how to remove win32.rootkit.agent.odg [Solved]

Need a geek? Geeks to Go offers free, quality tech support -- in terms anyone can understand. Volunteers are waiting to help, friendly, technology experts who have knowledge to share, and enjoy helping others. Feel free to browse the site as a guest. However, you must log in to reply to existing topics, or to start a new topic of your own. Other benefits of joining include richer forum features, and removal of all advertising. Learn more in our Welcome Guide Infected? Malware and Spyware Cleaning Guide. What are you waiting for? Click here to join for free today!

> Geeks to Go! » Security » Virus, Spyware and Trojan Removal

2 Pages

1 2 >

how to remove win32.rootkit.agent.odg [Solved]

Options

suryavarma143 View Member Profile	Aug 21 2009, 11:27 PM Post #1
Member Posts: 17 OS: XP	plz help me in removing this trojan thanks in advance

suryavarma143 View Member Profile	Aug 27 2009, 12:18 AM Post #2
Member Posts: 17 OS: XP	plz help me in removing this...

emeraldnzl View Member Profile	Aug 28 2009, 01:32 AM Post #3
Trusted Helper Posts: 8,065 OS: XP Pro	Hello suryavarma143, I have merged these topics. You should only have one topic at a time. Now You may have used Malwarebytes before. If you have, and still have it on your machine, please update and run. Post the scan report back here. If you do not have Malwarebytes please download from Here Double Click mbam-setup.exe to install the application. Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish. If an update is found, it will download and install the latest version. Once the program has loaded, select "Perform Quick Scan", then click Scan. The scan may take some time to finish,so please be patient. When the scan is complete, click OK, then Show Results to view the results. Make sure that everything is checked, and click Remove Selected. When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note) The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM. Copy&Paste the entire report in your next reply. Extra Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly. Next Download OTL to your desktop. Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted. When the window appears, underneath Output at the top change it to Minimal Output. Under the Standard Registry box change it to All. Check the boxes beside LOP Check and Purity Check. Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long. When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL. Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. So when you return please post MBAM log the two OTL logs - OTL.txt and Extras.txt Note: Unless otherwise instructed always post the logs in the forum. If reports don't fit on one post. It might be necessary to break the logs up to get them on the forum. Just use as many posts as you need, that's fine.

suryavarma143 View Member Profile	Aug 28 2009, 04:45 AM Post #4
Member Posts: 17 OS: XP	MBAM log 1 Malwarebytes' Anti-Malware 1.40 Database version: 2667 Windows 5.1.2600 Service Pack 3 8/21/2009 1:50:30 AM mbam-log-2009-08-21 (01-50-30).txt Scan type: Quick Scan Objects scanned: 86790 Time elapsed: 4 minute(s), 49 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 98 Registry Values Infected: 0 Registry Data Items Infected: 1 Folders Infected: 11 Files Infected: 3 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{cf54be1c-9359-4395-8533-1657cf209cfe} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\{d518921a-4a03-425e-9873-b9a71756821e} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea1-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18eab-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{25560540-9571-4d7b-9389-0f166788785a} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3dc201fb-e9c9-499c-a11f-23c360d7c3f8} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9ff05104-b030-46fc-94b8-81276e4e27df} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59c7fc09-1c83-4648-b3e6-003d2bbc7481} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68af847f-6e91-45dd-9b68-d6a12c30e5d7} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170b96c-28d4-4626-8358-27e6caeef907} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{d1a71fa0-ff48-48dd-9b6d-7a13a3e42127} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ddb1968e-ead6-40fd-8dae-ff14757f60c7} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{f138d901-86f0-4383-99b6-9cdd406036da} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\FocusInteractive (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWay) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rpt.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safe.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safebox.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\antiarp.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ArSwp.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AST.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutoRun.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutoRunKiller.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvMonitor.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccevtmgr.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccsetmgr.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Frameworkservice.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GFUpd.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GuardField.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HijackThis.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icesword.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Iparmor.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASARP.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAV32.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVPFW.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KavStart.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kissvc.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kmailmon.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFWSvc.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRegEx.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KSWebShield.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP.KXP (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVwsc.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LiveUpdate360.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Mcshield.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmsk.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\naprdmgr.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Navapsvc.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32kui.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFW.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQDoctor.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMon.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMonD.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavService.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStub.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavTask.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAVTRAY.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RfwMain.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwProxy.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwstub.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RsAgent.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rsaupd.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RsMain.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rsnetsvr.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RsTray.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rtvscan.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runiep.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safeboxTray.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ScanFrm.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SREngLdr.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojanDetector.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Trojanwall.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojDie.kxp (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VPC32.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vptray.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vstskmgr.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WOPTILITIES.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue (Hijack.System.Hidden) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully. Folders Infected: C:\Documents and Settings\Administrator\Application Data\FunWebProducts (Adware.MyWay) -> Quarantined and deleted successfully. C:\Documents and Settings\Administrator\Application Data\FunWebProducts\Data (Adware.MyWay) -> Quarantined and deleted successfully. C:\Documents and Settings\Administrator\Application Data\FunWebProducts\Data\Administrator (Adware.MyWay) -> Quarantined and deleted successfully. C:\Program Files\FunWebProducts (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\FunWebProducts\ScreenSaver (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\FunWebProducts\ScreenSaver\Images (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\FunWebProducts\Shared (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\History (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\Settings (Adware.MyWebSearch) -> Quarantined and deleted successfully. Files Infected: C:\Documents and Settings\Administrator\Application Data\FunWebProducts\Data\Administrator\avatar.dat (Adware.MyWay) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\History\search3 (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat (Adware.MyWebSearch) -> Quarantined and deleted successfully. This post has been edited by suryavarma143: Aug 28 2009, 04:48 AM

suryavarma143 View Member Profile	Aug 28 2009, 04:46 AM Post #5
Member Posts: 17 OS: XP	MBAM log 2 Malwarebytes' Anti-Malware 1.40 Database version: 2708 Windows 5.1.2600 Service Pack 3 8/28/2009 4:06:26 PM mbam-log-2009-08-28 (16-06-26).txt Scan type: Quick Scan Objects scanned: 85924 Time elapsed: 5 minute(s), 2 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 1 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: C:\Documents and Settings\Administrator\Local Settings\Temp\sai1C69.tmp (Adware.Zango) -> Quarantined and deleted successfully. This post has been edited by suryavarma143: Aug 28 2009, 04:49 AM

emeraldnzl View Member Profile	Aug 28 2009, 02:14 PM Post #7
Trusted Helper Posts: 8,065 OS: XP Pro	Hello suryavarma143, Download RootRepeal.zip and unzip it to your Desktop. Double click RootRepeal.exe to start the program Click on the Report tab at the bottom of the program window Click the Scan button In the Select Scan dialog, check: Drivers Files Processes SSDT Stealth Objects Hidden Services Click the OK button In the next dialog, select all drives showing Click OK to start the scan Note: The scan can take some time. DO NOT* run any other programs while the scan is running* When the scan is complete, the Save Report button will become available Click this and save the report to your Desktop as RootRepeal.txt Go to File, then Exit to close the program Post the contents of RootRepeal.txt in your next reply. Next Please download ComboFix from one of these locations: NOTE: If you are guest watching this topic. ComboFix is a very powerful tool. The disclaimer clearly states that you should not use it without supervision. There is good reason for this as ComboFix can, and sometimes does, run into conflict on a computer and render it unusable. Link 1 Link 2 Link 3 * IMPORTANT !!! Save ComboFix.exe to your Desktop Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Double click on ComboFix.exe & follow the prompts. As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware. Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console. Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures. Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message: Click on Yes, to continue scanning for malware. When finished, it will produce a log for you. Please include the C:\ComboFix.txt** in your next reply. So when you return please post RootRepeal.txt ComboFix.txt

