TrojanHunter Forum (http://www.trojanhunter.com/forum/)
Malware >> Trojans >> In Dire Need of Help!!
(Message started by: Aprileatlove on Mar 29th, 2008, 9:57pm)

Title: In Dire Need of Help!!
Post by Aprileatlove on Mar 29th, 2008, 9:57pm
Okay, this is the first time I've posted.
Today, I discovered that something may be wrong with my computer.
I'm pretty sure it's a Trojan.

Whenever I try to access my computer files or use the internet, a system error comes up and says:

Your computer was infected by unknown trojan.
It's dangerous for your system (critical files can be lost)!
Click OK to download the antispyware program to clean your system! (Recommended)

When I click OK, it leads to Files Secure, which I found out is actually malicious.
If I click the X (exit) button or Cancel, it keep popping back up for a while, which can be very annoying.


I've downloaded Spyware Doctor and it still won't go away!
And Spyware Doctor happened to find even more spyware, malware, and adware on my system.






Please help!!
I don't know where to turn from here.

Title: Re: In Dire Need of Help!!
Post by siliconman01 on Mar 29th, 2008, 10:52pm
Welcome to the forum Aprilatlove  :D

Yes, you have been infected.  Please do the following.

1.  Download/install program Hijackthis per the instructions in the link below.

http://www.misec.net/forum/board/FAQ/1163329424

2.  Go to the link below and download program Combofix.exe and save it on your desktop.

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

3.  Temporarily de-Activate all your security programs EXCEPT your software firewall.

4.  Close down as many programs as you can (programs in the Notification Tray-  next to the clock).

5.  Close your browser.

6.  Double click on Combofix.exe to execute it and follow the instructions.

Please note, that once you start ComboFix you should not click anywhere on the ComboFix window as it can cause the program to stall. In fact, when ComboFix is running, do not touch your computer at all and just take a break as it may take a while for it to complete.

-  When Combofix.exe is finished, it will save a log on your system.  

7.  Post the Combofix log back here

8.  Run Hijackthis and post a HiJackthis scan log back here.  DO NOT fix anything with HJT...just post the scan log.  

Title: Re: In Dire Need of Help!!
Post by Aprileatlove on Mar 30th, 2008, 1:28pm
This is the ComboFix log:

ComboFix 08-03-30.2 - ~Ape-Err-Uhl 2008-03-30 14:09:21.1 - NTFSx86
Microsoft Windows XP Home Edition  5.1.2600.2.1252.1.1033.18.195 [GMT -5:00]
Running from: C:\Documents and Settings\~Ape-Err-Uhl\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

(((((((((((((((((((((((((   Files Created from 2008-02-28 to 2008-03-30  )))))))))))))))))))))))))))))))
.

2008-03-30 14:04 . 2008-03-30 14:04<DIR>d--------C:\Program Files\Trend Micro
2008-03-29 21:34 . 2008-03-29 21:47<DIR>d--------C:\Program Files\Spyware Doctor
2008-03-29 21:34 . 2008-03-30 09:00<DIR>d-a------C:\Documents and Settings\All Users\Application Data\TEMP
2008-03-29 21:34 . 2008-03-29 21:34<DIR>d--------C:\Documents and Settings\~Ape-Err-Uhl\Application Data\PC Tools
2008-03-29 21:34 . 2007-12-10 14:5381,288--a------C:\WINDOWS\system32\drivers\iksyssec.sys
2008-03-29 21:34 . 2007-12-10 14:5366,952--a------C:\WINDOWS\system32\drivers\iksysflt.sys
2008-03-29 21:34 . 2008-02-01 12:5542,376--a------C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-03-29 21:34 . 2007-12-10 14:5329,576--a------C:\WINDOWS\system32\drivers\kcom.sys
2008-03-29 18:15 . 2008-03-29 18:15213,504--a------C:\WINDOWS\dsaip32b.dll
2008-03-29 18:15 . 2008-03-29 18:1557--a------C:\smp.bat
2008-03-29 16:01 . 2008-03-29 16:01<DIR>d--------C:\Program Files\NHN USA
2008-03-29 16:01 . 2008-01-16 18:25679,936--a------C:\WINDOWS\system32\ijjiSetup.exe
2008-03-16 20:44 . 2008-03-16 20:52<DIR>d--------C:\Program Files\AviSynth 2.5
2008-03-07 19:05 . 2008-03-29 18:54<DIR>d--------C:\Program Files\Common Files\Symantec Shared
2008-03-07 18:17 . 2008-03-29 18:16<DIR>d--------C:\Program Files\Norton Security Scan
2008-03-07 18:15 . 2008-03-07 18:15<DIR>d--------C:\Program Files\Photo Story 3 for Windows
2008-03-07 18:11 . 2006-10-04 09:061,197,294---------C:\WINDOWS\system32\dllcache\sysmain.sdb
2008-03-07 18:11 . 2006-10-04 09:06764,868---------C:\WINDOWS\system32\dllcache\apph_sp.sdb
2008-03-07 18:11 . 2006-10-04 09:06217,118---------C:\WINDOWS\system32\dllcache\apphelp.sdb
2008-03-07 18:10 . 2008-03-07 18:10<DIR>d--------C:\Program Files\Windows Media Connect 2
2008-03-07 18:08 . 2008-03-07 18:09<DIR>d--------C:\WINDOWS\system32\drivers\UMDF
2008-03-02 21:57 . 2008-03-30 14:05<DIR>d--------C:\Documents and Settings\~Ape-Err-Uhl\Application Data\OpenOffice.org2
2008-03-02 21:54 . 2008-03-02 21:54<DIR>d--------C:\Program Files\OpenOffice.org 2.3
2008-03-02 20:11 . 2008-03-02 20:11<DIR>d--------C:\Program Files\iPod
2008-02-26 21:16 . 2008-02-26 21:16<DIR>d--------C:\Documents and Settings\~Ape-Err-Uhl\Application Data\Mozilla
2008-02-17 13:16 . 2008-02-17 13:16<DIR>d--------C:\Documents and Settings\~Ape-Err-Uhl\Application Data\Help
2008-02-17 13:14 . 2008-02-17 13:14<DIR>d--------C:\Program Files\Attach
2008-02-17 12:30 . 2008-02-17 12:30<DIR>d--------C:\Documents and Settings\~Ape-Err-Uhl\WINDOWS
2008-02-17 12:30 . 1996-07-18 14:06297,472--a------C:\WINDOWS\uninst.exe
2008-02-11 23:04 . 2008-02-11 23:04<DIR>d--------C:\Documents and Settings\~Ape-Err-Uhl\Application Data\Yahoo!
2008-02-11 22:39 . 2008-02-11 22:56<DIR>d--------C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-02-11 22:31 . 2008-02-12 09:08<DIR>d--------C:\Program Files\Yahoo!
2008-02-09 17:07 . 2004-08-03 23:585,504--a------C:\WINDOWS\system32\drivers\MSTEE.sys
2008-02-09 17:07 . 2004-08-03 23:585,504--a------C:\WINDOWS\system32\dllcache\mstee.sys
2008-02-03 22:40 . 2008-03-29 21:46<DIR>d--------C:\Documents and Settings\~Ape-Err-Uhl\Incomplete
2008-02-01 00:13 . 2008-02-01 00:1390,112--a------C:\WINDOWS\system32\QuickTimeVR.qtx
2008-02-01 00:13 . 2008-02-01 00:1357,344--a------C:\WINDOWS\system32\QuickTime.qts

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-30 19:05---------d-----wC:\Documents and Settings\~Ape-Err-Uhl\Application Data\OpenOffice.org2
2008-03-30 03:593,932,160---ha-wC:\Documents and Settings\~Ape-Err-Uhl\NTUSER.DAT
2008-03-30 02:42---------d-----wC:\Documents and Settings\~Ape-Err-Uhl\Application Data\LimeWire
2008-03-30 02:34---------d-----wC:\Documents and Settings\~Ape-Err-Uhl\Application Data\PC Tools
2008-03-29 21:01---------d--h--wC:\Program Files\InstallShield Installation Information
2008-03-20 16:32---------d-----wC:\Program Files\EndlessOnline
2008-03-08 01:21---------d-s---wC:\Documents and Settings\~Ape-Err-Uhl\Application Data\Microsoft
2008-03-03 01:11---------d-----wC:\Program Files\iTunes
2008-03-03 01:09---------d-----wC:\Program Files\QuickTime
2008-02-27 02:16---------d-----wC:\Documents and Settings\~Ape-Err-Uhl\Application Data\Mozilla
2008-02-18 16:28---------d-----wC:\Documents and Settings\~Ape-Err-Uhl\Application Data\Adobe
2008-02-17 18:2026,250---ha-wC:\Program Files\PureVoice.GID
2008-02-17 18:16---------d-----wC:\Documents and Settings\~Ape-Err-Uhl\Application Data\Help
2008-02-12 04:04---------d-----wC:\Documents and Settings\~Ape-Err-Uhl\Application Data\Yahoo!
2008-02-09 05:07---------d-----wC:\Program Files\Common Files\Adobe
2008-02-05 00:32---------d-----wC:\Program Files\AIM6
2008-01-11 05:5344,544----a-wC:\WINDOWS\system32\dllcache\pngfilt.dll
2007-12-19 23:01347,136----a-wC:\WINDOWS\system32\dllcache\dxtmsft.dll
2007-12-18 09:51179,584------wC:\WINDOWS\system32\dllcache\mrxdav.sys
2007-12-08 05:213,592,192------wC:\WINDOWS\system32\dllcache\mshtml.dll
2007-12-06 11:01625,664------wC:\WINDOWS\system32\dllcache\iexplore.exe
2007-12-06 11:0070,656------wC:\WINDOWS\system32\dllcache\ie4uinit.exe
2007-12-06 11:0013,824------wC:\WINDOWS\system32\dllcache\ieudinit.exe
2007-12-06 04:59161,792------wC:\WINDOWS\system32\dllcache\ieakui.dll
2007-12-04 18:38550,912----a-wC:\WINDOWS\system32\oleaut32.dll
2007-12-04 18:38550,912------wC:\WINDOWS\system32\dllcache\oleaut32.dll
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8B65F8A9-BAD5-4261-BB6F-25B2020C3098}]
2008-03-29 18:15213504--a------C:\WINDOWS\dsaip32b.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ModemOnHold"="C:\Program Files\NetWaiting\netWaiting.exe" [2003-09-10 02:24 20480]
"DellSupport"="C:\Program Files\Dell Support\DSAgnt.exe" [2006-08-28 21:57 395776]
"Aim6"="" []
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:00 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.911.3380\GoogleToolbarNotifier.exe" [2008-01-03 15:33 162744]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 18:43 4670704]
"eobar"="C:\Documents and Settings\~Ape-Err-Uhl\Local Settings\Temporary Internet Files\Content.IE5\J25INM6X\eopbar[1].exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2005-10-06 23:13 176128]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-12-13 02:44 98304]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-12-13 02:41 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-12-13 02:45 118784]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 02:11 132496]
"Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY.exe" [2006-11-22 17:35 1392640]
"SigmatelSysTrayApp"="stsystra.exe" [2006-03-24 16:30 282624 C:\WINDOWS\stsystra.exe]
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\Quickset.exe" [2007-02-20 12:29 1191936]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-02-01 00:13 385024]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 14:10 267048]
"ISTray"="C:\Program Files\Spyware Doctor\pctsTray.exe" [2008-02-01 12:55 1103240]

C:\Documents and Settings\~Ape-Err-Uhl\Start Menu\Programs\Startup\
OpenOffice.org 2.3.lnk - C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe [2007-08-17 22:57:56 393216]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2007-08-25 03:25:09 24576]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\AIM6\\aim6.exe"=
"C:\\Program Files\\Kontiki\\KService.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"C:\\Program Files\\Photo Story 3 for Windows\\PhotoStory3.exe"=

R2 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" [2007-01-04 16:38]
S3 P1120VID;Creative WebCam NX Ultra;C:\WINDOWS\system32\DRIVERS\P1120Vid.sys [2004-01-12 17:51]

*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder
"2008-01-23 00:19:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-03-28 23:16:26 C:\WINDOWS\Tasks\Norton Security Scan.job"
- C:\Program Files\Norton Security Scan\Nss.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-30 14:15:13
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-03-30 14:16:36
ComboFix-quarantined-files.txt  2008-03-30 19:16:33
Pre-Run: 40,413,863,936 bytes free
Post-Run: 40,401,956,864 bytes free
.
2008-03-11 21:42:47--- E O F ---  

This is the HijackThis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:27:33 PM, on 3/30/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Kontiki\KService.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.911.3380\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Apoint\HidFind.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.misec.net/forum/board/Trojans;action=display;num=1206849473;start=0
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=6070825
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
O2 - BHO: Media Player Codec - {8B65F8A9-BAD5-4261-BB6F-25B2020C3098} - C:\WINDOWS\dsaip32b.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: AIM Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\Quickset.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.911.3380\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [eobar] C:\Documents and Settings\~Ape-Err-Uhl\Local Settings\Temporary Internet Files\Content.IE5\J25INM6X\eopbar[1].exe
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: AIM Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {C56BF45D-4722-4EFD-AA14-9DB1E92661E3} - http://coke.mycokerewards.com/cabs/CocaCola_1_0_0_9.cab
O16 - DPF: {CE7D2BF2-D173-4CE2-9DAF-15EA153B5B43} - http://coke.mycokerewards.com/cabs/Entriq_3_6_0_15_Silent.cab
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: C-DillaCdaC11BA - C-Dilla Ltd - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: KService - Unknown owner - C:\Program Files\Kontiki\KService.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

--
End of file - 8220 bytes

Title: Re: In Dire Need of Help!!
Post by siliconman01 on Mar 30th, 2008, 2:12pm
Okay, Now please do the following:

1.  Run another HiJackthis scan.

2.  When the scan is completed, place a checkmark in the box next to the following items.  BE SURE that these are the only items checked.


R3 - URLSearchHook: (no name) - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - (no file)

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)

O2 - BHO: Media Player Codec - {8B65F8A9-BAD5-4261-BB6F-25B2020C3098} - C:\WINDOWS\dsaip32b.dll

O4 - HKCU\..\Run: [eobar] C:\Documents and Settings\~Ape-Err-Uhl\Local Settings\Temporary Internet Files\Content.IE5\J25INM6X\eopbar[1].exe


3.  Close your browser window.

4.  Then click on Fix Checked located at the lower left of the HiJackthis window.  Confirm that you want HJT to fix these items and let it fix them.

5.  Close the HJT window.

6.  Reboot your computer

7.  Please post a new HJT scan log.

Do you still get this crazy message?


