UAC rootkit, uacinit.dll [Solved]

Please make sure you disable ALL of your Antivirus/Antispyware/Firewall before running ComboFix.. Please visit HERE if you don't know how.. Please re-enable them back after performing all steps given..

Please download ComboFix by sUBs from HERE or HERE and save it to your Desktop.

During the download, rename Combofix to Combo-Fix as follows:






It is important you rename Combofix during the download, but not after.

**NOTE: If you are using Firefox, make sure that your download settings are as follows:

• Tools->Options->Main tab
• Set to "Always ask me where to Save the files".

After that, double-click and run Combo-Fix. Let it finish its job and post the log here

If ComboFix asked you to install Recovery Console, please do so.. It will be your best interest..

Note: DON'T do anything with your computer while ComboFix is running.. Let ComboFix finishes its job..

LOG:

ComboFix 09-08-10.06 - J 08/11/2009 16:28.1.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.511.220 [GMT -4:00]
Running from: c:\documents and settings\J\Desktop\cf.exe
FW: ZoneAlarm Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\J\Local Settings\Temporary Internet Files\ijjistarter_verinfo.dat
c:\program files\INSTALL.LOG
C:\smp.bat
c:\windows\system32\drivers\UAClogodyenkgqtoyk.sys
c:\windows\system32\UACednsbaxctaftctm.log
c:\windows\system32\UACewhpsqcxnspisyr.log
c:\windows\system32\UACgmgfhpehribtvpd.dll
c:\windows\system32\uacinit.dll
c:\windows\system32\UACmdivrxuibteqdlq.dll
c:\windows\system32\UACnmwcvumpijnaoey.dat
c:\windows\system32\UACnvnnylexrnxopeg.log
c:\windows\system32\UACpmcrdkbbymaviwe.dll
c:\windows\system32\UACuxthqowyskvtmta.dll
c:\windows\system32\UACyxsqxpkjtaaqkcv.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_UACd.sys
-------\Legacy_UACd.sys


((((((((((((((((((((((((( Files Created from 2009-07-11 to 2009-08-11 )))))))))))))))))))))))))))))))
.