suryavarma143 View Member Profile	Aug 29 2009, 07:10 AM Post #8
Member Posts: 17 OS: XP	RootRepeal.txt ROOTREPEAL © AD, 2007-2009 ================================================== Scan Start Time: 2009/08/29 17:25 Program Version: Version 1.3.5.0 Windows Version: Windows XP SP3 ================================================== Drivers ------------------- Name: dump_atapi.sys Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys Address: 0xEF89E000 Size: 98304 File Visible: No Signed: - Status: - Name: dump_WMILIB.SYS Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS Address: 0xF8CC4000 Size: 8192 File Visible: No Signed: - Status: - Name: PCI_PNP9750 Image Path: \Driver\PCI_PNP9750 Address: 0x00000000 Size: 0 File Visible: No Signed: - Status: - Name: rootrepeal.sys Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys Address: 0xEE71E000 Size: 49152 File Visible: No Signed: - Status: - Name: sptd Image Path: \Driver\sptd Address: 0x00000000 Size: 0 File Visible: No Signed: - Status: - Name: spvp.sys Image Path: spvp.sys Address: 0xF8656000 Size: 1052672 File Visible: No Signed: - Status: - Hidden/Locked Files ------------------- Path: C:\WINDOWS\system32\kbiwkmlakvphui.dat Status: Invisible to the Windows API! Path: C:\WINDOWS\system32\kbiwkmlqbwwohi.dll Status: Invisible to the Windows API! Path: C:\WINDOWS\system32\kbiwkmnnkirilt.dat Status: Invisible to the Windows API! Path: C:\WINDOWS\system32\kbiwkmybjixvma.dll Status: Invisible to the Windows API! Path: c:\windows\temp\htt11a6.tmp Status: Size mismatch (API: 66, Raw: 44) Path: C:\Program Files\Yahoo!\Messenger\ugCVoRQkEl8DXeTYeo.0Ew-- Status: Visible to the Windows API, but not on disk. Path: C:\WINDOWS\system32\drivers\kbiwkmpqjngsky.sys Status: Invisible to the Windows API! Path: C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\qwpn8pec.default\sessionstore.js Status: Could not get file information (Error 0xc0000008) Stealth Objects ------------------- Object: Hidden Module [Name: kbiwkmlqbwwohi.dll] Process: svchost.exe (PID: 920) Address: 0x10000000 Size: 53248 Object: Hidden Module [Name: kbiwkmybjixvma.dll] Process: Explorer.EXE (PID: 1580) Address: 0x10000000 Size: 32768 Object: Hidden Module [Name: kbiwkmybjixvma.dll] Process: firefox.exe (PID: 2980) Address: 0x01010000 Size: 32768 Object: Hidden Code [ETHREAD: 0x82a0f020] Process: System Address: 0x82855790 Size: 1000 Object: Hidden Code [Driver: Ntfs, IRP_MJ_CREATE] Process: System Address: 0x82fde1f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_CLOSE] Process: System Address: 0x82fde1f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_READ] Process: System Address: 0x82fde1f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_WRITE] Process: System Address: 0x82fde1f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_INFORMATION] Process: System Address: 0x82fde1f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_INFORMATION] Process: System Address: 0x82fde1f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_EA] Process: System Address: 0x82fde1f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_EA] Process: System Address: 0x82fde1f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_FLUSH_BUFFERS] Process: System Address: 0x82fde1f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_VOLUME_INFORMATION] Process: System Address: 0x82fde1f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_VOLUME_INFORMATION] Process: System Address: 0x82fde1f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_DIRECTORY_CONTROL] Process: System Address: 0x82fde1f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_FILE_SYSTEM_CONTROL] Process: System Address: 0x82fde1f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x82fde1f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_SHUTDOWN] Process: System Address: 0x82fde1f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_LOCK_CONTROL] Process: System Address: 0x82fde1f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_CLEANUP] Process: System Address: 0x82fde1f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_SECURITY] Process: System Address: 0x82fde1f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_SECURITY] Process: System Address: 0x82fde1f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_QUOTA] Process: System Address: 0x82fde1f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_QUOTA] Process: System Address: 0x82fde1f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_PNP] Process: System Address: 0x82fde1f8 Size: 121 Object: Hidden Code [Driver: Fastfat, IRP_MJ_CREATE] Process: System Address: 0x82da9500 Size: 121 Object: Hidden Code [Driver: Fastfat, IRP_MJ_CLOSE] Process: System Address: 0x82da9500 Size: 121 Object: Hidden Code [Driver: Fastfat, IRP_MJ_READ] Process: System Address: 0x82da9500 Size: 121 Object: Hidden Code [Driver: Fastfat, IRP_MJ_WRITE] Process: System Address: 0x82da9500 Size: 121 Object: Hidden Code [Driver: Fastfat, IRP_MJ_QUERY_INFORMATION] Process: System Address: 0x82da9500 Size: 121 Object: Hidden Code [Driver: Fastfat, IRP_MJ_SET_INFORMATION] Process: System Address: 0x82da9500 Size: 121 Object: Hidden Code [Driver: Fastfat, IRP_MJ_QUERY_EA] Process: System Address: 0x82da9500 Size: 121 Object: Hidden Code [Driver: Fastfat, IRP_MJ_SET_EA] Process: System Address: 0x82da9500 Size: 121 Object: Hidden Code [Driver: Fastfat, IRP_MJ_FLUSH_BUFFERS] Process: System Address: 0x82da9500 Size: 121 Object: Hidden Code [Driver: Fastfat, IRP_MJ_QUERY_VOLUME_INFORMATION] Process: System Address: 0x82da9500 Size: 121 Object: Hidden Code [Driver: Fastfat, IRP_MJ_SET_VOLUME_INFORMATION] Process: System Address: 0x82da9500 Size: 121 Object: Hidden Code [Driver: Fastfat, IRP_MJ_DIRECTORY_CONTROL] Process: System Address: 0x82da9500 Size: 121 Object: Hidden Code [Driver: Fastfat, IRP_MJ_FILE_SYSTEM_CONTROL] Process: System Address: 0x82da9500 Size: 121 Object: Hidden Code [Driver: Fastfat, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x82da9500 Size: 121 Object: Hidden Code [Driver: Fastfat, IRP_MJ_SHUTDOWN] Process: System Address: 0x82da9500 Size: 121 Object: Hidden Code [Driver: Fastfat, IRP_MJ_LOCK_CONTROL] Process: System Address: 0x82da9500 Size: 121 Object: Hidden Code [Driver: Fastfat, IRP_MJ_CLEANUP] Process: System Address: 0x82da9500 Size: 121 Object: Hidden Code [Driver: Fastfat, IRP_MJ_PNP] Process: System Address: 0x82da9500 Size: 121 Object: Hidden Code [Driver: Cdrom, IRP_MJ_CREATE] Process: System Address: 0x82dbc1f8 Size: 121 Object: Hidden Code [Driver: Cdrom, IRP_MJ_CLOSE] Process: System Address: 0x82dbc1f8 Size: 121 Object: Hidden Code [Driver: Cdrom, IRP_MJ_READ] Process: System Address: 0x82dbc1f8 Size: 121 Object: Hidden Code [Driver: Cdrom, IRP_MJ_WRITE] Process: System Address: 0x82dbc1f8 Size: 121 Object: Hidden Code [Driver: Cdrom, IRP_MJ_FLUSH_BUFFERS] Process: System Address: 0x82dbc1f8 Size: 121 Object: Hidden Code [Driver: Cdrom, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x82dbc1f8 Size: 121 Object: Hidden Code [Driver: Cdrom, IRP_MJ_INTERNAL_DEVICE_CONTROL] Process: System Address: 0x82dbc1f8 Size: 121 Object: Hidden Code [Driver: Cdrom, IRP_MJ_SHUTDOWN] Process: System Address: 0x82dbc1f8 Size: 121 Object: Hidden Code [Driver: Cdrom, IRP_MJ_POWER] Process: System Address: 0x82dbc1f8 Size: 121 Object: Hidden Code [Driver: Cdrom, IRP_MJ_SYSTEM_CONTROL] Process: System Address: 0x82dbc1f8 Size: 121 Object: Hidden Code [Driver: Cdrom, IRP_MJ_PNP] Process: System Address: 0x82dbc1f8 Size: 121 Object: Hidden Code [Driver: dmio, IRP_MJ_CREATE] Process: System Address: 0x82f721f8 Size: 121 Object: Hidden Code [Driver: dmio, IRP_MJ_CLOSE] Process: System Address: 0x82f721f8 Size: 121 Object: Hidden Code [Driver: dmio, IRP_MJ_READ] Process: System Address: 0x82f721f8 Size: 121 Object: Hidden Code [Driver: dmio, IRP_MJ_WRITE] Process: System Address: 0x82f721f8 Size: 121 Object: Hidden Code [Driver: dmio, IRP_MJ_FLUSH_BUFFERS] Process: System Address: 0x82f721f8 Size: 121 Object: Hidden Code [Driver: dmio, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x82f721f8 Size: 121 Object: Hidden Code [Driver: dmio, IRP_MJ_INTERNAL_DEVICE_CONTROL] Process: System Address: 0x82f721f8 Size: 121 Object: Hidden Code [Driver: dmio, IRP_MJ_SHUTDOWN] Process: System Address: 0x82f721f8 Size: 121 Object: Hidden Code [Driver: dmio, IRP_MJ_POWER] Process: System Address: 0x82f721f8 Size: 121 Object: Hidden Code [Driver: dmio, IRP_MJ_SYSTEM_CONTROL] Process: System Address: 0x82f721f8 Size: 121 Object: Hidden Code [Driver: dmio, IRP_MJ_PNP] Process: System Address: 0x82f721f8 Size: 121 Object: Hidden Code [Driver: usbuhci, IRP_MJ_CREATE] Process: System Address: 0x82df41f8 Size: 121 Object: Hidden Code [Driver: usbuhci, IRP_MJ_CLOSE] Process: System Address: 0x82df41f8 Size: 121 Object: Hidden Code [Driver: usbuhci, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x82df41f8 Size: 121 Object: Hidden Code [Driver: usbuhci, IRP_MJ_INTERNAL_DEVICE_CONTROL] Process: System Address: 0x82df41f8 Size: 121 Object: Hidden Code [Driver: usbuhci, IRP_MJ_POWER] Process: System Address: 0x82df41f8 Size: 121 Object: Hidden Code [Driver: usbuhci, IRP_MJ_SYSTEM_CONTROL] Process: System Address: 0x82df41f8 Size: 121 Object: Hidden Code [Driver: usbuhci, IRP_MJ_PNP] Process: System Address: 0x82df41f8 Size: 121 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_CREATE] Process: System Address: 0x82fe01f8 Size: 121 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_READ] Process: System Address: 0x82fe01f8 Size: 121 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_WRITE] Process: System Address: 0x82fe01f8 Size: 121 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_FLUSH_BUFFERS] Process: System Address: 0x82fe01f8 Size: 121 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x82fe01f8 Size: 121 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_INTERNAL_DEVICE_CONTROL] Process: System Address: 0x82fe01f8 Size: 121 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_SHUTDOWN] Process: System Address: 0x82fe01f8 Size: 121 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_CLEANUP] Process: System Address: 0x82fe01f8 Size: 121 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_POWER] Process: System Address: 0x82fe01f8 Size: 121 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_SYSTEM_CONTROL] Process: System Address: 0x82fe01f8 Size: 121 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_PNP] Process: System Address: 0x82fe01f8 Size: 121 Object: Hidden Code [Driver: aaxo2mq9Ȁ౨瑎晦܂�ੈ, IRP_MJ_CREATE] Process: System Address: 0x82ceb1f8 Size: 121 Object: Hidden Code [Driver: aaxo2mq9Ȁ౨瑎晦܂�ੈ, IRP_MJ_CLOSE] Process: System Address: 0x82ceb1f8 Size: 121 Object: Hidden Code [Driver: aaxo2mq9Ȁ౨瑎晦܂�ੈ, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x82ceb1f8 Size: 121 Object: Hidden Code [Driver: aaxo2mq9Ȁ౨瑎晦܂�ੈ, IRP_MJ_INTERNAL_DEVICE_CONTROL] Process: System Address: 0x82ceb1f8 Size: 121 Object: Hidden Code [Driver: aaxo2mq9Ȁ౨瑎晦܂�ੈ, IRP_MJ_POWER] Process: System Address: 0x82ceb1f8 Size: 121 Object: Hidden Code [Driver: aaxo2mq9Ȁ౨瑎晦܂�ੈ, IRP_MJ_SYSTEM_CONTROL] Process: System Address: 0x82ceb1f8 Size: 121 Object: Hidden Code [Driver: aaxo2mq9Ȁ౨瑎晦܂�ੈ, IRP_MJ_PNP] Process: System Address: 0x82ceb1f8 Size: 121 Object: Hidden Code [Driver: NetBT, IRP_MJ_CREATE] Process: System Address: 0x82daf500 Size: 121 Object: Hidden Code [Driver: NetBT, IRP_MJ_CLOSE] Process: System Address: 0x82daf500 Size: 121 Object: Hidden Code [Driver: NetBT, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x82daf500 Size: 121 Object: Hidden Code [Driver: NetBT, IRP_MJ_INTERNAL_DEVICE_CONTROL] Process: System Address: 0x82daf500 Size: 121 Object: Hidden Code [Driver: NetBT, IRP_MJ_CLEANUP] Process: System Address: 0x82daf500 Size: 121 Object: Hidden Code [Driver: NetBT, IRP_MJ_PNP] Process: System Address: 0x82daf500 Size: 121 Object: Hidden Code [Driver: usbehci, IRP_MJ_CREATE] Process: System Address: 0x82df61f8 Size: 121 Object: Hidden Code [Driver: usbehci, IRP_MJ_CLOSE] Process: System Address: 0x82df61f8 Size: 121 Object: Hidden Code [Driver: usbehci, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x82df61f8 Size: 121 Object: Hidden Code [Driver: usbehci, IRP_MJ_INTERNAL_DEVICE_CONTROL] Process: System Address: 0x82df61f8 Size: 121 Object: Hidden Code [Driver: usbehci, IRP_MJ_POWER] Process: System Address: 0x82df61f8 Size: 121 Object: Hidden Code [Driver: usbehci, IRP_MJ_SYSTEM_CONTROL] Process: System Address: 0x82df61f8 Size: 121 Object: Hidden Code [Driver: usbehci, IRP_MJ_PNP] Process: System Address: 0x82df61f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CREATE] Process: System Address: 0x82d7d378 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CREATE_NAMED_PIPE] Process: System Address: 0x82d7d378 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CLOSE] Process: System Address: 0x82d7d378 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_READ] Process: System Address: 0x82d7d378 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_WRITE] Process: System Address: 0x82d7d378 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_INFORMATION] Process: System Address: 0x82d7d378 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_INFORMATION] Process: System Address: 0x82d7d378 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_EA] Process: System Address: 0x82d7d378 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_EA] Process: System Address: 0x82d7d378 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_FLUSH_BUFFERS] Process: System Address: 0x82d7d378 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_VOLUME_INFORMATION] Process: System Address: 0x82d7d378 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_VOLUME_INFORMATION] Process: System Address: 0x82d7d378 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_DIRECTORY_CONTROL] Process: System Address: 0x82d7d378 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_FILE_SYSTEM_CONTROL] Process: System Address: 0x82d7d378 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x82d7d378 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_INTERNAL_DEVICE_CONTROL] Process: System Address: 0x82d7d378 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SHUTDOWN] Process: System Address: 0x82d7d378 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_LOCK_CONTROL] Process: System Address: 0x82d7d378 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CLEANUP] Process: System Address: 0x82d7d378 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CREATE_MAILSLOT] Process: System Address: 0x82d7d378 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_SECURITY] Process: System Address: 0x82d7d378 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_SECURITY] Process: System Address: 0x82d7d378 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_POWER] Process: System Address: 0x82d7d378 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SYSTEM_CONTROL] Process: System Address: 0x82d7d378 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_DEVICE_CHANGE] Process: System Address: 0x82d7d378 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_QUOTA] Process: System Address: 0x82d7d378 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_QUOTA] Process: System Address: 0x82d7d378 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_PNP] Process: System Address: 0x82d7d378 Size: 121 Object: Hidden Code [Driver: Cdfsȅఅ瑁䅭挨쀝ँMDICli, IRP_MJ_CREATE] Process: System Address: 0x82ca23f0 Size: 121 Object: Hidden Code [Driver: Cdfsȅఅ瑁䅭挨쀝ँMDICli, IRP_MJ_CLOSE] Process: System Address: 0x82ca23f0 Size: 121 Object: Hidden Code [Driver: Cdfsȅఅ瑁䅭挨쀝ँMDICli, IRP_MJ_READ] Process: System Address: 0x82ca23f0 Size: 121 Object: Hidden Code [Driver: Cdfsȅఅ瑁䅭挨쀝ँMDICli, IRP_MJ_QUERY_INFORMATION] Process: System Address: 0x82ca23f0 Size: 121 Object: Hidden Code [Driver: Cdfsȅఅ瑁䅭挨쀝ँMDICli, IRP_MJ_SET_INFORMATION] Process: System Address: 0x82ca23f0 Size: 121 Object: Hidden Code [Driver: Cdfsȅఅ瑁䅭挨쀝ँMDICli, IRP_MJ_QUERY_VOLUME_INFORMATION] Process: System Address: 0x82ca23f0 Size: 121 Object: Hidden Code [Driver: Cdfsȅఅ瑁䅭挨쀝ँMDICli, IRP_MJ_DIRECTORY_CONTROL] Process: System Address: 0x82ca23f0 Size: 121 Object: Hidden Code [Driver: Cdfsȅఅ瑁䅭挨쀝ँMDICli, IRP_MJ_FILE_SYSTEM_CONTROL] Process: System Address: 0x82ca23f0 Size: 121 Object: Hidden Code [Driver: Cdfsȅఅ瑁䅭挨쀝ँMDICli, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x82ca23f0 Size: 121 Object: Hidden Code [Driver: Cdfsȅఅ瑁䅭挨쀝ँMDICli, IRP_MJ_SHUTDOWN] Process: System Address: 0x82ca23f0 Size: 121 Object: Hidden Code [Driver: Cdfsȅఅ瑁䅭挨쀝ँMDICli, IRP_MJ_LOCK_CONTROL] Process: System Address: 0x82ca23f0 Size: 121 Object: Hidden Code [Driver: Cdfsȅఅ瑁䅭挨쀝ँMDICli, IRP_MJ_CLEANUP] Process: System Address: 0x82ca23f0 Size: 121 Object: Hidden Code [Driver: Cdfsȅఅ瑁䅭挨쀝ँMDICli, IRP_MJ_PNP] Process: System Address: 0x82ca23f0 Size: 121 Hidden Services ------------------- Service Name: kbiwkmtkyxmmta Image Path: C:\WINDOWS\system32\drivers\kbiwkmpqjngsky.sys ==EOF==

