Infected with trojans and worm, vundo for sure [RESOLVED]

Welcome Guest ( Log In | Register )

Discover the best free computer help!
Learn more about Geeks to Go by taking the tour. Spyware, virus, trojan, fake security or privacy alerts? Read the malware cleaning guide.

> Geeks to Go! » Security » Malware Removal - HijackThis� Logs Go Here

Infected with trojans and worm, vundo for sure [RESOLVED]

Options

greyknight17 View Member Profile	May 20 2008, 08:17 PM Post #2
Malware Expert Posts: 15,719 From: New York OS: Windows 98, XP, Vista, Mac OS X	Welcome to GTG. Please do not create duplicate topics for the same issue. Your other topic is now closed. 1. Download combofix at http://www.techsupportforum.com/sectools/sUBs/ComboFix.exe or http://download.bleepingcomputer.com/sUBs/ComboFix.exe Save it to your Desktop before you run it. 2. Double-click combofix.exe & follow the prompts. 3. When finished, it will produce a log for you. Post that log in your next reply. Note: Do not click on combofix's window while it's running. That may cause it to stall.

my_computer_is_s... my_computer_is_screwed View Member Profile	May 21 2008, 12:38 AM Post #3
New Member Posts: 8 OS: XP	ComboFix 08-05-20.4 - libc1 2008-05-21 0:49:50.1 - NTFSx86 Running from: C:\Documents and Settings\libc1\Desktop\ComboFix.exe * Created a new restore point WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Temp\1cb C:\Temp\1cb\syscheck.log C:\temp\tn3 C:\WINDOWS\cookies.ini C:\WINDOWS\Fonts\' C:\WINDOWS\system32\CfggNXyb.ini C:\WINDOWS\system32\CfggNXyb.ini2 C:\WINDOWS\system32\Desktop_.ini C:\WINDOWS\system32\drivers\npf.sys C:\WINDOWS\system32\mcrh.tmp C:\WINDOWS\system32\MSINET.oca C:\WINDOWS\system32\packet.dll C:\WINDOWS\system32\pthreadVC.dll C:\WINDOWS\system32\uubnully.ini C:\WINDOWS\system32\WanPacket.dll C:\WINDOWS\system32\wpcap.dll . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_NPF ((((((((((((((((((((((((( Files Created from 2008-04-21 to 2008-05-21 ))))))))))))))))))))))))))))))) . 2008-05-19 22:32 . 2008-05-19 22:32 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab 2008-05-19 22:32 . 2008-05-19 22:32 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab 2008-05-19 21:28 . 2008-05-19 21:29 <DIR> d-------- C:\Program Files\Panda Security 2008-05-19 17:58 . 2008-05-19 17:58 <DIR> d-------- C:\Documents and Settings\libc1\Application Data\Malwarebytes 2008-05-19 17:57 . 2008-05-19 19:01 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-05-19 17:57 . 2008-05-19 17:57 <DIR> d-------- C:\Program Files\Common Files\Download Manager 2008-05-19 17:57 . 2008-05-19 17:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-05-19 17:57 . 2008-05-05 20:46 27,048 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys 2008-05-19 17:57 . 2008-05-05 20:46 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-05-19 14:26 . 2008-05-19 14:26 <DIR> d-------- C:\Deckard 2008-05-19 06:41 . 2008-05-19 06:41 <DIR> d-------- C:\Documents and Settings\libc1\DoctorWeb 2008-05-19 06:39 . 2008-05-19 06:39 <DIR> d-------- C:\Program Files\Trend Micro 2008-05-19 06:26 . 2008-03-06 21:32 23,904 --a------ C:\WINDOWS\system32\drivers\COH_Mon.sys 2008-05-19 06:26 . 2008-03-06 21:32 10,537 --a------ C:\WINDOWS\system32\drivers\COH_Mon.cat 2008-05-19 06:26 . 2008-03-06 21:32 706 --a------ C:\WINDOWS\system32\drivers\COH_Mon.inf 2008-05-19 06:12 . 2008-05-19 06:12 <DIR> d-------- C:\Documents and Settings\libc1\Application Data\Symantec 2008-05-19 02:43 . 2007-03-21 20:39 1,060,864 --a------ C:\WINDOWS\system32\MFC71.DL1 2008-05-19 02:16 . 2008-05-19 10:03 <DIR> d-------- C:\Program Files\Norton 360 2008-05-19 02:15 . 