Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

TROJANDOWNLOADER.XS [CLOSED]


  • This topic is locked This topic is locked

#1
Rabell

Rabell

    Member

  • Member
  • PipPip
  • 29 posts
Hi I am a newbe to this.

I have been working on a pc for three days. UGG!!

Have insalled AVG 7.5 Anti virus and anti spyware but i still have the trojandowner.xs?

I am open to any suggestion.

Here is the HiJackthis log..

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:00:36 PM, on 1/29/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\System32\gearsec.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rxjddnvj.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Intuit\QuickBooks\Components\QBAgent\QBDAgent.exe
C:\WINDOWS\system32\mrtMngr.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\lpcywinp.exe,C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\rxjddnvj.exe,
O2 - BHO: (no name) - {00000000-d9e3-4bc6-a0bd-3d0ca4be5271} - (no file)
O2 - BHO: (no name) - {00000012-890e-4aac-afd9-eff6954a34dd} - (no file)
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_0.dll
O2 - BHO: (no name) - {029e02f0-a0e5-4b19-b958-7bf2db29fb13} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {06dfedaa-6196-11d5-bfc8-00508b4a487d} - (no file)
O2 - BHO: (no name) - {12F02779-6D88-4958-8AD3-83C12D86ADC7} - (no file)
O2 - BHO: {0bef7fe4-a106-3938-8464-614ab7fbaf31} - {13fabf7b-a416-4648-8393-601a4ef7feb0} - C:\WINDOWS\System32\yrqqesfh.dll (file missing)
O2 - BHO: (no name) - {1adbcce8-cf84-441e-9b38-afc7a19c06a4} - (no file)
O2 - BHO: (no name) - {2d7cb618-cc1c-4126-a7e3-f5b12d3bcf71} - (no file)
O2 - BHO: egmulhxk.msdn_hlp - {477840F3-BA52-44D9-8E41-38D61CAA010F} - C:\WINDOWS\system32\egmulhxk.dll (file missing)
O2 - BHO: (no name) - {51641ef3-8a7a-4d84-8659-b0911e947cc8} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {53C330D6-A4AB-419B-B45D-FD4411C1FEF4} - (no file)
O2 - BHO: (no name) - {54645654-2225-4455-44A1-9F4543D34546} - (no file)
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: (no name) - {669695bc-a811-4a9d-8cdf-ba8c795f261e} - (no file)
O2 - BHO: (no name) - {6abc861a-31e7-4d91-b43b-d3c98f22a5c0} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: BndShell3 BHO Class - {875A1348-7674-42aa-ADAC-B4F36A004A2D} - C:\Program Files\QdrDrive\QdrDrive8.dll (file missing)
O2 - BHO: (no name) - {944864a5-3916-46e2-96a9-a2e84f3f1208} - (no file)
O2 - BHO: (no name) - {a4a435cf-3583-11d4-91bd-0048546a1450} - (no file)
O2 - BHO: (no name) - {A81BEEC5-0AB7-45C3-9F71-DB3543E31BD8} - C:\WINDOWS\System32\ssttu.dll (file missing)
O2 - BHO: (no name) - {b8875bfe-b021-11d4-bfa8-00508b8e9bd3} - (no file)
O2 - BHO: (no name) - {bb936323-19fa-4521-ba29-eca6a121bc78} - (no file)
O2 - BHO: (no name) - {BBB05D9E-0297-404D-A6BF-D8F2876B84A6} - C:\WINDOWS\System32\mljkiih.dll (file missing)
O2 - BHO: (no name) - {c2680e10-1655-4a0e-87f8-4259325a84b7} - (no file)
O2 - BHO: (no name) - {c4ca6559-2cf1-48b6-96b2-8340a06fd129} - (no file)
O2 - BHO: (no name) - {c5af2622-8c75-4dfb-9693-23ab7686a456} - (no file)
O2 - BHO: (no name) - {ca1d1b05-9c66-11d5-a009-000103c1e50b} - (no file)
O2 - BHO: (no name) - {D0CDEF78-1FA0-5874-946D-0E5B280C28FD} - C:\WINDOWS\System32\pscigks.dll (file missing)
O2 - BHO: (no name) - {d8efadf1-9009-11d6-8c73-608c5dc19089} - (no file)
O2 - BHO: (no name) - {e9147a0a-a866-4214-b47c-da821891240f} - (no file)
O2 - BHO: (no name) - {e9306072-417e-43e3-81d5-369490beef7c} - (no file)
O2 - BHO: (no name) - {FBE22921-89FD-CE7B-9218-C9A707C006F4} - C:\WINDOWS\System32\qjiknof.dll (file missing)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_0.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [QBCD Autorun] E:\autorun.exe restart QB_SEQUENCE first
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Global Startup: QuickBooks Delivery Agent.lnk = C:\Program Files\Intuit\QuickBooks\Components\QBAgent\QBDAgent.exe
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .aif: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll
O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.syma...bin/AvSniff.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.c...nst20040510.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace....ploader1005.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1112393012562
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O18 - Filter hijack: text/html - {07851C6A-1C43-41d9-8319-BC89154A8C00} - C:\Program Files\RcvSystem\httpdchk.dll
O20 - AppInit_DLLs:
O20 - Winlogon Notify: mljkiih - mljkiih.dll (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Gear Security Service (GEARSecurity) - GEAR Software - C:\WINDOWS\System32\gearsec.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

--
End of file - 8905 bytes

Plase help...Russ
  • 0

Advertisements


#2
Rorschach112

Rorschach112

    Ralphie

  • Retired Staff
  • 47,710 posts
Hello

Download ComboFix from one of the locations below, and save it to your Desktop.

