Please Help! Pop Ups Galore! - HiJack Log [Closed]

Need a geek? Geeks to Go offers free, quality tech support -- in terms anyone can understand. Volunteers are waiting to help, friendly, technology experts who have knowledge to share, and enjoy helping others. Feel free to browse the site as a guest. However, you must log in to reply to existing topics, or to start a new topic. Other benefits of joining include richer forum features, and removal of all advertising. Learn more in our Welcome Guide Infected? Malware and Spyware Cleaning Guide. What are you waiting for? Click here to join for free today!

> Geeks to Go! » Security » Virus, Spyware and Trojan Removal

Please Help! Pop Ups Galore! - HiJack Log [Closed], Please Help! Pop Ups Galore! - HiJack Log

Options

davidmizzle View Member Profile	Jan 14 2009, 01:36 AM Post #1
Member Posts: 10 OS: XP	THANKS IN ADVANCE FOR YOUR HELP! Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:34:18 PM, on 1/13/2009 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe C:\WINDOWS\System32\WLTRYSVC.EXE C:\WINDOWS\System32\bcmwltry.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\WLTRAY.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\PROGRA~1\SYMANT~1\VPTray.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe C:\WINDOWS\system32\igfxsrvc.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Symantec AntiVirus\vpc32.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless O4 - HKLM\..\Run: [a02177fb] rundll32.exe "C:\WINDOWS\system32\jybjtofi.dll",b O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O20 - AppInit_DLLs: kyvzby.dll O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe O23 - Service: Intel® PROSet/Wireless SSO Service (WLANKEEPER) - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE -- End of file - 5493 bytes

fenzodahl512 View Member Profile	Jan 14 2009, 01:52 AM Post #2
Trusted Helper Posts: 9,212 OS: Windows XP	Hello, my name is fenzodahl512 and welcome to Geekstogo.. Please do the following.... Please download Malwarebytes' Anti-Malware from HERE or HERE Note: If you already have Malwarebytes' Anti-Malware, just run and update it.. Then do a "Perform Full Scan" Double Click mbam-setup.exe to install the application. Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish. If an update is found, it will download and install the latest version. Once the program has loaded, select "Perform Full Scan", then click Scan. The scan may take some time to finish,so please be patient. When the scan is complete, click OK, then Show Results to view the results. Make sure that everything is checked, and click Remove Selected. When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note) The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM. Copy&Paste the entire report in your next reply. Extra Note: If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately. *NEXT* Please download RSIT by random/random and save it to your Desktop. Double click on RSIT.exe to run RSIT Before you click "Continue", make sure you change the List files/folders created or modified in the last 3 months Click Continue at the disclaimer screen. Once it has finished, two logs will open. Please post the contents of both log.txt and info.txt in your next reply. *NEXT* Please download GMER and unzip it to your Desktop. Open the program and click on the Rootkit tab. Make sure all the boxes on the right of the screen are checked, EXCEPT for �Show All�. Click on Scan. When the scan has run click Copy and paste the results into a Notepad >> save it and attach in this thread. Post me these logs in your next reply.. Post each log in separate post.. 1. Malwarebytes' 2. RSIT log.txt 3. RSIT info.txt 4. Attach GMER result..