suryavarma143 View Member Profile	Aug 29 2009, 07:30 AM Post #9
Member Posts: 17 OS: XP	ComboFix.txt ComboFix 09-08-28.05 - Administrator 08/29/2009 18:50.1.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.510.284 [GMT 5.5:30] Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe AV: ESET NOD32 Antivirus 4.0 On-access scanning disabled (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0} * Created a new restore point * Resident AV is active . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\Installer\177c15.msi c:\windows\system32\drivers\kbiwkmpqjngsky.sys c:\windows\system32\kbiwkmlakvphui.dat c:\windows\system32\kbiwkmlqbwwohi.dll c:\windows\system32\kbiwkmnnkirilt.dat c:\windows\system32\kbiwkmybjixvma.dll . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_kbiwkmtkyxmmta -------\Legacy_kbiwkmtkyxmmta ((((((((((((((((((((((((( Files Created from 2009-07-28 to 2009-08-29 ))))))))))))))))))))))))))))))) . 2009-08-28 10:10 . 2009-08-28 10:10 -------- d-----w- c:\program files\Veoh Networks 2009-08-28 09:32 . 2009-08-01 16:16 6256600 ---ha-w- c:\documents and settings\Administrator\Application Data\mjusbsp\in00000\setup.exe 2009-08-28 09:32 . 2009-08-01 16:12 728600 ---ha-w- c:\documents and settings\Administrator\Application Data\mjusbsp\ar00000\install.exe 2009-08-27 09:17 . 2009-08-27 09:17 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache 2009-08-27 07:23 . 2009-08-27 07:23 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE 2009-08-27 07:21 . 2009-08-27 07:21 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache 2009-08-27 07:17 . 2009-08-27 07:17 -------- d-----w- c:\windows\ie8updates 2009-08-27 07:16 . 2009-08-27 07:16 -------- dc-h--w- c:\windows\ie8 2009-08-27 07:14 . 2009-08-07 08:48 100352 -c----w- c:\windows\system32\dllcache\iecompat.dll 2009-08-27 07:13 . 2009-07-03 17:09 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll 2009-08-27 07:13 . 2009-07-03 17:09 594432 -c----w- c:\windows\system32\dllcache\msfeeds.dll 2009-08-27 07:13 . 2009-07-03 17:09 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll 2009-08-27 07:13 . 2009-07-03 17:09 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll 2009-08-27 07:13 . 2009-07-03 17:09 1985536 -c----w- c:\windows\system32\dllcache\iertutil.dll 2009-08-27 06:28 . 2009-08-27 06:29 0 ----a-w- c:\documents and settings\Administrator\Application Data\IDM\DwnlData\Administrator\wwae7few_322\wwae7few.exe 2009-08-25 06:15 . 2009-08-25 06:15 -------- d-----w- c:\program files\CCleaner 2009-08-24 07:18 . 2004-07-09 03:13 364544 ------w- c:\windows\system32\TwnLib4.dll 2009-08-24 07:18 . 2000-06-26 05:15 106496 ----a-w- c:\windows\system32\TwnLib20.dll 2009-08-24 07:18 . 2004-07-26 10:46 476320 ------w- c:\windows\system32\ImagXpr7.dll 2009-08-24 07:18 . 2004-07-26 10:46 471040 ------w- c:\windows\system32\ImagXRA7.dll 2009-08-24 07:18 . 2004-07-26 10:46 262144 ------w- c:\windows\system32\ImagXR7.dll 2009-08-24 07:18 . 2004-07-26 10:46 1568768 ------w- c:\windows\system32\ImagX7.dll 2009-08-24 07:18 . 2001-07-09 05:20 155648 ----a-w- c:\windows\system32\NeroCheck.exe 2009-08-24 07:17 . 2009-08-24 07:17 -------- d-----w- c:\program files\Common Files\Ahead 2009-08-24 07:17 . 2009-08-24 07:18 -------- d-----w- c:\program files\Ahead 2009-08-23 16:58 . 2009-08-23 17:08 -------- d-----w- c:\program files\Photo Optimizer 2009-08-23 16:56 . 2009-08-23 16:58 -------- d-----w- c:\documents and settings\Administrator\Application Data\GetRightToGo 2009-08-22 13:35 . 2009-08-22 13:35 -------- d-----w- c:\windows\system32\XPSViewer 2009-08-22 13:35 . 2009-08-22 13:35 -------- d-----w- c:\program files\MSBuild 2009-08-22 13:35 . 2009-08-22 13:35 -------- d-----w- c:\program files\Reference Assemblies 2009-08-22 13:35 . 2008-07-06 12:06 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll 2009-08-22 13:35 . 2008-07-06 12:06 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll 2009-08-22 13:35 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll 2009-08-22 13:35 . 2008-07-06 12:06 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll 2009-08-22 13:35 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll 2009-08-22 13:35 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll 2009-08-22 13:35 . 2008-07-06 10:50 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe 2009-08-22 10:18 . 2009-08-22 10:18 -------- d-----w- c:\windows\Sun 2009-08-22 05:19 . 2009-08-22 05:18 410984 ----a-w- c:\windows\system32\deploytk.dll 2009-08-22 05:18 . 2009-08-22 05:18 -------- d-----w- c:\program files\Java 2009-08-22 05:18 . 2009-08-22 05:18 152576 ----a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\jre1.6.0_14\lzma.dll 2009-08-20 20:27 . 2009-08-20 20:32 -------- d-----w- c:\program files\123 GIF&JPG Optimizer 2009-08-20 20:12 . 2009-08-20 20:12 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes 2009-08-20 20:11 . 2009-08-03 08:06 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-08-20 20:11 . 2009-08-20 20:12 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-08-20 20:11 . 2009-08-20 20:11 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2009-08-20 20:11 . 2009-08-03 08:06 19096 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-08-16 17:27 . 2009-08-16 18:03 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Adobe 2009-08-16 17:13 . 2009-08-16 17:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Adobe Systems 2009-08-16 17:13 . 2009-08-16 17:13 -------- d-----w- c:\program files\Common Files\Adobe Systems Shared 2009-08-16 17:12 . 2009-08-16 17:17 -------- d-----w- c:\program files\Common Files\Adobe 2009-08-14 11:34 . 2009-08-14 11:34 239088 ----a-w- c:\documents and settings\Administrator\Application Data\Mozilla\plugins\npgoogletalk.dll 2009-08-14 10:54 . 2009-08-14 10:55 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Riot 2009-08-14 09:52 . 2009-08-14 09:56 -------- d-----w- c:\program files\IrfanView 2009-08-12 13:14 . 2009-07-10 13:27 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll 2009-08-09 18:36 . 2009-08-09 18:36 -------- d-----w- c:\program files\MasRizal 2009-08-09 18:35 . 2009-08-09 18:35 -------- d-----w- c:\windows\Downloaded Installations 2009-08-09 18:18 . 2009-08-09 18:18 -------- d-----w- c:\program files\Geeks Ltd 2009-08-09 17:55 . 2009-08-09 17:55 19320 ---ha-w- c:\windows\system32\mlfcache.dat 2009-08-09 10:50 . 2009-08-09 10:53 -------- d-----w- c:\program files\Love2Photo 2009-08-07 13:04 . 2009-08-27 12:03 -------- d-----w- c:\documents and settings\Administrator\Application Data\vlc 2009-08-07 13:02 . 2009-08-07 13:02 -------- d-----w- c:\program files\VideoLAN 2009-08-06 18:58 . 2008-11-05 15:33 607472 ----a-w- c:\documents and settings\All Users\Application Data\Yahoo!\YUpdater\yupdater.exe 2009-08-06 09:04 . 2009-08-06 18:55 -------- d-----w- c:\program files\HTV 2009-08-06 09:04 . 2009-08-06 09:05 439580 ----a-w- c:\documents and settings\Administrator\Application Data\setup_akl.exe 2009-08-05 18:56 . 2009-08-05 18:58 -------- d-----w- c:\program files\NetConceal Anonymizer 2009-08-05 18:26 . 2009-08-05 18:26 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Help 2009-08-05 09:01 . 2009-08-05 09:01 204800 -c----w- c:\windows\system32\dllcache\mswebdvd.dll 2009-08-03 18:56 . 2009-08-03 18:57 -------- d-----w- c:\program files\NetBus Pro 2009-08-03 18:55 . 1998-10-29 12:15 306688 ----a-w- c:\windows\IsUninst.exe 2009-08-02 06:41 . 2009-08-01 16:16 6256600 ---ha-w- c:\documents and settings\Administrator\Application Data\mjusbsp\Upgrade\setup2.exe 2009-08-02 06:41 . 2009-08-01 16:12 728600 ---ha-w- c:\documents and settings\Administrator\Application Data\mjusbsp\Upgrade\install2.exe 2009-08-02 06:27 . 2009-08-02 06:27 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\magicJack 2009-08-01 16:16 . 2009-08-01 16:16 95576 ----a-w- c:\documents and settings\Administrator\Application Data\mjusbsp\ug00000\magicJack.dll 2009-08-01 16:16 . 2009-08-01 16:16 6256600 ----a-w- c:\documents and settings\Administrator\Application Data\mjusbsp\ug00000\setup.exe 2009-08-01 16:16 . 2009-08-01 16:16 413304 ----a-w- c:\documents and settings\Administrator\Application Data\mjusbsp\magicJackLoader.exe 2009-08-01 16:16 . 2009-08-01 16:16 480608 ----a-w- c:\documents and settings\Administrator\Application Data\mjusbsp\octvqe1_apiw.dll 2009-08-01 16:16 . 2009-08-01 16:16 214360 ----a-w- c:\documents and settings\Administrator\Application Data\mjusbsp\TjVista.dll 2009-08-01 16:16 . 2009-08-01 16:16 325040 ----a-w- c:\documents and settings\Administrator\Application Data\mjusbsp\TjIpSys.dll 2009-08-01 16:16 . 2009-08-01 16:16 570736 ----a-w- c:\documents and settings\Administrator\Application Data\mjusbsp\SJHandsetMagicJack.dll 2009-08-01 16:15 . 2009-08-01 16:15 87384 ----a-w- c:\documents and settings\Administrator\Application Data\mjusbsp\st00000\mjsetup.exe 2009-08-01 16:15 . 2009-08-01 16:15 95576 ----a-w- c:\documents and settings\Administrator\Application Data\mjusbsp\st00000\magicJack.dll 2009-08-01 16:15 . 2009-08-01 16:15 95576 ----a-w- c:\documents and settings\Administrator\Application Data\mjusbsp\magicJack.dll 2009-08-01 16:13 . 2009-08-01 16:13 12231512 ----a-w- c:\documents and settings\Administrator\Application Data\mjusbsp\magicJack.exe 2009-08-01 16:12 . 2009-08-01 16:12 728600 ----a-w- c:\documents and settings\Administrator\Application Data\mjusbsp\ug00000\install.exe 2009-08-01 16:12 . 2009-08-01 16:12 87384 ----a-w- c:\documents and settings\Administrator\Application Data\mjusbsp\in00000\mjsetup.exe 2009-08-01 16:12 . 2009-08-01 16:12 95576 ----a-w- c:\documents and settings\Administrator\Application Data\mjusbsp\in00000\magicJack.dll 2009-08-01 16:11 . 2009-08-01 16:11 441704 ----a-w- c:\documents and settings\Administrator\Application Data\mjusbsp\ug00000\magicJackSplash.exe 2009-08-01 16:11 . 2009-08-01 16:11 441704 ----a-w- c:\documents and settings\Administrator\Application Data\mjusbsp\st00000\magicJackSplash.exe 2009-08-01 16:11 . 2009-08-01 16:11 441704 ----a-w- c:\documents and settings\Administrator\Application Data\mjusbsp\magicJackSplash.exe 2009-08-01 16:11 . 2009-08-01 16:11 441704 ----a-w- c:\documents and settings\Administrator\Application Data\mjusbsp\in00000\magicJackSplash.exe 2009-08-01 16:11 . 2009-08-01 16:11 50520 ----a-w- c:\documents and settings\Administrator\Application Data\mjusbsp\cdloader2.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-08-29 11:48 . 2009-07-12 05:31 -------- d-----w- c:\documents and settings\Administrator\Application Data\DMCache 2009-08-28 09:32 . 2009-07-09 14:14 -------- d-----w- c:\documents and settings\Administrator\Application Data\mjusbsp 2009-08-23 16:33 . 2009-07-08 08:39 19584 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-08-23 08:31 . 2009-07-14 16:55 -------- d-----w- c:\program files\Opera 10 Beta 2009-08-20 20:09 . 2009-07-12 05:28 -------- d-----w- c:\program files\Internet Download Manager 2009-08-08 07:21 . 2009-07-12 05:32 -------- d-----w- c:\documents and settings\Administrator\Application Data\IDM 2009-08-06 18:58 . 2009-07-09 07:41 -------- d-----w- c:\program files\Yahoo! 2009-08-05 09:01 . 2004-08-04 12:00 204800 ----a-w- c:\windows\system32\mswebdvd.dll 2009-08-04 18:19 . 2009-07-08 10:22 -------- d-----w- c:\program files\MPlayer for Windows 2009-08-04 18:00 . 2009-07-11 14:39 -------- d-----w- c:\program files\The KMPlayer 2009-08-03 05:16 . 2009-07-23 10:09 -------- d-----w- c:\program files\OpenVPN 2009-07-29 07:29 . 2009-07-29 07:29 -------- d-----w- c:\program files\ESET 2009-07-29 07:29 . 2009-07-29 07:29 -------- d-----w- c:\documents and settings\All Users\Application Data\ESET 2009-07-28 16:31 . 2009-07-24 07:15 -------- d-----w- c:\documents and settings\Administrator\Application Data\Apple Computer 2009-07-24 07:15 . 2009-07-24 07:14 -------- d-----w- c:\program files\iTunes 2009-07-24 07:15 . 2009-07-24 07:14 -------- d-----w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906} 2009-07-24 07:15 . 2009-07-24 07:15 -------- d-----w- c:\program files\iPod 2009-07-24 07:15 . 2009-07-24 07:11 -------- d-----w- c:\program files\Common Files\Apple 2009-07-24 07:14 . 2009-07-24 07:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer 2009-07-24 07:14 . 2009-07-24 07:13 -------- d-----w- c:\program files\QuickTime 2009-07-24 07:12 . 2009-07-24 07:12 -------- d-----w- c:\program files\Apple Software Update 2009-07-24 07:11 . 2009-07-24 07:11 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple 2009-07-23 16:40 . 2009-07-12 11:08 -------- d-----w- c:\documents and settings\Administrator\Application Data\PC Suite 2009-07-23 12:47 . 2009-07-23 12:47 -------- d-----w- c:\documents and settings\Administrator\Application Data\Anonymizer 2009-07-23 12:46 . 