Quote:
Whenever I try to access my computer files or use the internet, a system error comes up and says:

Your computer was infected by unknown trojan.
It's dangerous for your system (critical files can be lost)!
Click OK to download the antispyware program to clean your system! (Recommended)







Title: Re: In Dire Need of Help!!
Post by Aprileatlove on Mar 30th, 2008, 2:46pm
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:44:49 PM, on 3/30/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Kontiki\KService.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Dell\QuickSet\Quickset.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\NetWaiting\netWaiting.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.911.3380\GoogleToolbarNotifier.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Apoint\HidFind.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\wuauclt.exe
\?\C:\WINDOWS\system32\WBEM\WMIADAP.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.misec.net/forum/board/Trojans;action=display;num=1206849473;start=0
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=6070825
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: AIM Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\Quickset.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.911.3380\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: AIM Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {C56BF45D-4722-4EFD-AA14-9DB1E92661E3} - http://coke.mycokerewards.com/cabs/CocaCola_1_0_0_9.cab
O16 - DPF: {CE7D2BF2-D173-4CE2-9DAF-15EA153B5B43} - http://coke.mycokerewards.com/cabs/Entriq_3_6_0_15_Silent.cab
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: C-DillaCdaC11BA - C-Dilla Ltd - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: KService - Unknown owner - C:\Program Files\Kontiki\KService.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

--
End of file - 8239 bytes



Wow, you're really helpful! Thank you so much!! You're a lifesaver. :)
http://farm2.static.flickr.com/1211/928178439_6fc9d6b5f9.jpg

Title: Re: In Dire Need of Help!!
Post by siliconman01 on Mar 30th, 2008, 3:08pm
You are most welcome  ;D

Your HJT log looks clean.  I assume the pesky message is no more.  

Title: Re: In Dire Need of Help!!
Post by Halcyon on Apr 2nd, 2008, 10:10pm
I'm having a very similar problem, same pop up message. I downloaded something a day ago, and now I'm getting a ton of popups. I know the trojan is a Vundo and is located in the file C:\WINDOWS\system32\qoMfeefF.dll.
However, no matter how many times I run Trojan Hunter, this particular trojan cannot be cleaned. (A few others were also found, but those were all cleaned).

Should I follow these same directions and post the log?

Title: Re: In Dire Need of Help!!
Post by siliconman01 on Apr 2nd, 2008, 10:24pm
Welcome to the forum Halcyon

Yes, please follow the same instructions.  When you post back here the Combofix log and HiJackthis log, we'll see what else may need to be done.

Title: Re: In Dire Need of Help!!
Post by Halcyon on Apr 2nd, 2008, 11:57pm
ComboFix 08-04-02.1 - Daniel Dix 2008-04-02 22:49:49.1 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1252.1.1033.18.1462 [GMT -7:00]
Running from: C:\My Downloads\Software\Trojan Hunter\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\update.exe
C:\WINDOWS\BMd7666c43.xml
C:\WINDOWS\cookies.ini
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\awtrQGAs.dll
C:\WINDOWS\system32\Cache
C:\WINDOWS\system32\dmudirwt.dll
C:\WINDOWS\system32\dpfuuajw.dll
C:\WINDOWS\system32\FfeefMoq.ini
C:\WINDOWS\system32\FfeefMoq.ini2
C:\WINDOWS\system32\jkkHXNhh.dll
C:\WINDOWS\system32\jrpdqlbu.ini
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\qoMfeefF.dll
C:\WINDOWS\system32\ssqRkkjG.dll
C:\WINDOWS\system32\tuvWpMef.dll
C:\WINDOWS\system32\twridumd.ini
C:\WINDOWS\system32\ublqdprj.dll
C:\WINDOWS\system32\winsys.exe
C:\WINDOWS\system32\xbbitmdh.dll
C:\WINDOWS\system32\yayxwVLC.dll

.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_IPRIP
-------\Service_Iprip


(((((((((((((((((((((((((   Files Created from 2008-03-03 to 2008-04-03  )))))))))))))))))))))))))))))))
.

2008-04-02 20:58 . 2008-04-02 20:58<DIR>d--------C:\Program Files\Trend Micro
2008-04-02 19:11 . 2008-04-02 19:11<DIR>d--------C:\Documents and Settings\Daniel Dix\Application Data\TrojanHunter
2008-04-02 18:54 . 2008-04-02 18:54<DIR>d--------C:\Program Files\TrojanHunter 5.0
2008-04-02 18:42 . 2008-04-02 18:4269--a------C:\WINDOWS\NeroDigital.ini
2008-04-02 17:48 . 2008-04-02 17:49<DIR>d--------C:\Program Files\Windows Defender
2008-04-02 17:18 . 2008-04-02 17:18<DIR>d--------C:\Documents and Settings\Daniel Dix\Application Data\MSN6
2008-04-02 17:18 . 2008-04-02 17:18<DIR>d--------C:\Documents and Settings\All Users\Application Data\MSN6
2008-04-01 21:00 . 2008-04-02 18:491,600,684---hs----C:\WINDOWS\system32\avxeojmf.ini
2008-03-31 17:59 . 2008-03-31 17:59<DIR>d--------C:\Documents and Settings\All Users\Application Data\LightScribe
2008-03-30 13:46 . 1999-07-02 00:19188,928---------C:\WINDOWS\system32\swflash.ocx
2008-03-30 13:46 . 1999-07-02 00:19137,728---------C:\WINDOWS\system32\amn21e.dll
2008-03-30 13:46 . 1999-07-02 00:1997,792---------C:\WINDOWS\system32\am21e.dll
2008-03-30 13:46 . 1999-07-02 00:1913,824---------C:\WINDOWS\system32\dslite.dll
2008-03-30 13:42 . 2008-03-30 13:48<DIR>d--------C:\Program Files\Microsoft Encarta
2008-03-30 13:24 . 2008-03-30 13:24<DIR>d--------C:\Program Files\Viewpoint
2008-03-30 13:24 . 2008-03-30 13:24<DIR>d--------C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-03-30 13:24 . 2008-03-30 13:2437,027--a------C:\WINDOWS\atmoUn.exe
2008-03-30 13:19 . 2008-03-31 18:20<DIR>d--------C:\Documents and Settings\Daniel Dix\Application Data\AdobeUM
2008-03-30 13:01 . 2008-03-30 13:01<DIR>d--------C:\Program Files\Common Files\LightScribe
2008-03-30 12:58 . 2008-03-30 12:58<DIR>d--------C:\Documents and Settings\Daniel Dix\Application Data\Ahead
2008-03-30 12:57 . 2008-03-30 12:57<DIR>d--------C:\Documents and Settings\All Users\Application Data\Ahead
2008-03-30 12:52 . 2008-03-30 12:52<DIR>d--------C:\Program Files\Nero
2008-03-30 12:52 . 2008-03-30 12:55<DIR>d--------C:\Program Files\Common Files\Ahead
2008-03-30 12:52 . 2008-03-30 12:52<DIR>d--------C:\Documents and Settings\All Users\Application Data\Nero
2008-03-29 21:20 . 2008-03-29 21:20<DIR>d--------C:\Documents and Settings\All Users\Application Data\Age of Empires 3
2008-03-29 20:45 . 2008-03-29 20:45<DIR>d--h-----C:\WINDOWS\PIF
2008-03-29 15:36 . 2008-03-29 15:36<DIR>d--------C:\Program Files\Lavalys
2008-03-29 15:07 . 2008-04-02 19:16<DIR>d--------C:\Program Files\Network Associates
2008-03-29 15:03 . 2008-03-29 15:03<DIR>d--------C:\Program Files\TechSmith
2008-03-29 14:53 . 2008-03-29 14:53379--a------C:\WINDOWS\PowerReg.dat
2008-03-29 14:52 . 2008-03-29 14:52<DIR>d--------C:\Program Files\Executive Software
2008-03-29 14:49 . 2008-03-30 13:19<DIR>d--------C:\Program Files\Common Files\Adobe
2008-03-29 13:19 . 2006-11-24 14:4740,136--a------C:\WINDOWS\system32\drivers\ET5Drv.sys
2008-03-27 21:24 . 2008-03-27 21:24<DIR>d--------C:\Program Files\MSXML 6.0
2008-03-27 21:24 . 2008-03-27 21:24<DIR>d--------C:\Program Files\MSXML 4.0
2008-03-27 21:19 . 2008-03-27 21:19<DIR>d--------C:\Program Files\Microsoft Works
2008-03-27 21:19 . 2006-10-26 19:5632,592--a------C:\WINDOWS\system32\msonpmon.dll
2008-03-27 21:18 . 2008-03-27 21:18<DIR>d--------C:\Program Files\Microsoft.NET
2008-03-27 21:17 . 2008-03-27 21:18<DIR>d--------C:\WINDOWS\SHELLNEW
2008-03-27 21:17 . 2008-03-27 21:17<DIR>d--------C:\Program Files\Microsoft Visual Studio 8
2008-03-27 21:16 . 2008-03-27 21:16<DIR>dr-h-----C:\MSOCache
2008-03-27 21:16 . 2008-04-01 23:59<DIR>d--------C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-03-27 20:25 . 2008-03-27 20:25<DIR>d--------C:\Documents and Settings\Daniel Dix\Application Data\HP
2008-03-27 20:24 . 2008-03-27 20:24<DIR>d--------C:\Documents and Settings\All Users\Application Data\HP
2008-03-27 20:21 . 2008-03-27 20:21<DIR>d--------C:\Program Files\Common Files\Sonic Shared
2008-03-27 20:21 . 2008-03-27 20:21<DIR>d--------C:\Documents and Settings\All Users\Application Data\Sonic
2008-03-27 20:20 . 2008-03-27 20:20<DIR>d--------C:\Program Files\Common Files\HP
2008-03-27 20:20 . 2008-03-27 20:20<DIR>d--------C:\Documents and Settings\Daniel Dix\Application Data\Logitech
2008-03-27 20:19 . 2008-03-27 20:19<DIR>d--------C:\Program Files\Hewlett-Packard
2008-03-27 20:19 . 2008-03-27 20:19<DIR>d--------C:\Program Files\Common Files\Hewlett-Packard
2008-03-27 20:18 . 2006-04-12 17:02827,392-ra------C:\WINDOWS\system32\hpotiop2.dll
2008-03-27 20:18 . 2006-04-12 17:02659,456-ra------C:\WINDOWS\system32\hpowiax2.dll
2008-03-27 20:18 . 2006-04-12 17:02254,026-ra------C:\WINDOWS\system32\hpovst09.dll
2008-03-27 20:18 . 2006-01-04 02:1277,824-ra------C:\WINDOWS\system32\HPZIDS01.dll
2008-03-27 20:18 . 2006-04-10 14:0338,400--a------C:\WINDOWS\system32\hpz3l054.dll
2008-03-27 20:18 . 2001-08-17 13:536,784--a------C:\WINDOWS\system32\drivers\serscan.sys
2008-03-27 20:18 . 2001-08-17 13:536,784--a--c---C:\WINDOWS\system32\dllcache\serscan.sys
2008-03-27 20:18 . 2008-03-27 20:18162--a------C:\WINDOWS\system32\AddPort.ini
2008-03-27 20:17 . 2008-03-29 21:20<DIR>d--------C:\TEMP
2008-03-27 20:17 . 2006-03-03 21:03282,680--a------C:\WINDOWS\system32\HPZidr12.dll
2008-03-27 20:17 . 2006-03-03 21:02204,800--a------C:\WINDOWS\system32\HPZipr12.dll
2008-03-27 20:17 . 2006-03-03 21:0294,208--a------C:\WINDOWS\system32\HPZipt12.dll
2008-03-27 20:17 . 2006-03-03 21:0369,632--a------C:\WINDOWS\system32\HPZipm12.exe
2008-03-27 20:17 . 2006-03-03 21:0365,536--a------C:\WINDOWS\system32\HPZinw12.exe
2008-03-27 20:17 . 2006-03-03 21:0257,344--a------C:\WINDOWS\system32\HPZisn12.dll
2008-03-27 20:17 . 2008-03-27 20:18815--a------C:\WINDOWS\hpntwksetup.ini
2008-03-27 20:16 . 2008-03-27 20:22<DIR>d--------C:\Program Files\HP
2008-03-27 20:14 . 2008-03-27 20:14<DIR>d--hs----C:\WINDOWS\ftpcache
2008-03-27 20:14 . 2004-08-03 23:0831,616--a------C:\WINDOWS\system32\drivers\usbccgp.sys
2008-03-27 20:14 . 2004-08-03 23:0831,616--a--c---C:\WINDOWS\system32\dllcache\usbccgp.sys
2008-03-27 20:14 . 2004-08-03 23:0826,496--a--c---C:\WINDOWS\system32\dllcache\usbstor.sys
2008-03-27 20:14 . 2004-08-03 23:0125,856--a------C:\WINDOWS\system32\drivers\usbprint.sys
2008-03-27 20:14 . 2004-08-03 23:0125,856--a--c---C:\WINDOWS\system32\dllcache\usbprint.sys
2008-03-27 20:13 . 2008-03-27 20:25117,092--a------C:\WINDOWS\hpoins11.dat
2008-03-27 20:11 . 2008-03-27 20:11<DIR>d--------C:\Program Files\Logitech
2008-03-27 20:11 . 2008-03-27 20:11<DIR>d--------C:\Program Files\Common Files\Logitech
2008-03-27 20:11 . 2004-06-08 12:3571,533--a------C:\WINDOWS\system32\drivers\LMouKE.Sys
2008-03-27 20:11 . 2004-06-08 12:3554,817--a------C:\WINDOWS\system32\drivers\L8042mou.Sys
2008-03-27 20:11 . 2004-06-08 12:3613,105--a------C:\WINDOWS\system32\drivers\L8042Kbd.sys
2008-03-27 19:56 . 2008-03-27 21:19<DIR>d--------C:\Program Files\MSBuild
2008-03-27 19:56 . 2008-03-27 19:56<DIR>d--------C:\Program Files\Microsoft Silverlight
2008-03-27 19:54 . 2008-03-27 21:27<DIR>d--------C:\WINDOWS\system32\XPSViewer
2008-03-27 19:54 . 2008-03-27 19:54<DIR>d--------C:\Program Files\Reference Assemblies
2008-03-27 19:54 . 2006-06-29 13:0714,048---------C:\WINDOWS\system32\spmsg2.dll
2008-03-27 19:53 . 2008-03-27 19:53<DIR>d--------C:\Program Files\Windows Media Connect 2
2008-03-27 19:49 . 2008-03-27 19:50<DIR>d--------C:\WINDOWS\system32\URTTemp
2008-03-27 19:42 . 2008-03-27 19:42<DIR>d--------C:\Documents and Settings\All Users\Application Data\WinZip
2008-03-27 19:23 . 2008-03-27 19:23<DIR>d--------C:\Documents and Settings\Daniel Dix\Application Data\teamspeak2
2008-03-27 19:21 . 2008-03-29 21:42<DIR>d--------C:\Program Files\Teamspeak2_Server
2008-03-27 19:20 . 2008-03-27 19:20<DIR>d--------C:\Program Files\Teamspeak2_RC2
2008-03-27 19:20 . 2008-03-27 19:2034,064--a------C:\WINDOWS\system32\lhacm.acm
2008-03-27 19:13 . 2008-03-27 19:58<DIR>d--------C:\Documents and Settings\Daniel Dix\Contacts
2008-03-27 19:11 . 2008-03-27 19:12<DIR>d--------C:\Program Files\Windows Live
2008-03-27 19:11 . 2008-03-27 19:12<DIR>d--hsc---C:\Program Files\Common Files\WindowsLiveInstaller
2008-03-27 19:11 . 2008-03-27 19:11<DIR>d--------C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-03-26 18:35 . 2008-03-26 19:084--a------C:\WINDOWS\system32\GVTunner.ref
2008-03-26 14:02 . 2008-03-26 14:02262,144--a------C:\WINDOWS\system32\wrap_oal.dll
2008-03-26 14:02 . 2008-03-26 14:0286,016--a------C:\WINDOWS\system32\OpenAL32.dll
2008-03-26 13:45 . 2008-03-26 13:45<DIR>d--------C:\Program Files\Futuremark
2008-03-26 13:26 . 2008-03-26 13:26<DIR>d--------C:\WINDOWS\system32\Futuremark