2008-05-19 02:40 123,952 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS 2008-05-19 02:15 . 2008-05-19 02:40 60,800 --a------ C:\WINDOWS\system32\S32EVNT1.DLL 2008-05-19 02:15 . 2008-05-19 02:40 10,740 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.CAT 2008-05-19 02:15 . 2008-05-19 02:40 805 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.INF 2008-05-19 02:13 . 2008-05-19 02:40 <DIR> d-------- C:\Program Files\Symantec 2008-05-19 02:13 . 2008-05-20 12:56 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared 2008-05-19 02:13 . 2008-05-20 12:48 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Symantec 2008-05-18 21:21 . 2008-05-18 21:21 <DIR> d--h----- C:\WINDOWS\system32\GroupPolicy 2008-05-18 20:18 . 2008-05-18 20:18 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com 2008-05-18 20:17 . 2008-05-18 20:17 <DIR> d-------- C:\Program Files\SUPERAntiSpyware 2008-05-18 20:17 . 2008-05-18 20:17 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-05-18 20:17 . 2008-05-18 20:17 <DIR> d-------- C:\Documents and Settings\libc1\Application Data\SUPERAntiSpyware.com 2008-05-18 19:47 . 2008-05-18 22:34 <DIR> d-------- C:\Program Files\Windows Live Safety Center 2008-05-18 18:56 . 2008-05-18 18:56 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\TEMP 2008-05-18 18:55 . 2008-05-18 18:59 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-05-18 18:31 . 2008-05-18 18:31 147,456 --a------ C:\WINDOWS\system32\vbzip10.dll 2008-05-18 18:30 . 2008-05-18 18:30 <DIR> d-------- C:\WINDOWS\Sun 2008-05-18 18:28 . 2008-05-18 20:33 <DIR> d--hs---- C:\WINDOWS\QUhT 2008-05-18 18:27 . 2008-05-19 19:01 <DIR> d-------- C:\WINDOWS\system32\polX 2008-05-18 18:27 . 2008-05-19 07:54 <DIR> d-------- C:\WINDOWS\system32\logXv18 2008-05-18 18:27 . 2008-05-18 20:31 <DIR> d-------- C:\WINDOWS\system32\GUI2 2008-05-18 18:27 . 2008-05-18 20:31 <DIR> d-------- C:\WINDOWS\system32\binR 2008-05-18 18:27 . 2008-05-18 20:31 <DIR> d-------- C:\WINDOWS\system32\3036a 2008-05-18 18:27 . 2008-05-18 18:27 <DIR> d-------- C:\TEMP\dmpxp32 2008-05-18 18:25 . 2008-05-18 20:33 <DIR> d-------- C:\Program Files\SurfingProgram 2008-05-18 18:21 . 2008-05-18 19:09 <DIR> d-------- C:\Documents and Settings\libc1\Application Data\LimeWire 2008-05-18 18:15 . 2008-05-18 18:34 <DIR> d-------- C:\Program Files\LimeWire 2008-05-10 08:28 . 2008-05-19 06:03 664 --a------ C:\WINDOWS\system32\d3d9caps.dat 2008-05-09 13:36 . 2008-05-19 21:28 2,550 --a------ C:\WINDOWS\mozver.dat 2008-05-01 08:38 . 2008-05-01 08:38 934 --a------ C:\Amazon Unbox.lnk 2008-05-01 08:36 . 2008-05-01 08:36 <DIR> d-------- C:\Program Files\Amazon 2008-05-01 08:36 . 2008-05-01 08:36 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Amazon 2008-05-01 08:30 . 2008-05-01 08:30 <DIR> d-------- C:\WINDOWS\Downloaded Installations 2008-04-28 10:47 . 2008-05-18 00:58 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-04-28 10:47 . 2008-04-28 10:47 1,409 --a------ C:\WINDOWS\QTFont.for . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-05-01 13:37 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-04-25 20:33 --------- d-----w C:\Documents and Settings\libc1\Application Data\U3 2008-04-09 19:54 --------- d--h--w C:\Program Files\Zenographics 2008-04-09 19:54 --------- d-----w C:\Program Files\Hewlett-Packard 2008-04-05 01:51 --------- d-----w C:\Program Files\Real 2008-04-05 01:51 --------- d-----w C:\Program Files\Common Files\xing shared 2008-04-05 01:51 --------- d-----w C:\Program Files\Common Files\Real 2008-04-04 13:24 --------- d-----w C:\Program Files\HP 2008-04-04 13:16 --------- d-----w C:\Program Files\Common Files\SWF Studio 2008-04-01 