Link 1
Link 2
Link 3

Double click combofix.exe and follow the prompts.
When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply
Note: Do not mouseclick combofix's window while its running. That may cause it to stall
  • 0

#3
Rabell

Rabell

    Member

  • Topic Starter
  • Member
  • PipPip
  • 29 posts
Thank here is the logs,

HiJakthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:42:48 PM, on 1/29/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\System32\gearsec.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Intuit\QuickBooks\Components\QBAgent\QBDAgent.exe
C:\WINDOWS\system32\mrtMngr.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: {0bef7fe4-a106-3938-8464-614ab7fbaf31} - {13fabf7b-a416-4648-8393-601a4ef7feb0} - C:\WINDOWS\System32\yrqqesfh.dll (file missing)
O2 - BHO: egmulhxk.msdn_hlp - {477840F3-BA52-44D9-8E41-38D61CAA010F} - C:\WINDOWS\system32\egmulhxk.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: BndShell3 BHO Class - {875A1348-7674-42aa-ADAC-B4F36A004A2D} - C:\Program Files\QdrDrive\QdrDrive8.dll (file missing)
O2 - BHO: (no name) - {A81BEEC5-0AB7-45C3-9F71-DB3543E31BD8} - C:\WINDOWS\System32\ssttu.dll (file missing)
O2 - BHO: (no name) - {D0CDEF78-1FA0-5874-946D-0E5B280C28FD} - C:\WINDOWS\System32\pscigks.dll (file missing)
O2 - BHO: (no name) - {FBE22921-89FD-CE7B-9218-C9A707C006F4} - C:\WINDOWS\System32\qjiknof.dll (file missing)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_0.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [QBCD Autorun] E:\autorun.exe restart QB_SEQUENCE first
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Global Startup: QuickBooks Delivery Agent.lnk = C:\Program Files\Intuit\QuickBooks\Components\QBAgent\QBDAgent.exe
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .aif: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll
O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.syma...bin/AvSniff.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.c...nst20040510.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace....ploader1005.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1112393012562
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O20 - AppInit_DLLs:
O20 - Winlogon Notify: mljkiih - mljkiih.dll (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Gear Security Service (GEARSecurity) - GEAR Software - C:\WINDOWS\System32\gearsec.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