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-30 04:00---------d-----wC:\Program Files\Common Files\InstallShield
2008-03-26 21:50278,984----a-wC:\WINDOWS\system32\drivers\atksgt.sys
2008-03-26 21:5025,416----a-wC:\WINDOWS\system32\drivers\lirsgt.sys
2008-03-26 08:06315,392----a-wC:\WINDOWS\HideWin.exe
2008-03-26 07:56---------d-----wC:\Program Files\Intel
2008-03-26 07:37---------d-----wC:\Program Files\microsoft frontpage
2008-03-11 23:256,593,376----a-wC:\WINDOWS\system32\drivers\nv4_mini.sys
2008-02-14 22:2829----a-wC:\Program Files\version.ini
2008-02-14 22:23231,944----a-wC:\Program Files\gwflash.exe
2007-09-22 03:4219,008----a-wC:\Program Files\markfun.a64
2007-08-22 03:4917,912----a-wC:\Program Files\markfun.w32
2007-08-22 03:49125,504----a-wC:\Program Files\MarkFunDrv.dll
2007-04-05 02:35207,680----a-wC:\Program Files\updateutility.exe
2007-03-30 12:36301----a-wC:\Program Files\update.ini
2007-03-02 12:48240,448----a-wC:\Program Files\gwf32.exe
2006-11-24 07:47207,680----a-wC:\Program Files\BIOS_Run.exe
2006-11-24 07:4060,224----a-wC:\Program Files\HUADRV.DLL
2006-11-04 02:09528----a-wC:\Program Files\CONFIG.INI
2005-04-28 03:406,800----a-wC:\Program Files\W95_HUA.vxd
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:56 15360]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-01 10:21 153136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinSys2"="C:\WINDOWS\System32\winsys2.exe" [2007-10-30 01:37 208896]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20 866584]
"RTHDCPL"="RTHDCPL.EXE" [2007-09-19 03:14 16844800 C:\WINDOWS\RTHDCPL.exe]
"nwiz"="nwiz.exe" [2008-03-11 16:25 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-03-11 16:25 86016]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-03-11 16:25 13520896]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-17 08:15 81920]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2005-02-17 08:15 221184]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 02:41 49152]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ssqRkkjG]
ssqRkkjG.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech SetPoint.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech SetPoint.lnk
backup=C:\WINDOWS\pss\Logitech SetPoint.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BMd7666c43]
C:\WINDOWS\system32\sqroibmh.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\d4555fdf]
C:\WINDOWS\system32\fmjoexva.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EasyTuneV]
--a------ 2007-08-14 14:10 20480 C:\Program Files\Gigabyte\ET5\ETcall.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
--a------ 2007-07-18 17:55 451872 C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2007-03-01 15:57 153136 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"LightScribeService"=2 (0x2)
"Diskeeper"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\GIGABYTE\\@BIOS\\gwflash.exe"=
"C:\\Program Files\\GIGABYTE\\@BIOS\\update.exe"=
"C:\\Program Files\\gwflash.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Teamspeak2_Server\\server_windows.exe"=
"C:\\WINDOWS\\system32\\spoolsv.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"G:\\Program Files\\Microsoft Games\\Age of Empires III\\age3.exe"=

R2 SMTPSVC;Simple Mail Transfer Protocol (SMTP);C:\WINDOWS\System32\inetsrv\inetinfo.exe [2004-08-04 01:56]
S3 gdrv;gdrv;C:\WINDOWS\gdrv.sys [2008-03-26 01:09]
S3 GVTDrv;GVTDrv;C:\WINDOWS\system32\Drivers\GVTDrv.sys [2008-03-26 19:08]
S3 SetupNTGLM7X;SetupNTGLM7X;D:\NTGLM7X.sys []


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
Contents of the 'Scheduled Tasks' folder
"2008-04-03 03:52:25 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-02 22:52:55
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\imapi.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
.
**************************************************************************
.
Completion time: 2008-04-02 22:54:11 - machine was rebooted [Daniel Dix]
ComboFix-quarantined-files.txt  2008-04-03 05:54:08
Pre-Run: 117,260,873,728 bytes free
Post-Run: 117,275,336,704 bytes free
.
2008-03-29 03:31:29--- E O F ---  

Title: Re: In Dire Need of Help!!
Post by Halcyon on Apr 2nd, 2008, 11:59pm
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:55:12 PM, on 4/2/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\imapi.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Microsoft Office\Office12\WINWORD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://news.google.com/news?ned=us
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 7\SnagItBHO.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 7\SnagItIEAddin.dll
O4 - HKLM\..\Run: [WinSys2] C:\WINDOWS\System32\winsys2.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: QuickDefine - C:\Program Files\Common Files\Microsoft Shared\Reference Titles\eddefine.htm
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://asia.msi.com.tw
O15 - Trusted Zone: http://global.msi.com.tw
O15 - Trusted Zone: http://www.msi.com.tw
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1206516800546
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1206516793092
O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} (WebSDev Control) - http://liveupdate.msi.com.tw/autobios/LOnline/install.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Measurement Services Client v.3.12) - http://www.yougamers.com/systeminfo/MSC3.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL
O20 - Winlogon Notify: ssqRkkjG - ssqRkkjG.dll (file missing)
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--
End of file - 7238 bytes

Title: Re: In Dire Need of Help!!
Post by siliconman01 on Apr 3rd, 2008, 12:19am
Okay, Halcyon

ComboFix found and removed several infections.  Please do the following

1.  Remove Combofix.exe from your desktop

2.  Remove the folder named Qoobox from C:\.  It is the Quarantine folder of Combofix.

3.  Remove the Combofix log file from your system.

4.  Run another HiJackthis scan.

5.  When the scan is completed, place a check mark next to the following item.  BE SURE it is the only item checked.

O20 - Winlogon Notify: ssqRkkjG - ssqRkkjG.dll (file missing)

6.  Close your browser.

7.  Click on Fix Checked located at the lower left of the Hijackthis window.  Confirm that you want HJT to fix this item and let it fix it.

8.  Close HiJackthis and reboot.

Do you know what the websites below are and did you purposely add them to your Trusted Sites?  

http://asia.msi.com.tw

http://global.msi.com.tw

http://www.msi.com.tw

Also, is your computer now running okay and no more popups?

Title: Re: In Dire Need of Help!!
Post by Halcyon on Apr 3rd, 2008, 6:59pm
Thank you very much for the help!

Everything is running very smoothly. No more annoying pop ups, no more stalling. I know MSI, but I did not add those to my list. It is possible that installing my video card driver did that automatically, but I didn't place those web sites there.

Title: Re: In Dire Need of Help!!
Post by siliconman01 on Apr 3rd, 2008, 11:29pm

Quote:
I know MSI, but I did not add those to my list. It is possible that installing my video card driver did that automatically, but I didn't place those web sites there.


Okay, as long as you know and trust that site.  If the video driver did put it there, it also unchecked the option that all "trusted" sites have to be https:\\ type sites.  That's okay, but something you should be aware of.

This is found in your Internet Options under the Security Tab>Trusted Sites.  

Title: Re: In Dire Need of Help!!
Post by FlightAttendant747 on Apr 6th, 2008, 8:00pm
Hi,
Im having the same problem. Tried running couple of anti-virus/spyware softwares but the pop-up is still there. Hope you could also help me with this. Thanks a lot. Here are the log files:
==============================================
ComboFix
==============================================
ComboFix 08-04-06.1 - Mike 2008-04-06 20:35:46.1 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.1.1252.1.1033.18.156 [GMT -4:00]
Running from: E:\Software\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\Cache

.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_NNSERV
-------\Service_NNServ


(((((((((((((((((((((((((   Files Created from 2008-03-07 to 2008-04-07  )))))))))))))))))))))))))))))))
.

2008-04-06 20:31 . 2008-04-06 20:31<DIR>d--------C:\Program Files\Trend Micro
2008-04-06 11:29 . 2008-04-06 11:29<DIR>d--------C:\Documents and Settings\Aze\Application Data\SUPERAntiSpyware.com
2008-04-06 09:27 . 2008-04-06 09:27<DIR>d--------C:\Documents and Settings\Mike\Application Data\Malwarebytes
2008-04-06 09:26 . 2008-04-06 09:26<DIR>d--------C:\Program Files\Malwarebytes' Anti-Malware
2008-04-06 09:26 . 2008-04-06 09:26<DIR>d--------C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-04-05 23:14 . 2008-04-06 11:334,954--a------C:\WINDOWS\system32\tmp.reg
2008-04-05 22:04 . 2008-04-05 22:04<DIR>d--------C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-04-05 22:03 . 2008-04-06 09:04<DIR>d--------C:\Program Files\SUPERAntiSpyware
2008-04-05 22:03 . 2008-04-05 22:03<DIR>d--------C:\Documents and Settings\Mike\Application Data\SUPERAntiSpyware.com
2008-04-05 21:25 . 2008-04-05 21:25<DIR>d--------C:\Documents and Settings\Aze\Application Data\PC Tools
2008-04-05 21:25 . 2008-04-05 21:25651,776--a------C:\WINDOWS\is-JSHEP.exe
2008-04-05 21:25 . 2008-04-05 21:25370--a------C:\WINDOWS\is-JSHEP.lst
2008-04-05 20:45 . 2008-04-05 20:45202,752--a------C:\WINDOWS\cndr32a.dll
2008-04-05 20:45 . 2008-04-05 20:4547--a------C:\smp.bat
2008-03-31 16:50 . 2008-03-31 16:50<DIR>d--------C:\Program Files\Common Files\WinCHM
2008-03-31 16:50 . 2000-11-21 11:35837,904--a------C:\WINDOWS\system32\Hha.dll
2008-03-31 16:50 . 2003-10-08 07:38154,352--a------C:\WINDOWS\system32\Itcc.dll

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-07 00:00---------d-----wC:\Program Files\Mozilla Thunderbird
2008-04-06 16:08---------d-----wC:\Program Files\Yahoo!
2008-04-06 16:08---------d-----wC:\Program Files\videofixer
2008-04-06 02:03---------d-----wC:\Program Files\Common Files\Wise Installation Wizard
2008-04-06 02:02---------d-----wC:\Documents and Settings\All Users\Application Data\avg7
2008-04-06 01:25---------d-----wC:\Program Files\Spyware Doctor
2008-04-04 00:15---------d-----wC:\Documents and Settings\Mike\Application Data\Yahoo!
2008-04-03 18:13---------d-----wC:\Documents and Settings\Aze\Application Data\Image Zone Express
2008-04-02 22:50---------d-----wC:\Documents and Settings\Aze\Application Data\Skype
2008-03-16 01:29---------d-----wC:\Program Files\SopCast
2008-03-09 18:32---------d-----wC:\Documents and Settings\Mike\Application Data\Image Zone Express
2008-03-02 04:07---------d-----wC:\Documents and Settings\Mike\Application Data\Skype
2008-02-23 14:24---------d-----wC:\Program Files\XP Codec Pack
2008-02-21 13:11---------d-----wC:\Documents and Settings\Aze\Application Data\AVG7
2008-02-21 13:00---------d-----wC:\Documents and Settings\LocalService\Application Data\AVG7
2008-02-11 15:18---------d-----wC:\Documents and Settings\Aze\Application Data\GetRightToGo
2008-02-11 15:17---------d-----wC:\Documents and Settings\Aze\Application Data\NJStar
2008-02-08 02:06---------d--h--wC:\Program Files\InstallShield Installation Information
2008-02-08 02:06---------d-----wC:\Documents and Settings\All Users\Application Data\Transparent
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{38E4618F-E3E4-42E9-925F-6B02C798BD94}]
2008-04-05 20:45202752--a------C:\WINDOWS\cndr32a.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TPKMAPMN"="C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe" [2004-02-04 06:39 32768]
"ATnotes.exe"="C:\Program Files\ATnotes\ATnotes.exe" [2005-01-05 03:45 1015808]
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [2007-08-30 17:43 4670704]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-07 22:28 68856]
"lieshtm"="C:\DOCUME~1\Mike\APPLIC~1\TRUSTF~1\dart idle more.exe" [ ]
"Chikka"="C:\PROGRA~1\CHIKKA~1\CHIKKA~1.4\\ChikkaLauncher.exe" [2007-08-28 18:11 36864]
"ChikkaDefault"="C:\Program Files\Chikka Messenger\Chikka v.4\\ChikkaLauncher.exe" [2007-08-28 18:11 36864]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-04-06 09:04 1481968]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TrackPointSrv"="tp4serv.exe" [2005-06-12 15:52 94208 C:\WINDOWS\system32\tp4serv.exe]
"TPHOTKEY"="C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe" [2005-04-04 00:43 94208]
"EZEJMNAP"="C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe" [2005-03-22 14:11 217088]
"BMMLREF"="C:\Program Files\ThinkPad\Utilities\BMMLREF.EXE" [2005-04-19 13:38 20480]
"BMMMONWND"="C:\PROGRA~1\ThinkPad\UTILIT~1\BatInfEx.dll" [2005-04-19 13:38 396288]
"BLOG"="C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL" [2005-04-19 13:38 208896]
"PRONoMgrWired"="C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe" [2003-08-06 04:08 86016]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2004-11-01 21:03 155648]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2004-11-01 20:59 126976]
"TP4EX"="tp4ex.exe" [2004-11-11 13:07 40960 C:\WINDOWS\system32\TP4EX.exe]
"TPKMAPHELPER"="C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe" [2004-02-04 06:39 897024]
"TPKBDLED"="C:\WINDOWS\System32\TpScrLk.exe" [2002-10-08 10:28 40960]
"SoundMAXPnP"="C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-03-31 22:52 1368064]
"SoundMAX"="C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" [2004-08-05 20:27 860160]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2002-08-28 09:38 208953]
"IMEKRMIG6.1"="C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE" [2001-08-23 00:00 44032]
"MSPY2002"="C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe" [2002-08-28 09:39 59392]
"PHIME2002ASync"="C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.exe" [2002-08-28 09:39 455168]
"PHIME2002A"="C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.exe" [2002-08-28 09:39 455168]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2008-01-11 20:55 579072]
"AVG7_EMC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe" [2008-01-11 20:55 406528]
"NeroCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-08 23:50 155648]
"MsmqIntCert"="regsvr32 /s mqrt.dll" []
"QCTRAY"="C:\PROGRA~1\ThinkPad\CONNEC~1\QCTray.exe" [2005-03-17 15:07 745472]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-01-26 23:46 155648]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-04-01 22:22 180269]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2006-07-07 19:15 600896]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00 132496]
"HP Software Update"="D:\Programs\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 21:52 49152]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe" [2007-10-23 18:41 219136]
"Spyware Doctor"="" []

