24 2112 ( A.... ) "C:\WINDOWS\system32\uxtomvsb.exe"
2008-05-14 19:22:24 2112 ( A.... ) "C:\WINDOWS\system32\sajhsomc.exe"
2008-05-14 19:19:24 2112 ( A.... ) "C:\WINDOWS\system32\ttaspvep.exe"
2008-05-14 19:16:24 96832 ( A.... ) "C:\WINDOWS\system32\dlfvupao.dll"
2008-05-14 19:13:24 105024 ( A.... ) "C:\WINDOWS\system32\pkkcbtno.dll"
2008-05-14 19:10:24 105024 ( A.... ) "C:\WINDOWS\system32\jqfgqgrh.dll"
2008-05-14 16:48:46 ( .D... ) "C:\Program Files\DiskTrix"
2008-05-14 13:00:54 ( .D... ) "C:\Program Files\Registry Mechanic"
2008-05-14 12:54:54 ( .D... ) "C:\Documents and Settings\Kasey Bennett1\Application Data\WinRAR"
2008-05-14 03:50:14 106560 ( A.... ) "C:\WINDOWS\system32\rpsqkmge.dll"
2008-05-07 19:10:48 2112 ( A.... ) "C:\WINDOWS\system32\bfuesken.exe"
2008-05-07 19:07:50 106560 ( A.... ) "C:\WINDOWS\system32\iobmntgg.dll"
2008-05-07 19:01:50 105024 ( A.... ) "C:\WINDOWS\system32\hfitubsb.dll"
2008-05-06 19:02:28 2112 ( A.... ) "C:\WINDOWS\system32\sstprjdl.exe"
2008-05-06 18:59:40 108608 ( A.... ) "C:\WINDOWS\system32\ircyandq.dll"
2008-05-06 18:59:28 104512 ( A.... ) "C:\WINDOWS\system32\tiywbcsb.dll"
2008-05-05 19:01:42 107584 ( A.... ) "C:\WINDOWS\system32\hrchnqwy.dll"
2008-05-05 18:59:02 96832 ( A.... ) "C:\WINDOWS\system32\bntxurgq.dll"
2008-05-05 18:58:54 104000 ( A.... ) "C:\WINDOWS\system32\gftaworw.dll"
2008-05-04 19:04:18 108096 ( A.... ) "C:\WINDOWS\system32\vsudsxvl.dll"
2008-05-04 18:58:08 104512 ( A.... ) "C:\WINDOWS\system32\sgbcwwxl.dll"
2008-05-04 18:56:42 104512 ( A.... ) "C:\WINDOWS\system32\mgujffjy.dll"
2008-05-02 00:44:32 107072 ( A.... ) "C:\WINDOWS\system32\txlscink.dll"
2008-05-02 00:38:32 107072 ( A.... ) "C:\WINDOWS\system32\yktnlkpu.dll"
2008-05-01 00:37:28 105536 ( A.... ) "C:\WINDOWS\system32\gbwkuayi.dll"
2008-05-01 00:37:04 104512 ( A.... ) "C:\WINDOWS\system32\eeueaeep.dll"
2008-04-29 20:50:42 107072 ( A.... ) "C:\WINDOWS\system32\arbarnni.dll"
2008-04-29 20:45:10 104512 ( A.... ) "C:\WINDOWS\system32\bagncdpq.dll"
2008-04-29 20:44:02 104512 ( A.... ) "C:\WINDOWS\system32\ocyixowp.dll"
2008-04-28 14:05:16 108608 ( A.... ) "C:\WINDOWS\system32\mbnwqdux.dll"
2008-04-28 14:05:02 104000 ( A.... ) "C:\WINDOWS\system32\udjnognc.dll"
2008-04-28 11:44:30 100416 ( A.... ) "C:\WINDOWS\system32\usvjigbc.dll"
2008-04-27 21:23:14 106048 ( A.... ) "C:\WINDOWS\system32\ojljigfw.dll"
2008-04-26 19:55:24 106048 ( A.... ) "C:\WINDOWS\system32\mkkijkvb.dll"
2008-04-25 09:21:26 2560 ( A.... ) "C:\WINDOWS\system32\bitcometres.dll"
2008-04-25 08:46:46 ( .D... ) "C:\Program Files\Stardock"
2008-04-25 03:14:32 ( .D... ) "C:\Documents and Settings\Kasey Bennett1\Application Data\Talkback"
2008-04-24 17:21:24 100416 ( A.... ) "C:\WINDOWS\system32\vslanudt.dll"
2008-04-24 17:15:24 96320 ( A.... ) "C:\WINDOWS\system32\tsetvwvu.dll"