2009-07-23 12:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Anonymizer 2009-07-21 07:22 . 2009-07-09 06:59 -------- d-----w- c:\program files\Google 2009-07-21 07:15 . 2009-07-21 07:14 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater 2009-07-20 10:52 . 2009-07-20 10:52 -------- d-----w- c:\program files\MP3 Cutter Plus 2009-07-18 10:14 . 2009-07-18 10:14 -------- d-----w- c:\program files\Easy GIF Animator 2009-07-17 19:01 . 2004-08-04 12:00 58880 ----a-w- c:\windows\system32\atl.dll 2009-07-16 16:48 . 2009-07-16 16:48 -------- d-----w- c:\program files\AndreaMosaic 2009-07-16 05:46 . 2009-07-16 04:40 -------- d-----w- c:\documents and settings\Administrator\Application Data\DAEMON Tools Lite 2009-07-16 04:47 . 2009-07-16 04:47 -------- d-----w- c:\documents and settings\All Users\Application Data\DAEMON Tools Lite 2009-07-16 04:47 . 2009-07-16 04:47 -------- d-----w- c:\program files\DAEMON Tools Toolbar 2009-07-16 04:47 . 2009-07-16 04:46 -------- d-----w- c:\program files\DAEMON Tools Lite 2009-07-16 04:42 . 2009-07-16 04:42 721904 ----a-w- c:\windows\system32\drivers\sptd.sys 2009-07-13 08:52 . 2009-07-13 08:52 75048 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.2.1.6\SetupAdmin.exe 2009-07-12 11:10 . 2009-07-12 11:08 -------- d-----w- c:\documents and settings\Administrator\Application Data\Nokia 2009-07-12 11:10 . 2009-07-12 11:10 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf 2009-07-12 11:10 . 2009-07-12 11:10 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf 2009-07-12 11:08 . 2009-07-12 11:08 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Suite 2009-07-12 11:07 . 2009-07-12 11:07 -------- d-----w- c:\program files\Common Files\PCSuite 2009-07-12 11:07 . 2009-07-12 11:07 -------- d-----w- c:\program files\Common Files\Nokia 2009-07-12 11:07 . 2009-07-12 11:06 -------- d-----w- c:\program files\Nokia 2009-07-12 11:06 . 2009-07-12 11:06 -------- d-----w- c:\program files\DIFX 2009-07-12 11:06 . 2009-07-12 11:06 -------- d-----w- c:\program files\PC Connectivity Solution 2009-07-12 11:04 . 2009-07-12 11:04 8192 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{58FB2F9A-5F2D-40E8-82DF-4987E60AD8BD}\Installer\CommonCustomActions\UninstCCD.exe 2009-07-12 11:04 . 2009-07-12 11:04 61440 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{58FB2F9A-5F2D-40E8-82DF-4987E60AD8BD}\Installer\CommonCustomActions\UninstPCSFEMsi.exe 2009-07-12 11:04 . 2009-07-12 11:04 10240 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{58FB2F9A-5F2D-40E8-82DF-4987E60AD8BD}\Installer\CommonCustomActions\UninstPCS.exe 2009-07-12 11:04 . 2009-07-12 11:04 -------- d-----w- c:\documents and settings\All Users\Application Data\Installations 2009-07-12 06:51 . 2004-08-04 12:00 233472 ----a-w- c:\windows\system32\wmpdxm.dll 2009-07-12 05:35 . 2009-07-12 05:32 198064 ----a-w- c:\documents and settings\Administrator\Application Data\IDM\idmmzcc3\components\idmmzcc.dll 2009-07-10 04:46 . 2009-07-07 13:46 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat 2009-07-09 17:57 . 2009-07-09 17:57 -------- d-----w- c:\program files\Realtek AC97 2009-07-09 17:57 . 2009-07-09 17:57 -------- d--h--w- c:\program files\InstallShield Installation Information 2009-07-09 17:57 . 2009-07-09 17:57 -------- d-----w- c:\program files\Common Files\InstallShield 2009-07-09 12:17 . 2009-07-09 12:17 -------- d-----w- c:\documents and settings\Administrator\Application Data\Foxit 2009-07-09 12:17 . 2009-07-09 12:17 -------- d-----w- c:\program files\Foxit Software 2009-07-09 11:58 . 2009-07-09 11:58 -------- d-----w- c:\program files\Microsoft ActiveSync 2009-07-09 09:06 . 2009-07-09 07:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo! 2009-07-09 06:46 . 2009-07-24 07:12 39424 ----a-w- c:\windows\system32\drivers\usbaapl.sys 2009-07-09 06:46 . 2009-07-24 07:12 2060288 ----a-w- c:\windows\system32\usbaaplrc.dll 2009-07-08 14:37 . 2009-07-08 14:37 0 ----a-w- c:\windows\nsreg.dat 2009-07-07 13:47 . 2009-07-07 13:47 -------- d-----w- c:\program files\microsoft frontpage 2009-07-07 13:43 . 2009-07-07 13:43 21640 ----a-w- c:\windows\system32\emptyregdb.dat 2009-07-03 17:09 . 2004-08-04 12:00 915456 ----a-w- c:\windows\system32\wininet.dll 2009-06-25 08:25 . 2004-08-04 12:00 730112 ----a-w- c:\windows\system32\lsasrv.dll 2009-06-25 08:25 . 2004-08-04 12:00 56832 ----a-w- c:\windows\system32\secur32.dll 2009-06-25 08:25 . 2004-08-04 12:00 54272 ----a-w- c:\windows\system32\wdigest.dll 2009-06-25 08:25 . 2004-08-04 12:00 301568 ----a-w- c:\windows\system32\kerberos.dll 2009-06-25 08:25 . 2004-08-04 12:00 147456 ----a-w- c:\windows\system32\schannel.dll 2009-06-25 08:25 . 2004-08-04 12:00 136192 ----a-w- c:\windows\system32\msv1_0.dll 2009-06-24 11:18 . 2004-08-04 12:00 92928 ----a-w- c:\windows\system32\drivers\ksecdd.sys 2009-06-16 14:36 . 2004-08-04 12:00 81920 ----a-w- c:\windows\system32\fontsub.dll 2009-06-16 14:36 . 2004-08-04 12:00 119808 ----a-w- c:\windows\system32\t2embed.dll 2009-06-12 12:31 . 2004-08-04 12:00 80896 ----a-w- c:\windows\system32\tlntsess.exe 2009-06-12 12:31 . 2004-08-04 12:00 76288 ----a-w- c:\windows\system32\telnet.exe 2009-06-10 14:13 . 2004-08-04 12:00 84992 ----a-w- c:\windows\system32\avifil32.dll 2009-06-10 06:14 . 2004-08-04 12:00 132096 ----a-w- c:\windows\system32\wkssvc.dll 2009-06-10 03:49 . 2009-07-07 13:42 2066432 ----a-w- c:\windows\system32\mstscax.dll 2009-06-03 19:09 . 2004-08-04 12:00 1291264 ----a-w- c:\windows\system32\quartz.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2008-12-03 1205760] "cdloader"="c:\documents and settings\Administrator\Application Data\mjusbsp\cdloader2.exe" [2009-08-01 50520] "VeohPlugin"="c:\program files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe" [2009-08-20 2000120] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-02-06 2021400] "MPlayerForWindows_UpdateReminder"="c:\program files\MPlayer for Windows\AutoUpdate.exe" [2009-07-24 72016] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-08-22 148888] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] c:\documents and settings\Administrator\Start Menu\Programs\Startup\ Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Google\\Google Talk\\googletalk.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Documents and Settings\\Administrator\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.dll"= "c:\\Documents and Settings\\Administrator\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Opera 10 Beta\\opera.exe"= "c:\\Documents and Settings\\Administrator\\Application Data\\mjusbsp\\magicJack.exe"= "c:\\Program Files\\Veoh Networks\\VeohWebPlayer\\veohwebplayer.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "9780:TCP"= 9780:TCP:lqcvfze R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2/6/2009 2:23 PM 106208] R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2/6/2009 2:24 PM 93336] R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2/6/2009 2:23 PM 727720] S2 .EsetTrialReset;Eset Trial Reset;c:\windows\system32\regedt32.exe [8/4/2004 5:30 PM 3584] S2 gupdate1ca09d3e0cb663a;Google Update Service (gupdate1ca09d3e0cb663a);c:\program files\Google\Update\GoogleUpdate.exe [7/21/2009 12:51 PM 133104] S2 unhjqnl;unhjqnl;c:\windows\system32\drivers\bszuf.sys --> c:\windows\system32\drivers\bszuf.sys [?] S2 wesbpwd;lveiwb;c:\windows\system32\svchost.exe -k netsvcs [8/4/2004 5:30 PM 14336] S3 tap0801;TAP-Win32 Adapter V8;c:\windows\system32\drivers\tap0801.sys [10/1/2006 6:07 PM 26624] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs wesbpwd [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] "c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP . Contents of the 'Scheduled Tasks' folder 2009-08-29 c:\windows\Tasks\Google Software Updater.job - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-07-12 07:14] 2009-08-29 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-07-21 07:21] 2009-08-29 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-07-21 07:21] 2009-08-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-682003330-796845957-839522115-500Core.job - c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-07-15 17:18] 2009-08-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-682003330-796845957-839522115-500UA.job - c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-07-15 17:18] . . ------- Supplementary Scan ------- . uStart Page = about:blank uInternet Settings,ProxyOverride = local IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: Download all links with IDM - c:\program files\Internet Download Manager\IEGetAll.htm IE: Download FLV video content with IDM - c:\program files\Internet Download Manager\IEGetVL.htm IE: Download with IDM - c:\program files\Internet Download Manager\IEExt.htm IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 LSP: c:\windows\system32\idmmbc.dll FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\qwpn8pec.default\ FF - prefs.js: browser.startup.homepage - www.google.com FF - component: c:\documents and settings\Administrator\Application Data\IDM\idmmzcc3\components\idmmzcc.dll FF - plugin: c:\documents and settings\Administrator\Application Data\Mozilla\plugins\npgoogletalk.dll FF - plugin: c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\1.2.183.7\npGoogleOneClick8.dll FF - plugin: c:\program files\Google\Google Updater\2.4.1636.7222\npCIDetect13.dll FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll FF - plugin: c:\program files\Opera 10 Beta\program\plugins\npdsplay.dll FF - plugin: c:\program files\Opera 10 Beta\program\plugins\npqtplugin.dll FF - plugin: c:\program files\Opera 10 Beta\program\plugins\npqtplugin2.dll FF - plugin: c:\program files\Opera 10 Beta\program\plugins\npqtplugin3.dll FF - plugin: c:\program files\Opera 10 Beta\program\plugins\npqtplugin4.dll FF - plugin: c:\program files\Opera 10 Beta\program\plugins\npqtplugin5.dll FF - plugin: c:\program files\Opera 10 Beta\program\plugins\npqtplugin6.dll FF - plugin: c:\program files\Opera 10 Beta\program\plugins\npqtplugin7.dll FF - plugin: c:\program files\Opera 10 Beta\program\plugins\npwmsdrm.dll FF - plugin: c:\program files\Veoh Networks\VeohWebPlayer\npWebPlayerVideoPluginATL.dll ---- FIREFOX POLICIES ---- c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200); c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews..wholeText", "noAccess"); c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120); c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1); c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1); c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072); c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35"); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json"); . *********************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-08-29 18:54 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************ . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_USERS\S-1-5-21-682003330-796845957-839522115-500\Software\Microsoft\Internet Explorer\User Preferences] @Denied: (2) (Administrator) "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,95,fe,7e,56,b7,c9,1c,47,88,bb,75,\ "2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,95,fe,7e,56,b7,c9,1c,47,88,bb,75,\ [HKEY_USERS\S-1-5-21-682003330-796845957-839522115-500\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{445F7D53-B350-17E8-8FC1-99980CA25174}*] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) "ianfljmljccnmkallk"=hex:6a,61,61,68,6e,66,66,65,6d,64,63,62,68,6a,6b,6a,63,6b, 67,66,00,d3 "halhbhmbkmjgdeml"=hex:6a,61,61,68,6e,66,66,65,6d,64,63,62,68,6a,6b,6a,63,6b, 67,66,00,00 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{1685f6f7-384f-435b-8692-5aa8a4bf9a44}] @Denied: (Full) (Everyone) "Model"=dword:000000dd "Therad"=dword:0000001e "MData"=hex(0):2b,8f,78,29,5a,0c,ce,ec,48,d4,68,e5,9f,6a,96,3e,ab,de,c5,81,26, 38,95,44,85,b1,12,f9,90,dd,23,a1,49,8c,bf,1a,9d,fe,41,71,cb,3f,46,a4,7c,ab,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation] "Enabled"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32] @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}] @Denied: (Full) (Everyone) "scansk"=hex(0):9f,c7,70,8e,65,b2,dd,d0,68,72,18,ed,7c,d6,62,9a,f0,f3,a9,ca,36, 91,b1,7b,93,02,15,fb,11,a3,59,76,fc,f8,0b,b9,bf,28,6d,03,00,00,00,00,00,00,\ [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}] @Denied: (A 2) (Everyone) @="IFlashBroker3" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'lsass.exe'(756) c:\windows\system32\idmmbc.dll . Completion time: 2009-08-29 18:57 ComboFix-quarantined-files.txt 2009-08-29 13:27 Pre-Run: 28,326,027,264 bytes free Post-Run: 28,292,501,504 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect 402 --- E O F --- 2009-08-25 19:13