C:\Documents and Settings\Aze\Start Menu\Programs\Startup\
qlock.lnk - E:\Program Files\Qlock\qlock.exe [2007-12-18 04:42:38 4158464]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - D:\PROGRAMS\HP\Digital Imaging\bin\hpqtra08.exe [2007-01-02 21:40:10 210520]
Kodak EasyShare software.lnk - C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2007-09-19 05:33:46 282624]
WordWeb.lnk - E:\Program Files\WordWeb\wweb32.exe [2008-01-15 17:50:02 19968]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\QConGina]
QConGina.dll 2005-03-17 15:07 262144 C:\WINDOWS\system32\QConGina.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey]
tphklock.dll 2004-08-12 08:11 24576 C:\WINDOWS\system32\tphklock.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3acm"= L3codeca.acm
"msacm.lameacm"= lameACM.acm
"vidc.3iv2"= 3ivxVfWCodec.dll
"VIDC.HFYU"= huffyuv.dll
"VIDC.wmv3"= wmv9vcm.dll
"VIDC.VP31"= vp31vfw.dll
"vidc.MPG4"= APmpg4v1.dll
"vidc.MP42"= APmpg4v1.dll
"vidc.mp43"= APmpg4v1.dll
"msacm.ac3acm"= ac3acm.acm
"MSVideo8"= VfWWDM32.dll
"vidc.DIV3"= APmpg4v1.dll
"vidc.DIV4"= APmpg4v1.dll
"msacm.divxa32"= DivXa32.acm
"VIDC.AP41"= APmpg4v1.dll
"vidc.ffds"= ffdshow.ax
"msacm.ac3filter"= ac3filter.acm

R1 ANC;ANC;C:\WINDOWS\System32\drivers\ANC.SYS [2005-03-17 15:07]
R1 IBMTPCHK;IBMTPCHK;C:\WINDOWS\System32\drivers\IBMBLDID.SYS [2005-03-17 15:07]
R1 TPPWR;TPPWR;C:\WINDOWS\System32\drivers\Tppwr.sys [2005-04-19 13:38]
R1 vcdrom;Virtual CD-ROM Device Driver;C:\VCdRom.sys [2001-12-19 12:45]
R2 SMTPSVC;Simple Mail Transfer Protocol (SMTP);C:\WINDOWS\System32\inetsrv\inetinfo.exe [2001-08-23 00:00]
S3 PNDIS5;PNDIS5 NDIS Protocol Driver;F:\PNDIS5.SYS []
S3 QCNDISIF;QCNDISIF;C:\WINDOWS\System32\drivers\qcndisif.SYS [2005-03-17 15:07]
S3 Tomcat5;Apache Tomcat;"D:\PROGRAMS\Apache Software Foundation\Tomcat 5.0\bin\tomcat5.exe" //RS//Tomcat5 []
S3 Tp4Track;IBM PS/2 TrackPoint Driver;C:\WINDOWS\System32\DRIVERS\tp4track.sys [2005-06-12 15:52]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12REG_MULTI_SZ   Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmtREG_MULTI_SZ   hpqcxs08 hpqddsvc

.
Contents of the 'Scheduled Tasks' folder
"2005-10-01 05:43:13 C:\WINDOWS\Tasks\BMMTask.job"
- C:\PROGRA~1\ThinkPad\UTILIT~1\BMMTASK.EXE
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-06 20:45:01
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MySql]
"ImagePath"="D:/PROGRAMS/MySQL/bin/mysqld-nt.exe"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MySql]
"ImagePath"="D:/PROGRAMS/MySQL/bin/mysqld-nt.exe"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\tphklock.dll
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\System32\ibmpmsvc.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\msdtc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
D:\PROGRAMS\MySQL\bin\mysqld-nt.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Lenovo\PkgMgr\HOTKEY\TPONSCR.exe
C:\Program Files\Lenovo\PkgMgr\HOTKEY_1\TpScrex.exe
C:\WINDOWS\System32\QCONSVC.EXE
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\PROGRA~1\CHIKKA~1\CHIKKA~1.4\ChikkaLauncher.exe
C:\WINDOWS\System32\snmp.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\TpKmpSVC.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\System32\mqsvc.exe
C:\WINDOWS\System32\mqtgsvc.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
D:\Programs\HP\Digital Imaging\bin\hpqSTE08.exe
.
**************************************************************************
.
Completion time: 2008-04-06 20:53:42 - machine was rebooted
ComboFix-quarantined-files.txt  2008-04-07 00:53:32
Pre-Run: 811,241,472 bytes free
Post-Run: 709,689,344 bytes free

Title: Re: In Dire Need of Help!!
Post by FlightAttendant747 on Apr 6th, 2008, 8:01pm
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:57:09 PM, on 4/6/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\msdtc.exe
C:\WINDOWS\System32\alg.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
D:\PROGRAMS\MySQL\bin\mysqld-nt.exe
C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Lenovo\PkgMgr\HOTKEY\TPONSCR.exe
C:\Program Files\Lenovo\PkgMgr\HOTKEY_1\TpScrex.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\TpScrLk.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\WINDOWS\System32\QCONSVC.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\PROGRA~1\ThinkPad\CONNEC~1\QCTray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
D:\Programs\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\PROGRA~1\CHIKKA~1\CHIKKA~1.4\ChikkaLauncher.exe
C:\WINDOWS\System32\snmp.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\TpKmpSVC.exe
C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe
C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\System32\mqsvc.exe
C:\WINDOWS\System32\mqtgsvc.exe
D:\PROGRAMS\HP\Digital Imaging\bin\hpqtra08.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
D:\Programs\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.picasa.com/support/welcome.php
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: FLW Viewer - {38E4618F-E3E4-42E9-925F-6B02C798BD94} - C:\WINDOWS\cndr32a.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: HP Smart Web Printing 1.0 - {AE84A6AA-A333-4B92-B276-C11E2212E4FE} - D:\Programs\HP\Smart Web Printing\SmartWebPrinting.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [TrackPointSrv] tp4serv.exe
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
O4 - HKLM\..\Run: [BMMLREF] C:\Program Files\ThinkPad\Utilities\BMMLREF.EXE
O4 - HKLM\..\Run: [BMMMONWND] rundll32.exe C:\PROGRA~1\ThinkPad\UTILIT~1\BatInfEx.dll,BMMAutonomicMonitor
O4 - HKLM\..\Run: [BLOG] rundll32.exe C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog
O4 - HKLM\..\Run: [PRONoMgrWired] C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper
O4 - HKLM\..\Run: [TPKBDLED] C:\WINDOWS\System32\TpScrLk.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [QCTRAY] C:\PROGRA~1\ThinkPad\CONNEC~1\QCTray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] D:\Programs\HP\HP Software Update\HPWuSchd2.exe
O4 - HKCU\..\Run: [TPKMAPMN] C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe
O4 - HKCU\..\Run: [ATnotes.exe] C:\Program Files\ATnotes\ATnotes.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [lieshtm] C:\DOCUME~1\Mike\APPLIC~1\TRUSTF~1\dart idle more.exe
O4 - HKCU\..\Run: [Chikka] C:\PROGRA~1\CHIKKA~1\CHIKKA~1.4\\ChikkaLauncher.exe
O4 - HKCU\..\Run: [ChikkaDefault] C:\Program Files\Chikka Messenger\Chikka v.4\\ChikkaLauncher.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = D:\PROGRAMS\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: WordWeb.lnk = E:\Program Files\WordWeb\wweb32.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O9 - Extra button: iSiloX Clipper - {C86027A6-12A1-4298-B6EA-A42AC6EE6C7C} - C:\Program Files\iSilo\iSiloX\iSiloXIE.dll (HKCU)
O9 - Extra 'Tools' menuitem: iSiloX Clipper... - {C86027A6-12A1-4298-B6EA-A42AC6EE6C7C} - C:\Program Files\iSilo\iSiloX\iSiloXIE.dll (HKCU)
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {09883431-7429-11D5-8B69-0050049F5256} (VBAuthentic.Authentic) - https://www.metrobankdirect.com/download/Authentic/VBAuthentic.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {5879B3B0-566E-4ECB-9B77-9A8A5E62AAB8} (DeviceMon Class) - http://www.blackberry.com/DST2007/patch/desktop/DSTUpdateLoaderUSB.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\System32\ibmpmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: MySql - Unknown owner - D:/PROGRAMS/MySQL/bin/mysqld-nt.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: QCONSVC - IBM Corp. - C:\WINDOWS\System32\QCONSVC.EXE
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Apache Tomcat (Tomcat5) - Apache Software Foundation - D:\PROGRAMS\Apache Software Foundation\Tomcat 5.0\bin\tomcat5.exe
O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe

--
End of file - 11366 bytes

Title: Re: In Dire Need of Help!!
Post by siliconman01 on Apr 7th, 2008, 1:52am
Welcome to the forum FlightAttendent747  ;)

Thanks for running Combofix and HiJackthis and then posting.  You have picked up a new variant of this critter, so we need to do some more work.  Please do the following:

0.  Please print these instructions for use without the browser being open.

1.  Clean off Combofix from your system.

-  Remove Combofix.exe from your desktop or E drive.

-  Remove the folder named Qoobox from your C drive.  This is the Quarantine folder of Combofix and is no longer needed.

-  Remove the Combofix log file from your hard drive.  

2.  Please submit the file named cndr32a.dll to Mischel Internet Security.  This file is located in C:\Windows.  The link below describes how to submit this file.

http://www.misec.net/forum/board/FAQ/1139308293

3.  Run another HiJackthis scan.

4.  When the scan is completed, place a checkmark in the box next to the following items.  BE SURE that these are the only items checked.  


O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)

O2 - BHO: FLW Viewer - {38E4618F-E3E4-42E9-925F-6B02C798BD94} - C:\WINDOWS\cndr32a.dll


5.  Close your browser

6.  Click on Fix Checked located at the lower left of the HJT window.  Confirm that you want HJT to fix the item and let it fix it.

7.  Close the HJT window.

8.  Immediately reboot your computer into SAFE MODE.

9.  Once in SAFE MODE, delete the file named cndr32a.dll from C:\Windows.

10.  Boot back into Normal Mode.

11.  Go to the link below and update your Java applet.  Your current version is severely out of date and needs updated for security fixes.

http://www.java.com

12.  Once the Java update is completed, go to the Control Panel>Add/Remove Programs and uninstall all older versions of Java.  

13.  Please post back here a new HiJackthis scan log.  

I assume that you know your XP system is severely out-of-date inasmuch as you are running SP1 and IE6.  I urge you to consider revving up to SP2 with IE7 so that you have the most secure MS operating software.  And rev up to SP3 when it is released in the next 30 days or so.  ;)

Title: Re: In Dire Need of Help!!
Post by FlightAttendant747 on Apr 7th, 2008, 9:07am
I really appreciate your help. Thanks a lot! The annoying popup is now gone. But I still have couple of things to update in my pc (SP2, Java, IE, etc). But for now, here's the latest HiJackThis scan log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:01:43 AM, on 4/7/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
C:\Program Files\Lenovo\PkgMgr\HOTKEY\TPONSCR.exe
C:\Program Files\Lenovo\PkgMgr\HOTKEY_1\TpScrex.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\TpScrLk.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\PROGRA~1\ThinkPad\CONNEC~1\QCTray.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
D:\Programs\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\WINDOWS\System32\msdtc.exe
C:\WINDOWS\System32\alg.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
D:\PROGRAMS\MySQL\bin\mysqld-nt.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\QCONSVC.EXE
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINDOWS\System32\snmp.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\TpKmpSVC.exe
C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe
C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\System32\mqsvc.exe
C:\WINDOWS\System32\mqtgsvc.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\System32\taskmgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://login.live.com/ppsecure/sha1auth.srf?lc=1033
R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: HP Smart Web Printing 1.0 - {AE84A6AA-A333-4B92-B276-C11E2212E4FE} - D:\Programs\HP\Smart Web Printing\SmartWebPrinting.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [TrackPointSrv] tp4serv.exe
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
O4 - HKLM\..\Run: [BMMLREF] C:\Program Files\ThinkPad\Utilities\BMMLREF.EXE
O4 - HKLM\..\Run: [BMMMONWND] rundll32.exe C:\PROGRA~1\ThinkPad\UTILIT~1\BatInfEx.dll,BMMAutonomicMonitor
O4 - HKLM\..\Run: [BLOG] rundll32.exe C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog
O4 - HKLM\..\Run: [PRONoMgrWired] C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper
O4 - HKLM\..\Run: [TPKBDLED] C:\WINDOWS\System32\TpScrLk.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [QCTRAY] C:\PROGRA~1\ThinkPad\CONNEC~1\QCTray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] D:\Programs\HP\HP Software Update\HPWuSchd2.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'Default user')
O4 - Startup: qlock.lnk = E:\Program Files\Qlock\qlock.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = D:\PROGRAMS\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: WordWeb.lnk = E:\Program Files\WordWeb\wweb32.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {09883431-7429-11D5-8B69-0050049F5256} (VBAuthentic.Authentic) - https://www.metrobankdirect.com/download/Authentic/VBAuthentic.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {5879B3B0-566E-4ECB-9B77-9A8A5E62AAB8} - http://www.blackberry.com/DST2007/patch/desktop/DSTUpdateLoaderUSB.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\System32\ibmpmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: MySql - Unknown owner - D:/PROGRAMS/MySQL/bin/mysqld-nt.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: QCONSVC - IBM Corp. - C:\WINDOWS\System32\QCONSVC.EXE
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Apache Tomcat (Tomcat5) - Apache Software Foundation - D:\PROGRAMS\Apache Software Foundation\Tomcat 5.0\bin\tomcat5.exe
O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe

--
End of file - 10107 bytes

Title: Re: In Dire Need of Help!!
Post by siliconman01 on Apr 7th, 2008, 9:46am
Good job,

Your HJT log looks clean.  

You should now clean out your System Restore folder because it is probably infected too.  The link below describes how to do this.

http://www.misec.net/forum/board/FAQ/1139255588

If you want to double check things, you can do a REMOTE scan with Kaspersky per the link below.

http://www.kaspersky.com/virusscanner

-  Use IE6 to go to this website.  Kaspersky will need to download an ActiveX component.  Please let it do so.

-  BE SURE to disable your other security programs temporarily prior to running this remote scan.  DO NOT disable your software firewall.

-  Run a FULL scan of your system with Kaspersky remote scanner.

-  It takes some time to perform this scan because Kaspersky is very thorough....so be prepared for some free time  ;)

-  You can post the Kaspersky scan log back here and I'll take a look at it to see if all is clean per Kaspersky.  