2008-04-23 15:02:40 93248 ( A.... ) "C:\WINDOWS\system32\ubpthait.dll"
2008-04-23 14:56:48 95808 ( A.... ) "C:\WINDOWS\system32\vtquvsfu.dll"
2008-04-23 01:03:32 ( .D... ) "C:\Documents and Settings\Kasey Bennett1\Application Data\Nero"
2008-04-23 00:50:34 272384 ( A.... ) "C:\WINDOWS\system32\jkkKcBrq.dll"
2008-04-23 00:36:16 38400 ( A.... ) "C:\WINDOWS\system32\urqOEuTM.dll"
2008-04-23 00:36:16 38400 ( A.... ) "C:\WINDOWS\system32\ddcawxYQ.dll"
2008-04-09 00:14:16 ( .D... ) "C:\Program Files\iPod"
2008-04-06 18:52:42 ( .D... ) "C:\Documents and Settings\Kasey Bennett1\Application Data\skypePM"
2008-04-06 18:44:40 ( .D... ) "C:\Documents and Settings\Kasey Bennett1\Application Data\Skype"
2008-04-06 18:42:36 ( .D... ) "C:\Program Files\Skype"
2008-04-06 18:42:34 ( .D... ) "C:\Program Files\Common Files\Skype"
2008-03-19 02:47:00 1845248 ( A.... ) "C:\WINDOWS\system32\win32k.sys"
2008-03-01 18:36:30 3591680 ( A.... ) "C:\WINDOWS\system32\mshtml.dll"
2008-03-01 06:06:32 826368 ( A.... ) "C:\WINDOWS\system32\wininet.dll"
2008-03-01 06:06:30 1159680 ( A.... ) "C:\WINDOWS\system32\urlmon.dll"
2008-03-01 06:06:30 671232 ( A.... ) "C:\WINDOWS\system32\mstime.dll"
2008-03-01 06:06:30 233472 ( A.... ) "C:\WINDOWS\system32\webcheck.dll"
2008-03-01 06:06:30 105984 ( A.... ) "C:\WINDOWS\system32\url.dll"
2008-03-01 06:06:30 102912 ( A.... ) "C:\WINDOWS\system32\occache.dll"
2008-03-01 06:06:30 44544 ( A.... ) "C:\WINDOWS\system32\pngfilt.dll"
2008-03-01 06:06:28 478208 ( A.... ) "C:\WINDOWS\system32\mshtmled.dll"
2008-03-01 06:06:28 193024 ( A.... ) "C:\WINDOWS\system32\msrating.dll"
2008-03-01 06:06:26 459264 ( A.... ) "C:\WINDOWS\system32\msfeeds.dll"
2008-03-01 06:06:26 267776 ( A.... ) "C:\WINDOWS\system32\iertutil.dll"
2008-03-01 06:06:26 52224 ( A.... ) "C:\WINDOWS\system32\msfeedsbs.dll"
2008-03-01 06:06:26 27648 ( A.... ) "C:\WINDOWS\system32\jsproxy.dll"
2008-03-01 06:06:24 6066176 ( A.... ) "C:\WINDOWS\system32\ieframe.dll"
2008-03-01 06:06:24 44544 ( A.... ) "C:\WINDOWS\system32\iernonce.dll"
2008-03-01 06:06:22 384512 ( A.... ) "C:\WINDOWS\system32\iedkcs32.dll"
2008-03-01 06:06:22 383488 ( A.... ) "C:\WINDOWS\system32\ieapfltr.dll"
2008-03-01 06:06:22 347136 ( A.... ) "C:\WINDOWS\system32\dxtmsft.dll"
2008-03-01 06:06:22 230400 ( A.... ) "C:\WINDOWS\system32\ieaksie.dll"
2008-03-01 06:06:22 214528 ( A.... ) "C:\WINDOWS\system32\dxtrans.dll"
2008-03-01 06:06:22 153088 ( A.... ) "C:\WINDOWS\system32\ieakeng.dll"
2008-03-01 06:06:22 133120 ( A.... ) "C:\WINDOWS\system32\extmgr.dll"
2008-03-01 06:06:22 63488 ( A.... ) "C:\WINDOWS\system32\icardie.dll"
2008-03-01 06:06:20 124928 ( A.... ) "C:\WINDOWS\system32\advpack.dll"
2008-02-29 01:55:24 70656 ( A.... ) "C:\WINDOWS\system32\ie4uinit.exe"
2008-02-28 13:26:06 1414440 ( A.... ) "C:\WINDOWS\system32\ShellManager310E2D762.dll"