01:45 --------- d-----w C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-02-28 07:00 15360] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 11:24 1694208] "SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-02-29 16:03 1481968] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SkyTel"="SkyTel.EXE" [2006-07-19 09:42 2879488 C:\WINDOWS\SkyTel.exe] "AzMixerSel"="C:\Program Files\Realtek\InstallShield\AzMixerSel.exe" [2005-12-21 15:02 53248] "igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2006-06-13 09:57 94208] "igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2006-06-13 09:57 77824] "igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2006-06-13 09:57 118784] "RTHDCPL"="RTHDCPL.EXE" [2006-03-14 17:01 16010752 C:\WINDOWS\RTHDCPL.exe] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-04-29 06:13 766041] "AGRSMMSG"="AGRSMMSG.exe" [2006-03-16 17:24 88204 C:\WINDOWS\AGRSMMSG.exe] "INPROCOMMWireless"="C:\Program Files\Atheros\Wireless\Utility\WlanUtil.exe" [ ] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11 49152] "hpbdfawep"="C:\Program Files\HP\Dfawep\bin\hpbdfawep.exe" [2007-12-23 21:47 618496] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-04-04 20:51 185896] "dbar_starter"="C:\Documents and Settings\libc1\Application Data\Deskbar_{380C73FA-F65D-49d1-95D5-C938579255FE}\starter.exe" [ ] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-07-17 20:54 116072] "Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 17:38 583048] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Acer Empowering Technology.lnk - C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe [2007-10-20 20:17:26 45056] Amazon Unbox.lnk - C:\Program Files\Amazon\Amazon Unbox Video\ADVWindowsClientSystemTray.exe [2007-07-11 17:25:20 97320] HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 05:21:22 288472] HP Photosmart Premier Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2006-02-10 08:56:20 73728] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableCAD"= 1 (0x1) [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 12:55 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 12:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 "FirewallOverride"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"= "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"= "C:\\Program Files\\LimeWire\\LimeWire.exe"= R2 EpmPsd;Acer EPM Power Scheme Driver;C:\WINDOWS\system32\drivers\epm-psd.sys [2005-04-22 16:57] R2 EpmShd;Acer EPM System Hardware Driver;C:\WINDOWS\system32\drivers\epm-shd.sys [2005-04-22 16:57] S1 nikedrvv;nikedrvv;C:\WINDOWS\system32\drivers\nikedrvv.sys [] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bb53831a-066e-11dd-a6a6-00197e72468e}] \Shell\AutoRun\command - D:\LaunchU3.exe -a Newly Created Service - COMHOST . ************************************************************************ catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-21 01:01:16 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ********************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\Amazon\Amazon Unbox Video\ADVWindowsClientService.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\HPZipm12.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\system32\wdfmgr.exe C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe C:\WINDOWS\system32\HPZinw12.exe . ************************************************************************ . Completion time: 2008-05-21 1:04:28 - machine was rebooted ComboFix-quarantined-files.txt 2008-05-21 06:04:23 Pre-Run: 50,490,429,440 bytes free Post-Run: 53,616,091,136 bytes free 201 --- E O F --- 2008-05-18 13:49:37