emeraldnzl View Member Profile	Aug 29 2009, 03:19 PM Post #10
Trusted Helper Posts: 8,065 OS: XP Pro	1. Close any open browsers. 2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. 3. Open notepad and copy/paste the text in the quotebox below into it: QUOTE KillAll:: Driver:: unhjqnl File:: c:\windows\system32\drivers\bszuf.sys REGLOCK:: [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{1685f6f7-384f-435b-8692-5aa8a4bf9a44}] [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}] [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}] [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32] [HKEY_USERS\S-1-5-21-682003330-796845957-839522115-500\Software\Microsoft\Internet Explorer\User Preferences] [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}] [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32] [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib] RegLockDel:: [-HKEY_LOCAL_MACHINE\software\Classes\CLSID\{1685f6f7-384f-435b-8692-5aa8a4bf9a44}] [-HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}] REGNULL:: [HKEY_USERS\S-1-5-21-682003330-796845957-839522115-500\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{445F7D53-B350-17E8-8FC1-99980CA25174}] NetSvc:: wesbpwd Reboot:: Save this as CFScript.txt, in the same location as ComboFix.exe Refering to the picture above, drag CFScript into ComboFix.exe When finished, it will produce a log for you at C:\ComboFix.txt*. Please post that here for further review.

suryavarma143 View Member Profile	Aug 30 2009, 03:34 AM Post #11
Member Posts: 17 OS: XP	ComboFix.txt ComboFix 09-08-29.01 - Administrator 08/30/2009 14:52.2.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.510.255 [GMT 5.5:30] Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt AV: ESET NOD32 Antivirus 4.0 On-access scanning disabled (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0} FILE :: "c:\windows\system32\drivers\bszuf.sys" . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_unhjqnl ((((((((((((((((((((((((( Files Created from 2009-07-28 to 2009-08-30 ))))))))))))))))))))))))))))))) . 2009-08-28 10:10 . 2009-08-28 10:10 -------- d-----w- c:\program files\Veoh Networks 2009-08-28 09:32 . 2009-08-01 16:16 6256600 ---ha-w- c:\documents and settings\Administrator\Application Data\mjusbsp\in00000\setup.exe 2009-08-28 09:32 . 2009-08-01 16:12 728600 ---ha-w- c:\documents and settings\Administrator\Application Data\mjusbsp\ar00000\install.exe 2009-08-27 09:17 . 2009-08-27 09:17 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache 2009-08-27 07:23 . 2009-08-27 07:23 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE 2009-08-27 07:21 . 2009-08-27 07:21 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache 2009-08-27 07:17 . 2009-08-27 07:17 -------- d-----w- c:\windows\ie8updates 2009-08-27 07:16 . 2009-08-27 07:16 -------- dc-h--w- c:\windows\ie8 2009-08-27 07:14 . 2009-08-07 08:48 100352 -c----w- c:\windows\system32\dllcache\iecompat.dll 2009-08-27 07:13 . 2009-07-03 17:09 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll 2009-08-27 07:13 . 2009-07-03 17:09 594432 -c----w- c:\windows\system32\dllcache\msfeeds.dll 2009-08-27 07:13 . 2009-07-03 17:09 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll 2009-08-27 07:13 . 2009-07-03 17:09 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll 2009-08-27 07:13 . 2009-07-03 17:09 1985536 -c----w- c:\windows\system32\dllcache\iertutil.dll 2009-08-27 06:28 . 2009-08-27 06:29 0 ----a-w- c:\documents and settings\Administrator\Application Data\IDM\DwnlData\Administrator\wwae7few_322\wwae7few.exe 2009-08-25 06:15 . 2009-08-25 06:15 -------- d-----w- c:\program files\CCleaner 2009-08-24 07:18 . 2004-07-09 03:13 364544 ------w- c:\windows\system32\TwnLib4.dll 2009-08-24 07:18 . 2000-06-26 05:15 106496 ----a-w- c:\windows\system32\TwnLib20.dll 2009-08-24 07:18 . 2004-07-26 10:46 476320 ------w- c:\windows\system32\ImagXpr7.dll 2009-08-24 07:18 . 2004-07-26 10:46 471040 ------w- c:\windows\system32\ImagXRA7.dll 2009-08-24 07:18 . 2004-07-26 10:46 262144 ------w- c:\windows\system32\ImagXR7.dll 2009-08-24 07:18 . 2004-07-26 10:46 1568768 ------w- c:\windows\system32\ImagX7.dll 2009-08-24 07:18 . 2001-07-09 05:20 155648 ----a-w- c:\windows\system32\NeroCheck.exe 2009-08-24 07:17 . 2009-08-24 07:17 -------- d-----w- c:\program files\Common Files\Ahead 2009-08-24 07:17 . 2009-08-24 07:18 -------- d-----w- c:\program files\Ahead 2009-08-23 16:58 . 2009-08-23 17:08 -------- d-----w- c:\program files\Photo Optimizer 2009-08-23 16:56 . 2009-08-23 16:58 -------- d-----w- c:\documents and settings\Administrator\Application Data\GetRightToGo 2009-08-22 13:35 . 2009-08-22 13:35 -------- d-----w- c:\windows\system32\XPSViewer 2009-08-22 13:35 . 2009-08-22 13:35 -------- d-----w- c:\program files\MSBuild 2009-08-22 13:35 . 2009-08-22 13:35 -------- d-----w- c:\program files\Reference Assemblies 2009-08-22 13:35 . 2008-07-06 12:06 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll 2009-08-22 13:35 . 2008-07-06 12:06 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll 2009-08-22 13:35 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll 2009-08-22 13:35 . 2008-07-06 12:06 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll 2009-08-22 13:35 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll 2009-08-22 13:35 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll 2009-08-22 13:35 . 2008-07-06 10:50 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe 2009-08-22 10:18 . 2009-08-22 10:18 -------- d-----w- c:\windows\Sun 2009-08-22 05:19 . 2009-08-22 05:18 410984 ----a-w- c:\windows\system32\deploytk.dll 2009-08-22 05:18 . 2009-08-22 05:18 -------- d-----w- c:\program files\Java 2009-08-22 05:18 . 2009-08-22 05:18 152576 ----a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\jre1.6.0_14\lzma.dll 2009-08-20 20:27 . 2009-08-20 20:32 -------- d-----w- c:\program files\123 GIF&JPG Optimizer 2009-08-20 20:12 . 2009-08-20 20:12 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes 2009-08-20 20:11 . 2009-08-03 08:06 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-08-20 20:11 . 2009-08-20 20:12 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-08-20 20:11 . 2009-08-20 20:11 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2009-08-20 20:11 . 2009-08-03 08:06 19096 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-08-16 17:27 . 2009-08-16 18:03 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Adobe 2009-08-16 17:13 . 2009-08-16 17:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Adobe Systems 2009-08-16 17:13 . 2009-08-16 17:13 -------- d-----w- c:\program files\Common Files\Adobe Systems Shared 2009-08-16 17:12 . 2009-08-16 17:17 -------- d-----w- c:\program files\Common Files\Adobe 2009-08-14 11:34 . 2009-08-14 11:34 239088 ----a-w- c:\documents and settings\Administrator\Application Data\Mozilla\plugins\npgoogletalk.dll 2009-08-14 10:54 . 2009-08-14 10:55 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Riot 2009-08-14 09:52 . 2009-08-14 09:56 -------- d-----w- c:\program files\IrfanView 2009-08-12 13:14 . 2009-07-10 13:27 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll 2009-08-09 18:36 . 2009-08-09 18:36 -------- d-----w- c:\program files\MasRizal 2009-08-09 18:35 . 2009-08-09 18:35 -------- d-----w- c:\windows\Downloaded Installations 2009-08-09 18:18 . 2009-08-09 18:18 -------- d-----w- c:\program files\Geeks Ltd 2009-08-09 17:55 . 2009-08-09 17:55 19320 ---ha-w- c:\windows\system32\mlfcache.dat 2009-08-09 10:50 . 2009-08-09 10:53 -------- d-----w- c:\program files\Love2Photo 2009-08-07 13:04 . 2009-08-27 12:03 -------- d-----w- c:\documents and settings\Administrator\Application Data\vlc 2009-08-07 13:02 . 2009-08-07 13:02 -------- d-----w- c:\program files\VideoLAN 2009-08-06 18:58 . 2008-11-05 15:33 607472 ----a-w- c:\documents and settings\All Users\Application Data\Yahoo!\YUpdater\yupdater.exe 2009-08-06 09:04 . 2009-08-06 18:55 -------- d-----w- c:\program files\HTV 2009-08-06 09:04 . 2009-08-06 09:05 439580 ----a-w- c:\documents and settings\Administrator\Application Data\setup_akl.exe 2009-08-05 18:56 . 2009-08-05 18:58 -------- d-----w- c:\program files\NetConceal Anonymizer 2009-08-05 18:26 . 2009-08-05 18:26 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Help 2009-08-05 09:01 . 2009-08-05 09:01 204800 -c----w- c:\windows\system32\dllcache\mswebdvd.dll 2009-08-03 18:56 . 2009-08-03 18:57 -------- d-----w- c:\program files\NetBus Pro 2009-08-03 18:55 . 1998-10-29 12:15 306688 ----a-w- c:\windows\IsUninst.exe 2009-08-02 06:41 . 2009-08-01 16:16 6256600 ---ha-w- c:\documents and settings\Administrator\Application Data\mjusbsp\Upgrade\setup2.exe 2009-08-02 06:41 . 2009-08-01 16:12 728600 ---ha-w- c:\documents and settings\Administrator\Application Data\mjusbsp\Upgrade\install2.exe 2009-08-02 06:27 . 2009-08-02 06:27 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\magicJack 2009-08-01 16:16 . 2009-08-01 16:16 95576 ----a-w- c:\documents and settings\Administrator\Application Data\mjusbsp\ug00000\magicJack.dll 2009-08-01 16:16 . 2009-08-01 16:16 6256600 ----a-w- c:\documents and settings\Administrator\Application Data\mjusbsp\ug00000\setup.exe 2009-08-01 16:16 . 2009-08-01 16:16 413304 ----a-w- c:\documents and settings\Administrator\Application Data\mjusbsp\magicJackLoader.exe 2009-08-01 16:16 . 2009-08-01 16:16 480608 ----a-w- c:\documents and settings\Administrator\Application Data\mjusbsp\octvqe1_apiw.dll 2009-08-01 16:16 . 2009-08-01 16:16 214360 ----a-w- c:\documents and settings\Administrator\Application Data\mjusbsp\TjVista.dll 2009-08-01 16:16 . 2009-08-01 16:16 325040 ----a-w- c:\documents and settings\Administrator\Application Data\mjusbsp\TjIpSys.dll 2009-08-01 16:16 . 2009-08-01 16:16 570736 ----a-w- c:\documents and settings\Administrator\Application Data\mjusbsp\SJHandsetMagicJack.dll 2009-08-01 16:15 . 2009-08-01 16:15 87384 ----a-w- c:\documents and settings\Administrator\Application Data\mjusbsp\st00000\mjsetup.exe 2009-08-01 16:15 . 2009-08-01 16:15 95576 ----a-w- c:\documents and settings\Administrator\Application Data\mjusbsp\st00000\magicJack.dll 2009-08-01 16:15 . 2009-08-01 16:15 95576 ----a-w- c:\documents and settings\Administrator\Application Data\mjusbsp\magicJack.dll 2009-08-01 16:13 . 2009-08-01 16:13 12231512 ----a-w- c:\documents and settings\Administrator\Application Data\mjusbsp\magicJack.exe 2009-08-01 16:12 . 2009-08-01 16:12 728600 ----a-w- c:\documents and settings\Administrator\Application Data\mjusbsp\ug00000\install.exe 2009-08-01 16:12 . 2009-08-01 16:12 87384 ----a-w- c:\documents and settings\Administrator\Application Data\mjusbsp\in00000\mjsetup.exe 2009-08-01 16:12 . 2009-08-01 16:12 95576 ----a-w- c:\documents and settings\Administrator\Application Data\mjusbsp\in00000\magicJack.dll 2009-08-01 16:11 . 2009-08-01 16:11 441704 ----a-w- c:\documents and settings\Administrator\Application Data\mjusbsp\ug00000\magicJackSplash.exe 2009-08-01 16:11 . 2009-08-01 16:11 441704 ----a-w- c:\documents and settings\Administrator\Application Data\mjusbsp\st00000\magicJackSplash.exe 2009-08-01 16:11 . 2009-08-01 16:11 441704 ----a-w- c:\documents and settings\Administrator\Application Data\mjusbsp\magicJackSplash.exe 2009-08-01 16:11 . 2009-08-01 16:11 441704 ----a-w- c:\documents and settings\Administrator\Application Data\mjusbsp\in00000\magicJackSplash.exe 2009-08-01 16:11 . 2009-08-01 16:11 50520 ----a-w- c:\documents and settings\Administrator\Application Data\mjusbsp\cdloader2.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-08-29 11:48 . 2009-07-12 05:31 -------- d-----w- c:\documents and settings\Administrator\Application Data\DMCache 2009-08-28 09:32 . 2009-07-09 14:14 -------- d-----w- c:\documents and settings\Administrator\Application Data\mjusbsp 2009-08-23 16:33 . 2009-07-08 08:39 19584 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-08-23 08:31 . 2009-07-14 16:55 -------- d-----w- c:\program files\Opera 10 Beta 2009-08-20 20:09 . 2009-07-12 05:28 -------- d-----w- c:\program files\Internet Download Manager 2009-08-08 07:21 . 2009-07-12 05:32 -------- d-----w- c:\documents and settings\Administrator\Application Data\IDM 2009-08-06 18:58 . 2009-07-09 07:41 -------- d-----w- c:\program files\Yahoo! 2009-08-05 09:01 . 2004-08-04 12:00 204800 ----a-w- c:\windows\system32\mswebdvd.dll 2009-08-04 18:19 . 2009-07-08 10:22 -------- d-----w- c:\program files\MPlayer for Windows 2009-08-04 18:00 . 2009-07-11 14:39 -------- d-----w- c:\program files\The KMPlayer 2009-08-03 05:16 . 2009-07-23 10:09 -------- d-----w- c:\program files\OpenVPN 2009-07-29 07:29 . 2009-07-29 07:29 -------- d-----w- c:\program files\ESET 2009-07-29 07:29 . 2009-07-29 07:29 -------- d-----w- c:\documents and settings\All Users\Application Data\ESET 2009-07-28 16:31 . 