((((((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"
"RegistryMechanic"=""
"GrooveMonitor"="\"C:\\Program Files\\Microsoft Office\\Office12\\GrooveMonitor.exe\""
"BM1725a549"="Rundll32.exe \"C:\\WINDOWS\\system32\\gfvuqqes.dll\",s"
"141696d5"="rundll32.exe \"C:\\WINDOWS\\system32\\hxckwbnd.dll\",b"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"BitComet"="\"C:\\Program Files\\BitComet\\BitComet.exe\" /tray"
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"H/PC Connection Agent"="\"C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe\""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runonce]
"FlashPlayerUpdate"="C:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil9c.exe"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=dword:00000000

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"
"{C3F37ECA-A8D9-4633-92C6-FE24C7D16ABA}"=""
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"="Groove GFS Stub Execution Hook"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
"backup"="C:\\WINDOWS\\pss\\HP Digital Imaging Monitor.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\HP\\DIGITA~1\\bin\\hpqtra08.exe "
"item"="HP Digital Imaging Monitor"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Photosmart Premier Fast Start.lnk]
"backup"="C:\\WINDOWS\\pss\\HP Photosmart Premier Fast Start.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\HP\\DIGITA~1\\bin\\hpqthb08.exe -s"
"item"="HP Photosmart Premier Fast Start"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"=""
"hkey"="HKLM"
"command"=""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!AVG Anti-Spyware]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="avgas"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\141696d5]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ciftxhoq"
"hkey"="HKLM"
"command"="rundll32.exe \"C:\\WINDOWS\\system32\\ciftxhoq.dll\",b"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="aim6"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\AIM6\\aim6.exe\" /d locale=en-US ee://aol/imApp"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitComet]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="BitComet"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\BitComet\\BitComet.exe\" /tray"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BM1725a549]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="hfitubsb"
"hkey"="HKLM"
"command"="Rundll32.exe \"C:\\WINDOWS\\system32\\hfitubsb.dll\",s"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ccApp"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cpqset]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="cpqset"
"hkey"="HKLM"
"command"="C:\\Program Files\\HPQ\\Default Settings\\cpqset.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ctfmon"
"hkey"="HKCU"
"command"="C:\\WINDOWS\\system32\\ctfmon.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DeleteLog]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="DeleteLog"
"hkey"="HKLM"
"command"="c:\\windows\\system32\\oobe\\DeleteLog.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DetectorApp]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="DetectorApp"
"hkey"="HKLM"
"command"="C:\\Program Files\\Sonic\\DigitalMedia Plus v7\\MyDVD Plus\\DetectorApp.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eabconfg.cpl]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="EabServr"
"hkey"="HKLM"
"command"="C:\\Program Files\\HPQ\\Quick Launch Buttons\\EabServr.exe /Start"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="wcescomm"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\High Definition Audio Property Page Shortcut]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="CHDAudPropShortcut"
"hkey"="HKLM"
"command"="CHDAudPropShortcut.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="HPWuSchd2"
"hkey"="HKLM"
"command"="C:\\Program Files\\Hp\\HP Software Update\\HPWuSchd2.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpWirelessAssistant]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="HP Wireless Assistant"
"hkey"="HKLM"
"command"="C:\\Program Files\\hpq\\HP Wireless Assistant\\HP Wireless Assistant.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="hkcmd"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\system32\\hkcmd.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="igfxpers"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\system32\\igfxpers.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="igfxtray"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\system32\\igfxtray.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NMIndexStoreSvr"
"hkey"="HKCU"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="iTunesHelper"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="msmsgs"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NBKeyScan"
"hkey"="HKLM"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QPService]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="QPService"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\HP\\QuickPlay\\QPService.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="QTTask"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\QuickTime\\QTTask.exe\" -atboottime"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RecGuard]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="RecGuard"
"hkey"="HKLM"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Reminder]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Remind_XP"
"hkey"="HKLM"
"command"="C:\\Windows\\CREATOR\\Remind_XP.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="jusched"
"hkey"="HKLM"
"command"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="SynTPEnh"
"hkey"="HKLM"
"command"="C:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe"
"inimapping"="0"


Contents of the 'Scheduled Tasks' folder

Completion time: Tue 05/27/2008 20:14:45.89
ComboFix ver 06.06.17 - This logfile is located at C:\ComboFix.txt
 

·
TSF Security Manager, Emeritus
Joined
·
42,836 Posts
Hello ajmart9,

That is a log from a terribly outdated version of ComboFix. Please delete your existing ComboFix.exe immediately.

Before we do anything, I'd like to see the following:


As noted in the final step (Step 5) of our sticky topic IMPORTANT - Read This Before Posting For Malware Removal Help....

Download Deckard's System Scanner (DSS) to your Desktop.

What DSS will do:
  • create a new System Restore point in Windows XP and Vista.
  • clean your Temporary Files, Downloaded Program Files, and Internet Cache Files, and also empty the Recycle Bin on all drives.
  • check some important areas of your system and produce a report for your analyst to review.
  • DSS automatically runs HijackThis for you, but it will also install and place a shortcut to HijackThis on your desktop if you do not already have HijackThis installed.

Note: You must be logged onto an account with administrator privileges.
  1. Close all applications and windows.
  2. Double-click on dss.exe to run it, and follow the prompts.
  3. When the scan is complete, two text files will open - main.txt <- this one will be maximized and extra.txt <-this one will be minimized
  4. Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of main.txt in your next reply.
  5. Please attach extra.txt to your post.
To attach a file to a new post, simply
  1. Click the[Manage Attachments] button under Additional Options > Attach Files on the post composition page, and
  2. copy and paste the following into the "Upload File from your Computer" box:
    C:\Deckard\System Scanner\extra.txt
  3. Click Upload.

Please include the following in your next reply:

main.txt
an attached extra.txt
 
1 - 3 of 3 Posts
Status
Not open for further replies.
Top