davidmizzle View Member Profile	Jan 18 2009, 02:35 AM Post #3
Member Posts: 10 OS: XP	Thanks for help fenzodahl512! Attached is the following requested information: 1. Malwarebytes' Malwarebytes' Anti-Malware 1.33 Database version: 1663 Windows 5.1.2600 Service Pack 2 1/17/2009 11:57:46 PM mbam-log-2009-01-17 (23-57-46).txt Scan type: Full Scan (C:\\|) Objects scanned: 79705 Time elapsed: 56 minute(s), 24 second(s) Memory Processes Infected: 0 Memory Modules Infected: 4 Registry Keys Infected: 14 Registry Values Infected: 1 Registry Data Items Infected: 2 Folders Infected: 0 Files Infected: 40 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: C:\WINDOWS\system32\ioontuls.dll (Trojan.Vundo.H) -> Delete on reboot. C:\WINDOWS\system32\mlJAropP.dll (Trojan.Vundo.H) -> Delete on reboot. C:\WINDOWS\system32\incchmfg.dll (Trojan.Vundo) -> Delete on reboot. C:\WINDOWS\system32\lqyvhd.dll (Trojan.Vundo) -> Delete on reboot. Registry Keys Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4cea3bcf-6f1b-4e1a-954e-42c1f427eec9} (Trojan.Vundo.H) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{4cea3bcf-6f1b-4e1a-954e-42c1f427eec9} (Trojan.Vundo.H) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6c15fc65-bd46-4167-af32-1618c4806f25} (Trojan.Vundo.H) -> Delete on reboot. HKEY_CLASSES_ROOT\CLSID\{6c15fc65-bd46-4167-af32-1618c4806f25} (Trojan.Vundo.H) -> Delete on reboot. HKEY_CLASSES_ROOT\CLSID\{bfe102a3-f503-4e90-a25a-3ed61e95c151} (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{bfe102a3-f503-4e90-a25a-3ed61e95c151} (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\xpreapp (Malware.Trace) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\instkey (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a02177fb (Trojan.Vundo.H) -> Quarantined and deleted successfully. Registry Data Items Infected: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\mljaropp -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\mljaropp -> Delete on reboot. Folders Infected: (No malicious items detected) Files Infected: C:\WINDOWS\system32\lqyvhd.dll (Trojan.Vundo.H) -> Delete on reboot. C:\WINDOWS\system32\mlJAropP.dll (Trojan.Vundo.H) -> Delete on reboot. C:\WINDOWS\system32\PporAJlm.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\PporAJlm.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\ghhtonpp.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\ppnothhg.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\ioontuls.dll (Trojan.Vundo.H) -> Delete on reboot. C:\WINDOWS\system32\slutnooi.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\jobuwufo.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\ofuwuboj.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\posidiha.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\ahidisop.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\vspimnik.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\kinmipsv.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\incchmfg.dll (Trojan.Vundo) -> Delete on reboot. C:\Documents and Settings\Abigail Rivamonte\Local Settings\Temp\prun.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Documents and Settings\Abigail Rivamonte\Local Settings\Temp\naxwoermcs.tmp (Rogue.Installer) -> Quarantined and deleted successfully. C:\Documents and Settings\Abigail Rivamonte\Local Settings\Temp\winvsnet.tmp (Rogue.Installer) -> Quarantined and deleted successfully. C:\Documents and Settings\Abigail Rivamonte\Local Settings\Temp\wxaornescm.tmp (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Documents and Settings\Abigail Rivamonte\Local Settings\Temporary Internet Files\Content.IE5\81KI5AKL\upd105320[1] (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\Documents and Settings\Abigail Rivamonte\Local Settings\Temporary Internet Files\Content.IE5\81KI5AKL\VirusRemover2008_Setup_Free_en[1].exe (Rogue.Installer) -> Quarantined and deleted successfully. C:\Documents and Settings\Abigail Rivamonte\Local Settings\Temporary Internet Files\Content.IE5\81KI5AKL\index[2] (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Documents and Settings\Abigail Rivamonte\Local Settings\Temporary Internet Files\Content.IE5\DVG0GK9C\dd_1[1] (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{3ED563E3-24F0-4A2C-9BF6-4E0B774589E8}\RP107\A0044848.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{3ED563E3-24F0-4A2C-9BF6-4E0B774589E8}\RP107\A0044849.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{3ED563E3-24F0-4A2C-9BF6-4E0B774589E8}\RP107\A0044850.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{3ED563E3-24F0-4A2C-9BF6-4E0B774589E8}\RP107\A0044851.exe (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{3ED563E3-24F0-4A2C-9BF6-4E0B774589E8}\RP107\A0044854.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{3ED563E3-24F0-4A2C-9BF6-4E0B774589E8}\RP108\A0049105.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{3ED563E3-24F0-4A2C-9BF6-4E0B774589E8}\RP108\A0049115.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{3ED563E3-24F0-4A2C-9BF6-4E0B774589E8}\RP95\A0035218.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\prunnet.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\WINDOWS\system32\barijatu.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\dokanisu.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\fgafvrab.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\kyvzby.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\wtdobu.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\wwngepdf.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\nhnxysne.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\wogirubi.dll (Trojan.Vundo) -> Quarantined and deleted successfully. 2. RSIT log.txt Logfile of random's system information tool 1.05 (written by random/random) Run by Abigail Rivamonte at 2009-01-18 00:32:35 Microsoft Windows XP Home Edition Service Pack 2 System drive C: has 3 GB (8%) free of 34 GB Total RAM: 1262 MB (47% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:32:37 AM, on 1/18/2009 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe C:\WINDOWS\System32\WLTRYSVC.EXE C:\WINDOWS\System32\bcmwltry.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\WLTRAY.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\PROGRA~1\SYMANT~1\VPTray.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\WINDOWS\system32\igfxsrvc.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\WINDOWS\system32\NOTEPAD.EXE C:\WINDOWS\system32\NOTEPAD.EXE C:\Documents and Settings\Abigail Rivamonte\Desktop\gmer.exe C:\Documents and Settings\Abigail Rivamonte\Desktop\RSIT.exe C:\Program Files\Trend Micro\HijackThis\Abigail Rivamonte.exe O2 - BHO: (no name) - {6C15FC65-BD46-4167-AF32-1618C4806F25} - C:\WINDOWS\system32\mlJAropP.dll O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O20 - AppInit_DLLs: lqyvhd.dll O20 - Winlogon Notify: urqOEwvU - urqOEwvU.dll (file missing) O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe O23 - Service: Intel® PROSet/Wireless SSO Service (WLANKEEPER) - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE -- End of file - 5936 bytes ======Scheduled tasks folder====== C:\WINDOWS\tasks\AppleSoftwareUpdate.job C:\WINDOWS\tasks\ezbepehb.job ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6C15FC65-BD46-4167-AF32-1618C4806F25}] C:\WINDOWS\system32\mlJAropP.dll [2008-12-27 287232] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "Broadcom Wireless Manager UI"=C:\WINDOWS\system32\WLTRAY.exe [2006-11-01 1392640] "Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792] "ccApp"=C:\Program Files\Common Files\Symantec Shared\ccApp.exe [2006-07-19 52896] "vptray"=C:\PROGRA~1\SYMANT~1\VPTray.exe [2006-10-24 125120] "DVDLauncher"=C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe [2005-02-23 53248] "SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2006-03-08 761947] "igfxtray"=C:\WINDOWS\system32\igfxtray.exe [2005-07-19 94208] "igfxhkcmd"=C:\WINDOWS\system32\hkcmd.exe [2005-07-19 77824] "igfxpers"=C:\WINDOWS\system32\igfxpers.exe [2005-07-19 114688] "QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2008-11-04 413696] "iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2008-11-20 290088] "IntelZeroConfig"=C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe [2007-02-21 819200] "IntelWireless"=C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe [2007-02-21 970752] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce] "Malwarebytes' Anti-Malware"=C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe [2009-01-14 399504] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\a02177fb] C:\WINDOWS\system32\posidiha.dll [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLS"="lqyvhd.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui] C:\WINDOWS\system32\igfxdev.dll [2005-07-19 135168] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon] C:\WINDOWS\system32\NavLogon.dll [2006-10-24 43712] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\urqOEwvU] urqOEwvU.dll [] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa] "authentication packages"=msv1_0 C:\WINDOWS\system32\mlJAropP [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"=145 [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe::enabled:@xpsp2res.dll,-22019" "C:\Program Files\ExamSoft\SofTest\SoftLnch.exe"="C:\Program Files\ExamSoft\SoftLnch.exe::Enabled:SofLaunch " "C:\Program Files\ExamSoft\SofTest\softest.exe"="C:\Program Files\ExamSoft\SofTest.exe::Enabled:SofTest " "C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe::Enabled:iTunes" "C:\WINDOWS\system32\logonui.exe"="C:\WINDOWS\system32\logonui.exe::Enabled:logonui" "C:\WINDOWS\system32\winlogon.exe"="C:\WINDOWS\system32\winlogon.exe::Enabled:winlogon" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe::enabled:@xpsp2res.dll,-22019" ======List of files/folders created in the last 3 months====== 2009-01-18 00:00:48 ----A---- C:\WINDOWS\gmer.ini 2009-01-18 00:00:43 ----RA---- C:\WINDOWS\gmer.exe 2009-01-18 00:00:43 ----A---- C:\WINDOWS\gmer_uninstall.cmd 2009-01-18 00:00:43 ----A---- C:\WINDOWS\gmer.dll 2009-01-17 23:59:55 ----ASH---- C:\WINDOWS\system32\PporAJlm.ini2 2009-01-17 23:59:13 ----D---- C:\rsit 2009-01-17 22:10:01 ----D---- C:\Documents and Settings\Abigail Rivamonte\Application Data\Malwarebytes 2009-01-17 22:09:47 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2009-01-17 22:09:46 ----D---- C:\Program Files\Malwarebytes' Anti-Malware 2009-01-17 22:08:36 ----N---- C:\WINDOWS\system32\ioontuls.dll 2009-01-17 22:05:39 ----N---- C:\WINDOWS\system32\lqyvhd.dll 2009-01-17 22:05:36 ----N---- C:\WINDOWS\system32\incchmfg.dll 2009-01-15 09:39:48 ----A---- C:\WINDOWS\system32\grpliw.dll 2009-01-15 09:39:46 ----A---- C:\WINDOWS\system32\hhgtsaqd.dll 2009-01-13 23:34:07 ----D---- C:\Program Files\Trend Micro 2009-01-13 23:13:20 ----SH---- C:\WINDOWS\system32\ifotjbyj.ini 2009-01-12 22:28:11 ----SH---- C:\WINDOWS\system32\enughiri.ini 2009-01-12 22:28:06 ----A---- C:\WINDOWS\system32\wulllj.dll 2009-01-12 