[Marina S]

Hello!

I was directed to this forum from OS/Win XP forum. I have a random crash with driver_irql_not_less_or_equal error at address 0x000000D1. Attached is a hijackthis log. I am told that there is a recognizable malware program on my computer. Could you let me know how to deal with this.

Thanks,
Marina

Attached Files

•  hijackthis.txt   10.22KB   110 downloads

[Advertisements]

Hello Marina

Please download ComboFix and save it to your desktop.
Double click combofix.exe and follow the prompts.
When it's done running it will produce a log for you. Please post that log in your next reply. Also rescan with Hijack and copy and paste the results into this thread


Important Note - Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

[loophole]

Hello Marina

Please download ComboFix and save it to your desktop.
Double click combofix.exe and follow the prompts.
When it's done running it will produce a log for you. Please post that log in your next reply. Also rescan with Hijack and copy and paste the results into this thread


Important Note - Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

[Marina S]

Here are the log files.

Marina

Attached Files

•  hijackthis.txt   9.61KB   74 downloads
•  ComboFix.txt   13.7KB   78 downloads

[loophole]

Hi marina. Can you copy and paste the results directly into this thread (use two post if needed). The results are really hard to read as an attachment. Its OK to do in this forum.

Thanks

[Marina S]

Logfile of HijackThis v1.99.1
Scan saved at 7:56:05 AM, on 10/22/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Creative\VoiceCenter\AndreaVC.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\DOCUME~1\MARINA~1\LOCALS~1\Temp\clclean.0001
C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\NetWaiting\netWaiting.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Creative\MediaSource5\Go\CTCMSGoU.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\WINDOWS\system32\wuauclt.exe
c:\program files\common files\installshield\updateservice\isuspm.exe
C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
F:\Downloads\Tools\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [MBMon] Rundll32 CTMBHA.DLL,MBMon
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [VoiceCenter] "C:\Program Files\Creative\VoiceCenter\AndreaVC.exe" /tray
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "c:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe
O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe
O4 - HKCU\..\Run: [Creative MediaSource Go] "C:\Program Files\Creative\MediaSource5\Go\CTCMSGoU.exe" /SCB
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [OE_OEM] "C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: LUMIX Simple Viewer.lnk = ?
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www2.snapfish...fishActivia.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: MSSQL$MICROSOFTSMLBIZ - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe" -sMICROSOFTSMLBIZ (file missing)
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: SQLAgent$MICROSOFTSMLBIZ - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlagent.EXE" -i MICROSOFTSMLBIZ (file missing)
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

[Marina S]

Marina Surlevich - 06-10-22 7:54:10.62 Service Pack 2
ComboFix 06.10.19 - Running from: "F:\Downloads\Tools"

((((((((((((((((((((((((((((((( Files Created from 2006-09-22 to 2006-10-22 ))))))))))))))))))))))))))))))))))