greyknight17 View Member Profile	May 21 2008, 06:58 PM Post #4
Malware Expert Posts: 15,719 From: New York OS: Windows 98, XP, Vista, Mac OS X	I don't recommend using file sharing programs like Limewire as they can help contribute to malware infections. Uninstall Deskbar and SurfingProgram via the Add/Remove Programs panel if found. Open up your Notepad editor (Start->Run, type in notepad and click OK). Copy the text from the quotebox below into Notepad: QUOTE Driver:: nikedrvv Folder:: C:\WINDOWS\QUhT C:\WINDOWS\system32\polX C:\WINDOWS\system32\logXv18 C:\WINDOWS\system32\GUI2 C:\WINDOWS\system32\binR C:\WINDOWS\system32\3036a C:\TEMP\dmpxp32 C:\Program Files\SurfingProgram C:\Documents and Settings\libc1\Application Data\Deskbar_{380C73FA-F65D-49d1-95D5-C938579255FE}\ Registry:: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "dbar_starter"=- Save this as CFScript.txt in the same location as the ComboFix.exe tool. Drag the CFScript.txt into ComboFix.exe Follow the prompts. When finished, it shall produce a log for you. Post that log in your next reply. Note: Do not click on combofix's window while it's running. That may cause it to stall.

my_computer_is_s... my_computer_is_screwed View Member Profile	May 22 2008, 09:24 AM Post #5
New Member Posts: 8 OS: XP	I removed surfing program, could not find deskbar. Thank you so much for helping me. You don't know how much I appreciate your knowledge. Here is my log: ComboFix 08-05-20.4 - libc1 2008-05-22 9:57:53.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.369 [GMT -5:00] Running from: C:\Documents and Settings\libc1\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\libc1\Desktop\CFScript.txt * Created a new restore point WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\TEMP\dmpxp32 C:\TEMP\dmpxp32\sakldsr.log C:\WINDOWS\QUhT C:\WINDOWS\system32\3036a C:\WINDOWS\system32\binR C:\WINDOWS\system32\GUI2 C:\WINDOWS\system32\logXv18 C:\WINDOWS\system32\polX . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_NIKEDRVV -------\Service_nikedrvv ((((((((((((((((((((((((( Files Created from 2008-04-22 to 2008-05-22 ))))))))))))))))))))))))))))))) . 2008-05-19 22:32 . 2008-05-19 22:32 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab 2008-05-19 22:32 . 2008-05-19 22:32 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab 2008-05-19 21:28 . 2008-05-19 21:29 <DIR> d-------- C:\Program Files\Panda Security 2008-05-19 17:58 . 2008-05-19 17:58 <DIR> d-------- C:\Documents and Settings\libc1\Application Data\Malwarebytes 2008-05-19 17:57 . 2008-05-19 19:01 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-05-19 17:57 . 2008-05-19 17:57 <DIR> d-------- C:\Program Files\Common Files\Download Manager 2008-05-19 17:57 . 2008-05-19 17:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-05-19 17:57 . 2008-05-05 20:46 27,048 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys 2008-05-19 17:57 . 2008-05-05 20:46 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-05-19 14:26 . 2008-05-19 14:26 <DIR> d-------- C:\Deckard 2008-05-19 06:41 . 2008-05-19 06:41 <DIR> d-------- C:\Documents and Settings\libc1\DoctorWeb 2008-05-19 06:39 . 2008-05-19 06:39 <DIR> d-------- C:\Program Files\Trend Micro 2008-05-19 06:26 . 2008-03-06 21:32 23,904 --a------ C:\WINDOWS\system32\drivers\COH_Mon.sys 2008-05-19 06:26 . 2008-03-06 21:32 10,537 --a------ C:\WINDOWS\system32\drivers\COH_Mon.cat 2008-05-19 06:26 . 2008-03-06 21:32 706 --a------ C:\WINDOWS\system32\drivers\COH_Mon.inf 2008-05-19 06:12 . 2008-05-19 06:12 <DIR> d-------- C:\Documents and Settings\libc1\Application Data\Symantec 2008-05-19 02:43 . 2007-03-21 20:39 1,060,864 --a------ C:\WINDOWS\system32\MFC71.DL1 2008-05-19 02:16 . 2008-05-19 10:03 <DIR> d-------- C:\Program Files\Norton 360 2008-05-19 02:15 . 