--
End of file - 6655 bytes


cOMBOFIX LOG

ComboFix 08-01-29.3 - Admin 2008-01-29 14:21:15.1 - NTFSx86
Running from: C:\Documents and Settings\Admin\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CnsMin.zip
C:\Documents and Settings\Owner\My Documents\CROSOF~1.NET
C:\Documents and Settings\Owner\My Documents\RACLE~1
C:\Program Files\3721
C:\Program Files\3721\assist\asbar.dll
C:\Program Files\3721\helper.dll
C:\Program Files\Accoona
C:\Program Files\Accoona\ASearchAssist.dll
C:\Program Files\akl
C:\Program Files\akl\akl.dll
C:\Program Files\akl\akl.exe
C:\Program Files\akl\curlog.htm
C:\Program Files\akl\keylog.txt
C:\Program Files\akl\readme.txt
C:\Program Files\akl\uninstall.exe
C:\Program Files\akl\unsetup.dat
C:\Program Files\akl\unsetup.exe
C:\Program Files\amsys
C:\Program Files\amsys\awmsg.dat
C:\Program Files\amsys\guid.dat
C:\Program Files\amsys\ijl15.dll
C:\Program Files\amsys\mfc42.dll
C:\Program Files\amsys\msvcrt.dll
C:\Program Files\amsys\unins000.dat
C:\Program Files\amsys\unis000.exe
C:\Program Files\amsys\winam.dat
C:\Program Files\Common Files\crosof~1
C:\Program Files\Common Files\smbols~1
C:\Program Files\Common Files\tsks~1
C:\Program Files\dobe~1
C:\Program Files\e-zshopper
C:\Program Files\e-zshopper\BarLcher.dll
C:\Program Files\outerinfo
C:\Program Files\p2pnetworks
C:\Program Files\p2pnetworks\amp2pl.exe
C:\Program Files\QdrModule
C:\Program Files\QdrModule\QdrModule10.exe
C:\Program Files\QdrPack
C:\Program Files\QdrPack\QdrPack12.exe
C:\Program Files\sembly~1
C:\Program Files\ssembl~1
C:\Program Files\WinBudget
C:\WINDOWS\764.exe
C:\WINDOWS\7search.dll
C:\WINDOWS\absolute key logger.lnk
C:\WINDOWS\aconti.exe
C:\WINDOWS\aconti.ini
C:\WINDOWS\aconti.log
C:\WINDOWS\aconti.sdb
C:\WINDOWS\acontidialer.txt
C:\WINDOWS\adbar.dll
C:\WINDOWS\cbinst$.exe
C:\WINDOWS\cookies.ini
C:\WINDOWS\crosof~1.net
C:\WINDOWS\daxtime.dll
C:\WINDOWS\default.htm
C:\WINDOWS\dp0.dll
C:\WINDOWS\eventlowg.dll
C:\WINDOWS\fhfmm-Uninstaller.exe
C:\WINDOWS\fhfmm.exe
C:\WINDOWS\flt.dll
C:\WINDOWS\hcwprn.exe
C:\WINDOWS\hotporn.exe
C:\WINDOWS\ie_32.exe
C:\WINDOWS\iexplorr23.dll
C:\WINDOWS\jd2002.dll
C:\WINDOWS\kkcomp$.exe
C:\WINDOWS\kkcomp.dll
C:\WINDOWS\kkcomp.exe
C:\WINDOWS\kvnab$.exe
C:\WINDOWS\kvnab.dll
C:\WINDOWS\kvnab.exe
C:\WINDOWS\liqad$.exe
C:\WINDOWS\liqad.dll
C:\WINDOWS\liqad.exe
C:\WINDOWS\liqui-Uninstaller.exe
C:\WINDOWS\liqui.dll
C:\WINDOWS\liqui.exe
C:\WINDOWS\msettings.ini
C:\WINDOWS\ngd.dll
C:\WINDOWS\pbar.dll
C:\WINDOWS\pbsysie.dll
C:\WINDOWS\settn.dll
C:\WINDOWS\smbols~1
C:\WINDOWS\spredirect.dll
C:\WINDOWS\system32\ace16win.dll
C:\WINDOWS\system32\acespy
C:\WINDOWS\system32\acespy\__acelog.ndx
C:\WINDOWS\system32\acespy\systune.exe
C:\WINDOWS\system32\cemfmupf.ini
C:\WINDOWS\system32\dcpyhhjl.ini
C:\WINDOWS\system32\din.ip
C:\WINDOWS\system32\dpqaqlqx.bin
C:\WINDOWS\system32\drivers\blank.gif
C:\WINDOWS\system32\drivers\box_2.gif
C:\WINDOWS\system32\drivers\button_buynow.gif
C:\WINDOWS\system32\drivers\button_freescan.gif
C:\WINDOWS\system32\drivers\cell_bg.gif
C:\WINDOWS\system32\drivers\cell_footer.gif
C:\WINDOWS\system32\drivers\cell_header_block.gif
C:\WINDOWS\system32\drivers\cell_header_remove.gif
C:\WINDOWS\system32\drivers\cell_header_scan.gif
C:\WINDOWS\system32\drivers\detect.htm
C:\WINDOWS\system32\drivers\download_btn.jpg
C:\WINDOWS\system32\drivers\download_now_btn.gif
C:\WINDOWS\system32\drivers\footer_back.jpg
C:\WINDOWS\system32\drivers\header_1.gif
C:\WINDOWS\system32\drivers\header_2.gif
C:\WINDOWS\system32\drivers\header_3.gif
C:\WINDOWS\system32\drivers\header_4.gif
C:\WINDOWS\system32\drivers\header_red_bg.gif
C:\WINDOWS\system32\drivers\header_red_free_scan.gif
C:\WINDOWS\system32\drivers\header_red_free_scan_bg.gif
C:\WINDOWS\system32\drivers\header_red_protect_your_pc.gif
C:\WINDOWS\system32\drivers\infected.gif
C:\WINDOWS\system32\drivers\main_back.gif
C:\WINDOWS\system32\drivers\product_2_header.gif
C:\WINDOWS\system32\drivers\product_2_name_small.gif
C:\WINDOWS\system32\drivers\product_features.gif
C:\WINDOWS\system32\drivers\pt.htm
C:\WINDOWS\system32\drivers\rating.gif
C:\WINDOWS\system32\drivers\s_detect.htm
C:\WINDOWS\system32\drivers\screenshot.jpg
C:\WINDOWS\system32\drivers\sep_hor.gif
C:\WINDOWS\system32\drivers\sep_vert.gif
C:\WINDOWS\system32\drivers\shadow.jpg
C:\WINDOWS\system32\drivers\shadow_bg.gif
C:\WINDOWS\system32\drivers\spacer.gif
C:\WINDOWS\system32\drivers\star.gif
C:\WINDOWS\system32\drivers\star_gray.gif
C:\WINDOWS\system32\drivers\star_gray_small.gif
C:\WINDOWS\system32\drivers\star_small.gif
C:\WINDOWS\system32\drivers\style.css
C:\WINDOWS\system32\drivers\v.gif
C:\WINDOWS\system32\drivers\warning_icon.gif
C:\WINDOWS\system32\drivers\win_logo.gif
C:\WINDOWS\system32\drivers\x.gif
C:\WINDOWS\system32\ESHOPEE.exe
C:\WINDOWS\system32\fxijyjwr.ini
C:\WINDOWS\system32\gtqttdgk.ini
C:\WINDOWS\system32\hbicxkdq.ini
C:\WINDOWS\system32\jhfgofhm.ini
C:\WINDOWS\system32\ktjwuqig.ini
C:\WINDOWS\system32\lwfcjnbx.ini
C:\WINDOWS\system32\mejqhama.ini
C:\WINDOWS\system32\mgabblnm.ini
C:\WINDOWS\system32\msole32.exe
C:\WINDOWS\system32\nomafnle.ini
C:\WINDOWS\system32\nrknmebj.ini
C:\WINDOWS\system32\racle~1
C:\WINDOWS\system32\ssembl~1
C:\WINDOWS\system32\ssembl~1\?ssembly\
C:\WINDOWS\system32\stfv.bin
C:\WINDOWS\system32\sznf.ascii
C:\WINDOWS\system32\tfdxdnlk.ini
C:\WINDOWS\system32\uavjyixx.ini
C:\WINDOWS\system32\uttss.ini
C:\WINDOWS\system32\uttss.ini2
C:\WINDOWS\system32\vxddsk.exe
C:\WINDOWS\system32\vxdijcwl.ini
C:\WINDOWS\system32\wiqbhhpb.ini
C:\WINDOWS\system32\wml.exe
C:\WINDOWS\system32\wnstsisv32.exe
C:\WINDOWS\system32\xbsfojis.ini
C:\WINDOWS\vxddsk.exe
C:\WINDOWS\wbeCheck.exe
C:\WINDOWS\wbeInst$.exe
C:\WINDOWS\wml.exe
C:\WINDOWS\xadbrk.dll
C:\WINDOWS\xadbrk.exe
C:\WINDOWS\xadbrk_.exe
C:\WINDOWS\xxxvideo.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_DOMAINSERVICE


((((((((((((((((((((((((( Files Created from 2007-12-28 to 2008-01-29 )))))))))))))))))))))))))))))))
.