Title: Re: In Dire Need of Help!!
Post by FlightAttendant747 on Apr 8th, 2008, 8:59am
Hi siliconman01,

Thanks for your suggestions. I did scan using Kaspersky. And it was  able to detect few more viruses. Mostly coming from our email archives. But hope these are not harmful. Let me know if something is critical. Thanks.
Here's the log:

  KASPERSKY ONLINE SCANNER REPORT
Tuesday, April 08, 2008 6:56:44 AM
Operating System: Microsoft Windows XP Professional, Service Pack 1 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 8/04/2008
Kaspersky Anti-Virus database records: 689126
Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true
Scan Target My Computer
C:\
D:\
E:\
F:\
Scan Statistics
Total number of scanned objects 265228
Number of viruses found 12
Number of infected objects 65
Number of suspicious objects 0
Duration of the scan process 05:18:53

Infected Object Name Virus Name Last Action
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped
C:\Documents and Settings\All Users\Documents\outlook.pst/Personal Folders/Inbox/02 Jun 2005 08:41 from Mike:information.zip/information.zip/information.txt .scr Infected: Net-Worm.Win32.Mytob.bf skipped
C:\Documents and Settings\All Users\Documents\outlook.pst/Personal Folders/Inbox/02 Jun 2005 08:41 from Mike:information.zip/information.zip Infected: Net-Worm.Win32.Mytob.bf skipped
C:\Documents and Settings\All Users\Documents\outlook.pst/Personal Folders/Inbox/02 Jun 2005 08:31 from Mike:[Fwd: Another virus mai/information.zip/information.txt .scr Infected: Net-Worm.Win32.Mytob.bf skipped
C:\Documents and Settings\All Users\Documents\outlook.pst/Personal Folders/Inbox/02 Jun 2005 08:31 from Mike:[Fwd: Another virus mai/information.zip Infected: Net-Worm.Win32.Mytob.bf skipped
C:\Documents and Settings\All Users\Documents\outlook.pst Mail MS Mail: infected - 4 skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Mike\Application Data\AVG7\Log\emc.log Object is locked skipped
C:\Documents and Settings\Mike\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Mike\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Inbox/02 Jun 2005 08:41 from Mike:information.zip/information.zip/information.txt .scr Infected: Net-Worm.Win32.Mytob.bf skipped
C:\Documents and Settings\Mike\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Inbox/02 Jun 2005 08:41 from Mike:information.zip/information.zip Infected: Net-Worm.Win32.Mytob.bf skipped
C:\Documents and Settings\Mike\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Inbox/02 Jun 2005 08:31 from Mike:[Fwd: Another virus mai/information.zip/information.txt .scr Infected: Net-Worm.Win32.Mytob.bf skipped
C:\Documents and Settings\Mike\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Inbox/02 Jun 2005 08:31 from Mike:[Fwd: Another virus mai/information.zip Infected: Net-Worm.Win32.Mytob.bf skipped
C:\Documents and Settings\Mike\Local Settings\Application Data\Microsoft\Outlook\outlook.pst Mail MS Mail: infected - 4 skipped
C:\Documents and Settings\Mike\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Mike\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Mike\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Mike\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Mike\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Mike\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Mike\QueueManager.log Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Mozilla Firefox\plugins\NPMySrch.dll Infected: not-a-virus:AdTool.Win32.MyWebSearch.i skipped
C:\Program Files\Trend Micro\HijackThis\backups\backup-20080407-083006-910.dll Object is locked skipped
C:\System Volume Information\_restore{C26695B2-9AD2-4615-90CD-C6B42B3985D9}\RP2\change.log Object is locked skipped
C:\WINDOWS\Debug\oakley.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat Object is locked skipped
C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\MsDtc\MSDTC.LOG Object is locked skipped
C:\WINDOWS\system32\MsDtc\Trace\dtctrace.log Object is locked skipped
C:\WINDOWS\system32\msmq\storage\QMLog Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\Temp\ib5 Object is locked skipped
C:\WINDOWS\Temp\ib6 Object is locked skipped
C:\WINDOWS\Temp\ib7 Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_4bc.dat Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
D:\Software\Windows\weatherstudio.exe/stream/data0007 Infected: not-a-virus:AdWare.Win32.Comet.aw skipped
D:\Software\Windows\weatherstudio.exe/stream Infected: not-a-virus:AdWare.Win32.Comet.aw skipped
D:\Software\Windows\weatherstudio.exe NSIS: infected - 2 skipped
D:\PROGRAMS\MySQL\data\lizparker.err Object is locked skipped
D:\PROGRAMS\MySQL\data\ibdata1 Object is locked skipped
D:\PROGRAMS\MySQL\data\ib_logfile0 Object is locked skipped
E:\Mailbox\Thunderbird\Inbox.sbd\Subscriptions.sbd\OpenOrb/[From "Michael Rumpf" ][Date Fri, 28 Jun 2002 14:02:06 +0200]/text/[From Shawn Boyce ][Date Fri, 05 Jul 2002 08:15:39 -0400]/text/[From "Erik Putrycz" ][Date Thu, 11 Jul 2002 16:33:49 +0200]/UNNAMED/[From from quoted-printable to 8bit by mnl.ntsp.nec.co.jp id WAA26748][Date Thu, 11 Jul 2002 16:51:56 +0200]/text/[From ][Date Fri, 4 Jul 2003 9:54:58 +0800]/UNNAMED/details.pif Infected: Email-Worm.Win32.Sobig.e skipped
E:\Mailbox\Thunderbird\Inbox.sbd\Subscriptions.sbd\OpenOrb/[From "Michael Rumpf" ][Date Fri, 28 Jun 2002 14:02:06 +0200]/text/[From Shawn Boyce ][Date Fri, 05 Jul 2002 08:15:39 -0400]/text/[From "Erik Putrycz" ][Date Thu, 11 Jul 2002 16:33:49 +0200]/UNNAMED/[From from quoted-printable to 8bit by mnl.ntsp.nec.co.jp id WAA26748][Date Thu, 11 Jul 2002 16:51:56 +0200]/text/[From ][Date Fri, 4 Jul 2003 9:54:58 +0800]/UNNAMED Infected: Email-Worm.Win32.Sobig.e skipped
E:\Mailbox\Thunderbird\Inbox.sbd\Subscriptions.sbd\OpenOrb/[From "Michael Rumpf" ][Date Fri, 28 Jun 2002 14:02:06 +0200]/text/[From Shawn Boyce ][Date Fri, 05 Jul 2002 08:15:39 -0400]/text/[From "Erik Putrycz" ][Date Thu, 11 Jul 2002 16:33:49 +0200]/UNNAMED/[From from quoted-printable to 8bit by mnl.ntsp.nec.co.jp id WAA26748][Date Thu, 11 Jul 2002 16:51:56 +0200]/text Infected: Email-Worm.Win32.Sobig.e skipped
E:\Mailbox\Thunderbird\Inbox.sbd\Subscriptions.sbd\OpenOrb/[From "Michael Rumpf" ][Date Fri, 28 Jun 2002 14:02:06 +0200]/text/[From Shawn Boyce ][Date Fri, 05 Jul 2002 08:15:39 -0400]/text/[From "Erik Putrycz" ][Date Thu, 11 Jul 2002 16:33:49 +0200]/UNNAMED Infected: Email-Worm.Win32.Sobig.e skipped
E:\Mailbox\Thunderbird\Inbox.sbd\Subscriptions.sbd\OpenOrb/[From "Michael Rumpf" ][Date Fri, 28 Jun 2002 14:02:06 +0200]/text/[From Shawn Boyce ][Date Fri, 05 Jul 2002 08:15:39 -0400]/text Infected: Email-Worm.Win32.Sobig.e skipped
E:\Mailbox\Thunderbird\Inbox.sbd\Subscriptions.sbd\OpenOrb/[From "Michael Rumpf" ][Date Fri, 28 Jun 2002 14:02:06 +0200]/text Infected: Email-Worm.Win32.Sobig.e skipped
E:\Mailbox\Thunderbird\Inbox.sbd\Subscriptions.sbd\OpenOrb Mail Berkeley mbox: infected - 6 skipped
E:\Linux\trustix-2.2.i586.iso/trustix/rpms/amavisd-new-2.2.0-6tr.i586.rpm/./usr/share/doc/amavisd-new-2.2.0/test-messages/sample-virus-executable.txt/[Date Wed, 14 Apr 2004 20:36:33 +0200]/EICAR.COM Infected: EICAR-Test-File skipped
E:\Linux\trustix-2.2.i586.iso/trustix/rpms/amavisd-new-2.2.0-6tr.i586.rpm/./usr/share/doc/amavisd-new-2.2.0/test-messages/sample-virus-executable.txt Infected: EICAR-Test-File skipped
E:\Linux\trustix-2.2.i586.iso/trustix/rpms/amavisd-new-2.2.0-6tr.i586.rpm Infected: EICAR-Test-File skipped
E:\Linux\trustix-2.2.i586.iso ISOimage: infected - 3 skipped
E:\Movies\ABS-CBN\ss1938.exe/WISE0025.BIN/data0001.cab/VVSN.exe Infected: not-a-virus:AdWare.Win32.SaveNow.z skipped
E:\Movies\ABS-CBN\ss1938.exe/WISE0025.BIN/data0001.cab Infected: not-a-virus:AdWare.Win32.SaveNow.z skipped
E:\Movies\ABS-CBN\ss1938.exe/WISE0025.BIN Infected: not-a-virus:AdWare.Win32.SaveNow.z skipped
E:\Movies\ABS-CBN\ss1938.exe/WISE0026.BIN Infected: not-a-virus:AdWare.Win32.NewDotNet skipped
E:\Movies\ABS-CBN\ss1938.exe WiseSFX: infected - 4 skipped
E:\Movies\ABS-CBN\kgsimo.exe/WISE0025.BIN/data0001.cab/VVSN.exe Infected: not-a-virus:AdWare.Win32.SaveNow.z skipped
E:\Movies\ABS-CBN\kgsimo.exe/WISE0025.BIN/data0001.cab Infected: not-a-virus:AdWare.Win32.SaveNow.z skipped
E:\Movies\ABS-CBN\kgsimo.exe/WISE0025.BIN Infected: not-a-virus:AdWare.Win32.SaveNow.z skipped
E:\Movies\ABS-CBN\kgsimo.exe/WISE0026.BIN Infected: not-a-virus:AdWare.Win32.NewDotNet skipped
E:\Movies\ABS-CBN\kgsimo.exe WiseSFX: infected - 4 skipped
E:\Movies\ABS-CBN\ss1889.exe/WISE0025.BIN/data0001.cab/VVSN.exe Infected: not-a-virus:AdWare.Win32.SaveNow.z skipped
E:\Movies\ABS-CBN\ss1889.exe/WISE0025.BIN/data0001.cab Infected: not-a-virus:AdWare.Win32.SaveNow.z skipped
E:\Movies\ABS-CBN\ss1889.exe/WISE0025.BIN Infected: not-a-virus:AdWare.Win32.SaveNow.z skipped
E:\Movies\ABS-CBN\ss1889.exe/WISE0026.BIN Infected: not-a-virus:AdWare.Win32.NewDotNet skipped
E:\Movies\ABS-CBN\ss1889.exe WiseSFX: infected - 4 skipped
E:\Movies\ABS-CBN\americanflag.exe/VVSNINST.EXE Infected: not-a-virus:AdTool.Win32.WhenU.a skipped
E:\Movies\ABS-CBN\americanflag.exe/SEARCHTOOLBARBUND.EXE/stream/data0005 Infected: not-a-virus:AdWare.Win32.MegaSearch.b skipped
E:\Movies\ABS-CBN\americanflag.exe/SEARCHTOOLBARBUND.EXE/stream Infected: not-a-virus:AdWare.Win32.MegaSearch.b skipped
E:\Movies\ABS-CBN\americanflag.exe/SEARCHTOOLBARBUND.EXE Infected: not-a-virus:AdWare.Win32.MegaSearch.b skipped
E:\Movies\ABS-CBN\americanflag.exe ZIP: infected - 4 skipped
E:\Software\SmitfraudFix.exe/data.rar/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
E:\Software\SmitfraudFix.exe/data.rar Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
E:\Software\SmitfraudFix.exe RarSFX: infected - 2 skipped
E:\Software\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
E:\LivingHope\Screensavers\america01.exe/WISE0014.BIN Infected: not-a-virus:AdWare.Win32.NewDotNet skipped
E:\LivingHope\Screensavers\america01.exe/WISE0015.BIN Infected: not-a-virus:AdTool.Win32.WhenU.a skipped
E:\LivingHope\Screensavers\america01.exe/WISE0016.BIN Infected: not-a-virus:AdTool.Win32.WhenU.a skipped
E:\LivingHope\Screensavers\america01.exe WiseSFX: infected - 3 skipped
E:\LivingHope\Screensavers\america01.exe WiseSFXDropper: infected - 3 skipped
E:\LivingHope\Screensavers\god_bless_america_c.exe/WISE0014.BIN Infected: not-a-virus:AdWare.Win32.NewDotNet skipped
E:\LivingHope\Screensavers\god_bless_america_c.exe/WISE0015.BIN Infected: not-a-virus:AdTool.Win32.WhenU.a skipped
E:\LivingHope\Screensavers\god_bless_america_c.exe/WISE0016.BIN Infected: not-a-virus:AdTool.Win32.WhenU.a skipped
E:\LivingHope\Screensavers\god_bless_america_c.exe WiseSFX: infected - 3 skipped
E:\LivingHope\Screensavers\god_bless_america_c.exe WiseSFXDropper: infected - 3 skipped
E:\temp\New Folder\Recover My Files 3.98.rar/keygen.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.iss skipped
E:\temp\New Folder\Recover My Files 3.98.rar/crack.exe Infected: Trojan.Win32.Dialer.yz skipped
E:\temp\New Folder\Recover My Files 3.98.rar RAR: infected - 2 skipped
E:\temp\New Folder\Recover My Files 3.98(2).rar/keygen.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.iss skipped
E:\temp\New Folder\Recover My Files 3.98(2).rar/crack.exe Infected: Trojan.Win32.Dialer.yz skipped
E:\temp\New Folder\Recover My Files 3.98(2).rar RAR: infected - 2 skipped
Scan process completed.


Title: Re: In Dire Need of Help!!
Post by siliconman01 on Apr 8th, 2008, 10:53am
Oh my, you have some significant infections on your system including SOBIG worm which is a whooper.  As you stated, several of your e-mails are infected too...both in Outlook and Thunderbird.  

All of these infections on your system need to be removed.  They can jump up and bite you without warning.  

I recommend that you now perform a Remote Scan with Bit Defender which will detect and repair or delete any infection that it finds.  As to whether it will find everything Kaspersky found is not known, but it will fix the majority.  Below is the link for BitDefender.

http://www.bitdefender.com/scan8/ie.html

-  Use IE6 to go to this web site because Bit Defender needs to download/install an ActiveX module.  Please let it do so.

-  Before running the scan, BE SURE to disable all your other security programs EXCEPT your software firewall.

-  BE SURE to scan all your system with Bit Defender.  

After Bit Defender has completed its work, reboot your computer.  Then run another Remote Scan with Kaspersky.  

Please post back here the results of the second Kaspersky scan.  

Title: Re: In Dire Need of Help!!
Post by FlightAttendant747 on Apr 10th, 2008, 7:48am
Hi,
I tried Bit Defender but it was not successful in healing the infected files. I need the full version to do the job. :(
I tried AVG but it cannot even detect the infected files.
If you know other free scanner, please let me know.
Thanks.

Title: Re: In Dire Need of Help!!
Post by siliconman01 on Apr 10th, 2008, 11:31am
Here's what I suggest to get rid of your multitude of infections.

Install the 30-day trial Version of Kaspersky Antivirus V7.0

http://usa.kaspersky.com/trials/home-users/anti-virus-7/

-  Be sure that you have fully removed AVG before installing KAV V7.0

-  Once you installed KAV V7.0, check the settings and be sure that it is set to scan emails and all your disks.

-  Run a Complete scan of your system with KAV and let it remove what it finds.

-  Post back here the scan report of the complete scan.  