2006-10-21 11:43 7,552 --a------ C:\WINDOWS\system32\drivers\SONYPVU1.SYS


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-10-21 16:39 5746 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys
2006-10-21 08:15 -------- d-------- C:\Documents and Settings\Marina Surlevich\Application Data\Sun
2006-10-17 22:12 -------- d-------- C:\Program Files\Google
2006-10-03 19:59 -------- d-------- C:\Program Files\WildTangent
2006-10-02 21:01 -------- d-------- C:\Documents and Settings\Marina Surlevich\Application Data\Google
2006-09-25 17:22 -------- d---s---- C:\Documents and Settings\Marina Surlevich\Application Data\Microsoft
2006-09-18 22:59 -------- d-------- C:\Program Files\Windows Media Player
2006-09-18 22:59 -------- d-------- C:\Program Files\Internet Explorer
2006-09-14 19:30 -------- d-------- C:\Program Files\TagRename
2006-09-14 17:51 -------- d-------- C:\Program Files\Winamp
2006-09-13 01:01 1084416 --a------ C:\WINDOWS\system32\msxml3.dll
2006-09-11 21:35 -------- d-------- C:\Documents and Settings\Marina Surlevich\Application Data\Real
2006-09-11 21:33 -------- d-------- C:\Program Files\Common Files\xing shared
2006-09-11 21:33 -------- d-------- C:\Program Files\Common Files\Real
2006-09-11 21:33 -------- d-------- C:\Program Files\Common Files
2006-09-11 21:25 -------- d-------- C:\Program Files\WinRAR
2006-09-10 11:33 38474 --a------ C:\Documents and Settings\Marina Surlevich\Application Data\Microsoft Excel.ADR
2006-09-10 08:22 -------- d-------- C:\Documents and Settings\Marina Surlevich\Application Data\ArcSoft
2006-09-10 07:47 24978 --a------ C:\Documents and Settings\Marina Surlevich\Application Data\Comma Separated Values (Windows).ADR
2006-09-09 07:22 -------- d-------- C:\Documents and Settings\Marina Surlevich\Application Data\Snapfish
2006-09-08 21:55 -------- d-------- C:\Program Files\Codec
2006-09-08 21:48 -------- d-------- C:\Program Files\WinZip
2006-09-07 22:21 -------- d-------- C:\Documents and Settings\Marina Surlevich\Application Data\Panasonic
2006-09-07 21:50 -------- d-------- C:\Documents and Settings\Marina Surlevich\Application Data\AdobeUM
2006-09-07 21:49 -------- d-------- C:\Program Files\Western Digital Technologies
2006-09-07 21:49 -------- d-------- C:\Documents and Settings\Marina Surlevich\Application Data\Adobe
2006-09-07 18:54 -------- d-------- C:\Program Files\Common Files\ArcSoft
2006-09-07 18:53 -------- d--h----- C:\Program Files\InstallShield Installation Information
2006-09-07 18:53 -------- d-------- C:\Program Files\ArcSoft
2006-09-07 18:50 -------- d-------- C:\Program Files\Panasonic
2006-09-07 18:29 -------- d-------- C:\Documents and Settings\Marina Surlevich\Application Data\Sonic
2006-09-07 18:27 -------- d-------- C:\Documents and Settings\Marina Surlevich\Application Data\Leadertech
2006-09-06 23:11 -------- d-------- C:\Program Files\Common Files\AOL
2006-09-06 22:08 -------- d-------- C:\Documents and Settings\Marina Surlevich\Application Data\Macromedia
2006-09-06 20:27 31248 --a------ C:\WINDOWS\system32\drivers\tmpreflt.sys
2006-09-06 20:27 197648 --a------ C:\WINDOWS\system32\drivers\tmxpflt.sys
2006-09-06 20:11 -------- d-------- C:\Documents and Settings\Marina Surlevich\Application Data\Corel Photo Album
2006-09-06 20:09 1051456 --a------ C:\WINDOWS\system32\drivers\VsapiNT.sys
2006-09-06 19:49 -------- d-------- C:\Program Files\Dell Support
2006-09-01 02:12 -------- d-------- C:\Program Files\Dell
2006-09-01 02:11 -------- d-------- C:\Program Files\Microsoft SQL Server
2006-09-01 02:10 -------- d-------- C:\Program Files\Microsoft Works
2006-09-01 02:10 -------- d-------- C:\Program Files\Microsoft Visual Studio .NET 2003
2006-09-01 02:10 -------- d-------- C:\Program Files\Microsoft Small Business
2006-09-01 02:10 -------- d-------- C:\Program Files\Common Files\Crystal Decisions
2006-09-01 02:09 -------- d-------- C:\Program Files\Common Files\Microsoft Shared
2006-09-01 02:08 -------- d-------- C:\Program Files\Common Files\Adobe
2006-09-01 02:08 -------- d-------- C:\Program Files\Adobe
2006-09-01 02:05 -------- d-------- C:\Program Files\SearchAssist
2006-09-01 02:05 -------- d-------- C:\Program Files\Corel
2006-09-01 02:05 -------- d-------- C:\Program Files\BAE
2006-09-01 02:05 -------- d-------- C:\Documents and Settings\Marina Surlevich\Application Data\Corel
2006-09-01 02:03 -------- d-------- C:\Program Files\Trend Micro
2006-09-01 02:03 -------- d-------- C:\Program Files\Corel Corporation
2006-09-01 02:02 -------- d-------- C:\Program Files\Common Files\Corel
2006-09-01 02:00 -------- d-------- C:\Program Files\MUSICMATCH
2006-09-01 01:59 -------- d-------- C:\Program Files\WebCyberCoach
2006-09-01 01:59 -------- d-------- C:\Program Files\Sonic
2006-09-01 01:59 -------- d-------- C:\Program Files\EarthLink Setup
2006-09-01 01:59 -------- d-------- C:\Program Files\Common Files\Sonic Shared
2006-09-01 01:59 -------- d-------- C:\Program Files\Common Files\InstallShield
2006-09-01 01:59 -------- d-------- C:\Documents and Settings\Marina Surlevich\Application Data\Gtek