2008-01-29 11:59 . 2008-01-29 11:59 <DIR> d-------- C:\Program Files\Trend Micro
2008-01-29 11:03 . 2007-10-10 18:55 6,065,664 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll
2008-01-29 11:03 . 2007-06-30 22:31 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-01-29 11:03 . 2007-06-30 22:36 991,232 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-01-29 11:03 . 2007-10-10 18:55 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-01-29 11:03 . 2007-10-10 18:55 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-01-29 11:03 . 2007-10-10 18:55 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll
2008-01-29 11:03 . 2007-10-10 18:55 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll
2008-01-29 11:03 . 2007-10-10 18:55 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-01-29 11:03 . 2007-10-10 05:59 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-01-29 10:51 . 2007-08-13 18:54 33,792 --a--c--- C:\WINDOWS\system32\dllcache\custsat.dll
2008-01-29 10:44 . 2008-01-29 10:44 <DIR> d---s---- C:\Documents and Settings\Admin\UserData
2008-01-29 08:58 . 2008-01-29 09:01 <DIR> d-------- C:\Documents and Settings\Admin\Application Data\AVG7
2008-01-29 08:56 . 2004-04-02 05:07 <DIR> d-------- C:\Documents and Settings\Admin\WINDOWS
2008-01-29 08:56 . 2004-04-03 03:05 <DIR> d-------- C:\Documents and Settings\Admin\Application Data\Symantec
2008-01-29 08:56 . 2004-04-02 20:28 <DIR> d-------- C:\Documents and Settings\Admin\Application Data\SampleView
2008-01-28 11:01 . 2008-01-28 11:55 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-01-28 09:46 . 2008-01-28 09:46 1,854 --a------ C:\WINDOWS\system32\tmp.reg
2008-01-28 09:44 . 2008-01-28 10:14 <DIR> d-------- C:\net downloads
2008-01-27 14:44 . 2008-01-27 14:46 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\AVG7
2008-01-27 14:43 . 2004-04-02 05:07 <DIR> d-------- C:\Documents and Settings\Administrator\WINDOWS
2008-01-27 14:43 . 2004-04-03 03:05 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Symantec
2008-01-27 14:43 . 2004-04-02 20:28 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\SampleView
2008-01-27 12:59 . 2006-08-21 04:14 128,896 -----c--- C:\WINDOWS\system32\dllcache\fltmgr.sys
2008-01-27 12:59 . 2006-08-21 04:14 23,040 -----c--- C:\WINDOWS\system32\dllcache\fltmc.exe
2008-01-27 12:59 . 2006-08-21 07:21 16,896 -----c--- C:\WINDOWS\system32\dllcache\fltlib.dll
2008-01-27 12:38 . 2008-01-27 12:38 89,617 --a------ C:\WINDOWS\system32\rxjddnvj.exe
2008-01-27 12:38 . 2008-01-27 12:38 89,617 --a------ C:\winaybm.exe
2008-01-27 10:41 . 2007-07-09 08:09 584,192 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2008-01-27 10:37 . 2006-10-13 07:35 142,336 -----c--- C:\WINDOWS\system32\dllcache\nwprovau.dll
2008-01-27 10:33 . 2007-03-08 08:47 1,843,584 -----c--- C:\WINDOWS\system32\dllcache\win32k.sys
2008-01-27 10:33 . 2007-03-08 10:36 577,536 -----c--- C:\WINDOWS\system32\dllcache\user32.dll
2008-01-27 10:33 . 2007-06-19 08:31 282,112 -----c--- C:\WINDOWS\system32\dllcache\gdi32.dll
2008-01-27 10:33 . 2007-03-08 10:36 40,960 -----c--- C:\WINDOWS\system32\dllcache\mf3216.dll
2008-01-27 10:32 . 2007-08-13 18:38 491,520 --a--c--- C:\WINDOWS\system32\dllcache\jscript.dll
2008-01-27 10:30 . 2006-12-26 08:07 536,576 -----c--- C:\WINDOWS\system32\dllcache\msado15.dll
2008-01-27 10:30 . 2006-12-26 08:07 200,704 -----c--- C:\WINDOWS\system32\dllcache\msadox.dll
2008-01-27 10:30 . 2006-12-26 08:07 180,224 -----c--- C:\WINDOWS\system32\dllcache\msadomd.dll
2008-01-27 10:30 . 2006-12-26 08:07 102,400 -----c--- C:\WINDOWS\system32\dllcache\msjro.dll
2008-01-27 10:23 . 2006-10-12 06:09 256,512 -----c--- C:\WINDOWS\system32\dllcache\agentsvr.exe
2008-01-27 10:23 . 2007-03-09 08:46 57,344 --a--c--- C:\WINDOWS\system32\dllcache\agentdpv.dll
2008-01-27 10:23 . 2006-10-12 09:02 42,496 -----c--- C:\WINDOWS\system32\dllcache\agentdp2.dll
2008-01-27 10:22 . 2007-08-21 01:15 683,520 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll
2008-01-27 10:13 . 2008-01-27 10:14 <DIR> d-------- C:\Program Files\Windows Defender
2008-01-27 09:49 . 2008-01-27 09:49 127 --a------ C:\WINDOWS\system32\MRT.INI
2008-01-27 09:45 . 2006-08-17 07:28 332,288 -----c--- C:\WINDOWS\system32\dllcache\netapi32.dll
2008-01-27 09:45 . 2006-08-17 07:28 132,096 -----c--- C:\WINDOWS\system32\dllcache\wkssvc.dll
2008-01-27 09:44 . 2007-11-07 04:26 721,920 -----c--- C:\WINDOWS\system32\dllcache\lsasrv.dll
2008-01-27 01:58 . 2008-01-27 01:58 <DIR> d-------- C:\WINDOWS\provisioning
2008-01-27 01:54 . 2008-01-27 01:54 <DIR> d-------- C:\WINDOWS\ServicePackFiles
2008-01-27 01:46 . 2004-07-17 11:40 19,528 --a------ C:\WINDOWS\002386_.tmp
2008-01-27 01:41 . 2008-01-27 01:41 <DIR> d-------- C:\WINDOWS\EHome
2008-01-26 10:18 . 2008-01-29 08:00 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\AVG7
2008-01-26 10:17 . 2008-01-26 10:17 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
2008-01-26 10:15 . 2008-01-26 10:15 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-01-26 10:15 . 2008-01-27 20:36 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg7
2008-01-14 19:22 . 2002-08-29 04:41 150,528 --a------ C:\WINDOWS\system32\ptpusd.dll
2008-01-14 19:22 . 2001-08-17 23:36 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll
2008-01-11 18:09 . 2008-01-27 09:23 16,600 --a------ C:\WINDOWS\BM6fc0a1b1.xml
2008-01-11 18:09 . 2008-01-27 09:17 22 --a------ C:\WINDOWS\pskt.ini
2008-01-09 19:22 . 2008-01-09 19:22 <DIR> d-------- C:\Program Files\RcvSystem
2007-12-31 11:09 . 2007-12-31 11:09 294 --ahs---- C:\WINDOWS\system32\hulebomv.ini