Title: Re: In Dire Need of Help!!
Post by FlightAttendant747 on Apr 15th, 2008, 8:54pm
Finally it was able to remove the worms. But left an iso file which i cannot delete because it contains important data. Please let me know if this kind of virus is critical "EICAR-Test-File". Here's the log:
  KASPERSKY ONLINE SCANNER REPORT
Tuesday, April 15, 2008 6:02:20 AM
Operating System: Microsoft Windows XP Professional, Service Pack 1 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 15/04/2008
Kaspersky Anti-Virus database records: 705072
Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true
Scan Target My Computer
C:\
D:\
E:\
F:\
Scan Statistics
Total number of scanned objects 276694
Number of viruses found 2
Number of infected objects 7
Number of suspicious objects 0
Duration of the scan process 04:53:17

Infected Object Name Virus Name Last Action
C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\Report\detected.idx Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\Report\detected.rpt Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\Report\eventlog.rpt Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\Report\report.rpt Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Mike\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Mike\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Mike\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Mike\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Mike\Local Settings\History\History.IE5\MSHist012008041420080415\index.dat Object is locked skipped
C:\Documents and Settings\Mike\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Mike\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Mike\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Mike\QueueManager.log Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\System Volume Information\_restore{C26695B2-9AD2-4615-90CD-C6B42B3985D9}\RP4\change.log Object is locked skipped
C:\WINDOWS\Debug\oakley.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat Object is locked skipped
C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\WINDOWS\system32\drivers\fidbox.dat Object is locked skipped
C:\WINDOWS\system32\drivers\fidbox.idx Object is locked skipped
C:\WINDOWS\system32\drivers\fidbox2.dat Object is locked skipped
C:\WINDOWS\system32\drivers\fidbox2.idx Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\MsDtc\MSDTC.LOG Object is locked skipped
C:\WINDOWS\system32\MsDtc\Trace\dtctrace.log Object is locked skipped
C:\WINDOWS\system32\msmq\storage\QMLog Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\Temp\ib5 Object is locked skipped
C:\WINDOWS\Temp\ib6 Object is locked skipped
C:\WINDOWS\Temp\ib7 Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_1d4.dat Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
D:\PROGRAMS\MySQL\data\lizparker.err Object is locked skipped
D:\PROGRAMS\MySQL\data\ibdata1 Object is locked skipped
D:\PROGRAMS\MySQL\data\ib_logfile0 Object is locked skipped
E:\Linux\trustix-2.2.i586.iso/trustix/rpms/amavisd-new-2.2.0-6tr.i586.rpm/./usr/share/doc/amavisd-new-2.2.0/test-messages/sample-virus-executable.txt/[Date Wed, 14 Apr 2004 20:36:33 +0200]/EICAR.COM Infected: EICAR-Test-File skipped
E:\Linux\trustix-2.2.i586.iso/trustix/rpms/amavisd-new-2.2.0-6tr.i586.rpm/./usr/share/doc/amavisd-new-2.2.0/test-messages/sample-virus-executable.txt Infected: EICAR-Test-File skipped
E:\Linux\trustix-2.2.i586.iso/trustix/rpms/amavisd-new-2.2.0-6tr.i586.rpm Infected: EICAR-Test-File skipped
E:\Linux\trustix-2.2.i586.iso ISOimage: infected - 3 skipped
E:\Software\SmitfraudFix.exe/data.rar/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
E:\Software\SmitfraudFix.exe/data.rar Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
E:\Software\SmitfraudFix.exe RarSFX: infected - 2 skipped
Scan process completed.

Title: Re: In Dire Need of Help!!
Post by siliconman01 on Apr 16th, 2008, 1:20am
Great!, your Kaspersky cleaning job looks very good.  :D

1.  You can delete the folder Smitfraudfix.exe at  E:\Software\SmitfraudFix.exe.  You have apparently run Smitfraudfix.exe to fix an infection in the past.  This tool should be removed after it is used.  If you need it again, then download a fresh copy because it gets updated as new infections appear.  

That will get rid of the infections below as shown by Kaspersky.


Quote:
E:\Software\SmitfraudFix.exe/data.rar/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
E:\Software\SmitfraudFix.exe/data.rar Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
E:\Software\SmitfraudFix.exe RarSFX: infected - 2 skipped


2.  The infections "EICAR-Test-File" are okay to ignore.  EICAR is kind of a universal benign viral test file that users can download to check if their antivirus program works.  Your ISO file is okay...not infected.  

3.  All the "locked" files just means that they were in use when Kaspersky tried to access them.  No problems there.  

Your system is essentially clean now.  


-  I urge you to obtain a good software firewall/anti-malware suite such as Norton Internet Security 2008, Kaspersky Internet Security V7.0, Avira Premium Security Suite V8, or NOD32 to fully protect your system in Real-time.  

These are not free and have an annual subscription fee.  However, based on what was found on your system, you need a strong realtime protection package....one that scans incoming and outgoing e-mails too.  And keep its detection rules updated daily.  

-  Update your XP-SP1 system to XP-SP2

-  Update IE6 to IE7

-  Update your Java applet as stated previously.  

Title: Re: In Dire Need of Help!!
Post by FlightAttendant747 on Apr 16th, 2008, 8:56am
Thanks again for your suggestions. I'll do those at the earliest.

Title: Re: In Dire Need of Help!!
Post by siliconman01 on Apr 16th, 2008, 3:18pm
You are most welcome.  If you need further assistance, please do not hesitate to holler.   ;)

Title: Re: In Dire Need of Help!!
Post by Muadib on Apr 22nd, 2008, 12:28pm
Hi, this is my first post.
I think the problem solved whit combofix but im gona post the logs anyway (if my english isn't very good sorry, i'm still lerning :P)

ComboFix 08-04-20.5 - Shinji_kun 2008-04-22 13:16:24.1 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1252.1.3082.18.1610 [GMT -4:00]
Se ejecuta desde: C:\Documents and Settings\Shinji_kun\Escritorio\ComboFix.exe
* Creado un nuevo punto de restauración

ADVERTENCIA - ESTE EQUIPO NO TIENE INSTALADA LA CONSOLA DE RECUPERACION!
.

((((((((((((((((((((((((((((((((((((   Otras eliminaciones   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\hgGxXRkk.dll
C:\WINDOWS\system32\kkRXxGgh.ini
C:\WINDOWS\system32\kkRXxGgh.ini2
C:\WINDOWS\system32\lhponhuu.ini
C:\WINDOWS\system32\uuhnophl.dll
C:\WINDOWS\system32\xkmlvdtu.dll
C:\WINDOWS\system32\yayxwVLc.dll

.
((((((((((((((((((   Archivos creados desde 2008-03-22 - 2008-04-22  )))))))))))))))))))))))))))))))))
.

2008-04-22 13:16 . 2008-04-22 13:161,024--ah-----C:\WINDOWS\system32\config\systemprofile\ntuser.dat.LOG
2008-04-22 13:07 . 2008-04-22 13:07<DIR>d--------C:\Archivos de programa\Trend Micro
2008-04-22 12:35 . 2008-04-22 12:35<DIR>d--------C:\Archivos de programa\Lavasoft
2008-04-22 00:57 . 2008-04-22 12:49109,669--a------C:\WINDOWS\BM576af2f3.xml
2008-04-21 12:47 . 2008-03-03 14:255,702--ah-----C:\WINDOWS\nod32restoretemdono.reg
2008-04-21 12:47 . 2008-03-03 18:21568--ah-----C:\WINDOWS\nod32fixtemdono.reg
2008-04-21 12:17 . 2008-04-21 12:17<DIR>d--------C:\Documents and Settings\All Users\Datos de programa\ESET
2008-04-21 12:17 . 2008-04-21 12:17<DIR>d--------C:\Archivos de programa\ESET
2008-04-20 11:30 . 2003-07-22 00:175,174--a------C:\WINDOWS\system32\nppt9x.vxd
2008-04-20 11:30 . 2005-01-05 15:434,682--a------C:\WINDOWS\system32\npptNT2.sys
2008-04-18 22:01 . 2008-04-18 22:01280--a------C:\WINDOWS\game.ini
2008-04-18 21:53 . 2008-04-18 21:53<DIR>d--hs----C:\WINDOWS\ftpcache
2008-04-16 17:31 . 2008-04-16 17:31<DIR>d--------C:\Documents and Settings\Shinji_kun\Datos de programa\AdobeUM
2008-04-13 17:30 . 2008-04-13 17:35800--a------C:\WINDOWS\Rtcw.INI
2008-04-13 00:53 . 2008-04-13 00:53<DIR>d--------C:\Documents and Settings\Shinji_kun\Datos de programa\Locktime
2008-04-13 00:53 . 2008-04-13 00:53<DIR>d--------C:\Documents and Settings\All Users\Datos de programa\Locktime
2008-04-11 11:06 . 2008-04-21 11:2669--a------C:\WINDOWS\NeroDigital.ini
2008-04-11 08:58 . 2008-04-11 08:58<DIR>d--------C:\Archivos de programa\Archivos comunes\Ahead
2008-04-11 08:58 . 2008-04-11 08:58<DIR>d--------C:\Archivos de programa\Ahead
2008-04-11 08:58 . 2004-07-26 17:161,568,768---------C:\WINDOWS\system32\ImagX7.dll
2008-04-11 08:58 . 2004-07-26 17:16476,320---------C:\WINDOWS\system32\ImagXpr7.dll
2008-04-11 08:58 . 2004-07-26 17:16471,040---------C:\WINDOWS\system32\ImagXRA7.dll
2008-04-11 08:58 . 2004-07-26 17:16262,144---------C:\WINDOWS\system32\ImagXR7.dll
2008-04-11 08:58 . 2001-07-09 11:50155,648--a------C:\WINDOWS\system32\NeroCheck.exe
2008-04-11 08:58 . 2004-03-02 17:37125,184---------C:\WINDOWS\system32\drivers\imagesrv.sys
2008-04-11 08:58 . 2000-06-26 11:45106,496--a------C:\WINDOWS\system32\TwnLib20.dll
2008-04-11 08:58 . 2004-03-02 17:375,504---------C:\WINDOWS\system32\drivers\imagedrv.sys
2008-04-11 08:58 . 2008-04-11 08:581,024--ah-----C:\Documents and Settings\Default User\NtUser.dat.LOG
2008-04-06 16:40 . 2008-04-06 16:40<DIR>d--------C:\Archivos de programa\Archivos comunes\DirectX
2008-04-04 11:08 . 2005-11-13 12:39442,368-ra------C:\WINDOWS\system32\vp6vfw.dll
2008-04-03 22:11 . 2008-04-03 22:11<DIR>d--------C:\Documents and Settings\Shinji_kun\Datos de programa\vlc
2008-04-03 22:11 . 2008-04-03 22:11<DIR>d--------C:\Archivos de programa\VideoLAN
2008-04-03 22:10 . 2008-04-03 22:1033,537--a------C:\WINDOWS\system32\CoreAAC-uninstall.exe
2008-04-03 21:57 . 2008-04-03 21:57<DIR>d--------C:\Archivos de programa\ffdshow
2008-04-03 18:21 . 2008-04-03 18:21<DIR>d--------C:\Archivos de programa\Alcohol Soft
2008-04-03 18:21 . 2004-04-30 09:37160,640--a------C:\WINDOWS\system32\drivers\a347bus.sys
2008-04-03 18:21 . 2004-04-30 09:335,248--a------C:\WINDOWS\system32\drivers\a347scsi.sys
2008-04-03 16:53 . 2008-04-03 16:531,186--a------C:\WINDOWS\mozver.dat
2008-04-03 14:57 . 2008-04-03 14:57<DIR>d--------C:\Documents and Settings\All Users\Datos de programa\Messenger Plus!
2008-04-03 14:33 . 2008-04-03 14:33<DIR>d--------C:\WINDOWS\nvidia icons
2008-04-03 14:32 . 2008-04-03 14:32<DIR>d--------C:\WINDOWS\nview
2008-04-03 14:32 . 2008-04-03 14:32<DIR>d--------C:\NVIDIA
2008-04-03 14:32 . 2008-03-24 11:27442,368--a------C:\WINDOWS\system32\NVUNINST.EXE
2008-04-03 14:32 . 2008-03-24 19:52442,368--a------C:\WINDOWS\system32\nvudisp.exe
2008-04-03 14:32 . 2008-04-22 13:19175,033--a------C:\WINDOWS\system32\nvapps.xml
2008-04-03 14:32 . 2008-03-24 19:5217,937--a------C:\WINDOWS\system32\nvdisp.nvu
2008-04-03 09:34 . 2008-04-03 09:34<DIR>d--------C:\Archivos de programa\Marvell
2008-04-03 09:33 . 2008-04-02 21:59<DIR>d----c---C:\WINDOWS\system32\DRVSTORE
2008-04-03 09:33 . 2008-04-03 09:33<DIR>d--------C:\Archivos de programa\Intel
2008-04-03 09:30 . 2008-04-03 09:30<DIR>d--------C:\Archivos de programa\Realtek
2008-04-03 09:30 . 2008-04-20 11:25<DIR>d--h-----C:\Archivos de programa\InstallShield Installation Information
2008-04-03 09:30 . 2007-01-12 04:54520,192-r-------C:\WINDOWS\RtlExUpd.dll
2008-04-03 09:30 . 2008-04-03 09:30315,392--a------C:\WINDOWS\HideWin.exe
2008-04-03 09:28 . 2008-04-03 17:16<DIR>d--------C:\Archivos de programa\Winamp
2008-04-03 09:26 . 2008-04-22 13:13558--a------C:\WINDOWS\DFC.INI
2008-04-03 09:23 . 2008-04-17 21:47<DIR>d--------C:\Archivos de programa\Archivos comunes\InstallShield
2008-04-03 09:22 . 2008-04-03 09:22<DIR>d--------C:\Archivos de programa\VDOTool
2008-04-03 09:22 . 2007-03-12 16:423,495,784--a------C:\WINDOWS\system32\d3dx9_33.dll
2008-04-03 09:20 . 2004-08-03 23:0826,496--a--c---C:\WINDOWS\system32\dllcache\usbstor.sys
2008-04-03 09:13 . 2008-04-19 20:27<DIR>d--------C:\sysreset
2008-04-03 03:46 . 2004-08-19 10:2158,624--a------C:\WINDOWS\system32\drivers\redbook.sys
2008-04-03 03:46 . 2001-08-17 16:593,072--a------C:\WINDOWS\system32\drivers\audstub.sys
2008-04-03 03:45 . 2004-08-19 15:4277,824--a------C:\WINDOWS\system32\usbui.dll
2008-04-03 03:45 . 2004-08-19 15:4277,824--a--c---C:\WINDOWS\system32\dllcache\usbui.dll
2008-04-03 03:44 . 2008-04-03 03:44<DIR>d--h-----C:\Documents and Settings\Default User\Reciente
2008-04-03 03:44 . 2008-04-03 08:51<DIR>d--h-----C:\Documents and Settings\Default User\Plantillas
2008-04-03 03:44 . 2008-04-03 03:44<DIR>d--------C:\Documents and Settings\Default User\Mis documentos
2008-04-03 03:44 . 2008-04-03 03:44<DIR>dr-------C:\Documents and Settings\Default User\Men£ Inicio
2008-04-03 03:44 . 2008-04-03 03:44<DIR>d--h-----C:\Documents and Settings\Default User\Impresoras
2008-04-03 03:44 . 2008-04-03 03:44<DIR>d--------C:\Documents and Settings\Default User\Favoritos
2008-04-03 03:44 . 2008-04-03 03:44<DIR>d--------C:\Documents and Settings\Default User\Escritorio
2008-04-03 03:44 . 2008-04-03 03:44<DIR>d--h-----C:\Documents and Settings\Default User\Entorno de red
2008-04-03 03:44 . 2008-04-03 03:44<DIR>dr-h-----C:\Documents and Settings\Default User\Configuraci¢n local
2008-04-03 03:44 . 2008-04-03 03:44<DIR>d--h-----C:\Documents and Settings\All Users\Plantillas
2008-04-03 03:44 . 2008-04-03 17:40<DIR>dr-------C:\Documents and Settings\All Users\Men£ Inicio
2008-04-03 03:44 . 2008-04-03 03:44<DIR>d--------C:\Documents and Settings\All Users\Favoritos
2008-04-03 03:44 . 2008-04-13 00:58<DIR>d--------C:\Documents and Settings\All Users\Escritorio
2008-04-03 03:44 . 2008-04-04 11:15<DIR>dr-------C:\Documents and Settings\All Users\Documentos
2008-04-03 03:42 . 2008-04-21 12:47<DIR>d--------C:\WINDOWS\system32\CatRoot2
2008-04-03 03:42 . 2008-04-03 03:44<DIR>dr-h-----C:\Documents and Settings\Default User\Datos de programa
2008-04-03 03:42 . 2008-04-21 12:17<DIR>dr-h-----C:\Documents and Settings\All Users\Datos de programa
2008-04-03 03:41 . 2008-04-11 08:58<DIR>d--h-----C:\Documents and Settings\Default User
2008-04-03 03:41 . 2008-04-03 08:54<DIR>d--------C:\Documents and Settings\All Users
2008-04-03 03:41 . 2008-04-03 08:59<DIR>d--------C:\Documents and Settings
2008-04-03 00:23 . 2008-04-03 00:23<DIR>d--------C:\Documents and Settings\Shinji_kun\Datos de programa\ACD Systems
2008-04-03 00:22 . 2008-04-03 00:22<DIR>d--------C:\WINDOWS\Downloaded Installations
2008-04-03 00:22 . 2008-04-03 00:22<DIR>d--------C:\Documents and Settings\All Users\Datos de programa\ACD Systems
2008-04-03 00:22 . 2008-04-03 00:22<DIR>d--------C:\Archivos de programa\Archivos comunes\ACD Systems
2008-04-03 00:22 . 2008-04-03 00:22<DIR>d--------C:\Archivos de programa\ACD Systems
2008-04-03 00:19 . 2008-04-03 00:19359,040--a------C:\WINDOWS\system32\drivers\TCPIP.SYS.ORIGINAL
2008-04-03 00:15 . 2008-04-21 12:41<DIR>d--------C:\Documents and Settings\Shinji_kun\Datos de programa\uTorrent
2008-04-03 00:14 . 2008-04-03 21:28<DIR>d--------C:\Archivos de programa\uTorrent
2008-04-03 00:10 . 2008-04-03 00:10<DIR>d--------C:\Archivos de programa\Lavalys
2008-04-02 23:58 . 2008-04-02 23:58268--ah-----C:\sqmdata00.sqm
2008-04-02 23:58 . 2008-04-02 23:58244--ah-----C:\sqmnoopt00.sqm
2008-04-02 23:57 . 2008-04-02 23:57<DIR>d--------C:\Archivos de programa\Windows Live
2008-04-02 23:57 . 2008-04-02 23:57<DIR>d--------C:\Archivos de programa\Messenger Plus! Live
2008-04-02 22:53 . 2008-04-02 22:53<DIR>d--------C:\Archivos de programa\XviD
2008-04-02 22:53 . 2008-04-02 22:53<DIR>d--------C:\Archivos de programa\Haali
2008-04-02 22:53 . 2008-04-02 22:53<DIR>d--------C:\Archivos de programa\DivX
2008-04-02 22:53 . 2005-12-30 20:10761,856--a------C:\WINDOWS\system32\xvidcore.dll
2008-04-02 22:53 . 2005-12-30 20:18180,224--a------C:\WINDOWS\system32\xvidvfw.dll
2008-04-02 22:53 . 2005-12-30 20:1677,824--a------C:\WINDOWS\system32\xvid.ax
2008-04-02 22:52 . 2008-04-03 22:17<DIR>d--------C:\Archivos de programa\Webteh
2008-04-02 22:31 . 2008-04-20 11:36<DIR>d-a------C:\l2encdec_281
2008-04-02 21:59 . 2008-04-02 21:59<DIR>d--------C:\Documents and Settings\Shinji_kun\Contacts
2008-04-02 21:57 . 2008-04-02 23:57<DIR>d--------C:\Archivos de programa\MSN Messenger
2008-04-02 21:52 . 2008-04-22 12:51<DIR>d--------C:\Documents and Settings\Shinji_kun\Datos de programa\teamspeak2
2008-04-02 21:52 . 2008-04-02 21:52<DIR>d--------C:\Archivos de programa\Teamspeak2_RC2
2008-04-02 21:52 . 2008-04-02 21:5234,064--a------C:\WINDOWS\system32\lhacm.acm
2008-04-02 21:50 . 2008-04-02 21:500--a------C:\WINDOWS\nsreg.dat
2008-04-02 21:46 . 2008-04-02 21:4613,646--a------C:\WINDOWS\system32\wpa.bak
2008-04-02 21:44 . 2008-04-02 21:44940,794--a------C:\WINDOWS\system32\LoopyMusic.wav
2008-04-02 21:44 . 2008-04-02 21:44146,650--a------C:\WINDOWS\system32\BuzzingBee.wav
2008-04-02 21:43 . 2008-04-02 21:43<DIR>d--------C:\WINDOWS\system32\Lang
2008-04-02 21:42 . 2008-04-02 21:42<DIR>d--------C:\Archivos de programa\Archivos comunes\Adobe