2008-05-19 02:40 123,952 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS 2008-05-19 02:15 . 2008-05-19 02:40 60,800 --a------ C:\WINDOWS\system32\S32EVNT1.DLL 2008-05-19 02:15 . 2008-05-19 02:40 10,740 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.CAT 2008-05-19 02:15 . 2008-05-19 02:40 805 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.INF 2008-05-19 02:13 . 2008-05-19 02:40 <DIR> d-------- C:\Program Files\Symantec 2008-05-19 02:13 . 2008-05-22 10:04 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared 2008-05-19 02:13 . 2008-05-21 07:36 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Symantec 2008-05-18 21:21 . 2008-05-18 21:21 <DIR> d--h----- C:\WINDOWS\system32\GroupPolicy 2008-05-18 20:18 . 2008-05-18 20:18 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com 2008-05-18 20:17 . 2008-05-18 20:17 <DIR> d-------- C:\Program Files\SUPERAntiSpyware 2008-05-18 20:17 . 2008-05-18 20:17 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-05-18 20:17 . 2008-05-18 20:17 <DIR> d-------- C:\Documents and Settings\libc1\Application Data\SUPERAntiSpyware.com 2008-05-18 19:47 . 2008-05-18 22:34 <DIR> d-------- C:\Program Files\Windows Live Safety Center 2008-05-18 18:56 . 2008-05-18 18:56 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\TEMP 2008-05-18 18:55 . 2008-05-18 18:59 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-05-18 18:31 . 2008-05-18 18:31 147,456 --a------ C:\WINDOWS\system32\vbzip10.dll 2008-05-18 18:30 . 2008-05-18 18:30 <DIR> d-------- C:\WINDOWS\Sun 2008-05-18 18:21 . 2008-05-18 19:09 <DIR> d-------- C:\Documents and Settings\libc1\Application Data\LimeWire 2008-05-18 18:15 . 2008-05-18 18:34 <DIR> d-------- C:\Program Files\LimeWire 2008-05-10 08:28 . 2008-05-19 06:03 664 --a------ C:\WINDOWS\system32\d3d9caps.dat 2008-05-09 13:36 . 2008-05-19 21:28 2,550 --a------ C:\WINDOWS\mozver.dat 2008-05-01 08:38 . 2008-05-01 08:38 934 --a------ C:\Amazon Unbox.lnk 2008-05-01 08:36 . 2008-05-01 08:36 <DIR> d-------- C:\Program Files\Amazon 2008-05-01 08:36 . 2008-05-01 08:36 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Amazon 2008-05-01 08:30 . 2008-05-01 08:30 <DIR> d-------- C:\WINDOWS\Downloaded Installations 2008-04-28 10:47 . 2008-05-18 00:58 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-04-28 10:47 . 2008-04-28 10:47 1,409 --a------ C:\WINDOWS\QTFont.for . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-05-01 13:37 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-04-25 20:33 --------- d-----w C:\Documents and Settings\libc1\Application Data\U3 2008-04-09 19:54 --------- d--h--w C:\Program Files\Zenographics 2008-04-09 19:54 --------- d-----w C:\Program Files\Hewlett-Packard 2008-04-05 01:51 --------- d-----w C:\Program Files\Real 2008-04-05 01:51 --------- d-----w C:\Program Files\Common Files\xing shared 2008-04-05 01:51 --------- d-----w C:\Program Files\Common Files\Real 2008-04-04 13:24 --------- d-----w C:\Program Files\HP 2008-04-04 13:16 --------- d-----w C:\Program Files\Common Files\SWF Studio 2008-04-01 01:45 --------- d-----w C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage . ((((((((((((((((((((((((((((( snapshot@2008-05-21_ 1.04.09.14 ))))))))))))))))))))))))))))))))))))))))) . - 2008-05-21 05:55:50 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2008-05-22 15:01:41 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2008-05-22 15:02:20 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_618.