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-29 19:28 8,448 ----a-w C:\WINDOWS\764.exe
2008-01-27 14:21 --------- d-----w C:\Program Files\MSN Messenger
2007-12-22 00:40 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-16 22:56 --------- d-----w C:\Program Files\Veo Stingray
2006-11-06 19:03 722,109 --sha-w C:\WINDOWS\system32\lnnmp.bak1
2006-11-16 12:37 731,826 --sha-w C:\WINDOWS\system32\lnnmp.bak2
2006-11-16 13:09 732,406 --sha-w C:\WINDOWS\system32\lnnmp.ini2
.

((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{13fabf7b-a416-4648-8393-601a4ef7feb0}]
C:\WINDOWS\System32\yrqqesfh.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{477840F3-BA52-44D9-8E41-38D61CAA010F}]
C:\WINDOWS\system32\egmulhxk.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{875A1348-7674-42aa-ADAC-B4F36A004A2D}]
C:\Program Files\QdrDrive\QdrDrive8.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A81BEEC5-0AB7-45C3-9F71-DB3543E31BD8}]
C:\WINDOWS\System32\ssttu.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D0CDEF78-1FA0-5874-946D-0E5B280C28FD}]
C:\WINDOWS\System32\pscigks.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FBE22921-89FD-CE7B-9218-C9A707C006F4}]
C:\WINDOWS\System32\qjiknof.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VTTimer"="VTTimer.exe" []
"QBCD Autorun"="E:\autorun.exe" [ ]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2004-04-02 04:43 151597]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-01-27 20:37 411648]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20 866584]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-01-27 20:37 145920]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 16:38 39264]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
QuickBooks Delivery Agent.lnk - C:\Program Files\Intuit\QuickBooks\Components\QBAgent\QBDAgent.exe [2005-01-29 11:14:42 118784]
Quicken Scheduled Updates.lnk - C:\Program Files\Quicken\bagent.exe [2003-07-30 07:49:48 57344]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mljkiih]
mljkiih.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=

R1 crlscsi;crlscsi;C:\WINDOWS\system32\drivers\crlscsi.sys [1995-11-07 04:57]
S3 DCamUSBVeo532;Veo Web Camera;C:\WINDOWS\system32\Drivers\ubVeo532.sys [2002-07-01 19:30]

.
Contents of the 'Scheduled Tasks' folder
"2004-11-14 19:22:00 C:\WINDOWS\Tasks\Easy Internet Sign-up.job"
- C:\Program Files\Easy Internet signup\HPSdpApp.exe
"2008-01-29 19:34:24 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
"2008-01-29 17:04:00 C:\WINDOWS\Tasks\Symantec NetDetect.job"
- C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-29 14:33:04
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\System32\gearsec.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Intuit\QuickBooks\Components\QBAgent\QBDAgent.exe
C:\WINDOWS\system32\mrtMngr.EXE
.
**************************************************************************
.
Completion time: 2008-01-29 14:41:27 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-29 19:41:15
.
2008-01-28 15:22:26 --- E O F ---
  • 0

#4
Rorschach112

Rorschach112

    Ralphie

  • Retired Staff
  • 47,710 posts
Hello

1. Close any open browsers.

2. Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\WINDOWS\system32\rxjddnvj.exe
C:\winaybm.exe
C:\WINDOWS\system32\hulebomv.ini
C:\WINDOWS\764.exe
C:\WINDOWS\system32\lnnmp.bak1
C:\WINDOWS\system32\lnnmp.bak2
C:\WINDOWS\system32\lnnmp.ini2


Save this as CFScript.txt, in the same location as ComboFix.exe


Posted Image

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at "C:\ComboFix.txt"

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall




Also post a new HijackThis log
  • 0

#5
Rabell

Rabell

    Member

  • Topic Starter
  • Member
  • PipPip
  • 29 posts
Hello,

Here the two logs,

Combofix log,

ComboFix 08-01-29.3 - Admin 2008-01-29 15:19:46.2 - NTFSx86
Running from: C:\Documents and Settings\Admin\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Admin\Desktop\CFScript.txt
* Created a new restore point

FILE
C:\winaybm.exe
C:\WINDOWS\764.exe
C:\WINDOWS\system32\hulebomv.ini
C:\WINDOWS\system32\lnnmp.bak1
C:\WINDOWS\system32\lnnmp.bak2
C:\WINDOWS\system32\lnnmp.ini2
C:\WINDOWS\system32\rxjddnvj.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\winaybm.exe
C:\WINDOWS\system32\hulebomv.ini
C:\WINDOWS\system32\lnnmp.bak1
C:\WINDOWS\system32\lnnmp.bak2
C:\WINDOWS\system32\lnnmp.ini2
C:\WINDOWS\system32\rxjddnvj.exe

.
((((((((((((((((((((((((( Files Created from 2007-12-28 to 2008-01-29 )))))))))))))))))))))))))))))))
.