2006-09-01 01:58 8552 --a------ C:\WINDOWS\system32\drivers\asctrm.sys
2006-09-01 01:58 -------- d-------- C:\Program Files\Viewpoint
2006-09-01 01:58 -------- d-------- C:\Program Files\Real
2006-09-01 01:58 -------- d-------- C:\Program Files\QuickTime
2006-09-01 01:58 -------- d-------- C:\Program Files\Learn2.com
2006-09-01 01:58 -------- d-------- C:\Program Files\Common Files\Nullsoft
2006-09-01 01:57 -------- d-------- C:\Program Files\Common Files\TiVo Shared
2006-09-01 01:56 -------- d-------- C:\Program Files\NetZeroInstallers
2006-09-01 01:56 -------- d-------- C:\Program Files\Microsoft Plus! Photo Story 2 LE
2006-09-01 01:56 -------- d-------- C:\Program Files\Microsoft Plus! Digital Media Edition
2006-09-01 01:55 -------- d-------- C:\Program Files\Microsoft ActiveSync
2006-09-01 01:54 -------- d-------- C:\Program Files\Microsoft.NET
2006-09-01 01:54 -------- d-------- C:\Program Files\Microsoft Visual Studio
2006-09-01 01:54 -------- d-------- C:\Program Files\Microsoft Office
2006-09-01 01:54 -------- d-------- C:\Program Files\Common Files\System
2006-09-01 01:54 -------- d-------- C:\Program Files\Common Files\DESIGNER
2006-09-01 01:52 -------- d-------- C:\Program Files\CyberLink
2006-09-01 01:51 -------- d--h----- C:\Program Files\Creative Installation Information
2006-09-01 01:51 -------- d-------- C:\Program Files\Creative
2006-09-01 01:51 -------- d-------- C:\Program Files\Common Files\Creative
2006-09-01 01:50 40 --a------ C:\WINDOWS\system32\mes2046.dll
2006-09-01 01:50 -------- d-------- C:\Program Files\Common Files\Creative Labs Shared
2006-09-01 01:49 -------- d-------- C:\Program Files\NetWaiting
2006-09-01 01:49 -------- d-------- C:\Program Files\Modem Helper
2006-09-01 01:49 -------- d-------- C:\Program Files\Digital Line Detect
2006-09-01 01:47 -------- d-------- C:\Program Files\Sigmatel
2006-09-01 01:47 -------- d-------- C:\Program Files\CONEXANT
2006-09-01 01:44 -------- d-------- C:\Program Files\WIDCOMM
2006-09-01 01:44 -------- d-------- C:\Program Files\Synaptics
2006-09-01 01:44 -------- d-------- C:\Program Files\Broadcom
2006-09-01 01:43 -------- d-------- C:\Program Files\Outlook Express
2006-09-01 01:41 -------- d-------- C:\Program Files\Messenger
2006-09-01 01:41 -------- d-------- C:\Program Files\Java
2006-09-01 01:40 -------- d-------- C:\Program Files\Common Files\Java
2006-08-25 11:45 617472 --a------ C:\WINDOWS\system32\comctl32.dll
2006-08-24 23:47 36528 --------- C:\WINDOWS\system32\drivers\pxhelp20.sys
2006-08-24 23:47 2560 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys
2006-08-24 23:47 2432 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys
2006-08-24 23:47 129784 --------- C:\WINDOWS\system32\pxafs.dll
2006-08-24 23:47 115880 --------- C:\WINDOWS\system32\pxinsi64.exe
2006-08-21 08:21 16896 --a------ C:\WINDOWS\system32\fltlib.dll
2006-08-21 05:14 23040 --a------ C:\WINDOWS\system32\fltmc.exe
2006-08-16 07:58 100352 --a------ C:\WINDOWS\system32\6to4svc.dll
2006-07-27 09:24 679424 --a------ C:\WINDOWS\system32\inetcomm.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"ModemOnHold"="C:\\Program Files\\NetWaiting\\netWaiting.exe"
"SetDefaultMIDI"="MIDIDef.exe"
"Creative MediaSource Go"="\"C:\\Program Files\\Creative\\MediaSource5\\Go\\CTCMSGoU.exe\" /SCB"
"DellSupport"="\"C:\\Program Files\\Dell Support\\DSAgnt.exe\" /startup"
"OE_OEM"="\"C:\\Program Files\\Trend Micro\\Internet Security 12\\TMAS_OE\\TMAS_OEMon.exe\""
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.0.720.3640\\GoogleToolbarNotifier.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"ehTray"="C:\\WINDOWS\\ehome\\ehtray.exe"
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"nwiz"="nwiz.exe /installquiet"
"NVHotkey"="rundll32.exe nvHotkey.dll,Start"
"SynTPEnh"="C:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe"
"Broadcom Wireless Manager UI"="C:\\WINDOWS\\system32\\WLTRAY.exe"
"SigmatelSysTrayApp"="stsystra.exe"
"Dell QuickSet"="C:\\Program Files\\Dell\\QuickSet\\quickset.exe"
"CTSysVol"="C:\\Program Files\\Creative\\SBAudigy\\Surround Mixer\\CTSysVol.exe /r"
"MBMon"="Rundll32 CTMBHA.DLL,MBMon"
"UpdReg"="C:\\WINDOWS\\UpdReg.EXE"
"VoiceCenter"="\"C:\\Program Files\\Creative\\VoiceCenter\\AndreaVC.exe\" /tray"
"DVDLauncher"="\"C:\\Program Files\\CyberLink\\PowerDVD\\DVDLauncher.exe\""
"dla"="C:\\WINDOWS\\system32\\dla\\tfswctrl.exe"
"ISUSPM Startup"="\"c:\\Program Files\\Common Files\\InstallShield\\UpdateService\\isuspm.exe\" -startup"
"ISUSScheduler"="\"C:\\Program Files\\Common Files\\InstallShield\\UpdateService\\issch.exe\" -start"
@=""
"pccguide.exe"="\"C:\\Program Files\\Trend Micro\\Internet Security 12\\pccguide.exe\""
"Google Desktop Search"="\"C:\\Program Files\\Google\\Google Desktop Search\\GoogleDesktop.exe\" /startup"
"MMTray"="\"C:\\Program Files\\Musicmatch\\Musicmatch Jukebox\\mm_tray.exe\""
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"WinampAgent"="C:\\Program Files\\Winamp\\winampa.exe"
"KernelFaultCheck"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,\
65,6d,33,32,5c,64,75,6d,70,72,65,70,20,30,20,2d,6b,00