22:28:06 ----A---- C:\WINDOWS\system32\qdipqsgg.dll 2009-01-11 22:20:02 ----D---- C:\Program Files\Lavasoft 2009-01-11 22:20:00 ----D---- C:\Documents and Settings\All Users\Application Data\Lavasoft 2009-01-11 22:19:07 ----D---- C:\Program Files\Common Files\Wise Installation Wizard 2009-01-11 22:18:01 ----A---- C:\WINDOWS\system32\lblqbu.dll 2009-01-11 22:17:59 ----A---- C:\WINDOWS\system32\dvmfsava.dll 2009-01-11 22:05:50 ----SHD---- C:\Config.Msi 2009-01-11 22:05:31 ----D---- C:\Documents and Settings\All Users\Application Data\Intel 2009-01-11 22:05:12 ----D---- C:\Documents and Settings\Abigail Rivamonte\Application Data\Intel 2009-01-11 21:23:15 ----A---- C:\WINDOWS\system32\W70MLRES.DLL 2009-01-11 21:23:15 ----A---- C:\WINDOWS\system32\W20MLRES.DLL 2009-01-11 21:10:14 ----D---- C:\WINDOWS\pss 2009-01-04 14:12:10 ----SH---- C:\WINDOWS\system32\heyuyuko.exe 2009-01-03 23:52:10 ----SH---- C:\WINDOWS\system32\vororeni.exe 2009-01-02 11:59:47 ----SH---- C:\WINDOWS\system32\fivudego.exe 2009-01-01 17:58:33 ----SH---- C:\WINDOWS\system32\muzaheva.exe 2009-01-01 11:57:30 ----A---- C:\WINDOWS\setuplog.txt 2008-12-27 19:12:50 ----D---- C:\WINDOWS\system32\LogFiles 2008-12-27 16:23:01 ----SH---- C:\WINDOWS\system32\tqqvjekj.ini 2008-12-27 16:22:25 ----A---- C:\WINDOWS\system32\ab02b385-.txt 2008-12-27 16:21:55 ----ASH---- C:\WINDOWS\system32\PporAJlm.ini 2008-12-27 16:21:49 ----N---- C:\WINDOWS\system32\mlJAropP.dll 2008-12-10 07:56:05 ----D---- C:\Program Files\iPod 2008-12-10 07:56:01 ----D---- C:\Program Files\iTunes 2008-12-10 07:56:01 ----D---- C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2008-12-10 07:53:16 ----D---- C:\Program Files\QuickTime ======List of files/folders modified in the last 3 months====== 2009-01-18 00:06:29 ----D---- C:\WINDOWS\Prefetch 2009-01-18 00:00:48 ----D---- C:\WINDOWS 2009-01-18 00:00:43 ----D---- C:\WINDOWS\system32\drivers 2009-01-17 23:59:55 ----D---- C:\WINDOWS\system32 2009-01-17 22:48:17 ----D---- C:\Program Files\Mozilla Firefox 2009-01-17 22:09:46 ----RD---- C:\Program Files 2009-01-17 22:04:56 ----D---- C:\WINDOWS\Temp 2009-01-17 14:45:33 ----D---- C:\WINDOWS\system32\CatRoot2 2009-01-15 09:59:59 ----A---- C:\WINDOWS\SchedLgU.Txt 2009-01-13 14:22:11 ----RASH---- C:\boot.ini 2009-01-13 14:22:11 ----A---- C:\WINDOWS\win.ini 2009-01-13 14:22:11 ----A---- C:\WINDOWS\system.ini 2009-01-11 22:21:09 ----SHD---- C:\WINDOWS\Installer 2009-01-11 22:19:07 ----D---- C:\Program Files\Common Files 2009-01-11 22:09:30 ----AC---- C:\WINDOWS\system32\results.txt 2009-01-11 22:09:25 ----HD---- C:\WINDOWS\inf 2009-01-11 22:08:29 ----D---- C:\WINDOWS\system32\CatRoot 2009-01-11 22:07:47 ----DC---- C:\WINDOWS\system32\DRVSTORE 2009-01-11 22:06:18 ----D---- C:\WINDOWS\WinSxS 2009-01-11 21:55:44 ----D---- C:\WINDOWS\Help 2009-01-11 21:14:49 ----A---- C:\h.txt 2008-12-28 15:45:05 ----A---- C:\WINDOWS\imsins.BAK 2008-12-28 15:44:14 ----AC---- C:\WINDOWS\system32\PerfStringBackup.INI 2008-12-28 15:41:13 ----D---- C:\Program Files\Common Files\Apple 2008-12-28 15:29:00 ----D---- C:\Program Files\Windows NT 2008-12-27 16:16:49 ----SD---- C:\WINDOWS\Tasks 2008-12-27 16:16:31 ----D---- C:\Program Files\Symantec AntiVirus ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [] R1 intelppm;Intel Processor Driver; C:\WINDOWS\System32\DRIVERS\intelppm.sys [2004-08-03 36096] R1 OMCI;OMCI; C:\WINDOWS\SYSTEM32\DRIVERS\OMCI.SYS [2001-08-22 13632] R1 SAVRT;SAVRT; \??\C:\Program Files\Symantec AntiVirus\savrt.sys [] R1 SAVRTPEL;SAVRTPEL; \??\C:\Program Files\Symantec AntiVirus\Savrtpel.sys [] R1 SPBBCDrv;SPBBCDrv; \??\C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys [] R1 SYMTDI;SYMTDI; C:\WINDOWS\System32\Drivers\SYMTDI.SYS [2006-08-07 195776] R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.6.0.0; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2009-01-11 21425] R2 mdmxsdk;mdmxsdk; C:\WINDOWS\System32\DRIVERS\mdmxsdk.sys [2004-08-03 11868] R2 s24trans;WLAN Transport; C:\WINDOWS\System32\DRIVERS\s24trans.sys [2007-02-21 12416] R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\System32\DRIVERS\arp1394.sys [2004-08-03 60800] R3 CmBatt;Microsoft AC Adapter Driver; C:\WINDOWS\System32\DRIVERS\CmBatt.sys [2004-08-03 14080] R3 EraserUtilRebootDrv;EraserUtilRebootDrv; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [] R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2008-04-17 15464] R3 HSF_DPV;HSF_DPV; C:\WINDOWS\System32\DRIVERS\HSF_DPV.SYS [2005-05-03 1033728] R3 HSFHWICH;HSFHWICH; C:\WINDOWS\System32\DRIVERS\HSFHWICH.sys [2005-05-03 208384] R3 ialm;ialm; C:\WINDOWS\System32\DRIVERS\ialmnt5.sys [2005-07-19 1049180] R3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\WINDOWS\system32\drivers\mbamswissarmy.sys [] R3 NAVENG;NAVENG; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20081226.002\naveng.sys [] R3 NAVEX15;NAVEX15; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20081226.002\navex15.sys [] R3 NIC1394;1394 Net Driver; C:\WINDOWS\System32\DRIVERS\nic1394.sys [2004-08-03 61824] R3 STAC97;Audio Driver (WDM) - SigmaTel CODEC; C:\WINDOWS\system32\drivers\stac97.sys [2004-11-15 264440] R3 SymEvent;SymEvent; \??\C:\Program Files\Symantec\SYMEVENT.SYS [] R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2006-03-08 191872] R3 tifm;tifm; C:\WINDOWS\system32\drivers\tifm.sys [2006-07-21 55808] R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbehci.sys [2004-08-03 26624] R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2004-08-03 57600] R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2004-08-03 20480] R3 w29n51;Intel® PRO/Wireless 2200BG Network Connection Driver for Windows XP; C:\WINDOWS\System32\DRIVERS\w29n51.sys [2007-02-08 2209408] R3 winachsf;winachsf; C:\WINDOWS\System32\DRIVERS\HSF_CNXT.sys [2005-05-03 705408] S3 flash;flash; \??\C:\WINDOWS\System32\drivers\flash.sys [] S3 gmer;gmer; C:\WINDOWS\System32\DRIVERS\gmer.sys [2009-01-18 85969] S3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\System32\DRIVERS\hidusb.sys [2001-08-17 9600] S3 nm;Network Monitor Driver; C:\WINDOWS\System32\DRIVERS\NMnt.sys [2004-08-03 40320] S3 PRISM_A02;D-Link Wireless 802.11b/g Driver (USB); C:\WINDOWS\System32\DRIVERS\PRISMA02.sys [2005-01-30 381312] S3 SYMREDRV;SYMREDRV; C:\WINDOWS\System32\Drivers\SYMREDRV.SYS [2006-08-07 24768] S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [] S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\System32\DRIVERS\usbccgp.sys [2004-08-03 31616] S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\System32\DRIVERS\usbprint.sys [2004-08-03 25856] S3 usbscan;USB Scanner Driver; C:\WINDOWS\System32\DRIVERS\usbscan.sys [2004-08-03 15104] S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2004-08-03 26496] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 aawservice;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe [2008-09-10 611664] R2 ccSetMgr;Symantec Settings Manager; C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe [2006-07-19 169632] R2 DefWatch;Symantec AntiVirus Definition Watcher; C:\Program Files\Symantec AntiVirus\DefWatch.exe [2006-10-24 31424] R2 EvtEng;Intel® PROSet/Wireless Event Log; C:\Program Files\Intel\Wireless\Bin\EvtEng.exe [2007-02-21 643072] R2 RegSrvc;Intel® PROSet/Wireless Registry Service; C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe [2007-02-21 327680] R2 S24EventMonitor;Intel® PROSet/Wireless Service; C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe [2007-02-21 983040] R2 SPBBCSvc;Symantec SPBBCSvc; C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe [2006-04-11 1160848] R2 WLANKEEPER;Intel® PROSet/Wireless SSO Service; C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe [2007-02-21 294912] R2 wltrysvc;Dell Wireless WLAN Tray Service; C:\WINDOWS\System32\WLTRYSVC.EXE [2006-11-01 20480] R3 ccEvtMgr;Symantec Event Manager; C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe [2006-07-19 192160] R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2008-11-20 536872] S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-01-03 136120] S3 LiveUpdate;LiveUpdate; C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE [2006-09-02 2528960] S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136] S3 SavRoam;SAVRoam; C:\Program Files\Symantec AntiVirus\SavRoam.exe [2006-10-24 116416] S3 SNDSrvc;Symantec Network Drivers Service; C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe [2006-08-07 214720] S3 Symantec AntiVirus;Symantec AntiVirus; C:\Program Files\Symantec AntiVirus\Rtvscan.exe [2006-10-24 1813184] -----------------EOF----------------- 3. RSIT info.txt ??? 4. Attach GMER result.. Logfile of random's system information tool 1.05 (written by random/random) Run by Abigail Rivamonte at 2009-01-17 23:59:13 Microsoft Windows XP Home Edition Service Pack 2 System drive C: has 3 GB (8%) free of 34 GB Total RAM: 1262 MB (51% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:59:19 PM, on 1/17/2009 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe C:\WINDOWS\System32\WLTRYSVC.EXE C:\WINDOWS\System32\bcmwltry.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\WLTRAY.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\PROGRA~1\SYMANT~1\VPTray.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\WINDOWS\system32\igfxsrvc.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Documents and Settings\Abigail Rivamonte\Desktop\RSIT.exe C:\Program Files\Trend Micro\HijackThis\Abigail Rivamonte.exe O2 - BHO: (no name) - {6C15FC65-BD46-4167-AF32-1618C4806F25} - C:\WINDOWS\system32\mlJAropP.dll O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O20 - AppInit_DLLs: lqyvhd.dll O20 - Winlogon Notify: urqOEwvU - urqOEwvU.dll (file missing) O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe O23 - Service: Intel® PROSet/Wireless SSO Service (WLANKEEPER) - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE -- End of file - 5808 bytes ======Scheduled tasks folder====== C:\WINDOWS\tasks\AppleSoftwareUpdate.job C:\WINDOWS\tasks\ezbepehb.job ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6C15FC65-BD46-4167-AF32-1618C4806F25}] C:\WINDOWS\system32\mlJAropP.dll [2008-12-27 287232] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "Broadcom Wireless Manager UI"=C:\WINDOWS\system32\WLTRAY.exe [2006-11-01 1392640] "Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792] "ccApp"=C:\Program Files\Common Files\Symantec Shared\ccApp.exe [2006-07-19 52896] "vptray"=C:\PROGRA~1\SYMANT~1\VPTray.exe [2006-10-24 125120] "DVDLauncher"=C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe [2005-02-23 53248] "SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2006-03-08 761947] "igfxtray"=C:\WINDOWS\system32\igfxtray.exe [2005-07-19 94208] "igfxhkcmd"=C:\WINDOWS\system32\hkcmd.exe [2005-07-19 77824] "igfxpers"=C:\WINDOWS\system32\igfxpers.exe [2005-07-19 114688] "QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2008-11-04 413696] "iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2008-11-20 290088] "IntelZeroConfig"=C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe [2007-02-21 819200] "IntelWireless"=C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe [2007-02-21 970752] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce] "Malwarebytes' Anti-Malware"=C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe [2009-01-14 399504] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\a02177fb] C:\WINDOWS\system32\posidiha.dll [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLS"="lqyvhd.