2009-08-10 21:59 . 2009-08-11 01:52 117760 ----a-w- c:\documents and settings\J\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-08-10 21:58 . 2009-08-10 21:58 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-08-10 21:58 . 2009-08-10 22:11 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-08-10 21:58 . 2009-08-10 21:58 -------- d-----w- c:\documents and settings\J\Application Data\SUPERAntiSpyware.com
2009-08-10 18:11 . 2009-08-10 18:11 552 ----a-w- c:\windows\system32\d3d8caps.dat
2009-08-10 16:38 . 2007-10-23 13:27 110592 ----a-w- c:\documents and settings\J\Application Data\U3\temp\cleanup.exe
2009-08-10 16:33 . 2008-05-02 14:41 3493888 ---ha-w- c:\documents and settings\J\Application Data\U3\temp\Launchpad Removal.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-11 20:41 . 2007-11-20 20:23 27045920 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-08-11 20:14 . 2004-12-23 02:32 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-08-11 20:12 . 2008-05-24 05:42 -------- d-----w- c:\program files\HJT2
2009-08-11 20:11 . 2007-11-25 17:36 -------- d-----w- c:\program files\Norton Security Scan
2009-08-11 04:17 . 2009-05-29 23:12 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-08-10 21:58 . 2008-08-15 02:01 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-08-10 19:15 . 2009-08-10 21:20 5164032 ----a-w- c:\windows\Internet Logs\xDBE.tmp
2009-08-10 16:33 . 2008-08-24 00:47 -------- d-----w- c:\documents and settings\J\Application Data\U3
2009-06-29 16:12 . 2001-08-23 12:00 827392 ----a-w- c:\windows\system32\wininet.dll
2009-06-29 16:12 . 2004-12-21 21:18 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-06-29 16:12 . 2001-08-23 12:00 17408 ----a-w- c:\windows\system32\corpol.dll
2009-06-16 14:55 . 2001-08-23 12:00 82432 ----a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:55 . 2001-08-23 12:00 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-05 10:48 . 2009-06-05 10:48 0 ----a-w- c:\documents and settings\J\Application Data\~ygw.tmp
2009-06-03 19:27 . 2001-08-23 12:00 1290752 ----a-w- c:\windows\system32\quartz.dll
2009-05-26 17:20 . 2009-05-29 23:12 40160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-26 17:19 . 2009-05-29 23:12 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2005-06-27 23:16 . 2005-06-27 23:16 774144 ----a-w- c:\program files\RngInterstitial.dll
2005-01-21 00:53 . 2005-11-05 18:29 45056 ------r- c:\program files\SetAttrib.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MessengerPlus3"="c:\program files\Messenger Plus! 3\MsgPlus.exe" [2006-09-30 190024]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"msnmsgr"="c:\program files\MSN Messenger\msnmsgr.exe" [2007-01-19 5674352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BJCFD"="c:\program files\BroadJump\Client Foundation\CFD.exe" [2001-12-17 483394]
"MessengerPlus3"="c:\program files\Messenger Plus! 3\MsgPlus.exe" [2006-09-30 190024]
"EPSON PictureMate"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S4I2P1.EXE" [2003-09-19 99840]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"LaunchPDeviceConn"="c:\program files\Philips\Philips Device Transfer Pop-up\PDeviceConn.exe" [2005-07-06 299008]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2006-02-23 278528]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 90112]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-06-29 286720]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-09-06 919016]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2006-02-23 35328]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-17 49152]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-12-22 113664]
Event Planner Reminders Tray Icon.lnk - c:\sierra\Planner\PLNRnote.exe [2005-2-6 184320]
Forget Me Not.lnk - c:\program files\Broderbund\AG CreataCard\AGRemind.exe [2006-11-11 323584]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-1-2 210520]
InterVideo WinCinema Manager.lnk - c:\program files\InterVideo\Common\Bin\WinCinemaMgr.exe [2005-7-8 81920]
VIA RAID TOOL.lnk - c:\program files\VIA\RAID\raid_tool.exe [2004-12-21 565248]
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2004-12-22 118784]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 16:05 356352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AVG Anti-Spyware Guard]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Westwood\\Nox\\Game.exe"=
"c:\\Westwood\\Nox\\patchget.dat"=
"c:\\Program Files\\Microsoft Games\\Dungeon Siege\\DungeonSiege.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\MAIET\\Gunz\\Gunz.exe"=
"c:\\Valve\\Condition Zero\\czero.exe"=
"c:\\Program Files\\UnrealExtract\\UnrealGOTY\\System\\UnrealTournament.exe"=
"c:\\Program Files\\MAIET\\Gunz\\GunzLauncher.exe"=
"c:\\Program Files\\BitTorrent\\btdownloadgui.exe"=
"c:\\Program Files\\DS2\\DungeonSiege2.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"c:\\Documents and Settings\\J\\Desktop\\Quake3 with Team Arena\\quake3.exe"=
"c:\\Program Files\\MAIET\\Gunz\\BAReport.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\uTorrent\\utorrent.exe"=
"c:\\Program Files\\Sierra\\FEAR\\FEAR.exe"=
"c:\\Program Files\\Sierra\\FEAR\\fpupdate.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\ijji\\ENGLISH\\Gunz\\BAReport.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe"=
"c:\nexon\Combat Arms\CombatArms.exe"= c:\nexon\Combat Arms\CombatArms.exe:*Enabled:CombatArms.exe
"c:\nexon\Combat Arms\Engine.exe"= c:\nexon\Combat Arms\Engine.exe:*Enabled:Engine.exe
"c:\\Nexon\\Combat Arms\\NMService.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"56422:TCP"= 56422:TCP:Pando Media Booster
"56422:UDP"= 56422:UDP:Pando Media Booster

R0 viasraid;viasraid;c:\windows\system32\drivers\viasraid.sys [12/21/2004 4:38 PM 77312]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [8/5/2009 4:06 PM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [8/5/2009 4:06 PM 74480]
R3 Eacfilt;Eacfilt Miniport;c:\windows\system32\drivers\eacfilt.sys [1/8/2005 5:24 PM 9433]
S2 gzfil;gzfil;c:\windows\system32\drivers\myjkbx.sys --> c:\windows\system32\drivers\myjkbx.sys [?]
S2 IPSECEXT;Nortel Extranet Access Protocol;c:\windows\system32\drivers\ipsecw2k.sys [1/8/2005 5:21 PM 115680]
S3 jnv4_mib;jnv4_mib;\??\c:\docume~1\J\LOCALS~1\Temp\jnv4_mib.sys --> c:\docume~1\J\LOCALS~1\Temp\jnv4_mib.sys [?]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [8/5/2009 4:06 PM 7408]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [3/31/2008 1:42 AM 747912]
S3 XDva090;XDva090;\??\c:\windows\system32\XDva090.sys --> c:\windows\system32\XDva090.sys [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder