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000004

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,80,01,00,00,00,00,00,00,00,06,00,00,8e,04,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=dword:40000004
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\
00,00,01,00,00,00

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
"InstallVisualStyle"=hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,52,65,73,6f,75,72,\
63,65,73,5c,54,68,65,6d,65,73,5c,52,6f,79,61,6c,65,5c,52,6f,79,61,6c,65,2e,\
6d,73,73,74,79,6c,65,73,00
"InstallTheme"=hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,52,65,73,6f,75,72,63,65,\
73,5c,54,68,65,6d,65,73,5c,52,6f,79,61,6c,65,2e,74,68,65,6d,65,00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

Completion time: 06-10-22 7:54:31.25
C:\ComboFix.txt ... 06-10-22 07:54

[loophole]

Everything looks pretty good

Can you run one online scan just to be sure there is nothing that the logs dont see, and then we can turn you over to Wannabe so he can get you fixed up

Please go HERE to run Panda's ActiveScan

• Once you are on the Panda site click the Scan your PC button
• A new window will open...click the Check Now button
• Enter your Country
• Enter your State/Province
• Enter your e-mail address and click send
• Select either Home User or Company
• Click the big Scan Now button
• If it wants to install an ActiveX component allow it
• It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
• When download is complete, click on My Computer to start the scan
• When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location. Post the contents of the ActiveScan report along with a new hijackthis log.