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui] C:\WINDOWS\system32\igfxdev.dll [2005-07-19 135168] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon] C:\WINDOWS\system32\NavLogon.dll [2006-10-24 43712] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\urqOEwvU] urqOEwvU.dll [] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa] "authentication packages"=msv1_0 C:\WINDOWS\system32\mlJAropP [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"=145 [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe::enabled:@xpsp2res.dll,-22019" "C:\Program Files\ExamSoft\SofTest\SoftLnch.exe"="C:\Program Files\ExamSoft\SoftLnch.exe::Enabled:SofLaunch " "C:\Program Files\ExamSoft\SofTest\softest.exe"="C:\Program Files\ExamSoft\SofTest.exe::Enabled:SofTest " "C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe::Enabled:iTunes" "C:\WINDOWS\system32\logonui.exe"="C:\WINDOWS\system32\logonui.exe::Enabled:logonui" "C:\WINDOWS\system32\winlogon.exe"="C:\WINDOWS\system32\winlogon.exe::Enabled:winlogon" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe::enabled:@xpsp2res.dll,-22019" ======List of files/folders created in the last 3 months====== 2009-01-17 23:59:13 ----D---- C:\rsit 2009-01-17 22:10:01 ----D---- C:\Documents and Settings\Abigail Rivamonte\Application Data\Malwarebytes 2009-01-17 22:09:47 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2009-01-17 22:09:46 ----D---- C:\Program Files\Malwarebytes' Anti-Malware 2009-01-17 22:08:36 ----N---- C:\WINDOWS\system32\ioontuls.dll 2009-01-17 22:05:39 ----N---- C:\WINDOWS\system32\lqyvhd.dll 2009-01-17 22:05:36 ----N---- C:\WINDOWS\system32\incchmfg.dll 2009-01-15 09:39:48 ----A---- C:\WINDOWS\system32\grpliw.dll 2009-01-15 09:39:46 ----A---- C:\WINDOWS\system32\hhgtsaqd.dll 2009-01-13 23:34:07 ----D---- C:\Program Files\Trend Micro 2009-01-13 23:13:20 ----SH---- C:\WINDOWS\system32\ifotjbyj.ini 2009-01-12 22:28:11 ----SH---- C:\WINDOWS\system32\enughiri.ini 2009-01-12 22:28:06 ----A---- C:\WINDOWS\system32\wulllj.dll 2009-01-12 22:28:06 ----A---- C:\WINDOWS\system32\qdipqsgg.dll 2009-01-11 22:20:02 ----D---- C:\Program Files\Lavasoft 2009-01-11 22:20:00 ----D---- C:\Documents and Settings\All Users\Application Data\Lavasoft 2009-01-11 22:19:07 ----D---- C:\Program Files\Common Files\Wise Installation Wizard 2009-01-11 22:18:01 ----A---- C:\WINDOWS\system32\lblqbu.dll 2009-01-11 22:17:59 ----A---- C:\WINDOWS\system32\dvmfsava.dll 2009-01-11 22:05:50 ----SHD---- C:\Config.Msi 2009-01-11 22:05:31 ----D---- C:\Documents and Settings\All Users\Application Data\Intel 2009-01-11 22:05:12 ----D---- C:\Documents and Settings\Abigail Rivamonte\Application Data\Intel 2009-01-11 21:23:15 ----A---- C:\WINDOWS\system32\W70MLRES.DLL 2009-01-11 21:23:15 ----A---- C:\WINDOWS\system32\W20MLRES.DLL 2009-01-11 21:10:14 ----D---- C:\WINDOWS\pss 2009-01-04 14:12:10 ----SH---- C:\WINDOWS\system32\heyuyuko.exe 2009-01-03 23:52:10 ----SH---- C:\WINDOWS\system32\vororeni.exe 2009-01-02 11:59:47 ----SH---- C:\WINDOWS\system32\fivudego.exe 2009-01-01 17:58:33 ----SH---- C:\WINDOWS\system32\muzaheva.exe 2009-01-01 11:57:30 ----A---- C:\WINDOWS\setuplog.txt 2008-12-27 19:12:50 ----D---- C:\WINDOWS\system32\LogFiles 2008-12-27 16:23:01 ----SH---- C:\WINDOWS\system32\tqqvjekj.ini 2008-12-27 16:22:25 ----A---- C:\WINDOWS\system32\ab02b385-.txt 2008-12-27 16:21:55 ----ASH---- C:\WINDOWS\system32\PporAJlm.ini 2008-12-27 16:21:49 ----N---- C:\WINDOWS\system32\mlJAropP.dll 2008-12-10 07:56:05 ----D---- C:\Program Files\iPod 2008-12-10 07:56:01 ----D---- C:\Program Files\iTunes 2008-12-10 07:56:01 ----D---- C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2008-12-10 07:53:16 ----D---- C:\Program Files\QuickTime ======List of files/folders modified in the last 3 months====== 2009-01-17 23:59:14 ----D---- C:\WINDOWS\Prefetch 2009-01-17 23:57:47 ----D---- C:\WINDOWS\system32 2009-01-17 22:48:17 ----D---- C:\Program Files\Mozilla Firefox 2009-01-17 22:09:50 ----D---- C:\WINDOWS\system32\drivers 2009-01-17 22:09:46 ----RD---- C:\Program Files 2009-01-17 22:04:56 ----D---- C:\WINDOWS\Temp 2009-01-17 22:02:36 ----D---- C:\WINDOWS 2009-01-17 14:45:33 ----D---- C:\WINDOWS\system32\CatRoot2 2009-01-15 09:59:59 ----A---- C:\WINDOWS\SchedLgU.Txt 2009-01-13 14:22:11 ----RASH---- C:\boot.ini 2009-01-13 14:22:11 ----A---- C:\WINDOWS\win.ini 2009-01-13 14:22:11 ----A---- C:\WINDOWS\system.ini 2009-01-11 22:21:09 ----SHD---- C:\WINDOWS\Installer 2009-01-11 22:19:07 ----D---- C:\Program Files\Common Files 2009-01-11 22:09:30 ----AC---- C:\WINDOWS\system32\results.txt 2009-01-11 22:09:25 ----HD---- C:\WINDOWS\inf 2009-01-11 22:08:29 ----D---- C:\WINDOWS\system32\CatRoot 2009-01-11 22:07:47 ----DC---- C:\WINDOWS\system32\DRVSTORE 2009-01-11 22:06:18 ----D---- C:\WINDOWS\WinSxS 2009-01-11 21:55:44 ----D---- C:\WINDOWS\Help 2009-01-11 21:14:49 ----A---- C:\h.txt 2008-12-28 15:45:05 ----A---- C:\WINDOWS\imsins.BAK 2008-12-28 15:44:14 ----AC---- C:\WINDOWS\system32\PerfStringBackup.INI 2008-12-28 15:41:13 ----D---- C:\Program Files\Common Files\Apple 2008-12-28 15:29:00 ----D---- C:\Program Files\Windows NT 2008-12-27 16:16:49 ----SD---- C:\WINDOWS\Tasks 2008-12-27 16:16:31 ----D---- C:\Program Files\Symantec AntiVirus ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [] R1 intelppm;Intel Processor Driver; C:\WINDOWS\System32\DRIVERS\intelppm.sys [2004-08-03 36096] R1 OMCI;OMCI; C:\WINDOWS\SYSTEM32\DRIVERS\OMCI.SYS [2001-08-22 13632] R1 SAVRT;SAVRT; \??\C:\Program Files\Symantec AntiVirus\savrt.sys [] R1 SAVRTPEL;SAVRTPEL; \??\C:\Program Files\Symantec AntiVirus\Savrtpel.sys [] R1 SPBBCDrv;SPBBCDrv; \??\C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys [] R1 SYMTDI;SYMTDI; C:\WINDOWS\System32\Drivers\SYMTDI.SYS [2006-08-07 195776] R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.6.0.0; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2009-01-11 21425] R2 mdmxsdk;mdmxsdk; C:\WINDOWS\System32\DRIVERS\mdmxsdk.sys [2004-08-03 11868] R2 s24trans;WLAN Transport; C:\WINDOWS\System32\DRIVERS\s24trans.sys [2007-02-21 12416] R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\System32\DRIVERS\arp1394.sys [2004-08-03 60800] R3 CmBatt;Microsoft AC Adapter Driver; C:\WINDOWS\System32\DRIVERS\CmBatt.sys [2004-08-03 14080] R3 EraserUtilRebootDrv;EraserUtilRebootDrv; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [] R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2008-04-17 15464] R3 HSF_DPV;HSF_DPV; C:\WINDOWS\System32\DRIVERS\HSF_DPV.SYS [2005-05-03 1033728] R3 HSFHWICH;HSFHWICH; C:\WINDOWS\System32\DRIVERS\HSFHWICH.sys [2005-05-03 208384] R3 ialm;ialm; C:\WINDOWS\System32\DRIVERS\ialmnt5.sys [2005-07-19 1049180] R3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\WINDOWS\system32\drivers\mbamswissarmy.sys [] R3 NAVENG;NAVENG; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20081226.002\naveng.sys [] R3 NAVEX15;NAVEX15; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20081226.002\navex15.sys [] R3 NIC1394;1394 Net Driver; C:\WINDOWS\System32\DRIVERS\nic1394.sys [2004-08-03 61824] R3 STAC97;Audio Driver (WDM) - SigmaTel CODEC; C:\WINDOWS\system32\drivers\stac97.sys [2004-11-15 264440] R3 SymEvent;SymEvent; \??\C:\Program Files\Symantec\SYMEVENT.SYS [] R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2006-03-08 191872] R3 tifm;tifm; C:\WINDOWS\system32\drivers\tifm.sys [2006-07-21 55808] R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbehci.sys [2004-08-03 26624] R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2004-08-03 57600] R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2004-08-03 20480] R3 w29n51;Intel® PRO/Wireless 2200BG Network Connection Driver for Windows XP; C:\WINDOWS\System32\DRIVERS\w29n51.sys [2007-02-08 2209408] R3 winachsf;winachsf; C:\WINDOWS\System32\DRIVERS\HSF_CNXT.sys [2005-05-03 705408] S3 flash;flash; \??\C:\WINDOWS\System32\drivers\flash.sys [] S3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\System32\DRIVERS\hidusb.sys [2001-08-17 9600] S3 nm;Network Monitor Driver; C:\WINDOWS\System32\DRIVERS\NMnt.sys [2004-08-03 40320] S3 PRISM_A02;D-Link Wireless 802.11b/g Driver (USB); C:\WINDOWS\System32\DRIVERS\PRISMA02.sys [2005-01-30 381312] S3 SYMREDRV;SYMREDRV; C:\WINDOWS\System32\Drivers\SYMREDRV.SYS [2006-08-07 24768] S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [] S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\System32\DRIVERS\usbccgp.sys [2004-08-03 31616] S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\System32\DRIVERS\usbprint.sys [2004-08-03 25856] S3 usbscan;USB Scanner Driver; C:\WINDOWS\System32\DRIVERS\usbscan.sys [2004-08-03 15104] S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2004-08-03 26496] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 aawservice;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe [2008-09-10 611664] R2 ccSetMgr;Symantec Settings Manager; C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe [2006-07-19 169632] R2 DefWatch;Symantec AntiVirus Definition Watcher; C:\Program Files\Symantec AntiVirus\DefWatch.exe [2006-10-24 31424] R2 EvtEng;Intel® PROSet/Wireless Event Log; C:\Program Files\Intel\Wireless\Bin\EvtEng.exe [2007-02-21 643072] R2 RegSrvc;Intel® PROSet/Wireless Registry Service; C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe [2007-02-21 327680] R2 S24EventMonitor;Intel® PROSet/Wireless Service; C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe [2007-02-21 983040] R2 SPBBCSvc;Symantec SPBBCSvc; C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe [2006-04-11 1160848] R2 WLANKEEPER;Intel® PROSet/Wireless SSO Service; C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe [2007-02-21 294912] R2 wltrysvc;Dell Wireless WLAN Tray Service; C:\WINDOWS\System32\WLTRYSVC.EXE [2006-11-01 20480] R3 ccEvtMgr;Symantec Event Manager; C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe [2006-07-19 192160] R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2008-11-20 536872] S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-01-03 136120] S3 LiveUpdate;LiveUpdate; C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE [2006-09-02 2528960] S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136] S3 SavRoam;SAVRoam; C:\Program Files\Symantec AntiVirus\SavRoam.exe [2006-10-24 116416] S3 SNDSrvc;Symantec Network Drivers Service; C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe [2006-08-07 214720] S3 Symantec AntiVirus;Symantec AntiVirus; C:\Program Files\Symantec AntiVirus\Rtvscan.exe [2006-10-24 1813184] -----------------EOF-----------------