2008-01-29 11:59 . 2008-01-29 11:59 <DIR> d-------- C:\Program Files\Trend Micro
2008-01-29 11:03 . 2007-10-10 18:55 6,065,664 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll
2008-01-29 11:03 . 2007-06-30 22:31 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-01-29 11:03 . 2007-06-30 22:36 991,232 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-01-29 11:03 . 2007-10-10 18:55 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-01-29 11:03 . 2007-10-10 18:55 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-01-29 11:03 . 2007-10-10 18:55 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll
2008-01-29 11:03 . 2007-10-10 18:55 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll
2008-01-29 11:03 . 2007-10-10 18:55 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-01-29 11:03 . 2007-10-10 05:59 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-01-29 10:51 . 2007-08-13 18:54 33,792 --a--c--- C:\WINDOWS\system32\dllcache\custsat.dll
2008-01-29 10:44 . 2008-01-29 10:44 <DIR> d---s---- C:\Documents and Settings\Admin\UserData
2008-01-29 08:58 . 2008-01-29 09:01 <DIR> d-------- C:\Documents and Settings\Admin\Application Data\AVG7
2008-01-29 08:56 . 2004-04-02 05:07 <DIR> d-------- C:\Documents and Settings\Admin\WINDOWS
2008-01-29 08:56 . 2004-04-03 03:05 <DIR> d-------- C:\Documents and Settings\Admin\Application Data\Symantec
2008-01-29 08:56 . 2004-04-02 20:28 <DIR> d-------- C:\Documents and Settings\Admin\Application Data\SampleView
2008-01-28 11:01 . 2008-01-28 11:55 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-01-28 09:46 . 2008-01-28 09:46 1,854 --a------ C:\WINDOWS\system32\tmp.reg
2008-01-28 09:44 . 2008-01-28 10:14 <DIR> d-------- C:\net downloads
2008-01-27 14:44 . 2008-01-27 14:46 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\AVG7
2008-01-27 14:43 . 2004-04-02 05:07 <DIR> d-------- C:\Documents and Settings\Administrator\WINDOWS
2008-01-27 14:43 . 2004-04-03 03:05 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Symantec
2008-01-27 14:43 . 2004-04-02 20:28 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\SampleView
2008-01-27 12:59 . 2006-08-21 04:14 128,896 -----c--- C:\WINDOWS\system32\dllcache\fltmgr.sys
2008-01-27 12:59 . 2006-08-21 04:14 23,040 -----c--- C:\WINDOWS\system32\dllcache\fltmc.exe
2008-01-27 12:59 . 2006-08-21 07:21 16,896 -----c--- C:\WINDOWS\system32\dllcache\fltlib.dll
2008-01-27 10:41 . 2007-07-09 08:09 584,192 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2008-01-27 10:37 . 2006-10-13 07:35 142,336 -----c--- C:\WINDOWS\system32\dllcache\nwprovau.dll
2008-01-27 10:33 . 2007-03-08 08:47 1,843,584 -----c--- C:\WINDOWS\system32\dllcache\win32k.sys
2008-01-27 10:33 . 2007-03-08 10:36 577,536 -----c--- C:\WINDOWS\system32\dllcache\user32.dll
2008-01-27 10:33 . 2007-06-19 08:31 282,112 -----c--- C:\WINDOWS\system32\dllcache\gdi32.dll
2008-01-27 10:33 . 2007-03-08 10:36 40,960 -----c--- C:\WINDOWS\system32\dllcache\mf3216.dll
2008-01-27 10:32 . 2007-08-13 18:38 491,520 --a--c--- C:\WINDOWS\system32\dllcache\jscript.dll
2008-01-27 10:30 . 2006-12-26 08:07 536,576 -----c--- C:\WINDOWS\system32\dllcache\msado15.dll
2008-01-27 10:30 . 2006-12-26 08:07 200,704 -----c--- C:\WINDOWS\system32\dllcache\msadox.dll
2008-01-27 10:30 . 2006-12-26 08:07 180,224 -----c--- C:\WINDOWS\system32\dllcache\msadomd.dll
2008-01-27 10:30 . 2006-12-26 08:07 102,400 -----c--- C:\WINDOWS\system32\dllcache\msjro.dll
2008-01-27 10:23 . 2006-10-12 06:09 256,512 -----c--- C:\WINDOWS\system32\dllcache\agentsvr.exe
2008-01-27 10:23 . 2007-03-09 08:46 57,344 --a--c--- C:\WINDOWS\system32\dllcache\agentdpv.dll
2008-01-27 10:23 . 2006-10-12 09:02 42,496 -----c--- C:\WINDOWS\system32\dllcache\agentdp2.dll
2008-01-27 10:22 . 2007-08-21 01:15 683,520 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll
2008-01-27 10:13 . 2008-01-27 10:14 <DIR> d-------- C:\Program Files\Windows Defender
2008-01-27 09:49 . 2008-01-27 09:49 127 --a------ C:\WINDOWS\system32\MRT.INI
2008-01-27 09:45 . 2006-08-17 07:28 332,288 -----c--- C:\WINDOWS\system32\dllcache\netapi32.dll
2008-01-27 09:45 . 2006-08-17 07:28 132,096 -----c--- C:\WINDOWS\system32\dllcache\wkssvc.dll
2008-01-27 09:44 . 2007-11-07 04:26 721,920 -----c--- C:\WINDOWS\system32\dllcache\lsasrv.dll
2008-01-27 01:58 . 2008-01-27 01:58 <DIR> d-------- C:\WINDOWS\provisioning
2008-01-27 01:54 . 2008-01-27 01:54 <DIR> d-------- C:\WINDOWS\ServicePackFiles
2008-01-27 01:46 . 2004-07-17 11:40 19,528 --a------ C:\WINDOWS\002386_.tmp
2008-01-27 01:41 . 2008-01-27 01:41 <DIR> d-------- C:\WINDOWS\EHome
2008-01-26 10:18 . 2008-01-29 08:00 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\AVG7
2008-01-26 10:17 . 2008-01-26 10:17 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
2008-01-26 10:15 . 2008-01-26 10:15 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-01-26 10:15 . 2008-01-27 20:36 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg7
2008-01-14 19:22 . 2002-08-29 04:41 150,528 --a------ C:\WINDOWS\system32\ptpusd.dll
2008-01-14 19:22 . 2001-08-17 23:36 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll
2008-01-11 18:09 . 2008-01-27 09:23 16,600 --a------ C:\WINDOWS\BM6fc0a1b1.xml
2008-01-11 18:09 . 2008-01-27 09:17 22 --a------ C:\WINDOWS\pskt.ini
2008-01-09 19:22 . 2008-01-09 19:22 <DIR> d-------- C:\Program Files\RcvSystem