.
((((((((((((((((((((((((((((((((((((((   Reporte Find3M   )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-04 15:3511,973----a-wC:\WINDOWS\system32\drivers\secdrv.sys
2008-04-03 12:55---------d-----wC:\Archivos de programa\microsoft frontpage
2008-04-03 12:54---------d-----wC:\Archivos de programa\Servicios en línea
2008-04-03 04:19359,040----a-wC:\WINDOWS\system32\drivers\TCPIP.SYS
.

------- Sigcheck -------

2008-04-03 00:19  359040  fa0bc0391438567057b555899613564bC:\WINDOWS\system32\dllcache\TCPIP.SYS
2008-04-03 00:19  359040  fa0bc0391438567057b555899613564bC:\WINDOWS\system32\drivers\TCPIP.SYS
.
(((((((((((((((((((((((((((((((((   Cargando Puntos Reg   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* entradas vac¡as & entradas leg¡timas predeterminadas no son mostradas

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TBPanel"="C:\Archivos de programa\VDOTool\TBPanel.exe" [2008-01-09 15:33 2169384]
"RTHDCPL"="RTHDCPL.EXE" [2007-05-10 06:08 16342528 C:\WINDOWS\RTHDCPL.exe]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-03-24 19:52 13524992]
"nwiz"="nwiz.exe" [2008-03-24 19:52 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-03-24 19:52 86016]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"egui"="C:\Archivos de programa\ESET\ESET NOD32 Antivirus\egui.exe" [2008-02-20 11:06 1443072]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-20 08:00 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\yayxwVLc]
yayxwVLc.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Archivos de programa\\MSN Messenger\\msnmsgr.exe"=
"C:\\Archivos de programa\\MSN Messenger\\livecall.exe"=
"C:\\Archivos de programa\\uTorrent\\utorrent.exe"=
"C:\\Documents and Settings\\Shinji_kun\\Escritorio\\L2Walker\\l2asrv.exe"=
"C:\\Documents and Settings\\Shinji_kun\\Escritorio\\Utilidades\\L2Walker\\L2Walker\\l2asrv.exe"=
"C:\\sysreset\\mirc.exe"=
"E:\\Juegos\\Aspyr\\Guitar Hero III\\GH3.exe"=
"E:\\Juegos\\Liquid Entertainment\\Battle Realms\\Battle_Realms_F.exe"=

R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2008-02-20 11:11]
S2 NOD32FiXTemDono;Eset Nod32 Boot;C:\WINDOWS\system32\regedt32.exe [2004-08-20 08:00]

.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-22 13:19:06
Windows 5.1.2600 Service Pack 2 NTFS

escaneando procesos ocultos ...

escaneando entradas ocultas de autostart ...

escaneando archivos ocultos ...

el escaneo se completo con exito
archivos ocultos: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\rundll32.exe
C:\Archivos de programa\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Archivos de programa\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\WINDOWS\system32\nvsvc32.exe
.
**************************************************************************
.
Tiempo completado: 2008-04-22 13:19:57 - machine was rebooted
ComboFix-quarantined-files.txt  2008-04-22 17:19:54

              9 dirs   5,267,230,720 bytes libres
             11 dirs   5,283,995,648 bytes libres

204

Title: Re: In Dire Need of Help!!
Post by Muadib on Apr 22nd, 2008, 12:29pm
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:22:25, on 22-04-2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Archivos de programa\VDOTool\TBPanel.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Archivos de programa\ESET\ESET NOD32 Antivirus\egui.exe
C:\Archivos de programa\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Archivos de programa\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Archivos de programa\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Archivos de programa\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [TBPanel] C:\Archivos de programa\VDOTool\TBPanel.exe /A
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [egui] "C:\Archivos de programa\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICIO LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Servicio de red')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Archivos de programa\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O20 - Winlogon Notify: yayxwVLc - yayxwVLc.dll (file missing)
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Archivos de programa\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Archivos de programa\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 2895 bytes

Title: Re: In Dire Need of Help!!
Post by siliconman01 on Apr 22nd, 2008, 1:19pm
Welcome to the forum Muadib,

Combofix cleaned several infections from your system.  

Your system does appear to be disinfected based on your posted HJT this log.  There are some final cleanup items that you need to take care of.  Please do this:

1.  Clean off Combofix from your system.  

-  Delete Combofix.exe from your desktop or from where you originally saved it.

-  Delete the folder named Qoobox from your C drive.  This is the Quarantine folder of Combofix and is no longer needed.

-  Delete the Combofix log file from your hard drive.

2.  Run another HiJackthis scan.

3.  When the scan is completed, place a check mark the box next to the item shown below.  BE SURE this is the only item check marked.

O20 - Winlogon Notify: yayxwVLc - yayxwVLc.dll (file missing)

4.  Click on Fix Checked located at the lower left of the HiJackthis window.  Confirm that you want to fix this item and let HJT fix it.

5.  Close HiJackthis and immediately reboot your computer.

6.  I am confident that your System Restore is still infected.  Please clear out your System Restore as per the instructions in the link below.

http://www.misec.net/forum/board/FAQ/1139255588

7.  If you want to double check things, you can do a REMOTE scan with Kaspersky per the link below.

http://www.kaspersky.com/virusscanner

-  Use IE6 to go to this website.  Kaspersky will need to download an ActiveX component.  Please let it do so.

-  BE SURE to disable your other security programs temporarily prior to running this remote scan.  DO NOT disable your software firewall.

-  Run a FULL scan of your system with Kaspersky remote scanner.

-  It takes some time to perform this scan because Kaspersky is very thorough....so be prepared for some free time  

-  You can post the Kaspersky scan log back here and I'll take a look at it to see if all is clean per Kaspersky.

Title: Re: In Dire Need of Help!!
Post by Muadib on Apr 22nd, 2008, 1:42pm
Thanks for all the help ^^

Title: Re: In Dire Need of Help!!
Post by siliconman01 on Apr 22nd, 2008, 3:12pm
You are very welcome.  :D

Title: Re: In Dire Need of Help!!
Post by Muadib on May 20th, 2008, 1:51pm
Hi, It's me again and now I have problem with my notebook >.<

this is the combofix log:

ComboFix 08-05-19.4 - Shinji_kun 2008-05-20 13:57:03.1 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1252.1.1033.18.130 [GMT -4:00]
Running from: C:\Documents and Settings\Shinji_kun\Desktop\ComboFix.exe
* Created a new restore point
* Resident AV is active


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Shinji_kun\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
C:\WINDOWS\recover.reg
C:\WINDOWS\system32\qsYaHRqr.ini
C:\WINDOWS\system32\qsYaHRqr.ini2
C:\WINDOWS\system32\qvsnqgjd.ini

.
(((((((((((((((((((((((((   Files Created from 2008-04-20 to 2008-05-20  )))))))))))))))))))))))))))))))
.

2008-05-20 13:48 . 2008-05-20 13:4859,392--a------C:\WINDOWS\system32\mlJDUnME.Vdll
2008-05-20 12:07 . 2008-05-20 12:07117,248--a------C:\WINDOWS\system32\djgqnsvq.dll
2008-05-20 12:06 . 2008-05-20 12:07370,176--a------C:\WINDOWS\system32\rqRHaYsq.dll
2008-05-20 01:03 . 2008-05-20 01:03221,405,354--a------C:\20.rmvb
2008-05-20 01:03 . 2008-05-20 01:0396,768---------C:\is154453.exe
2008-05-20 01:03 . 2008-05-20 01:0359,392--a------C:\WINDOWS\system32\mlJDUnME.dll
2008-05-19 11:18 . 2008-05-19 11:18<DIR>d--------C:\Program Files\Thomson

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-20 17:48---------d-----wC:\Documents and Settings\Shinji_kun\Application Data\uTorrent
2008-05-19 16:35---------d-----wC:\Documents and Settings\Shinji_kun\Application Data\teamspeak2
2008-05-19 16:16---------d-----wC:\Program Files\FlashGet
2008-05-19 15:18---------d--h--wC:\Program Files\InstallShield Installation Information
2008-04-01 03:13---------d-----wC:\Program Files\Diablo II
2008-03-29 19:2373,216----a-wC:\WINDOWS\ST6UNST.EXE
2008-03-29 19:23249,856------wC:\WINDOWS\Setup1.exe
2008-03-29 19:23---------d-----wC:\Program Files\Hero Editor
2008-03-22 16:10---------d-----wC:\Program Files\Common Files\InstallShield
2008-03-20 02:21---------d-----wC:\Program Files\Teamspeak2_RC2
2007-09-16 13:0413,195----a-wC:\Documents and Settings\Shinji_kun\zguicfgw.dat
.