2009-05-16 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 17:42]
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-SUPERAntiSpyware - c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe
SafeBoot-AVG Anti-Spyware Driver


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
IE: &Search - ?p=ZJ
IE: &Yahoo! Search - file:///c:\program files\Yahoo!\Common/ycsrch.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Yahoo! &Dictionary - file:///c:\program files\Yahoo!\Common/ycdict.htm
IE: Yahoo! &Maps - file:///c:\program files\Yahoo!\Common/ycmap.htm
IE: Yahoo! &SMS - file:///c:\program files\Yahoo!\Common/ycsms.htm
FF - ProfilePath - c:\documents and settings\J\Application Data\Mozilla\Firefox\Profiles\sgdpa1i7.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official
FF - plugin: c:\documents and settings\All Users\Application Data\NexonUS\NGM\npNxGameUS.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npPandoWebInst.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-11 16:38
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1312)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2009-08-11 16:43
ComboFix-quarantined-files.txt 2009-08-11 20:43

Pre-Run: 3,477,893,120 bytes free
Post-Run: 3,472,637,952 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=AlwaysOff

211 --- E O F --- 2009-07-29 12:09

1. Please open Notepad

• If you don't know how, just go to Start >> Run >> copy/paste notepad.exe >> Enter

2. Now copy/paste the entire content of the codebox below into the Notepad window:

KillAll::

Driver::
gzfil
jnv4_mib

File::
c:\windows\system32\drivers\myjkbx.sys
c:\docume~1\J\LOCALS~1\Temp\jnv4_mib.sys

3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.




5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

• Combofix.txt
• A new HijackThis log.

COMBO log:

ComboFix 09-08-10.06 - J 08/12/2009 1:47.2.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.511.258 [GMT -4:00]
Running from: c:\documents and settings\J\Desktop\cf.exe
Command switches used :: c:\documents and settings\J\Desktop\CFScript.txt
FW: ZoneAlarm Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

FILE ::
"c:\docume~1\J\LOCALS~1\Temp\jnv4_mib.sys"
"c:\windows\system32\drivers\myjkbx.sys"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_GZFIL
-------\Legacy_JNV4_MIB
-------\Service_gzfil
-------\Service_jnv4_mib


((((((((((((((((((((((((( Files Created from 2009-07-12 to 2009-08-12 )))))))))))))))))))))))))))))))
.

2009-08-10 21:59 . 2009-08-11 01:52 117760 ----a-w- c:\documents and settings\J\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-08-10 21:58 . 2009-08-10 21:58 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-08-10 21:58 . 2009-08-10 22:11 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-08-10 21:58 . 2009-08-10 21:58 -------- d-----w- c:\documents and settings\J\Application Data\SUPERAntiSpyware.com
2009-08-10 18:11 . 2009-08-10 18:11 552 ----a-w- c:\windows\system32\d3d8caps.dat
2009-08-10 16:38 . 2007-10-23 13:27 110592 ----a-w- c:\documents and settings\J\Application Data\U3\temp\cleanup.exe
2009-08-10 16:33 . 2008-05-02 14:41 3493888 ---ha-w- c:\documents and settings\J\Application Data\U3\temp\Launchpad Removal.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-12 06:01 . 2007-11-20 20:23 27148320 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-08-12 05:58 . 2007-11-20 20:23 319148 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-08-11 20:14 . 2004-12-23 02:32 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-08-11 20:12 . 2008-05-24 05:42 -------- d-----w- c:\program files\HJT2
2009-08-11 20:11 . 2007-11-25 17:36 -------- d-----w- c:\program files\Norton Security Scan
2009-08-11 04:17 . 2009-05-29 23:12 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-08-10 21:58 . 2008-08-15 02:01 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-08-10 19:15 . 2009-08-10 21:20 5164032 ----a-w- c:\windows\Internet Logs\xDBE.tmp
2009-08-10 16:33 . 2008-08-24 00:47 -------- d-----w- c:\documents and settings\J\Application Data\U3
2009-06-29 16:12 . 2001-08-23 12:00 827392 ----a-w- c:\windows\system32\wininet.dll
2009-06-29 16:12 . 2004-12-21 21:18 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-06-29 16:12 . 2001-08-23 12:00 17408 ----a-w- c:\windows\system32\corpol.dll
2009-06-16 14:55 . 2001-08-23 12:00 82432 ----a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:55 . 2001-08-23 12:00 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-05 10:48 . 2009-06-05 10:48 0 ----a-w- c:\documents and settings\J\Application Data\~ygw.tmp
2009-06-03 19:27 . 2001-08-23 12:00 1290752 ----a-w- c:\windows\system32\quartz.dll
2009-05-26 17:20 . 2009-05-29 23:12 40160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-26 17:19 . 2009-05-29 23:12 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2005-06-27 23:16 . 2005-06-27 23:16 774144 ----a-w- c:\program files\RngInterstitial.dll
2005-01-21 00:53 . 2005-11-05 18:29 45056 ------r- c:\program files\SetAttrib.exe
.