fenzodahl512 View Member Profile	Jan 18 2009, 02:59 AM Post #4
Trusted Helper Posts: 9,212 OS: Windows XP	You posted RSIT log.txt twice and not the GMER report Please post the GMER report as I need to see it.. In the mean time, please do below.. IMPORTANT!! Uninstall these programs first (if present..) so that they won't interfere with our fixes.. 1. Ask Toolbar 2. Lavasoft Ad-Aware 3. Spybot - Search & Destroy 4. Viewpoint (all of them..) Please download the OTMoveIt3 by OldTimer Save it to your Desktop. Please double-click OTMoveIt3.exe to run it. (Vista users, please right click on OTMoveit3.exe and select "Run as an Administrator") Let the Unregister Dll's and Ocx's remain ticked and Zip Files After Moves remain unticked.. Copy the codebox contents and paste it to the "Paste List of Files/Folders to Move" window (under the light Yellow bar) CODE :processes explorer.exe :services :files C:\WINDOWS\tasks\ezbepehb.job C:\WINDOWS\system32\mlJAropP.dll C:\WINDOWS\system32\posidiha.dll C:\WINDOWS\system32\ioontuls.dll C:\WINDOWS\system32\lqyvhd.dll C:\WINDOWS\system32\incchmfg.dll C:\WINDOWS\system32\grpliw.dll C:\WINDOWS\system32\hhgtsaqd.dll C:\WINDOWS\system32\ifotjbyj.ini C:\WINDOWS\system32\enughiri.ini C:\WINDOWS\system32\wulllj.dll C:\WINDOWS\system32\qdipqsgg.dll C:\WINDOWS\system32\lblqbu.dll C:\WINDOWS\system32\dvmfsava.dll C:\WINDOWS\system32\heyuyuko.exe C:\WINDOWS\system32\vororeni.exe C:\WINDOWS\system32\fivudego.exe C:\WINDOWS\system32\muzaheva.exe C:\WINDOWS\system32\tqqvjekj.ini C:\WINDOWS\system32\ab02b385-.txt C:\WINDOWS\system32\PporAJlm.ini C:\WINDOWS\system32\mlJAropP.dll C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} :reg [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6C15FC65-BD46-4167-AF32-1618C4806F25}] [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\a02177fb] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLS"="" [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\urqOEwvU] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa] "Authentication Packages"=hex(7):6d,73,76,31,5f,30,00,00 :commands [purity] [emptytemp] [start explorer] [reboot] Click the red Moveit! button. A log of files and folders moved will be created in the c:\_OTMoveIt\MovedFiles folder in the form of Date and Time (mmddyyyy_hhmmss.log). Please open this log in Notepad and post its contents in your next reply. Close OTMoveIt3 If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. Run RSIT again... Post these logs in your next reply.. 1. OTMoveIt3 2. RSIT log.txt