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-27 14:21 --------- d-----w C:\Program Files\MSN Messenger
2007-12-22 00:40 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-16 22:56 --------- d-----w C:\Program Files\Veo Stingray
2007-11-07 09:26 721,920 ----a-w C:\WINDOWS\system32\lsasrv.dll
2007-10-31 19:03 245,408 ----a-w C:\WINDOWS\system32\unicows.dll
2007-10-29 22:43 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
.

((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{13fabf7b-a416-4648-8393-601a4ef7feb0}]
C:\WINDOWS\System32\yrqqesfh.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{477840F3-BA52-44D9-8E41-38D61CAA010F}]
C:\WINDOWS\system32\egmulhxk.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{875A1348-7674-42aa-ADAC-B4F36A004A2D}]
C:\Program Files\QdrDrive\QdrDrive8.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A81BEEC5-0AB7-45C3-9F71-DB3543E31BD8}]
C:\WINDOWS\System32\ssttu.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D0CDEF78-1FA0-5874-946D-0E5B280C28FD}]
C:\WINDOWS\System32\pscigks.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FBE22921-89FD-CE7B-9218-C9A707C006F4}]
C:\WINDOWS\System32\qjiknof.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VTTimer"="VTTimer.exe" []
"QBCD Autorun"="E:\autorun.exe" [ ]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2004-04-02 04:43 151597]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-01-27 20:37 411648]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20 866584]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-01-27 20:37 145920]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 16:38 39264]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
QuickBooks Delivery Agent.lnk - C:\Program Files\Intuit\QuickBooks\Components\QBAgent\QBDAgent.exe [2005-01-29 11:14:42 118784]
Quicken Scheduled Updates.lnk - C:\Program Files\Quicken\bagent.exe [2003-07-30 07:49:48 57344]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mljkiih]
mljkiih.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=


.
Contents of the 'Scheduled Tasks' folder
"2004-11-14 19:22:00 C:\WINDOWS\Tasks\Easy Internet Sign-up.job"
- C:\Program Files\Easy Internet signup\HPSdpApp.exe
"2008-01-29 19:34:24 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
"2008-01-29 17:04:00 C:\WINDOWS\Tasks\Symantec NetDetect.job"
- C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-29 15:26:32
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-29 15:30:13
ComboFix-quarantined-files.txt 2008-01-29 20:29:44
ComboFix2.txt 2008-01-29 19:41:27
.
2008-01-28 15:22:26 --- E O F ---


HiJackthis log,

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:39:31 PM, on 1/29/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\System32\gearsec.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Intuit\QuickBooks\Components\QBAgent\QBDAgent.exe
C:\WINDOWS\system32\mrtMngr.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: {0bef7fe4-a106-3938-8464-614ab7fbaf31} - {13fabf7b-a416-4648-8393-601a4ef7feb0} - C:\WINDOWS\System32\yrqqesfh.dll (file missing)
O2 - BHO: egmulhxk.msdn_hlp - {477840F3-BA52-44D9-8E41-38D61CAA010F} - C:\WINDOWS\system32\egmulhxk.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: BndShell3 BHO Class - {875A1348-7674-42aa-ADAC-B4F36A004A2D} - C:\Program Files\QdrDrive\QdrDrive8.dll (file missing)
O2 - BHO: (no name) - {A81BEEC5-0AB7-45C3-9F71-DB3543E31BD8} - C:\WINDOWS\System32\ssttu.dll (file missing)
O2 - BHO: (no name) - {D0CDEF78-1FA0-5874-946D-0E5B280C28FD} - C:\WINDOWS\System32\pscigks.dll (file missing)
O2 - BHO: (no name) - {FBE22921-89FD-CE7B-9218-C9A707C006F4} - C:\WINDOWS\System32\qjiknof.dll (file missing)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_0.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [QBCD Autorun] E:\autorun.exe restart QB_SEQUENCE first
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Global Startup: QuickBooks Delivery Agent.lnk = C:\Program Files\Intuit\QuickBooks\Components\QBAgent\QBDAgent.exe
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .aif: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll
O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.syma...bin/AvSniff.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.c...nst20040510.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace....ploader1005.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1112393012562
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O20 - AppInit_DLLs:
O20 - Winlogon Notify: mljkiih - mljkiih.dll (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Gear Security Service (GEARSecurity) - GEAR Software - C:\WINDOWS\System32\gearsec.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