((((((((((((((((((((((((((((( SnapShot@2009-08-11_20.38.48 )))))))))))))))))))))))))))))))))))))))))
.
- 2001-08-23 12:00 . 2009-08-11 20:32 65044 c:\windows\system32\perfc009.dat
+ 2001-08-23 12:00 . 2009-08-11 20:39 65044 c:\windows\system32\perfc009.dat
+ 2001-08-23 12:00 . 2009-08-11 20:39 410112 c:\windows\system32\perfh009.dat
- 2001-08-23 12:00 . 2009-08-11 20:32 410112 c:\windows\system32\perfh009.dat
+ 2009-08-12 05:58 . 2009-08-12 05:58 1413120 c:\windows\ERDNT\subs\Users\00000006\UsrClass.dat
+ 2009-08-12 05:58 . 2009-08-12 05:58 1191936 c:\windows\ERDNT\subs\Users\00000004\UsrClass.dat
+ 2009-08-12 05:58 . 2009-08-12 05:58 1421312 c:\windows\ERDNT\subs\Users\00000003\NTUSER.DAT
+ 2009-08-12 05:58 . 2009-08-12 05:58 1191936 c:\windows\ERDNT\subs\Users\00000002\UsrClass.dat
+ 2009-08-12 05:58 . 2009-08-12 05:58 1421312 c:\windows\ERDNT\subs\Users\00000001\NTUSER.DAT
+ 2009-08-12 05:58 . 2009-08-12 05:58 11104256 c:\windows\ERDNT\subs\Users\00000005\ntuser.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MessengerPlus3"="c:\program files\Messenger Plus! 3\MsgPlus.exe" [2006-09-30 190024]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"msnmsgr"="c:\program files\MSN Messenger\msnmsgr.exe" [2007-01-19 5674352]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BJCFD"="c:\program files\BroadJump\Client Foundation\CFD.exe" [2001-12-17 483394]
"MessengerPlus3"="c:\program files\Messenger Plus! 3\MsgPlus.exe" [2006-09-30 190024]
"EPSON PictureMate"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S4I2P1.EXE" [2003-09-19 99840]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"LaunchPDeviceConn"="c:\program files\Philips\Philips Device Transfer Pop-up\PDeviceConn.exe" [2005-07-06 299008]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2006-02-23 278528]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 90112]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-06-29 286720]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-09-06 919016]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2006-02-23 35328]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-17 49152]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-12-22 113664]
Event Planner Reminders Tray Icon.lnk - c:\sierra\Planner\PLNRnote.exe [2005-2-6 184320]
Forget Me Not.lnk - c:\program files\Broderbund\AG CreataCard\AGRemind.exe [2006-11-11 323584]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-1-2 210520]
InterVideo WinCinema Manager.lnk - c:\program files\InterVideo\Common\Bin\WinCinemaMgr.exe [2005-7-8 81920]
VIA RAID TOOL.lnk - c:\program files\VIA\RAID\raid_tool.exe [2004-12-21 565248]
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2004-12-22 118784]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 16:05 356352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AVG Anti-Spyware Guard]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Westwood\\Nox\\Game.exe"=
"c:\\Westwood\\Nox\\patchget.dat"=
"c:\\Program Files\\Microsoft Games\\Dungeon Siege\\DungeonSiege.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\MAIET\\Gunz\\Gunz.exe"=
"c:\\Valve\\Condition Zero\\czero.exe"=
"c:\\Program Files\\UnrealExtract\\UnrealGOTY\\System\\UnrealTournament.exe"=
"c:\\Program Files\\MAIET\\Gunz\\GunzLauncher.exe"=
"c:\\Program Files\\BitTorrent\\btdownloadgui.exe"=
"c:\\Program Files\\DS2\\DungeonSiege2.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"c:\\Documents and Settings\\J\\Desktop\\Quake3 with Team Arena\\quake3.exe"=
"c:\\Program Files\\MAIET\\Gunz\\BAReport.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\uTorrent\\utorrent.exe"=
"c:\\Program Files\\Sierra\\FEAR\\FEAR.exe"=
"c:\\Program Files\\Sierra\\FEAR\\fpupdate.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\ijji\\ENGLISH\\Gunz\\BAReport.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe"=
"c:\nexon\Combat Arms\CombatArms.exe"= c:\nexon\Combat Arms\CombatArms.exe:*Enabled:CombatArms.exe
"c:\nexon\Combat Arms\Engine.exe"= c:\nexon\Combat Arms\Engine.exe:*Enabled:Engine.exe
"c:\\Nexon\\Combat Arms\\NMService.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"56422:TCP"= 56422:TCP:Pando Media Booster
"56422:UDP"= 56422:UDP:Pando Media Booster