davidmizzle View Member Profile	Jan 18 2009, 02:07 PM Post #5
Member Posts: 10 OS: XP	Sorry about that. Here's the GMER. GMER 1.0.14.14536 - http://www.gmer.net Rootkit scan 2009-01-18 00:29:16 Windows 5.1.2600 Service Pack 2 ---- System - GMER 1.0.14 ---- SSDT 892B5CD0 ZwAlertResumeThread SSDT 891FA8E8 ZwAlertThread SSDT 891DAC60 ZwAllocateVirtualMemory SSDT 894ABE60 ZwConnectPort SSDT 891BF2E8 ZwCreateMutant SSDT 89473E80 ZwCreateThread SSDT \??\C:\Program Files\Symantec\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwDeleteValueKey [0xB227E350] SSDT 89589578 ZwFreeVirtualMemory SSDT 891BF3A8 ZwImpersonateAnonymousToken SSDT 892B5C10 ZwImpersonateThread SSDT 89282AA8 ZwMapViewOfSection SSDT 891913B0 ZwOpenEvent SSDT 892B5258 ZwOpenProcessToken SSDT 8929E710 ZwOpenThreadToken SSDT 891912E0 ZwQueryValueKey SSDT 891BC358 ZwResumeThread SSDT 891954B8 ZwSetContextThread SSDT 8940DBE8 ZwSetInformationProcess SSDT 891953F8 ZwSetInformationThread SSDT \??\C:\Program Files\Symantec\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwSetValueKey [0xB227E580] SSDT 891AA938 ZwSuspendProcess SSDT 891966B8 ZwSuspendThread SSDT 8929C9C0 ZwTerminateProcess SSDT 89196778 ZwTerminateThread SSDT 892A3C48 ZwUnmapViewOfSection SSDT 8919E4A8 ZwWriteVirtualMemory ---- User code sections - GMER 1.0.14 ---- .text C:\Program Files\Mozilla Firefox\firefox.exe[468] kernel32.dll!MultiByteToWideChar 7C809CAD 5 Bytes JMP 011373AD C:\WINDOWS\system32\mlJAropP.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[468] WS2_32.dll!send 71AB428A 5 Bytes JMP 1000C93B C:\WINDOWS\system32\lqyvhd.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[468] USER32.dll!CreateWindowExW 77D51AD5 5 Bytes JMP 10014792 C:\WINDOWS\system32\lqyvhd.dll ---- Devices - GMER 1.0.14 ---- Device Ntfs.sys (NT File System Driver/Microsoft Corporation) AttachedDevice \Driver\Tcpip \Device\Ip SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation) AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.) AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.) AttachedDevice \Driver\Tcpip \Device\Tcp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation) AttachedDevice \Driver\Tcpip \Device\Udp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation) AttachedDevice \Driver\Tcpip \Device\RawIp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation) Device mrxsmb.sys (Windows NT SMB Minirdr/Microsoft Corporation) Device B0594C8A AttachedDevice fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation) AttachedDevice SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ---- EOF - GMER 1.0.14 ----