2009-07-24 07:15 -------- d-----w- c:\documents and settings\Administrator\Application Data\Apple Computer 2009-07-24 07:15 . 2009-07-24 07:14 -------- d-----w- c:\program files\iTunes 2009-07-24 07:15 . 2009-07-24 07:14 -------- d-----w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906} 2009-07-24 07:15 . 2009-07-24 07:15 -------- d-----w- c:\program files\iPod 2009-07-24 07:15 . 2009-07-24 07:11 -------- d-----w- c:\program files\Common Files\Apple 2009-07-24 07:14 . 2009-07-24 07:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer 2009-07-24 07:14 . 2009-07-24 07:13 -------- d-----w- c:\program files\QuickTime 2009-07-24 07:12 . 2009-07-24 07:12 -------- d-----w- c:\program files\Apple Software Update 2009-07-24 07:11 . 2009-07-24 07:11 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple 2009-07-23 16:40 . 2009-07-12 11:08 -------- d-----w- c:\documents and settings\Administrator\Application Data\PC Suite 2009-07-23 12:47 . 2009-07-23 12:47 -------- d-----w- c:\documents and settings\Administrator\Application Data\Anonymizer 2009-07-23 12:46 . 2009-07-23 12:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Anonymizer 2009-07-21 07:22 . 2009-07-09 06:59 -------- d-----w- c:\program files\Google 2009-07-21 07:15 . 2009-07-21 07:14 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater 2009-07-20 10:52 . 2009-07-20 10:52 -------- d-----w- c:\program files\MP3 Cutter Plus 2009-07-18 10:14 . 2009-07-18 10:14 -------- d-----w- c:\program files\Easy GIF Animator 2009-07-17 19:01 . 2004-08-04 12:00 58880 ----a-w- c:\windows\system32\atl.dll 2009-07-16 16:48 . 2009-07-16 16:48 -------- d-----w- c:\program files\AndreaMosaic 2009-07-16 05:46 . 2009-07-16 04:40 -------- d-----w- c:\documents and settings\Administrator\Application Data\DAEMON Tools Lite 2009-07-16 04:47 . 2009-07-16 04:47 -------- d-----w- c:\documents and settings\All Users\Application Data\DAEMON Tools Lite 2009-07-16 04:47 . 2009-07-16 04:47 -------- d-----w- c:\program files\DAEMON Tools Toolbar 2009-07-16 04:47 . 2009-07-16 04:46 -------- d-----w- c:\program files\DAEMON Tools Lite 2009-07-16 04:42 . 2009-07-16 04:42 721904 ----a-w- c:\windows\system32\drivers\sptd.sys 2009-07-13 08:52 . 2009-07-13 08:52 75048 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.2.1.6\SetupAdmin.exe 2009-07-12 11:10 . 2009-07-12 11:08 -------- d-----w- c:\documents and settings\Administrator\Application Data\Nokia 2009-07-12 11:10 . 2009-07-12 11:10 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf 2009-07-12 11:10 . 2009-07-12 11:10 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf 2009-07-12 11:08 . 2009-07-12 11:08 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Suite 2009-07-12 11:07 . 2009-07-12 11:07 -------- d-----w- c:\program files\Common Files\PCSuite 2009-07-12 11:07 . 2009-07-12 11:07 -------- d-----w- c:\program files\Common Files\Nokia 2009-07-12 11:07 . 2009-07-12 11:06 -------- d-----w- c:\program files\Nokia 2009-07-12 11:06 . 2009-07-12 11:06 -------- d-----w- c:\program files\DIFX 2009-07-12 11:06 . 2009-07-12 11:06 -------- d-----w- c:\program files\PC Connectivity Solution 2009-07-12 11:04 . 2009-07-12 11:04 8192 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{58FB2F9A-5F2D-40E8-82DF-4987E60AD8BD}\Installer\CommonCustomActions\UninstCCD.exe 2009-07-12 11:04 . 2009-07-12 11:04 61440 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{58FB2F9A-5F2D-40E8-82DF-4987E60AD8BD}\Installer\CommonCustomActions\UninstPCSFEMsi.exe 2009-07-12 11:04 . 2009-07-12 11:04 10240 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{58FB2F9A-5F2D-40E8-82DF-4987E60AD8BD}\Installer\CommonCustomActions\UninstPCS.exe 2009-07-12 11:04 . 2009-07-12 11:04 -------- d-----w- c:\documents and settings\All Users\Application Data\Installations 2009-07-12 06:51 . 2004-08-04 12:00 233472 ----a-w- c:\windows\system32\wmpdxm.dll 2009-07-12 05:35 . 2009-07-12 05:32 198064 ----a-w- c:\documents and settings\Administrator\Application Data\IDM\idmmzcc3\components\idmmzcc.dll 2009-07-10 04:46 . 2009-07-07 13:46 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat 2009-07-09 17:57 . 2009-07-09 17:57 -------- d-----w- c:\program files\Realtek AC97 2009-07-09 17:57 . 2009-07-09 17:57 -------- d--h--w- c:\program files\InstallShield Installation Information 2009-07-09 17:57 . 2009-07-09 17:57 -------- d-----w- c:\program files\Common Files\InstallShield 2009-07-09 12:17 . 2009-07-09 12:17 -------- d-----w- c:\documents and settings\Administrator\Application Data\Foxit 2009-07-09 12:17 . 2009-07-09 12:17 -------- d-----w- c:\program files\Foxit Software 2009-07-09 11:58 . 2009-07-09 11:58 -------- d-----w- c:\program files\Microsoft ActiveSync 2009-07-09 09:06 . 2009-07-09 07:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo! 2009-07-09 06:46 . 2009-07-24 07:12 39424 ----a-w- c:\windows\system32\drivers\usbaapl.sys 2009-07-09 06:46 . 2009-07-24 07:12 2060288 ----a-w- c:\windows\system32\usbaaplrc.dll 2009-07-08 14:37 . 2009-07-08 14:37 0 ----a-w- c:\windows\nsreg.dat 2009-07-07 13:47 . 2009-07-07 13:47 -------- d-----w- c:\program files\microsoft frontpage 2009-07-07 13:43 . 2009-07-07 13:43 21640 ----a-w- c:\windows\system32\emptyregdb.dat 2009-07-03 17:09 . 2004-08-04 12:00 915456 ------w- c:\windows\system32\wininet.dll 2009-06-25 08:25 . 2004-08-04 12:00 730112 ----a-w- c:\windows\system32\lsasrv.dll 2009-06-25 08:25 . 2004-08-04 12:00 56832 ----a-w- c:\windows\system32\secur32.dll 2009-06-25 08:25 . 2004-08-04 12:00 54272 ----a-w- c:\windows\system32\wdigest.dll 2009-06-25 08:25 . 2004-08-04 12:00 301568 ----a-w- c:\windows\system32\kerberos.dll 2009-06-25 08:25 . 2004-08-04 12:00 147456 ----a-w- c:\windows\system32\schannel.dll 2009-06-25 08:25 . 2004-08-04 12:00 136192 ----a-w- c:\windows\system32\msv1_0.dll 2009-06-24 11:18 . 2004-08-04 12:00 92928 ----a-w- c:\windows\system32\drivers\ksecdd.sys 2009-06-16 14:36 . 2004-08-04 12:00 81920 ----a-w- c:\windows\system32\fontsub.dll 2009-06-16 14:36 . 2004-08-04 12:00 119808 ----a-w- c:\windows\system32\t2embed.dll 2009-06-12 12:31 . 2004-08-04 12:00 80896 ----a-w- c:\windows\system32\tlntsess.exe 2009-06-12 12:31 . 2004-08-04 12:00 76288 ----a-w- c:\windows\system32\telnet.exe 2009-06-10 14:13 . 2004-08-04 12:00 84992 ----a-w- c:\windows\system32\avifil32.dll 2009-06-10 06:14 . 2004-08-04 12:00 132096 ----a-w- c:\windows\system32\wkssvc.dll 2009-06-10 03:49 . 2009-07-07 13:42 2066432 ----a-w- c:\windows\system32\mstscax.dll 2009-06-03 19:09 . 2004-08-04 12:00 1291264 ----a-w- c:\windows\system32\quartz.dll . ((((((((((((((((((((((((((((( SnapShot@2009-08-29_13.24.59 ))))))))))))))))))))))))))))))))))))))))) . + 2009-08-30 09:28 . 2009-08-30 09:28 16384 c:\windows\temp\Perflib_Perfdata_2a8.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2008-12-03 1205760] "cdloader"="c:\documents and settings\Administrator\Application Data\mjusbsp\cdloader2.exe" [2009-08-01 50520] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-02-06 2021400] "MPlayerForWindows_UpdateReminder"="c:\program files\MPlayer for Windows\AutoUpdate.exe" [2009-07-24 72016] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-08-22 148888] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] c:\documents and settings\Administrator\Start Menu\Programs\Startup\ Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Google\\Google Talk\\googletalk.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Documents and Settings\\Administrator\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.dll"= "c:\\Documents and Settings\\Administrator\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Opera 10 Beta\\opera.exe"= "c:\\Documents and Settings\\Administrator\\Application Data\\mjusbsp\\magicJack.exe"= "c:\\Program Files\\Veoh Networks\\VeohWebPlayer\\veohwebplayer.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "9780:TCP"= 9780:TCP:lqcvfze R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2/6/2009 2:23 PM 106208] R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2/6/2009 2:24 PM 93336] R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2/6/2009 2:23 PM 727720] S2 .EsetTrialReset;Eset Trial Reset;c:\windows\system32\regedt32.exe [8/4/2004 5:30 PM 3584] S2 gupdate1ca09d3e0cb663a;Google Update Service (gupdate1ca09d3e0cb663a);c:\program files\Google\Update\GoogleUpdate.exe [7/21/2009 12:51 PM 133104] S2 wesbpwd;lveiwb;c:\windows\system32\svchost.exe -k netsvcs [8/4/2004 5:30 PM 14336] S3 tap0801;TAP-Win32 Adapter V8;c:\windows\system32\drivers\tap0801.sys [10/1/2006 6:07 PM 26624] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] "c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP . Contents of the 'Scheduled Tasks' folder 2009-08-30 c:\windows\Tasks\Google Software Updater.job - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-07-12 07:14] 2009-08-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-07-21 07:21] 2009-08-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-07-21 07:21] 2009-08-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-682003330-796845957-839522115-500Core.job - c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-07-15 17:18] 2009-08-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-682003330-796845957-839522115-500UA.job - c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-07-15 17:18] . . ------- Supplementary Scan ------- . uStart Page = about:blank uInternet Settings,ProxyOverride = local IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: Download all links with IDM - c:\program files\Internet Download Manager\IEGetAll.htm IE: Download FLV video content with IDM - c:\program files\Internet Download Manager\IEGetVL.htm IE: Download with IDM - c:\program files\Internet Download Manager\IEExt.htm IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 LSP: c:\windows\system32\idmmbc.dll FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\qwpn8pec.default\ FF - prefs.js: browser.startup.homepage - www.google.com FF - component: c:\documents and settings\Administrator\Application Data\IDM\idmmzcc3\components\idmmzcc.dll FF - plugin: c:\documents and settings\Administrator\Application Data\Mozilla\plugins\npgoogletalk.dll FF - plugin: c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\1.2.183.7\npGoogleOneClick8.dll FF - plugin: c:\program files\Google\Google Updater\2.4.1636.7222\npCIDetect13.dll FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll FF - plugin: c:\program files\Opera 10 Beta\program\plugins\npdsplay.dll FF - plugin: c:\program files\Opera 10 Beta\program\plugins\npqtplugin.dll FF - plugin: c:\program files\Opera 10 Beta\program\plugins\npqtplugin2.dll FF - plugin: c:\program files\Opera 10 Beta\program\plugins\npqtplugin3.dll FF - plugin: c:\program files\Opera 10 Beta\program\plugins\npqtplugin4.dll FF - plugin: c:\program files\Opera 10 Beta\program\plugins\npqtplugin5.dll FF - plugin: c:\program files\Opera 10 Beta\program\plugins\npqtplugin6.dll FF - plugin: c:\program files\Opera 10 Beta\program\plugins\npqtplugin7.dll FF - plugin: c:\program files\Opera 10 Beta\program\plugins\npwmsdrm.dll FF - plugin: c:\program files\Veoh Networks\VeohWebPlayer\npWebPlayerVideoPluginATL.dll ---- FIREFOX POLICIES ---- c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200); c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews..wholeText", "noAccess"); c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120); c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1); c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1); c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072); c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35"); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json"); . *********************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-08-30 14:58 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ********************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'lsass.exe'(756) c:\windows\system32\idmmbc.dll - - - - - - - > 'explorer.exe'(864) c:\windows\system32\WININET.dll c:\windows\system32\ieframe.dll c:\windows\system32\webcheck.dll . ------------------------ Other Running Processes ------------------------ . c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Java\jre6\bin\jqs.exe c:\program files\PC Connectivity Solution\ServiceLayer.exe c:\program files\PC Connectivity Solution\Transports\NclUSBSrv.exe c:\program files\PC Connectivity Solution\Transports\NclRSSrv.exe . ************************************************************************ . Completion time: 2009-08-30 15:02 - machine was rebooted ComboFix-quarantined-files.txt 2009-08-30 09:32 ComboFix2.txt 2009-08-29 13:27 Pre-Run: 28,283,805,696 bytes free Post-Run: 28,165,558,272 bytes free 361 --- E O F --- 2009-08-25 19:13