R0 viasraid;viasraid;c:\windows\system32\drivers\viasraid.sys [12/21/2004 4:38 PM 77312]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [8/5/2009 4:06 PM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [8/5/2009 4:06 PM 74480]
R3 Eacfilt;Eacfilt Miniport;c:\windows\system32\drivers\eacfilt.sys [1/8/2005 5:24 PM 9433]
S2 IPSECEXT;Nortel Extranet Access Protocol;c:\windows\system32\drivers\ipsecw2k.sys [1/8/2005 5:21 PM 115680]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [8/5/2009 4:06 PM 7408]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [3/31/2008 1:42 AM 747912]
S3 XDva090;XDva090;\??\c:\windows\system32\XDva090.sys --> c:\windows\system32\XDva090.sys [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder

2009-05-16 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 17:42]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
IE: &Search - ?p=ZJ
IE: &Yahoo! Search - file:///c:\program files\Yahoo!\Common/ycsrch.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Yahoo! &Dictionary - file:///c:\program files\Yahoo!\Common/ycdict.htm
IE: Yahoo! &Maps - file:///c:\program files\Yahoo!\Common/ycmap.htm
IE: Yahoo! &SMS - file:///c:\program files\Yahoo!\Common/ycsms.htm
FF - ProfilePath - c:\documents and settings\J\Application Data\Mozilla\Firefox\Profiles\sgdpa1i7.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official
FF - plugin: c:\documents and settings\All Users\Application Data\NexonUS\NGM\npNxGameUS.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npPandoWebInst.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-12 02:01
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1312)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(4016)
c:\windows\system32\WININET.dll
c:\program files\Messenger Plus! 3\MsgPlusLoader1.dll
c:\windows\system32\ieframe.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ZoneLabs\vsmon.exe
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe
c:\program files\ATI Technologies\ATI.ACE\CLI.exe
c:\program files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Analog Devices\SoundMAX\SMAgent.exe
c:\windows\system32\wdfmgr.exe
c:\progra~1\Yahoo!\MESSEN~1\Ymsgr_tray.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\wscntfy.exe
c:\program files\HP\Digital Imaging\bin\hpqste08.exe
c:\program files\ATI Technologies\ATI.ACE\CLI.exe
c:\program files\ATI Technologies\ATI.ACE\CLI.exe
c:\program files\Java\jre1.6.0_07\bin\jucheck.exe
.
**************************************************************************
.
Completion time: 2009-08-12 2:11 - machine was rebooted
ComboFix-quarantined-files.txt 2009-08-12 06:11
ComboFix2.txt 2009-08-11 20:43

Pre-Run: 3,393,245,184 bytes free
Post-Run: 3,250,470,912 bytes free

232 --- E O F --- 2009-07-29 12:09




HJT LOG:




Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:20:23 AM, on 8/12/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16876)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Messenger Plus! 3\MsgPlus.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2P1.EXE
C:\Program Files\Philips\Philips Device Transfer Pop-up\PDeviceConn.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Sierra\Planner\PLNRnote.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HJT2\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c...rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.c...//www.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [EPSON PictureMate] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2P1.EXE /P17 "EPSON PictureMate" /O6 "USB001" /M "PictureMate"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LaunchPDeviceConn] "C:\Program Files\Philips\Philips Device Transfer Pop-up\PDeviceConn.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Event Planner Reminders Tray Icon.lnk = C:\Sierra\Planner\PLNRnote.exe
O4 - Global Startup: Forget Me Not.lnk = C:\Program Files\Broderbund\AG CreataCard\AGRemind.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Search - ?p=ZJ
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {1842B0EE-B597-11D4-8997-00104BD12D94} (iCC Class) - http://www.pcpitstop...cpConnCheck.cab
O16 - DPF: {44C1E3A2-B594-401C-B27A-D1B4476E4797} (XTSAC Control) - https://bizlink.oeconn.com/XTSAC.cab
O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} (ijjiPlugin2 Class) - http://gamedownload....Plugin11USA.cab
O16 - DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850} (Microsoft RDP Client Control (redist)) - https://bizlink.oeconn.com/msrdp.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O16 - DPF: {CC32D4D8-2A0B-4CEB-B105-C9B968379105} (CGameManagerCtrl Object) - https://disney.go.co...GameManager.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload....GPlugin9USA.cab
O16 - DPF: {DD583921-A9E9-4FBF-9266-8DC2AB5EA0AF} (HGPlugin10USA Class) - http://gamedownload....Plugin10USA.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 10505 bytes

Please download Malwarebytes' Anti-Malware from HERE or HERE

Note: If you already have Malwarebytes' Anti-Malware, just run and update it.. Then do a "Perform Full Scan"

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Full Scan", then click Scan.
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.





Please run a free online scan with the ESET Online Scanner
Note: You will need to use Internet Explorer for this scan.

• Tick the box next to YES, I accept the Terms of Use.
• Click Start
• When asked, allow the ActiveX control to install
• Click Start
• Make sure that the options Remove found threats and the option Scan unwanted applications is checked
• Click Scan
  Wait for the scan to finish
• Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
• Copy and paste that log as a reply to this topic

How's the computer now?

I cannot run the ESET scanner. It attempts to download the database since it is my first time running it. It Reaches 99% then says "Cannot download... Is Proxy Configured?". I did not tell it to use a custom proxy. I am using IE 7.

Here is the malwarebytes log (It found a bunch of stuff):

Malwarebytes' Anti-Malware 1.40
Database version: 2551
Windows 5.1.2600 Service Pack 2

8/12/2009 9:08:45 PM
mbam-log-2009-08-12 (21-08-45).txt

Scan type: Full Scan (C:\|)
Objects scanned: 269002
Time elapsed: 55 minute(s), 22 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 13

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Qoobox\Quarantine\C\WINDOWS\system32\UACgmgfhpehribtvpd.dll.vir (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\UACmdivrxuibteqdlq.dll.vir (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\UACpmcrdkbbymaviwe.dll.vir (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\UACuxthqowyskvtmta.dll.vir (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\UACyxsqxpkjtaaqkcv.dll.vir (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\UAClogodyenkgqtoyk.sys.vir (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{8FF9F956-2653-4BF1-85C6-9AAAF011EBEA}\RP0\A0000001.sys (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{8FF9F956-2653-4BF1-85C6-9AAAF011EBEA}\RP0\A0000002.dll (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{8FF9F956-2653-4BF1-85C6-9AAAF011EBEA}\RP0\A0000003.dll (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{8FF9F956-2653-4BF1-85C6-9AAAF011EBEA}\RP0\A0000004.dll (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{8FF9F956-2653-4BF1-85C6-9AAAF011EBEA}\RP0\A0000005.dll (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{8FF9F956-2653-4BF1-85C6-9AAAF011EBEA}\RP0\A0000006.dll (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\Documents and Settings\J\My Documents\Unzipped\plane\plane.exe (Trojan.Agent) -> Quarantined and deleted successfully.

Lets use other type of scanner...

Go HERE and download Dr.Web CureIt to the Desktop. It will be download as random filename.

• Run Dr.Web CureIt (random filename) and let it run the express scan
• This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan.
• Once the short scan has finished, please do a re-scan.. This time, choose Complete Scan
• Click the green arrow button at the right, and the scan will start.
• After the scan finished, click Select all
• Click on Cure and choose Move incurable
• When the scan has finished, in the menu, click File and choose Save report list
• Save the report to your Desktop. The report will be called DrWeb.csv
• Close Dr.Web Cureit. Reboot your PC in Normal Mode, and post DrWeb.csv in your next reply (Open it as Notepad)

It didnt do anything two a few items, even after like an hour of letting it process the cures (Notably the Tool.NirCmd.1's).