davidmizzle View Member Profile	Jan 18 2009, 02:17 PM Post #6
Member Posts: 10 OS: XP	AdAware Unintalled. The other programs were not present on my system. Below are the requested log files. 1. OTMoveIt3 ========== PROCESSES ========== Process explorer.exe killed successfully. ========== SERVICES/DRIVERS ========== ========== FILES ========== C:\WINDOWS\tasks\ezbepehb.job moved successfully. File/Folder C:\WINDOWS\system32\mlJAropP.dll not found. File/Folder C:\WINDOWS\system32\posidiha.dll not found. File/Folder C:\WINDOWS\system32\ioontuls.dll not found. File/Folder C:\WINDOWS\system32\lqyvhd.dll not found. File/Folder C:\WINDOWS\system32\incchmfg.dll not found. DllUnregisterServer procedure not found in C:\WINDOWS\system32\grpliw.dll C:\WINDOWS\system32\grpliw.dll NOT unregistered. C:\WINDOWS\system32\grpliw.dll moved successfully. DllUnregisterServer procedure not found in C:\WINDOWS\system32\hhgtsaqd.dll C:\WINDOWS\system32\hhgtsaqd.dll NOT unregistered. C:\WINDOWS\system32\hhgtsaqd.dll moved successfully. C:\WINDOWS\system32\ifotjbyj.ini moved successfully. C:\WINDOWS\system32\enughiri.ini moved successfully. DllUnregisterServer procedure not found in C:\WINDOWS\system32\wulllj.dll C:\WINDOWS\system32\wulllj.dll NOT unregistered. C:\WINDOWS\system32\wulllj.dll moved successfully. DllUnregisterServer procedure not found in C:\WINDOWS\system32\qdipqsgg.dll C:\WINDOWS\system32\qdipqsgg.dll NOT unregistered. C:\WINDOWS\system32\qdipqsgg.dll moved successfully. DllUnregisterServer procedure not found in C:\WINDOWS\system32\lblqbu.dll C:\WINDOWS\system32\lblqbu.dll NOT unregistered. C:\WINDOWS\system32\lblqbu.dll moved successfully. DllUnregisterServer procedure not found in C:\WINDOWS\system32\dvmfsava.dll C:\WINDOWS\system32\dvmfsava.dll NOT unregistered. C:\WINDOWS\system32\dvmfsava.dll moved successfully. C:\WINDOWS\system32\heyuyuko.exe moved successfully. C:\WINDOWS\system32\vororeni.exe moved successfully. C:\WINDOWS\system32\fivudego.exe moved successfully. C:\WINDOWS\system32\muzaheva.exe moved successfully. C:\WINDOWS\system32\tqqvjekj.ini moved successfully. C:\WINDOWS\system32\ab02b385-.txt moved successfully. File/Folder C:\WINDOWS\system32\PporAJlm.ini not found. File/Folder C:\WINDOWS\system32\mlJAropP.dll not found. C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}\x86\x86 moved successfully. C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}\x86 moved successfully. C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} moved successfully. ========== REGISTRY ========== Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6C15FC65-BD46-4167-AF32-1618C4806F25}\\ not found. Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\a02177fb\\ deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\"AppInit_DLLS"\|"" /E : value set successfully! Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\urqOEwvU\\ deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\"Authentication Packages"\|hex(7):6d,73,76,31,5f,30,00,00 /E : value set successfully! ========== COMMANDS ========== File delete failed. C:\DOCUME~1\ABIGAI~1\LOCALS~1\Temp\etilqs_vYatcmoSSVhXCwR07btd scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\ABIGAI~1\LOCALS~1\Temp\Perflib_Perfdata_a98.dat scheduled to be deleted on reboot. User's Temp folder emptied. User's Temporary Internet Files folder emptied. User's Internet Explorer cache folder emptied. Local Service Temp folder emptied. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. Local Service Temporary Internet Files folder emptied. Windows Temp folder emptied. File delete failed. C:\Documents and Settings\Abigail Rivamonte\Local Settings\Application Data\Mozilla\Firefox\Profiles\x4fc7934.default\Cache\_CACHE_001_ scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Abigail Rivamonte\Local Settings\Application Data\Mozilla\Firefox\Profiles\x4fc7934.default\Cache\_CACHE_002_ scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Abigail Rivamonte\Local Settings\Application Data\Mozilla\Firefox\Profiles\x4fc7934.default\Cache\_CACHE_003_ scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Abigail Rivamonte\Local Settings\Application Data\Mozilla\Firefox\Profiles\x4fc7934.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Abigail Rivamonte\Local Settings\Application Data\Mozilla\Firefox\Profiles\x4fc7934.default\urlclassifier3.sqlite scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Abigail Rivamonte\Local Settings\Application Data\Mozilla\Firefox\Profiles\x4fc7934.default\XUL.mfl scheduled to be deleted on reboot. FireFox cache emptied. Temp folders emptied. Explorer started successfully OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 01182009_121130 Files moved on Reboot... File C:\DOCUME~1\ABIGAI~1\LOCALS~1\Temp\etilqs_vYatcmoSSVhXCwR07btd not found! File C:\DOCUME~1\ABIGAI~1\LOCALS~1\Temp\Perflib_Perfdata_a98.dat not found! File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot. C:\Documents and Settings\Abigail Rivamonte\Local Settings\Application Data\Mozilla\Firefox\Profiles\x4fc7934.default\Cache\_CACHE_001_ moved successfully. C:\Documents and Settings\Abigail Rivamonte\Local Settings\Application Data\Mozilla\Firefox\Profiles\x4fc7934.default\Cache\_CACHE_002_ moved successfully. C:\Documents and Settings\Abigail Rivamonte\Local Settings\Application Data\Mozilla\Firefox\Profiles\x4fc7934.default\Cache\_CACHE_003_ moved successfully. C:\Documents and Settings\Abigail Rivamonte\Local Settings\Application Data\Mozilla\Firefox\Profiles\x4fc7934.default\Cache\_CACHE_MAP_ moved successfully. C:\Documents and Settings\Abigail Rivamonte\Local Settings\Application Data\Mozilla\Firefox\Profiles\x4fc7934.default\urlclassifier3.sqlite moved successfully. C:\Documents and Settings\Abigail Rivamonte\Local Settings\Application Data\Mozilla\Firefox\Profiles\x4fc7934.default\XUL.mfl moved successfully. 2. RSIT log.txt Logfile of random's system information tool 1.05 (written by random/random) Run by Abigail Rivamonte at 2009-01-18 12:16:44 Microsoft Windows XP Home Edition Service Pack 2 System drive C: has 3 GB (9%) free of 34 GB Total RAM: 1262 MB (60% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:16:47 PM, on 1/18/2009 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe C:\WINDOWS\System32\WLTRYSVC.EXE C:\WINDOWS\System32\bcmwltry.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\notepad.exe C:\WINDOWS\system32\WLTRAY.exe C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\PROGRA~1\SYMANT~1\VPTray.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\system32\igfxsrvc.exe C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Abigail Rivamonte\Desktop\RSIT.exe C:\Program Files\Trend Micro\HijackThis\Abigail Rivamonte.exe O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe O23 - Service: Intel® PROSet/Wireless SSO Service (WLANKEEPER) - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE -- End of file - 5247 bytes ======Scheduled tasks folder====== C:\WINDOWS\tasks\AppleSoftwareUpdate.job ======Registry dump====== [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "Broadcom Wireless Manager UI"=C:\WINDOWS\system32\WLTRAY.exe [2006-11-01 1392640] "Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792] "ccApp"=C:\Program Files\Common Files\Symantec Shared\ccApp.exe [2006-07-19 52896] "vptray"=C:\PROGRA~1\SYMANT~1\VPTray.exe [2006-10-24 125120] "DVDLauncher"=C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe [2005-02-23 53248] "SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2006-03-08 761947] "igfxtray"=C:\WINDOWS\system32\igfxtray.exe [2005-07-19 94208] "igfxhkcmd"=C:\WINDOWS\system32\hkcmd.exe [2005-07-19 77824] "igfxpers"=C:\WINDOWS\system32\igfxpers.exe [2005-07-19 114688] "QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2008-11-04 413696] "iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2008-11-20 290088] "IntelZeroConfig"=C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe [2007-02-21 819200] "IntelWireless"=C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe [2007-02-21 970752] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui] C:\WINDOWS\system32\igfxdev.dll [2005-07-19 135168] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon] C:\WINDOWS\system32\NavLogon.dll [2006-10-24 43712] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"=145 [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe::enabled:@xpsp2res.dll,-22019" "C:\Program Files\ExamSoft\SofTest\SoftLnch.exe"="C:\Program Files\ExamSoft\SoftLnch.exe::Enabled:SofLaunch " "C:\Program Files\ExamSoft\SofTest\softest.exe"="C:\Program Files\ExamSoft\SofTest.exe::Enabled:SofTest " "C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe::Enabled:iTunes" "C:\WINDOWS\system32\logonui.exe"="C:\WINDOWS\system32\logonui.exe::Enabled:logonui" "C:\WINDOWS\system32\winlogon.exe"="C:\WINDOWS\system32\winlogon.exe::Enabled:winlogon" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" ======List of files/folders created in the last 3 months====== 2009-01-18 12:11:30 ----D---- C:\_OTMoveIt 2009-01-18 00:00:48 ----A---- C:\WINDOWS\gmer.ini 2009-01-18 00:00:43 ----RA---- C:\WINDOWS\gmer.exe 2009-01-18 00:00:43 ----A---- C:\WINDOWS\gmer_uninstall.cmd 2009-01-18 00:00:43 ----A---- C:\WINDOWS\gmer.dll 2009-01-17 23:59:13 ----D---- C:\rsit 2009-01-17 22:10:01 ----D---- C:\Documents and Settings\Abigail Rivamonte\Application Data\Malwarebytes 2009-01-17 22:09:47 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2009-01-17 22:09:46 ----D---- C:\Program Files\Malwarebytes' Anti-Malware 2009-01-13 23:34:07 ----D---- C:\Program Files\Trend Micro 2009-01-11 22:20:00 ----D---- C:\Documents and Settings\All Users\Application Data\Lavasoft 2009-01-11 22:05:31 ----D---- C:\Documents and Settings\All Users\Application Data\Intel 2009-01-11 22:05:12 ----D---- C:\Documents and Settings\Abigail Rivamonte\Application Data\Intel 2009-01-11 21:23:15 ----A---- C:\WINDOWS\system32\W70MLRES.DLL 2009-01-11 21:23:15 ----A---- C:\WINDOWS\system32\W20MLRES.DLL 2009-01-11 21:10:14 ----D---- C:\WINDOWS\pss 2009-01-01 11:57:30 ----A---- C:\WINDOWS\setuplog.txt 2008-12-27 19:12:50 ----D---- C:\WINDOWS\system32\LogFiles 2008-12-10 07:56:05 ----D---- C:\Program Files\iPod 2008-12-10 07:56:01 ----D---- C:\Program Files\iTunes 2008-12-10 07:53:16 ----D---- C:\Program Files\QuickTime ======List of files/folders modified in the last 3 months====== 2009-01-18 12:14:25 ----D---- C:\Program Files\Mozilla Firefox 2009-01-18 12:14:12 ----D---- C:\WINDOWS\Temp 2009-01-18 12:13:21 ----D---- C:\WINDOWS 2009-01-18 12:12:22 ----A---- C:\WINDOWS\SchedLgU.Txt 2009-01-18 12:11:31 ----D---- C:\WINDOWS\system32 2009-01-18 12:11:30 ----SD---- C:\WINDOWS\Tasks 2009-01-18 12:11:03 ----D---- C:\WINDOWS\Prefetch 2009-01-18 12:09:24 ----SHD---- C:\WINDOWS\Installer 2009-01-18 12:09:24 ----D---- C:\Program Files\Common Files 2009-01-18 12:09:19 ----RD---- C:\Program Files 2009-01-18 12:09:19 ----D---- C:\WINDOWS\system32\drivers 2009-01-17 14:45:33 ----D---- C:\WINDOWS\system32\CatRoot2 2009-01-13 14:22:11 ----RASH---- C:\boot.ini 2009-01-13 14:22:11 ----A---- C:\WINDOWS\win.ini 2009-01-13 14:22:11 ----A---- C:\WINDOWS\system.ini 2009-01-11 22:09:30 ----AC---- C:\WINDOWS\system32\results.txt 2009-01-11 22:09:25 ----HD---- C:\WINDOWS\inf 2009-01-11 22:08:29 ----D---- C:\WINDOWS\system32\CatRoot 2009-01-11 22:07:47 ----DC---- C:\WINDOWS\system32\DRVSTORE 2009-01-11 22:06:18 ----D---- C:\WINDOWS\WinSxS 2009-01-11 21:55:44 ----D---- C:\WINDOWS\Help 2009-01-11 21:14:49 ----A---- C:\h.txt 2008-12-28 15:45:05 ----A---- C:\WINDOWS\imsins.BAK 2008-12-28 15:44:14 ----AC---- C:\WINDOWS\system32\PerfStringBackup.INI 2008-12-28 15:41:13 ----D---- C:\Program Files\Common Files\Apple 2008-12-28 15:29:00 ----D---- C:\Program Files\Windows NT 2008-12-27 16:16:31 ----D---- C:\Program Files\Symantec AntiVirus ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [] R1 intelppm;Intel Processor Driver; C:\WINDOWS\System32\DRIVERS\intelppm.sys [2004-08-03 36096] R1 OMCI;OMCI; C:\WINDOWS\SYSTEM32\DRIVERS\OMCI.SYS [2001-08-22 13632] R1 SAVRT;SAVRT; \??\C:\Program Files\Symantec AntiVirus\savrt.sys [] R1 SAVRTPEL;SAVRTPEL; \??\C:\Program Files\Symantec AntiVirus\Savrtpel.sys [] R1 SPBBCDrv;SPBBCDrv; \??\C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys [] R1 SYMTDI;SYMTDI; C:\WINDOWS\System32\Drivers\SYMTDI.SYS [2006-08-07 195776] R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.6.0.0; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2009-01-11 21425] R2 mdmxsdk;mdmxsdk; C:\WINDOWS\System32\DRIVERS\mdmxsdk.sys [2004-08-03 11868] R2 s24trans;WLAN Transport; C:\WINDOWS\System32\DRIVERS\s24trans.sys [2007-02-21 12416] R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\System32\DRIVERS\arp1394.sys [2004-08-03 60800] R3 CmBatt;Microsoft AC Adapter Driver; C:\WINDOWS\System32\DRIVERS\CmBatt.sys [2004-08-03 14080] R3 EraserUtilRebootDrv;EraserUtilRebootDrv; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [] R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2008-04-17 15464] R3 HSF_DPV;HSF_DPV; C:\WINDOWS\System32\DRIVERS\HSF_DPV.SYS [2005-05-03 1033728] R3 HSFHWICH;HSFHWICH; C:\WINDOWS\System32\DRIVERS\HSFHWICH.sys [2005-05-03 208384] R3 ialm;ialm; C:\WINDOWS\System32\DRIVERS\ialmnt5.sys [2005-07-19 1049180] R3 NAVENG;NAVENG; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20081226.002\naveng.sys [] R3 NAVEX15;NAVEX15; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20081226.002\navex15.sys [] R3 NIC1394;1394 Net Driver; C:\WINDOWS\System32\DRIVERS\nic1394.sys [2004-08-03 61824] R3 STAC97;Audio Driver (WDM) - SigmaTel CODEC; C:\WINDOWS\system32\drivers\stac97.sys [2004-11-15 264440] R3 SymEvent;SymEvent; \??\C:\Program Files\Symantec\SYMEVENT.SYS [] R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2006-03-08 191872] R3 tifm;tifm; C:\WINDOWS\system32\drivers\tifm.sys [2006-07-21 55808] R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbehci.sys [2004-08-03 26624] R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2004-08-03 57600] R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2004-08-03 20480] R3 w29n51;Intel® PRO/Wireless 2200BG Network Connection Driver for Windows XP; C:\WINDOWS\System32\DRIVERS\w29n51.sys [2007-02-08 2209408] R3 winachsf;winachsf; C:\WINDOWS\System32\DRIVERS\HSF_CNXT.sys [2005-05-03 705408] S3 flash;flash; \??\C:\WINDOWS\System32\drivers\flash.sys [] S3 gmer;gmer; C:\WINDOWS\System32\DRIVERS\gmer.sys [2009-01-18 85969] S3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\System32\DRIVERS\hidusb.sys [2001-08-17 9600] S3 nm;Network Monitor Driver; C:\WINDOWS\System32\DRIVERS\NMnt.sys [2004-08-03 40320] S3 PRISM_A02;D-Link Wireless 802.11b/g Driver (USB); C:\WINDOWS\System32\DRIVERS\PRISMA02.sys [2005-01-30 381312] S3 SYMREDRV;SYMREDRV; C:\WINDOWS\System32\Drivers\SYMREDRV.SYS [2006-08-07 24768] S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [] S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\System32\DRIVERS\usbccgp.sys [2004-08-03 31616] S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\System32\DRIVERS\usbprint.sys [2004-08-03 25856] S3 usbscan;USB Scanner Driver; C:\WINDOWS\System32\DRIVERS\usbscan.sys [2004-08-03 15104] S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2004-08-03 26496] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 ccSetMgr;Symantec Settings Manager; C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe [2006-07-19 169632] R2 DefWatch;Symantec AntiVirus Definition Watcher; C:\Program Files\Symantec AntiVirus\DefWatch.exe [2006-10-24 31424] R2 EvtEng;Intel® PROSet/Wireless Event Log; C:\Program Files\Intel\Wireless\Bin\EvtEng.exe [2007-02-21 643072] R2 RegSrvc;Intel® PROSet/Wireless Registry Service; C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe [2007-02-21 327680] R2 S24EventMonitor;Intel® PROSet/Wireless Service; C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe [2007-02-21 983040] R2 SPBBCSvc;Symantec SPBBCSvc; C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe [2006-04-11 1160848] R2 WLANKEEPER;Intel® PROSet/Wireless SSO Service; C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe [2007-02-21 294912] R2 wltrysvc;Dell Wireless WLAN Tray Service; C:\WINDOWS\System32\WLTRYSVC.EXE [2006-11-01 20480] R3 ccEvtMgr;Symantec Event Manager; C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe [2006-07-19 192160] R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2008-11-20 536872] S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-01-03 136120] S3 LiveUpdate;LiveUpdate; C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE [2006-09-02 2528960] S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136] S3 SavRoam;SAVRoam; C:\Program Files\Symantec AntiVirus\SavRoam.exe [2006-10-24 116416] S3 SNDSrvc;Symantec Network Drivers Service; C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe [2006-08-07 214720] S3 Symantec AntiVirus;Symantec AntiVirus; C:\Program Files\Symantec AntiVirus\Rtvscan.exe [2006-10-24 1813184] -----------------EOF-----------------