emeraldnzl View Member Profile	Aug 30 2009, 03:31 PM Post #12
Trusted Helper Posts: 8,065 OS: XP Pro	Hello suryavarma143, Looking much better. Now 1. Close any open browsers. 2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. 3. Open notepad and copy/paste the text in the quotebox below into it: QUOTE KillAll:: Registry:: [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "9780:TCP"= "" Reboot:: Save this as CFScript.txt, in the same location as ComboFix.exe Refering to the picture above, drag CFScript into ComboFix.exe When finished, it will produce a log for you at C:\ComboFix.txt. Please post that here for further review.

suryavarma143 View Member Profile	Aug 31 2009, 01:47 AM Post #13
Member Posts: 17 OS: XP	ComboFix.txt ComboFix 09-08-30.01 - Administrator 08/31/2009 13:07.4.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.510.260 [GMT 5.5:30] Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt AV: ESET NOD32 Antivirus 4.0 On-access scanning enabled (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0} . ((((((((((((((((((((((((( Files Created from 2009-07-28 to 2009-08-31 ))))))))))))))))))))))))))))))) . 2009-08-28 10:10 . 2009-08-28 10:10 -------- d-----w- c:\program files\Veoh Networks 2009-08-28 09:32 . 2009-08-01 16:16 6256600 ---ha-w- c:\documents and settings\Administrator\Application Data\mjusbsp\in00000\setup.exe 2009-08-28 09:32 . 2009-08-01 16:12 728600 ---ha-w- c:\documents and settings\Administrator\Application Data\mjusbsp\ar00000\install.exe 2009-08-27 09:17 . 2009-08-27 09:17 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache 2009-08-27 07:23 . 2009-08-27 07:23 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE 2009-08-27 07:21 . 2009-08-27 07:21 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache 2009-08-27 07:17 . 2009-08-27 07:17 -------- d-----w- c:\windows\ie8updates 2009-08-27 07:16 . 2009-08-27 07:16 -------- dc-h--w- c:\windows\ie8 2009-08-27 07:14 . 2009-08-07 08:48 100352 -c----w- c:\windows\system32\dllcache\iecompat.dll 2009-08-27 07:13 . 2009-07-03 17:09 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll 2009-08-27 07:13 . 2009-07-03 17:09 594432 -c----w- c:\windows\system32\dllcache\msfeeds.dll 2009-08-27 07:13 . 2009-07-03 17:09 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll 2009-08-27 07:13 . 2009-07-03 17:09 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll 2009-08-27 07:13 . 2009-07-03 17:09 1985536 -c----w- c:\windows\system32\dllcache\iertutil.dll 2009-08-27 06:28 . 2009-08-27 06:29 0 ----a-w- c:\documents and settings\Administrator\Application Data\IDM\DwnlData\Administrator\wwae7few_322\wwae7few.exe 2009-08-25 06:15 . 2009-08-25 06:15 -------- d-----w- c:\program files\CCleaner 2009-08-24 07:18 . 2004-07-09 03:13 364544 ------w- c:\windows\system32\TwnLib4.dll 2009-08-24 07:18 . 2000-06-26 05:15 106496 ----a-w- c:\windows\system32\TwnLib20.dll 2009-08-24 07:18 . 2004-07-26 10:46 476320 ------w- c:\windows\system32\ImagXpr7.dll 2009-08-24 07:18 . 2004-07-26 10:46 471040 ------w- c:\windows\system32\ImagXRA7.dll 2009-08-24 07:18 . 2004-07-26 10:46 262144 ------w- c:\windows\system32\ImagXR7.dll 2009-08-24 07:18 . 2004-07-26 10:46 1568768 ------w- c:\windows\system32\ImagX7.dll 2009-08-24 07:18 . 2001-07-09 05:20 155648 ----a-w- c:\windows\system32\NeroCheck.exe 2009-08-24 07:17 . 2009-08-24 07:17 -------- d-----w- c:\program files\Common Files\Ahead 2009-08-24 07:17 . 2009-08-24 07:18 -------- d-----w- c:\program files\Ahead 2009-08-23 16:58 . 2009-08-23 17:08 -------- d-----w- c:\program files\Photo Optimizer 2009-08-23 16:56 . 2009-08-23 16:58 -------- d-----w- c:\documents and settings\Administrator\Application Data\GetRightToGo 2009-08-22 13:35 . 2009-08-22 13:35 -------- d-----w- c:\windows\system32\XPSViewer 2009-08-22 13:35 . 2009-08-22 13:35 -------- d-----w- c:\program files\MSBuild 2009-08-22 13:35 . 2009-08-22 13:35 -------- d-----w- c:\program files\Reference Assemblies 2009-08-22 13:35 . 2008-07-06 12:06 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll 2009-08-22 13:35 . 2008-07-06 12:06 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll 2009-08-22 13:35 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll 2009-08-22 13:35 . 2008-07-06 12:06 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll 2009-08-22 13:35 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll 2009-08-22 13:35 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll 2009-08-22 13:35 . 2008-07-06 10:50 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe 2009-08-22 10:18 . 2009-08-22 10:18 -------- d-----w- c:\windows\Sun 2009-08-22 05:19 . 2009-08-22 05:18 410984 ----a-w- c:\windows\system32\deploytk.dll 2009-08-22 05:18 . 2009-08-22 05:18 -------- d-----w- c:\program files\Java 2009-08-22 05:18 . 2009-08-22 05:18 152576 ----a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\jre1.6.0_14\lzma.dll 2009-08-20 20:27 . 2009-08-20 20:32 -------- d-----w- c:\program files\123 GIF&JPG Optimizer 2009-08-20 20:12 . 2009-08-20 20:12 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes 2009-08-20 20:11 . 2009-08-03 08:06 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-08-20 20:11 . 2009-08-20 20:12 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-08-20 20:11 . 2009-08-20 20:11 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2009-08-20 20:11 . 2009-08-03 08:06 19096 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-08-16 17:27 . 2009-08-16 18:03 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Adobe 2009-08-16 17:13 . 2009-08-16 17:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Adobe Systems 2009-08-16 17:13 . 2009-08-16 17:13 -------- d-----w- c:\program files\Common Files\Adobe Systems Shared 2009-08-16 17:12 . 2009-08-16 17:17 -------- d-----w- c:\program files\Common Files\Adobe 2009-08-14 11:34 . 2009-08-14 11:34 239088 ----a-w- c:\documents and settings\Administrator\Application Data\Mozilla\plugins\npgoogletalk.dll 2009-08-14 10:54 . 2009-08-14 10:55 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Riot 2009-08-14 09:52 . 2009-08-14 09:56 -------- d-----w- c:\program files\IrfanView 2009-08-12 13:14 . 2009-07-10 13:27 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll 2009-08-09 18:36 . 2009-08-09 18:36 -------- d-----w- c:\program files\MasRizal 2009-08-09 18:35 . 2009-08-09 18:35 -------- d-----w- c:\windows\Downloaded Installations 2009-08-09 18:18 . 2009-08-09 18:18 -------- d-----w- c:\program files\Geeks Ltd 2009-08-09 17:55 . 2009-08-09 17:55 19320 ---ha-w- c:\windows\system32\mlfcache.dat 2009-08-09 10:50 . 2009-08-09 10:53 -------- d-----w- c:\program files\Love2Photo 2009-08-07 13:04 . 2009-08-27 12:03 -------- d-----w- c:\documents and settings\Administrator\Application Data\vlc 2009-08-07 13:02 . 2009-08-07 13:02 -------- d-----w- c:\program files\VideoLAN 2009-08-06 18:58 . 2008-11-05 15:33 607472 ----a-w- c:\documents and settings\All Users\Application Data\Yahoo!\YUpdater\yupdater.exe 2009-08-06 09:04 . 2009-08-06 18:55 -------- d-----w- c:\program files\HTV 2009-08-06 09:04 . 2009-08-06 09:05 439580 ----a-w- c:\documents and settings\Administrator\Application Data\setup_akl.exe 2009-08-05 18:56 . 2009-08-05 18:58 -------- d-----w- c:\program files\NetConceal Anonymizer 2009-08-05 18:26 . 2009-08-05 18:26 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Help 2009-08-05 09:01 . 2009-08-05 09:01 204800 -c----w- c:\windows\system32\dllcache\mswebdvd.dll 2009-08-03 18:56 . 2009-08-03 18:57 -------- d-----w- c:\program files\NetBus Pro 2009-08-03 18:55 . 1998-10-29 12:15 306688 ----a-w- c:\windows\IsUninst.exe 2009-08-02 06:41 . 2009-08-01 16:16 6256600 ---ha-w- c:\documents and settings\Administrator\Application Data\mjusbsp\Upgrade\setup2.exe 2009-08-02 06:41 . 2009-08-01 16:12 728600 ---ha-w- c:\documents and settings\Administrator\Application Data\mjusbsp\Upgrade\install2.exe 2009-08-02 06:27 . 2009-08-02 06:27 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\magicJack 2009-08-01 16:16 . 2009-08-01 16:16 95576 ----a-w- c:\documents and settings\Administrator\Application Data\mjusbsp\ug00000\magicJack.dll 2009-08-01 16:16 . 2009-08-01 16:16 6256600 ----a-w- c:\documents and settings\Administrator\Application Data\mjusbsp\ug00000\setup.exe 2009-08-01 16:16 . 2009-08-01 16:16 413304 ----a-w- c:\documents and settings\Administrator\Application Data\mjusbsp\magicJackLoader.exe 2009-08-01 16:16 . 2009-08-01 16:16 480608 ----a-w- c:\documents and settings\Administrator\Application Data\mjusbsp\octvqe1_apiw.dll 2009-08-01 16:16 . 2009-08-01 16:16 214360 ----a-w- c:\documents and settings\Administrator\Application Data\mjusbsp\TjVista.dll 2009-08-01 16:16 . 2009-08-01 16:16 325040 ----a-w- c:\documents and settings\Administrator\Application Data\mjusbsp\TjIpSys.dll 2009-08-01 16:16 . 2009-08-01 16:16 570736 ----a-w- c:\documents and settings\Administrator\Application Data\mjusbsp\SJHandsetMagicJack.dll 2009-08-01 16:15 . 2009-08-01 16:15 87384 ----a-w- c:\documents and settings\Administrator\Application Data\mjusbsp\st00000\mjsetup.exe 2009-08-01 16:15 . 2009-08-01 16:15 95576 ----a-w- c:\documents and settings\Administrator\Application Data\mjusbsp\st00000\magicJack.dll 2009-08-01 16:15 . 2009-08-01 16:15 95576 ----a-w- c:\documents and settings\Administrator\Application Data\mjusbsp\magicJack.dll 2009-08-01 16:13 . 2009-08-01 16:13 12231512 ----a-w- c:\documents and settings\Administrator\Application Data\mjusbsp\magicJack.exe 2009-08-01 16:12 . 2009-08-01 16:12 728600 ----a-w- c:\documents and settings\Administrator\Application Data\mjusbsp\ug00000\install.exe 2009-08-01 16:12 . 2009-08-01 16:12 87384 ----a-w- c:\documents and settings\Administrator\Application Data\mjusbsp\in00000\mjsetup.exe 2009-08-01 16:12 . 2009-08-01 16:12 95576 ----a-w- c:\documents and settings\Administrator\Application Data\mjusbsp\in00000\magicJack.dll 2009-08-01 16:11 . 2009-08-01 16:11 441704 ----a-w- c:\documents and settings\Administrator\Application Data\mjusbsp\ug00000\magicJackSplash.exe 2009-08-01 16:11 . 2009-08-01 16:11 441704 ----a-w- c:\documents and settings\Administrator\Application Data\mjusbsp\st00000\magicJackSplash.exe 2009-08-01 16:11 . 2009-08-01 16:11 441704 ----a-w- c:\documents and settings\Administrator\Application Data\mjusbsp\magicJackSplash.exe 2009-08-01 16:11 . 2009-08-01 16:11 441704 ----a-w- c:\documents and settings\Administrator\Application Data\mjusbsp\in00000\magicJackSplash.exe 2009-08-01 16:11 . 2009-08-01 16:11 50520 ----a-w- c:\documents and settings\Administrator\Application Data\mjusbsp\cdloader2.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-08-30 16:22 . 2009-07-12 05:31 -------- d-----w- c:\documents and settings\Administrator\Application Data\DMCache 2009-08-28 09:32 . 2009-07-09 14:14 -------- d-----w- c:\documents and settings\Administrator\Application Data\mjusbsp 2009-08-23 16:33 . 2009-07-08 08:39 19584 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-08-23 08:31 . 2009-07-14 16:55 -------- d-----w- c:\program files\Opera 10 Beta 2009-08-20 20:09 . 2009-07-12 05:28 -------- d-----w- c:\program files\Internet Download Manager 2009-08-08 07:21 . 2009-07-12 05:32 -------- d-----w- c:\documents and settings\Administrator\Application Data\IDM 2009-08-06 18:58 . 2009-07-09 07:41 -------- d-----w- c:\program files\Yahoo! 2009-08-05 09:01 . 2004-08-04 12:00 204800 ----a-w- c:\windows\system32\mswebdvd.dll 2009-08-04 18:19 . 2009-07-08 10:22 -------- d-----w- c:\program files\MPlayer for Windows 2009-08-04 18:00 . 2009-07-11 14:39 -------- d-----w- c:\program files\The KMPlayer 2009-08-03 05:16 . 2009-07-23 10:09 -------- d-----w- c:\program files\OpenVPN 2009-07-29 07:29 . 2009-07-29 07:29 -------- d-----w- c:\program files\ESET 2009-07-29 07:29 . 2009-07-29 07:29 -------- d-----w- c:\documents and settings\All Users\Application Data\ESET 2009-07-28 16:31 . 2009-07-24 07:15 -------- d-----w- c:\documents and settings\Administrator\Application Data\Apple Computer 2009-07-24 07:15 . 2009-07-24 07:14 -------- d-----w- c:\program files\iTunes 2009-07-24 07:15 . 2009-07-24 07:14 -------- d-----w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906} 2009-07-24 07:15 . 2009-07-24 07:15 -------- d-----w- c:\program files\iPod 2009-07-24 07:15 . 2009-07-24 07:11 -------- d-----w- c:\program files\Common Files\Apple 2009-07-24 07:14 . 2009-07-24 07:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer 2009-07-24 07:14 . 2009-07-24 07:13 -------- d-----w- c:\program files\QuickTime 2009-07-24 07:12 . 2009-07-24 07:12 -------- d-----w- c:\program files\Apple Software Update 2009-07-24 07:11 . 2009-07-24 07:11 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple 2009-07-23 16:40 . 2009-07-12 11:08 -------- d-----w- c:\documents and settings\Administrator\Application Data\PC Suite 2009-07-23 12:47 . 2009-07-23 12:47 -------- d-----w- c:\documents and settings\Administrator\Application Data\Anonymizer 2009-07-23 12:46 . 2009-07-23 12:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Anonymizer 2009-07-21 07:22 . 2009-07-09 06:59 -------- d-----w- c:\program files\Google 2009-07-21 07:15 . 2009-07-21 07:14 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater 2009-07-20 10:52 . 2009-07-20 10:52 -------- d-----w- c:\program files\MP3 Cutter Plus 2009-07-18 10:14 . 2009-07-18 10:14 -------- d-----w- c:\program files\Easy GIF Animator 2009-07-17 19:01 . 2004-08-04 12:00 58880 ----a-w- c:\windows\system32\atl.dll 2009-07-16 16:48 . 2009-07-16 16:48 -------- d-----w- c:\program files\AndreaMosaic 2009-07-16 05:46 . 2009-07-16 04:40 -------- d-----w- c:\documents and settings\Administrator\Application Data\DAEMON Tools Lite 2009-07-16 04:47 . 2009-07-16 04:47 -------- d-----w- c:\documents and settings\All Users\Application Data\DAEMON Tools Lite 2009-07-16 04:47 . 2009-07-16 04:47 -------- d-----w- c:\program files\DAEMON Tools Toolbar 2009-07-16 04:47 . 2009-07-16 04:46 -------- d-----w- c:\program files\DAEMON Tools Lite 2009-07-16 04:42 . 2009-07-16 04:42 721904 ----a-w- c:\windows\system32\drivers\sptd.sys 2009-07-13 08:52 . 2009-07-13 08:52 75048 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.2.1.6\SetupAdmin.exe 2009-07-12 11:10 . 2009-07-12 11:08 -------- d-----w- c:\documents and settings\Administrator\Application Data\Nokia 2009-07-12 11:10 . 2009-07-12 11:10 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf 2009-07-12 11:10 . 2009-07-12 11:10 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf 2009-07-12 11:08 . 2009-07-12 11:08 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Suite 2009-07-12 11:07 . 2009-07-12 11:07 -------- d-----w- c:\program files\Common Files\PCSuite 2009-07-12 11:07 . 2009-07-12 11:07 -------- d-----w- c:\program files\Common Files\Nokia 2009-07-12 11:07 . 2009-07-12 11:06 -------- d-----w- c:\program files\Nokia 2009-07-12 11:06 . 2009-07-12 11:06 -------- d-----w- c:\program files\DIFX 2009-07-12 11:06 . 2009-07-12 11:06 -------- d-----w- c:\program files\PC Connectivity Solution 2009-07-12 11:04 . 2009-07-12 11:04 8192 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{58FB2F9A-5F2D-40E8-82DF-4987E60AD8BD}\Installer\CommonCustomActions\UninstCCD.exe 2009-07-12 11:04 . 2009-07-12 11:04 61440 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{58FB2F9A-5F2D-40E8-82DF-4987E60AD8BD}\Installer\CommonCustomActions\UninstPCSFEMsi.exe 2009-07-12 11:04 . 2009-07-12 11:04 10240 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{58FB2F9A-5F2D-40E8-82DF-4987E60AD8BD}\Installer\CommonCustomActions\UninstPCS.exe 2009-07-12 11:04 . 2009-07-12 11:04 -------- d-----w- c:\documents and settings\All Users\Application Data\Installations 2009-07-12 06:51 . 2004-08-04 12:00 233472 ----a-w- c:\windows\system32\wmpdxm.dll 2009-07-12 05:35 . 2009-07-12 05:32 198064 ----a-w- c:\documents and settings\Administrator\Application Data\IDM\idmmzcc3\components\idmmzcc.dll 2009-07-10 04:46 . 2009-07-07 13:46 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat 2009-07-09 17:57 . 2009-07-09 17:57 -------- d-----w- c:\program files\Realtek AC97 2009-07-09 17:57 . 2009-07-09 17:57 -------- d--h--w- c:\program files\InstallShield Installation Information 2009-07-09 17:57 . 2009-07-09 17:57 -------- d-----w- c:\program files\Common Files\InstallShield 2009-07-09 12:17 . 2009-07-09 12:17 -------- d-----w- c:\documents and settings\Administrator\Application Data\Foxit 2009-07-09 12:17 . 2009-07-09 12:17 -------- d-----w- c:\program files\Foxit Software 2009-07-09 11:58 . 2009-07-09 11:58 -------- d-----w- c:\program files\Microsoft ActiveSync 2009-07-09 09:06 . 2009-07-09 07:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo! 2009-07-09 06:46 . 2009-07-24 07:12 39424 ----a-w- c:\windows\system32\drivers\usbaapl.sys 2009-07-09 06:46 . 2009-07-24 07:12 2060288 ----a-w- c:\windows\system32\usbaaplrc.dll 2009-07-08 14:37 . 2009-07-08 14:37 0 ----a-w- c:\windows\nsreg.dat 2009-07-07 13:47 . 2009-07-07 13:47 -------- d-----w- c:\program files\microsoft frontpage 2009-07-07 13:43 . 2009-07-07 13:43 21640 ----a-w- c:\windows\system32\emptyregdb.dat 2009-07-03 17:09 . 2004-08-04 12:00 915456 ------w- c:\windows\system32\wininet.dll 2009-06-25 08:25 . 2004-08-04 12:00 730112 ----a-w- c:\windows\system32\lsasrv.dll 2009-06-25 08:25 . 2004-08-04 12:00 56832 ----a-w- c:\windows\system32\secur32.dll 2009-06-25 08:25 . 2004-08-04 12:00 54272 ----a-w- c:\windows\system32\wdigest.dll 2009-06-25 08:25 . 2004-08-04 12:00 301568 ----a-w- c:\windows\system32\kerberos.dll 2009-06-25 08:25 . 2004-08-04 12:00 147456 ----a-w- c:\windows\system32\schannel.dll 2009-06-25 08:25 . 2004-08-04 12:00 136192 ----a-w- c:\windows\system32\msv1_0.dll 2009-06-24 11:18 . 2004-08-04 12:00 92928 ----a-w- c:\windows\system32\drivers\ksecdd.sys 2009-06-16 14:36 . 2004-08-04 12:00 81920 ----a-w- c:\windows\system32\fontsub.dll 2009-06-16 14:36 . 2004-08-04 12:00 119808 ----a-w- c:\windows\system32\t2embed.dll 2009-06-12 12:31 . 2004-08-04 12:00 80896 ----a-w- c:\windows\system32\tlntsess.exe 2009-06-12 12:31 . 2004-08-04 12:00 76288 ----a-w- c:\windows\system32\telnet.exe 2009-06-10 14:13 . 2004-08-04 12:00 84992 ----a-w- c:\windows\system32\avifil32.dll 2009-06-10 06:14 . 2004-08-04 12:00 132096 ----a-w- c:\windows\system32\wkssvc.dll 2009-06-10 03:49 . 2009-07-07 13:42 2066432 ----a-w- c:\windows\system32\mstscax.dll 2009-06-03 19:09 . 2004-08-04 12:00 1291264 ----a-w- c:\windows\system32\quartz.dll . ((((((((((((((((((((((((((((( SnapShot@2009-08-29_13.24.59 ))))))))))))))))))))))))))))))))))))))))) . + 2009-08-31 07:42 . 2009-08-31 07:42 16384 c:\windows\temp\Perflib_Perfdata_294.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2008-12-03 1205760] "cdloader"="c:\documents and settings\Administrator\Application Data\mjusbsp\cdloader2.exe" [2009-08-01 50520] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-02-06 2021400] "MPlayerForWindows_UpdateReminder"="c:\program files\MPlayer for Windows\AutoUpdate.exe" [2009-07-24 72016] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-08-22 148888] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] c:\documents and settings\Administrator\Start Menu\Programs\Startup\ Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Google\\Google Talk\\googletalk.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Documents and Settings\\Administrator\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.dll"= "c:\\Documents and Settings\\Administrator\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Opera 10 Beta\\opera.exe"= "c:\\Documents and Settings\\Administrator\\Application Data\\mjusbsp\\magicJack.exe"= "c:\\Program Files\\Veoh Networks\\VeohWebPlayer\\veohwebplayer.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "9780:TCP"= R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2/6/2009 2:23 PM 106208] R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2/6/2009 2:24 PM 93336] R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2/6/2009 2:23 PM 727720] S2 .EsetTrialReset;Eset Trial Reset;c:\windows\system32\regedt32.exe [8/4/2004 5:30 PM 3584] S2 gupdate1ca09d3e0cb663a;Google Update Service (gupdate1ca09d3e0cb663a);c:\program files\Google\Update\GoogleUpdate.exe [7/21/2009 12:51 PM 133104] S2 wesbpwd;lveiwb;c:\windows\system32\svchost.exe -k netsvcs [8/4/2004 5:30 PM 14336] S3 tap0801;TAP-Win32 Adapter V8;c:\windows\system32\drivers\tap0801.sys [10/1/2006 6:07 PM 26624] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] "c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP . Contents of the 'Scheduled Tasks' folder 2009-08-31 c:\windows\Tasks\Google Software Updater.job - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-07-12 07:14] 2009-08-31 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-07-21 07:21] 2009-08-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-07-21 07:21] 2009-08-30 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-682003330-796845957-839522115-500Core.job - c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-07-15 17:18] 2009-08-31 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-682003330-796845957-839522115-500UA.job - c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-07-15 17:18] . . ------- Supplementary Scan ------- . uStart Page = about:blank uInternet Settings,ProxyOverride = local IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: Download all links with IDM - c:\program files\Internet Download Manager\IEGetAll.htm IE: Download FLV video content with IDM - c:\program files\Internet Download Manager\IEGetVL.htm IE: Download with IDM - c:\program files\Internet Download Manager\IEExt.htm IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 LSP: c:\windows\system32\idmmbc.dll FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\qwpn8pec.default\ FF - prefs.js: browser.startup.homepage - www.google.com FF - component: c:\documents and settings\Administrator\Application Data\IDM\idmmzcc3\components\idmmzcc.dll FF - plugin: c:\documents and settings\Administrator\Application Data\Mozilla\plugins\npgoogletalk.dll FF - plugin: c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\1.2.183.7\npGoogleOneClick8.dll FF - plugin: c:\program files\Google\Google Updater\2.4.1636.7222\npCIDetect13.dll FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll FF - plugin: c:\program files\Opera 10 Beta\program\plugins\npdsplay.dll FF - plugin: c:\program files\Opera 10 Beta\program\plugins\npqtplugin.dll FF - plugin: c:\program files\Opera 10 Beta\program\plugins\npqtplugin2.dll FF - plugin: c:\program files\Opera 10 Beta\program\plugins\npqtplugin3.dll FF - plugin: c:\program files\Opera 10 Beta\program\plugins\npqtplugin4.dll FF - plugin: c:\program files\Opera 10 Beta\program\plugins\npqtplugin5.dll FF - plugin: c:\program files\Opera 10 Beta\program\plugins\npqtplugin6.dll FF - plugin: c:\program files\Opera 10 Beta\program\plugins\npqtplugin7.dll FF - plugin: c:\program files\Opera 10 Beta\program\plugins\npwmsdrm.dll FF - plugin: c:\program files\Veoh Networks\VeohWebPlayer\npWebPlayerVideoPluginATL.dll ---- FIREFOX POLICIES ---- c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200); c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews..wholeText", "noAccess"); c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120); c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1); c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1); c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072); c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35"); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json"); . *********************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-08-31 13:12 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ********************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'lsass.exe'(756) c:\windows\system32\idmmbc.dll - - - - - - - > 'explorer.exe'(208) c:\windows\system32\WININET.dll c:\windows\system32\ieframe.dll c:\windows\system32\webcheck.dll c:\progra~1\MICROS~2\OFFICE11\MCPS.DLL c:\program files\Internet Download Manager\idmmkb.dll . ------------------------ Other Running Processes ------------------------ . c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Java\jre6\bin\jqs.exe c:\program files\PC Connectivity Solution\ServiceLayer.exe c:\program files\PC Connectivity Solution\Transports\NclUSBSrv.exe c:\program files\PC Connectivity Solution\Transports\NclRSSrv.exe c:\program files\Mozilla Firefox\firefox.exe . ************************************************************************ . Completion time: 2009-08-31 13:16 - machine was rebooted ComboFix-quarantined-files.txt 2009-08-31 07:46 ComboFix2.txt 2009-08-30 09:32 ComboFix3.txt 2009-08-29 13:27 Pre-Run: 27,937,988,608 bytes free Post-Run: 27,883,794,432 bytes free 357 --- E O F --- 2009-08-25 19:13