My computer seems to be running well.

msimg32.dll;c:\program files\msn messenger;Adware.MyWebSearch.2;Incurable.Moved.;
Fixwareout.exe\data003;C:\Documents and Settings\J\Desktop\Fixwareout.exe;Tool.NirCmd.1;;
Fixwareout.exe;C:\Documents and Settings\J\Desktop;Archive contains infected objects;Moved.;
Fixwareout.exe\data003;C:\Documents and Settings\J\Desktop\Desktop Cleanup\Fixwareout.exe;Tool.NirCmd.1;;
Fixwareout.exe;C:\Documents and Settings\J\Desktop\Desktop Cleanup;Archive contains infected objects;Moved.;
Process.exe;C:\Documents and Settings\J\Desktop\Desktop Cleanup\smitRem;Tool.Prockill;Incurable.Moved.;
pv.exe;C:\Documents and Settings\J\Desktop\Desktop Cleanup\smitRem;Program.PrcView.3741;Incurable.Moved.;
NoInvis.exe;C:\Documents and Settings\J\My Documents\My Received Files;Tool.GameCrack;Incurable.Moved.;
ShadyEDK.exe;C:\Documents and Settings\J\My Documents\My Received Files;Tool.GameCrack;Incurable.Moved.;
RichBound.exe;C:\Documents and Settings\J\My Documents\Unzipped\Gunbound Money Hack;BackDoor.IRC.Gunbot.origin;Incurable.Moved.;
nircmd.exe;C:\fixwareout\FindT;Tool.NirCmd.1;Incurable.Moved.;
XTrapApi.dll;C:\Program Files\MAIET\Gunz\XTrap;Probably DLOADER.Trojan;Incurable.Moved.;
0945299D;C:\Program Files\Norton AntiVirus\Quarantine;Trojan.MulDrop.1409;Deleted.;
13B90046;C:\Program Files\Norton AntiVirus\Quarantine;Trojan.MulDrop.1773;Deleted.;
18F32702.exe;C:\Program Files\Norton AntiVirus\Quarantine;Trojan.Proxy;Deleted.;
19144ADE.exe;C:\Program Files\Norton AntiVirus\Quarantine;Trojan.Proxy;Deleted.;
192172D0.exe;C:\Program Files\Norton AntiVirus\Quarantine;Trojan.Proxy;Deleted.;
19356EBA.exe;C:\Program Files\Norton AntiVirus\Quarantine;Trojan.Proxy;Deleted.;
20005DB3;C:\Program Files\Norton AntiVirus\Quarantine;Trojan.DownLoader.2163;Deleted.;
22C11919.exe;C:\Program Files\Norton AntiVirus\Quarantine;Trojan.MulDrop.1773;Deleted.;
31E77F36;C:\Program Files\Norton AntiVirus\Quarantine;Trojan.DownLoader.2163;Deleted.;
394E5C35;C:\Program Files\Norton AntiVirus\Quarantine;Trojan.MulDrop.2069;Deleted.;
3CAC72E7.exe;C:\Program Files\Norton AntiVirus\Quarantine;Trojan.MulDrop.1773;Deleted.;
3CAF1CE4.exe;C:\Program Files\Norton AntiVirus\Quarantine;Trojan.MulDrop.1773;Deleted.;
55F1631B.exe;C:\Program Files\Norton AntiVirus\Quarantine;Trojan.MulDrop.1773;Deleted.;
66BE037F;C:\Program Files\Norton AntiVirus\Quarantine;Trojan.MulDrop.1773;Deleted.;
7B0B1E80;C:\Program Files\Norton AntiVirus\Quarantine;Trojan.MulDrop.1773;Deleted.;
7BF24271.exe;C:\Program Files\Norton AntiVirus\Quarantine;Trojan.MulDrop.1773;Deleted.;
7CC851AB;C:\Program Files\Norton AntiVirus\Quarantine;Trojan.MulDrop.1773;Deleted.;
7E8D6F19.exe;C:\Program Files\Norton AntiVirus\Quarantine;Trojan.MulDrop.1773;Deleted.;
GameMon.des;C:\Program Files\softnyx\GunBound\GameGuard;Probably BACKDOOR.Trojan;Incurable.Moved.;
GameMon.des;C:\Program Files\softnyx\GunboundWC\GameGuard;Probably BACKDOOR.Trojan;Incurable.Moved.;
GameMon.des;C:\Program Files\Webzen\Mu\GameGuard;Probably BACKDOOR.Trojan;Incurable.Moved.;
Process.exe;C:\smitRem;Tool.Prockill;Incurable.Moved.;
pv.exe;C:\smitRem;Program.PrcView.3741;Incurable.Moved.;
A0000368.dll;C:\System Volume Information\_restore{8FF9F956-2653-4BF1-85C6-9AAAF011EBEA}\RP2;Adware.MyWebSearch.2;Incurable.Moved.;