Edited by loophole, 23 October 2006 - 10:11 AM.

[Marina S]

Here is the ActiveScan log. It didn't disinfect anything, so the hijackthis log should be the same.


Incident Status Location

Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Marina Surlevich\Cookies\marina surlevich@2o7[1].txt
Spyware:Cookie/7search Not disinfected C:\Documents and Settings\Marina Surlevich\Cookies\marina surlevich@7search[2].txt
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Marina Surlevich\Cookies\marina [email protected][2].txt
Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Marina Surlevich\Cookies\marina surlevich@adrevolver[1].txt
Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Marina Surlevich\Cookies\marina surlevich@adrevolver[3].txt
Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Marina Surlevich\Cookies\marina [email protected][2].txt
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Marina Surlevich\Cookies\marina surlevich@advertising[1].txt
Spyware:Cookie/Falkag Not disinfected C:\Documents and Settings\Marina Surlevich\Cookies\marina [email protected][1].txt
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Marina Surlevich\Cookies\marina surlevich@atdmt[2].txt
Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Marina Surlevich\Cookies\marina surlevich@atwola[1].txt
Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\Marina Surlevich\Cookies\marina surlevich@casalemedia[1].txt
Spyware:Cookie/Bridgetrack Not disinfected C:\Documents and Settings\Marina Surlevich\Cookies\marina [email protected][1].txt
Spyware:Cookie/360i Not disinfected C:\Documents and Settings\Marina Surlevich\Cookies\marina [email protected][2].txt
Spyware:Cookie/Coremetrics Not disinfected C:\Documents and Settings\Marina Surlevich\Cookies\marina [email protected][1].txt
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Marina Surlevich\Cookies\marina surlevich@doubleclick[1].txt
Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Marina Surlevich\Cookies\marina surlevich@fastclick[2].txt
Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\Marina Surlevich\Cookies\marina surlevich@hitbox[2].txt
Spyware:Cookie/HotLog Not disinfected C:\Documents and Settings\Marina Surlevich\Cookies\marina surlevich@hotlog[2].txt
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Marina Surlevich\Cookies\marina surlevich@mediaplex[1].txt
Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\Marina Surlevich\Cookies\marina surlevich@overture[1].txt
Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Marina Surlevich\Cookies\marina surlevich@questionmarket[1].txt
Spyware:Cookie/WUpd Not disinfected C:\Documents and Settings\Marina Surlevich\Cookies\marina surlevich@revenue[2].txt
Spyware:Cookie/Searchportal Not disinfected C:\Documents and Settings\Marina Surlevich\Cookies\marina [email protected][2].txt
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\Marina Surlevich\Cookies\marina [email protected][1].txt
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Marina Surlevich\Cookies\marina surlevich@serving-sys[2].txt
Spyware:Cookie/SpyLog Not disinfected C:\Documents and Settings\Marina Surlevich\Cookies\marina surlevich@spylog[2].txt
Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\Marina Surlevich\Cookies\marina surlevich@statcounter[2].txt
Spyware:Cookie/WebtrendsLive Not disinfected C:\Documents and Settings\Marina Surlevich\Cookies\marina [email protected][2].txt
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Marina Surlevich\Cookies\marina surlevich@tribalfusion[1].txt
Spyware:Cookie/Valueclick Not disinfected C:\Documents and Settings\Marina Surlevich\Cookies\marina surlevich@valueclick[1].txt
Spyware:Cookie/Yadro Not disinfected C:\Documents and Settings\Marina Surlevich\Cookies\marina surlevich@yadro[1].txt
Virus:Eicar.Mod Not disinfected C:\Program Files\Trend Micro\Internet Security 12\tmhelp.chm[/PCC12/Test_virus.htm]

[loophole]

Good, just some minor tracking cookies. Just do the following and proceed back to you and Wannabes thread

Please download ATF Cleaner by Atribune.
This program is for XP and Windows 2000 only Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

[Marina S]

Thank you!

[loophole]

Your welcome