emeraldnzl View Member Profile	Aug 31 2009, 01:21 PM Post #14
Trusted Helper Posts: 8,065 OS: XP Pro	Hello suryavarma143, A question: Did you install the Internet Download Manager idmmkb module or perhaps it's called Acoustica Effects Pack or Internet Download Manager Tonec Inc? The reason I ask is that there is a file showing in your logs that can be either good or bad depending on what it is there for. Now You have used Malwarebytes before. If you still have it on your machine please update and run. Post the scan report back here. If you no-longer have Malwarebytes please download from Here Double Click mbam-setup.exe to install the application. Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish. If an update is found, it will download and install the latest version. Once the program has loaded, select "Perform Quick Scan", then click Scan. The scan may take some time to finish,so please be patient. When the scan is complete, click OK, then Show Results to view the results. Make sure that everything is checked, and click Remove Selected. When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note) The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM. Copy & Paste the entire report in your next reply. Extra Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly. Next Kaspersky on line scanner is very thorough. It can take a long time and for periods may seem not to be working. Just be patient and let it do its job. Kaspersky works with Internet Explorer and Firefox 3. It uses Java Runtime Environment (JRE) . Go to Kaspersky website and perform an online antivirus scan. Note: you will need to turn off your security programs to allow Kaspersky to do its job. Read through the requirements and privacy statement and click on Accept button. It will start dowanloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run. When the downloads have finished, click on Settings. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button: Spyware, Adware, Dialers, and other potentially dangerous programs Archives Mail databases Click on My Computer under Scan. Once the scan is complete, it will display the results. Click on View Scan Report. You will see a list of infected items there. Click on Save Report As.... Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Copy and paste that information in your next post. When you return please post MBAM log Kaspersky scan results tell me about that file and tell me how your computer is now

suryavarma143 View Member Profile	Aug 31 2009, 01:43 PM Post #15
Member Posts: 17 OS: XP	hi emeraldnzl regarding file:ya i have IDM(Internet Download Manager) installed in my PC... regarding my pc: my pc is working fine now...with ur help i was able to remove that rootkit any suggestions to keep my pc safe?? This post has been edited by suryavarma143: Aug 31 2009, 01:44 PM

« Next Oldest · Virus, Spyware and Trojan Removal · Next Newest »

2 Pages

1 2 >

1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)

0 Members:

Topic Title	Replies / Views	Topic Information
Virus, Spyware and Trojan Removal Win32/Rootkit.Agent.ODG [Solved] 12	25 / 348	20th July 2009 - 09:47 AM xbLazE started - last by fenzodahl512
Virus, Spyware and Trojan Removal Failed to remove Win32/Rootkit.Agent.ODG trojan [Closed]	4 / 675	18th August 2009 - 01:18 AM ebregi started - last by emeraldnzl
Virus, Spyware and Trojan Removal Win32/Rootkit.Agent.ODG [Solved] 12	17 / 537	19th August 2009 - 05:28 AM knoker started - last by Rorschach112
Virus, Spyware and Trojan Removal can't remove Win32/Rootkit.Agent.ODG [Solved] 12	16 / 466	14th August 2009 - 05:56 PM lastray started - last by Rorschach112