A0000369.exe\data003;C:\System Volume Information\_restore{8FF9F956-2653-4BF1-85C6-9AAAF011EBEA}\RP2\A0000369.exe;Tool.NirCmd.1;;
A0000369.exe;C:\System Volume Information\_restore{8FF9F956-2653-4BF1-85C6-9AAAF011EBEA}\RP2;Archive contains infected objects;Moved.;
A0000370.exe\data003;C:\System Volume Information\_restore{8FF9F956-2653-4BF1-85C6-9AAAF011EBEA}\RP2\A0000370.exe;Tool.NirCmd.1;;
A0000370.exe;C:\System Volume Information\_restore{8FF9F956-2653-4BF1-85C6-9AAAF011EBEA}\RP2;Archive contains infected objects;Moved.;
A0000372.exe;C:\System Volume Information\_restore{8FF9F956-2653-4BF1-85C6-9AAAF011EBEA}\RP2;Trojan.Proxy;Deleted.;
A0000373.exe;C:\System Volume Information\_restore{8FF9F956-2653-4BF1-85C6-9AAAF011EBEA}\RP2;Trojan.Proxy;Deleted.;
A0000374.exe;C:\System Volume Information\_restore{8FF9F956-2653-4BF1-85C6-9AAAF011EBEA}\RP2;Trojan.Proxy;Deleted.;
A0000375.exe;C:\System Volume Information\_restore{8FF9F956-2653-4BF1-85C6-9AAAF011EBEA}\RP2;Trojan.Proxy;Deleted.;
A0000376.exe;C:\System Volume Information\_restore{8FF9F956-2653-4BF1-85C6-9AAAF011EBEA}\RP2;Trojan.MulDrop.1773;Deleted.;
A0000377.exe;C:\System Volume Information\_restore{8FF9F956-2653-4BF1-85C6-9AAAF011EBEA}\RP2;Trojan.MulDrop.1773;Deleted.;
A0000378.exe;C:\System Volume Information\_restore{8FF9F956-2653-4BF1-85C6-9AAAF011EBEA}\RP2;Trojan.MulDrop.1773;Deleted.;
A0000379.exe;C:\System Volume Information\_restore{8FF9F956-2653-4BF1-85C6-9AAAF011EBEA}\RP2;Trojan.MulDrop.1773;Deleted.;
A0000380.exe;C:\System Volume Information\_restore{8FF9F956-2653-4BF1-85C6-9AAAF011EBEA}\RP2;Trojan.MulDrop.1773;Deleted.;
A0000381.exe;C:\System Volume Information\_restore{8FF9F956-2653-4BF1-85C6-9AAAF011EBEA}\RP2;Trojan.MulDrop.1773;Deleted.;
ChatHack.exe;C:\Unzipped;Tool.GameCrack;Incurable.Moved.;
DeFi's Player Editor.exe;C:\Unzipped\defiplayereditor;Tool.GameCrack;Incurable.Moved.;
ZoaEDK.exe;C:\Unzipped\noxtools-0.30;Tool.GameCrack;Incurable.Moved.;
msn.hta;C:\WINDOWS;Trojan.DownLoader.588;Deleted.;

(Notably the Tool.NirCmd.1's)

That's a legit that been used by tools that designed to remove specific malware.. Dr.Web detects it because you used it earlier..

Looks good to me.. Lets do some cleanup...


Please download OTC and save it to Desktop.

• Make sure you have internet connection..
• Double-click OTC
• Click the CleanUp! button.
• Select Yes when the "Begin cleanup Process?" prompt appears.
• If you are prompted to Reboot during the cleanup, select Yes

Please read these excellent articles write by my friends:
Preventing Malware and Safe Computing by Rorschach112
What makes your machine slow? by Artellos


Also, please read these excellent articles by miekiemoes :
Help! My computer is slow!
How to prevent Malware


Read these great info's about safe internet surfing..

http://www.pcpitstop...safesurfing.asp
http://bluefive.pair...afe_surfing.htm




Please reply to this thread once more and tell us about the computer behaviour before we can close this thread



Have a safe and happy computing day!


Regards
fenzodahl512

Thank you for your help. The world needs more tech-savvy people to fight the ugly on the internet.

My computer is running well.

-Roman

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.