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-02-28 07:00 15360] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 11:24 1694208] "SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-02-29 16:03 1481968] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SkyTel"="SkyTel.EXE" [2006-07-19 09:42 2879488 C:\WINDOWS\SkyTel.exe] "AzMixerSel"="C:\Program Files\Realtek\InstallShield\AzMixerSel.exe" [2005-12-21 15:02 53248] "igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2006-06-13 09:57 94208] "igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2006-06-13 09:57 77824] "igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2006-06-13 09:57 118784] "RTHDCPL"="RTHDCPL.EXE" [2006-03-14 17:01 16010752 C:\WINDOWS\RTHDCPL.exe] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-04-29 06:13 766041] "AGRSMMSG"="AGRSMMSG.exe" [2006-03-16 17:24 88204 C:\WINDOWS\AGRSMMSG.exe] "INPROCOMMWireless"="C:\Program Files\Atheros\Wireless\Utility\WlanUtil.exe" [ ] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11 49152] "hpbdfawep"="C:\Program Files\HP\Dfawep\bin\hpbdfawep.exe" [2007-12-23 21:47 618496] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-04-04 20:51 185896] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-07-17 20:54 116072] "Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 17:38 583048] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Acer Empowering Technology.lnk - C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe [2007-10-20 20:17:26 45056] Amazon Unbox.lnk - C:\Program Files\Amazon\Amazon Unbox Video\ADVWindowsClientSystemTray.exe [2007-07-11 17:25:20 97320] HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 05:21:22 288472] HP Photosmart Premier Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2006-02-10 08:56:20 73728] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableCAD"= 1 (0x1) [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 12:55 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 12:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 "FirewallOverride"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"= "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"= "C:\\Program Files\\LimeWire\\LimeWire.exe"= R2 EpmPsd;Acer EPM Power Scheme Driver;C:\WINDOWS\system32\drivers\epm-psd.sys [2005-04-22 16:57] R2 EpmShd;Acer EPM System Hardware Driver;C:\WINDOWS\system32\drivers\epm-shd.sys [2005-04-22 16:57] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bb53831a-066e-11dd-a6a6-00197e72468e}] \Shell\AutoRun\command - D:\LaunchU3.exe -a Newly Created Service - COMHOST . ************************************************************************ catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-22 10:03:44 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ********************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\Amazon\Amazon Unbox Video\ADVWindowsClientService.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\system32\wdfmgr.exe C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe C:\WINDOWS\system32\HPZinw12.exe . ************************************************************************ . Completion time: 2008-05-22 10:07:11 - machine was rebooted ComboFix-quarantined-files.txt 2008-05-22 15:07:07 ComboFix2.txt 2008-05-21 06:04:29 Pre-Run: 53,612,666,880 bytes free Post-Run: 53,601,226,752 bytes free 192 --- E O F --- 2008-05-18 13:49:37

greyknight17 View Member Profile	May 23 2008, 05:23 PM Post #6
Malware Expert Posts: 15,719 From: New York OS: Windows 98, XP, Vista, Mac OS X	No problem. Glad to help out Good job. Your log is clean. To help prevent future spyware infections, read the Anti-Spyware Tutorial and use the tools provided. Are there any problems now? If none, go to Start->Run, copy/paste in combofix /u and hit OK to remove it. You should be set to go.

my_computer_is_s... my_computer_is_screwed View Member Profile	May 23 2008, 08:54 PM Post #7
New Member Posts: 8 OS: XP	Everything seems to be fine. Thank you so much! I don't quite understand what you mean by "go to Start->Run, copy/paste in combofix /u and hit OK to remove it"

greyknight17

May 24 2008, 06:40 PM

Post