fenzodahl512 View Member Profile	Jan 19 2009, 04:36 AM Post #7
Trusted Helper Posts: 9,212 OS: Windows XP	Log looks good.. Lets do an online scan to see what might left Please run a free online scan with the ESET Online Scanner *Note*: You will need to use Internet Explorer for this scan. Tick the box next to YES, I accept the Terms of Use. Click Start When asked, allow the ActiveX control to install Click Start Make sure that the options Remove found threats and the option Scan unwanted applications is checked Click Scan Wait for the scan to finish Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt Copy and paste that log as a reply to this topic How's the computer now?

fenzodahl512 View Member Profile	Jan 24 2009, 05:25 AM Post #8
Trusted Helper Posts: 9,212 OS: Windows XP	Due to lack of feedback, this topic has been closed. If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.

« Next Oldest · Virus, Spyware and Trojan Removal · Next Newest »

1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)

0 Members:

Topic Title	Replies / Views	Topic Information
Virus, Spyware and Trojan Removal Please help with pop ups in my company's laptop!	13 / 1,047	28th December 2005 - 09:32 AM Adis started - last by Flrman1
Virus, Spyware and Trojan Removal My computer is a sick computer! POP UPS GALORE! SUPER SLOW! 12	24 / 1,122	10th June 2007 - 10:24 PM Losguapos6 started - last by gibb
Virus, Spyware and Trojan Removal Please help Identify suspicious files in my Hijack Log!	0 / 973	10th December 2007 - 10:10 PM catthomas started - last by catthomas
Virus, Spyware and Trojan Removal POP UPs Galore! [RESOLVED]	14 / 950	6th January 2008 - 06:36 PM dawn3519 started - last by kahdah