------- Sigcheck -------

2002-08-28 21:58  332928  244a2f9816bc9b593957281ef577d976C:\WINDOWS\$NtServicePackUninstall$\tcpip.sys
2004-08-03 23:14  359040  9f4b36614a0fc234525ba224957de55cC:\WINDOWS\ServicePackFiles\i386\TCPIP.SYS
2008-02-23 22:15  359040  fa0bc0391438567057b555899613564bC:\WINDOWS\system32\dllcache\TCPIP.SYS
2008-02-23 22:15  359040  fa0bc0391438567057b555899613564bC:\WINDOWS\system32\drivers\TCPIP.SYS
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3A278C73-F47A-4B76-8F56-B719D2EA538A}]
2008-05-20 12:07370176--a------C:\WINDOWS\system32\rqRHaYsq.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{663656DF-6BAE-460C-A612-8133DF519346}]
2008-05-20 01:0359392--a------C:\WINDOWS\system32\mlJDUnME.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VTTimer"="VTTimer.exe" [2004-09-01 17:28 53248 C:\WINDOWS\system32\VTTimer.exe]
"SoundMan"="SOUNDMAN.EXE" [2004-09-16 21:39 69632 C:\WINDOWS\SOUNDMAN.EXE]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-08-12 16:13 102400]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-08-12 16:12 684032]
"Emurayden PSX Emulator"="" []
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-08-15 16:21 949376]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 20:24 32768]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"BigDog305"="C:\WINDOWS\VM305_STI.exe" [ ]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2003-09-05 06:59 878080]
"74cca149"="C:\WINDOWS\system32\djgqnsvq.dll" [2008-05-20 12:07 117248]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:56 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{663656DF-6BAE-460C-A612-8133DF519346}"= C:\WINDOWS\system32\mlJDUnME.dll [2008-05-20 01:03 59392]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mlJDUnME]
mlJDUnME.dll 2008-05-20 01:03 59392 C:\WINDOWS\system32\mlJDUnME.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\uTorrent\\utorrent.exe"=
"C:\\sysreset\\mirc.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Documents and Settings\\Shinji_kun\\Desktop\\L2Walker\\Nueva carpeta\\l2asrv.exe"=
"C:\\Documents and Settings\\Shinji_kun\\Desktop\\L2Walker\\l2asrv.exe"=

R1 oreans32;oreans32;C:\WINDOWS\system32\drivers\oreans32.sys [2007-12-02 15:17]
R3 alcan5ln;SpeedTouch(tm) USB ADSL RFC1483 Networking Driver (NDIS);C:\WINDOWS\system32\DRIVERS\alcan5ln.sys [2003-09-05 06:58]
R3 TNET1130;TNET1130 WLAN Adapter;C:\WINDOWS\system32\DRIVERS\tnet1130.sys [2004-07-29 08:28]
S2 {09BB444F-B2E2-4009-BAF2-7B727681223E};BuddyVM;C:\Program Files\VMLaunch\BuddyVM.sys []
S3 ZSMC0305;VIMICRO USB PC Camera V;C:\WINDOWS\system32\Drivers\usbVM305.sys []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3d36f646-7c18-11dc-b01e-0060b3d251fc}]
\Shell\auto\command - E:\Knight.exe open
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Knight.exe open
\Shell\explore\command - E:\Knight.exe open
\Shell\find\command - E:\Knight.exe open
\Shell\install\command - E:\Knight.exe open
\Shell\open\command - E:\Knight.exe open

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{63ea66a8-bd1b-11dc-b0fa-000e50b58f6d}]
\Shell\Auto\command - E:\MSOCache\doWTP_RESTORE_0.exe -autorun
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL MSOCache\doWTP_RESTORE_0.exe -autorun

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{df601983-c138-11dc-b109-000e50b58f6d}]
\Shell\Auto\command - E:\MSOCache\doWTP_RESTORE_0.exe -autorun
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL MSOCache\doWTP_RESTORE_0.exe -autorun

.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-20 14:07:01
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\mlJDUnME.dll

PROCESS: C:\WINDOWS\explorer.exe
-> C:\WINDOWS\system32\djgqnsvq.dll
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\ESET\nod32krn.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\rundll32.exe
.
**************************************************************************
.
Completion time: 2008-05-20 14:13:10 - machine was rebooted
ComboFix-quarantined-files.txt  2008-05-20 18:13:01

Pre-Run: 1,764,380,672 bytes free
Post-Run: 1,842,085,888 bytes free

134



Title: Re: In Dire Need of Help!!
Post by Muadib on May 20th, 2008, 1:52pm
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:49:26, on 20-05-2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.emurayden.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {3A278C73-F47A-4B76-8F56-B719D2EA538A} - C:\WINDOWS\system32\rqRHaYsq.dll
O2 - BHO: (no name) - {663656DF-6BAE-460C-A612-8133DF519346} - C:\WINDOWS\system32\mlJDUnME.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [BigDog305] C:\WINDOWS\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305)
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [74cca149] rundll32.exe "C:\WINDOWS\system32\djgqnsvq.dll",b
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{8A8DD0DA-52B2-440C-AA24-AC493E49DDD5}: NameServer = 200.28.4.129 200.28.4.130
O20 - Winlogon Notify: mlJDUnME - C:\WINDOWS\SYSTEM32\mlJDUnME.dll
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset\nod32krn.exe
O23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS\SYSTEM32\slserv.exe

--
End of file - 4170 bytes

Title: Re: In Dire Need of Help!!
Post by siliconman01 on May 20th, 2008, 3:47pm
Maudib,

Even after running ComboFix, you have several infections remaining on your computer.  Please do the following:

1.  Remove all of Combofix.exe from your system

-  Delete file Combofix.exe

-  Delete the Combofix log file

-  Delete the Combofix Quarantine folder which is named C:\QooBox\

2.  Download/install the trial version of TrojanHunter.  The download link is at the top of the forum page.

-  Be sure to update the rulesets to the latest rulesets once the TH is installed.  The manual download link for updating the rulesets for the Trial Version of TH is at the link below:

http://www.misec.net/trojanhunter/updating/

-  Then reboot your computer into SAFE MODE

-  Run a FULL SCAN of your system with TrojanHunter.  Let it quarantine anything that it detects.

-  Once the scan/cleaning is completed by TrojanHunter, reboot back into Normal Mode.

-  Post the scan/cleaning log of TrojanHunter.  It is in C:\Program Files\TrojanHunter 5.0\Scan Reports

-  Post a new Hijackthis log.  

Title: Re: In Dire Need of Help!!
Post by Muadib on May 20th, 2008, 4:56pm
Ok, this are the results:

TrojanHunter Scan Report - Saved 2008-05-20 17:49

Found trojan file: C:\Documents and Settings\Shinji_kun\Desktop\Utilidades\l2\Auto_CP_Cliker_delay100_.exe (TrojanSpy.Agent.430)
Found trojan file: C:\is154453.exe (TrojanDownloader.Agent.2292)
Found adware file: C:\Program Files\Webteh\BSplayer\bplay.exe/Upx.waonvjcs (Adware.BSPlay.100)
Found adware file: C:\Program Files\Webteh\BSplayer\bsplay.exe/Upx.hygtncyh (Adware.BSPlay.100)
Found trojan file: C:\WINDOWS\system32\rqRHaYsq.dll (Generic.Vundo.B)
Quarantined file C:\is154453.exe
Unable to quarantine file C:\WINDOWS\system32\rqRHaYsq.dll: Scheduling file to be quarantined when computer is restarted

Title: Re: In Dire Need of Help!!
Post by Muadib on May 20th, 2008, 4:56pm
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [BigDog305] C:\WINDOWS\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305)
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [74cca149] rundll32.exe "C:\WINDOWS\system32\yyqiyiqa.dll",b
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 5.0\THGuard.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset\nod32krn.exe
O23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS\SYSTEM32\slserv.exe

--
End of file - 2911 bytes

Title: Re: In Dire Need of Help!!
Post by siliconman01 on May 20th, 2008, 11:31pm
Would you please do this:

1.  Run another HJT scan.

2.  When the scan is completed, place a checkmark in the box next to the following item.  BE SURE this is the only item checked.

O4 - HKLM\..\Run: [74cca149] rundll32.exe "C:\WINDOWS\system32\yyqiyiqa.dll",b

3.  Click on Fix Checked located at the lower left of the HJT window.  Confirm that you want HJT to fix this item and let it fix it.

4.  Close your HJT window.

5.  Immediately reboot your computer.

6.  When the computer is rebooted, run another HJT scan and post the log back here.

Title: Re: In Dire Need of Help!!
Post by Muadib on May 21st, 2008, 12:29pm
ok, this is the hijack post:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:27:46, on 21-05-2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\TrojanHunter 5.0\THGuard.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.emurayden.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [BigDog305] C:\WINDOWS\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305)
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 5.0\THGuard.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{8A8DD0DA-52B2-440C-AA24-AC493E49DDD5}: NameServer = 200.28.4.129 200.28.4.130
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset\nod32krn.exe
O23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS\SYSTEM32\slserv.exe

--
End of file - 3642 bytes

Title: Re: In Dire Need of Help!!
Post by siliconman01 on May 21st, 2008, 12:41pm
Okay, the HJT is showing clean.  However I recommend that you do a remote scan with Kaspersky via the link below.

http://www.kaspersky.com/virusscanner

-  Use Internet Explorer to access the Kaspersky site.  It needs to download/install an ActiveX component to perform the scan.  Please let it do so.

-  Before starting the remote scan, temporarily disable your normal antivirus software.

-  Close down as many other programs as you can (the ones with icons next to the clock in your task bar).  DO NOT disable your software firewall.

-  Be sure to run a full scan (all disks) of your system with the Kaspersky remote scanner.

-  Kaspersky will not quarantine any malicious items it finds; however, it will tell us if any infections exist.

-  Post the Kaspersky remote scan log back here for review.


Title: Re: In Dire Need of Help!!
Post by Muadib on May 22nd, 2008, 9:05am
I downloaded kaspersky 7.0 trial to do the scan. I don't know how to do a log in this antivirus, but this is the picture of the scan result.

http://alumnos.elo.utfsm.cl/~ecaceres/antivirus.bm

Title: Re: In Dire Need of Help!!
Post by siliconman01 on May 22nd, 2008, 4:36pm
Okay, Kaspersky did quarantine some malicious items.

As long as you did a complete scan of your system with Kaspersky and based on your last posted HJT log, I feel that you are now clean.  Would you please post one more HJT scan log.

Is your system running okay?  


Title: Re: In Dire Need of Help!!
Post by Muadib on May 23rd, 2008, 9:42am
this is the HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:37:46, on 23-05-2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.emurayden.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [BigDog305] C:\WINDOWS\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305)
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKLM\..\Run: [BM77ff92d5] Rundll32.exe "C:\WINDOWS\system32\dgqycqdk.dll",s
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{8A8DD0DA-52B2-440C-AA24-AC493E49DDD5}: NameServer = 200.28.4.129 200.28.4.130
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
O23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS\SYSTEM32\slserv.exe

--
End of file - 3899 bytes

Title: Re: In Dire Need of Help!!
Post by Muadib on May 23rd, 2008, 9:45am
and this is the last test i did with kaspersky
http://alumnos.elo.utfsm.cl/~ecaceres/antivirus2.bm

until yesterday the notebook it was a little slow and some pages didn't work (like google or gmail), but after i deleted the las 2 file in the kaspersky report i can navegate normaly.

PD: I just opened a page with IE to test, and the problem with the pages come back T.T

Title: Re: In Dire Need of Help!!
Post by siliconman01 on May 23rd, 2008, 1:11pm
Okay, your HJT shows something malicious.  


Quote:
O4 - HKLM\..\Run: [BM77ff92d5] Rundll32.exe "C:\WINDOWS\system32\dgqycqdk.dll",s


It looks and sounds like Kaspersky has identified and removed other infections and your system is back to running normal.  

Is the HJT scan log that you posted from a HJT scan run before or after your last scan with Kaspersky?


Quote:
I just opened a page with IE to test, and the problem with the pages come back T.T


I'm not quite sure what you mean by "problem with pages come back T.T"  

Title: Re: In Dire Need of Help!!
Post by Muadib on May 23rd, 2008, 1:55pm
the HTJ is after the scan with kaspersky. The problem that I have with some page like google, gmail, hotmail, some forums and blogs just don't open.

Title: Re: In Dire Need of Help!!
Post by siliconman01 on May 24th, 2008, 2:37am

Quote:
The problem that I have with some page like google, gmail, hotmail, some forums and blogs just don't open.


Hmmm...okay, let's look deeper.  Please do this:

1.  Install/run freebie program CCleaner to clean up all your temp and junk files.  The link below is for CCleaner.

http://www.ccleaner.com

-  This is a good program to keep on your system and to run routinely to clear off unneeded temp and junk files.  

-  DO NOT run the Registry cleaning component of CCleaner unless you are comfortable with registry cleaners.  

2.  Check your HOSTS file for contamination.  This is to make sure that your IE is not being redirected to malicious sites.

-  Open Windows Explorer and navigate to the following folder:
C:\Windows\System32\drivers\etc

-  Open the etc folder

-  Locate the file named HOSTS  (with no extension)

-  Right click on HOSTS and open it with NotePad

-  The very first operational entry must be  
127.0.0.1      localhost
(Note: Entries starting with # are a comment line and are okay)
-  If the first operational entry is not  127.0.0.1      localhost , insert 127.0.0.1      localhost as the first operational entry.

-  If there are more entries in the HOSTS file, they MUST each start with 127.0.0.1 .  Delete any entries that do not start with 127.0.0.1

-  Save the changed HOSTS file, exit NotePad and Windows Explorer.

See example below:


Quote:
127.0.0.1  localhost
127.0.0.1  ad.a8.net
127.0.0.1  asy.a8ww.net
127.0.0.1  www.aaa-livedoor.net #[Trojan-PSW.Win32.Maran.ei]
127.0.0.1  www.abx4.com #[Adware.ABXToolbar]
127.0.0.1  acezip.net #[SiteAdvisor.acezip.net]
127.0.0.1  www.acezip.net #[Win32/Adware.180Solutions]
127.0.0.1  phpadsnew.abac.com
127.0.0.1  a.abnad.net
127.0.0.1  b.abnad.net
127.0.0.1  c.abnad.net #[eTrust.Tracking.Cookie]
127.0.0.1  d.abnad.net
127.0.0.1  e.abnad.net
127.0.0.1  t.abnad.net


3.  Download/Install the Free version of SuperAntiSpyware from the link below:

http://www.superantispyware.com

-  Be sure to download the very latest rules/definitions for SuperAntiSpyware when it asks during the installation.

-  Then reboot your computer into SAFE MODE.

-  Run a COMPLETE SCAN of your system with SuperAntiSpyware.  Let it quarantine what it finds.

-  Reboot back into Normal Mode.

Note:  The free version of SAS is a good program to keep on your system and to routinely scan with.  For the free version, you need to manually update the definitions.  The download link for this is:

http://www.superantispyware.com/definitions.html

4.  Run another Kaspersky Full Scan of your system.

-  Be sure to update the detection rules to the very latest before doing the scan.  

-  Let it quarantine what it finds.

-  If any files are quarantined by Kaspersky, reboot after the quarantining is completed.

5.  Run another HJT scan.

-  After the scan is completed, place a check mark in the box next to the following item.

O4 - HKLM\..\Run: [BM77ff92d5] Rundll32.exe "C:\WINDOWS\system32\dgqycqdk.dll",s

-  Click on Fix Checked on the lower left of the HJT window.  Confirm that you want it fixed and let HJT fix it.

-  Close HJT and immediately reboot.

6.  Please Post a new HJT log, the scan log of SuperAntiSpyware, and the Kaspersky results.  Also tell me if your HOSTS file was contaminated.

Does IE open the various sites now?


Have you considered upgrading to Service Pack 3 of XP and to Internet Explorer 7 ?




Title: Re: In Dire Need of Help!!
Post by siliconman01 on May 28th, 2008, 2:38am
This thread is now locked.  Please start a new thread if assistance is needed.