--
End of file - 6704 bytes

Russ
  • 0

#6
Rorschach112

Rorschach112

    Ralphie

  • Retired Staff
  • 47,710 posts
Hello

1. Close any open browsers.

2. Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\WINDOWS\pskt.ini

Folder::
C:\Program Files\QdrDrive


Save this as CFScript.txt, in the same location as ComboFix.exe


Posted Image

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at "C:\ComboFix.txt"

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall




1. Please re-open HiJackThis and choose do a system scan only. Check the boxes next to ONLY the entries listed below(if present):

O2 - BHO: {0bef7fe4-a106-3938-8464-614ab7fbaf31} - {13fabf7b-a416-4648-8393-601a4ef7feb0} - C:\WINDOWS\System32\yrqqesfh.dll (file missing)
O2 - BHO: egmulhxk.msdn_hlp - {477840F3-BA52-44D9-8E41-38D61CAA010F} - C:\WINDOWS\system32\egmulhxk.dll (file missing)
O2 - BHO: BndShell3 BHO Class - {875A1348-7674-42aa-ADAC-B4F36A004A2D} - C:\Program Files\QdrDrive\QdrDrive8.dll (file missing)
O2 - BHO: (no name) - {A81BEEC5-0AB7-45C3-9F71-DB3543E31BD8} - C:\WINDOWS\System32\ssttu.dll (file missing)
O2 - BHO: (no name) - {D0CDEF78-1FA0-5874-946D-0E5B280C28FD} - C:\WINDOWS\System32\pscigks.dll (file missing)
O2 - BHO: (no name) - {FBE22921-89FD-CE7B-9218-C9A707C006F4} - C:\WINDOWS\System32\qjiknof.dll (file missing)
O20 - AppInit_DLLs:
O20 - Winlogon Notify: mljkiih - mljkiih.dll (file missing)


2. Now close all windows other than HiJackThis, including browsers, so that nothing other than HijackThis is open, then click Fix Checked. A box will pop up asking you if you wish to fix the selected items. Please choose YES. Once it has fixed them, please exit/close HijackThis.



Download FindAWF.exe from here or here, and save it to your desktop.
  • Double-click on the FindAWF.exe file to run it.
  • It will open a command prompt and ask you to "Press any key to continue".
  • You will be presented with a Menu.

    1. Press 1 then Enter to scan for bak folders
    2. Press 2 then Enter to restore files from bak folders
    3. Press 3 then Enter to remove bak folders
    4. Press 4 then Enter to reset domain zones
    5. Press E then Enter to EXIT

  • Press 1, then press Enter
  • It may take a few minutes to complete so be patient.
  • When it is complete, it will open a text file in notepad called AWF.txt.
  • Please copy and paste the contents of the AWF.txt file in your next reply.

Edited by Rorschach112, 29 January 2008 - 02:47 PM.

  • 0

#7
Rabell

Rabell

    Member

  • Topic Starter
  • Member
  • PipPip
  • 29 posts
Good Morning,

The logs you requested.

AWF log



Find AWF report by noahdfear ©2006
Version 1.40

The current date is: Wed 01/30/2008
The current time is: 9:06:09.82


bak folders found
~~~~~~~~~~~


Directory of C:\HP\KBD\BAK

02/11/2003 10:02 PM 61,440 KBD.EXE
1 File(s) 61,440 bytes

Directory of C:\PROGRA~1\LEXMAR~1\BAK

01/16/2004 05:04 AM 57,344 lxbmbmgr.exe
1 File(s) 57,344 bytes

Directory of C:\PROGRA~1\QUICKT~1\BAK

04/02/2004 05:04 AM 98,304 qttask.exe
1 File(s) 98,304 bytes

Directory of C:\WINDOWS\SMINST\BAK

04/13/2004 11:43 PM 233,472 RECGUARD.EXE
1 File(s) 233,472 bytes

Directory of C:\WINDOWS\SYSTEM\BAK

05/07/1998 07:04 PM 52,736 hpsysdrv.exe
1 File(s) 52,736 bytes

Directory of C:\WINDOWS\SYSTEM32\BAK

08/20/2004 03:51 PM 118,784 hkcmd.exe
08/20/2004 03:55 PM 155,648 igfxtray.exe
09/12/2003 10:13 PM 98,304 ps2.exe
3 File(s) 372,736 bytes

Directory of C:\PROGRA~1\GRISOFT\AVG7\BAK

05/18/2005 09:31 AM 341,039 avgcc.exe
05/18/2005 09:31 AM 228,404 avgemc.exe
2 File(s) 569,443 bytes

Directory of C:\PROGRA~1\LEXMAR~1\FAX\BAK

01/22/2004 10:59 AM 151,552 fm3032.exe
1 File(s) 151,552 bytes

Directory of C:\PROGRA~1\MICROS~4\SYSTEM\BAK

06/18/2003 10:00 PM 200,704 mnyexpr.exe
1 File(s) 200,704 bytes

Directory of C:\PROGRA~1\JAVA\JRE15~1.0_0\BIN\BAK

03/04/2005 04:36 AM 36,975 jusched.exe
1 File(s) 36,975 bytes


Duplicate files of bak directory contents
~~~~~~~~~~~~~~~~~~~~~~~

61440 Feb 11 2003 "C:\hp\KBD\bak\KBD.EXE"
57344 Jan 16 2004 "C:\Program Files\Lexmark 4200 Series\bak\lxbmbmgr.exe"
98304 Apr 2 2004 "C:\Program Files\QuickTime\bak\qttask.exe"
233472 Apr 13 2004 "C:\WINDOWS\SMINST\bak\RECGUARD.EXE"
233472 Apr 13 2004 "C:\hp\patches\43WW3OWN\files\UP\Recguard.exe"
233472 Apr 13 2004 "D:\hp\patches\43WW3OWN\files\UP\Recguard.exe"
52736 May 7 1998 "C:\WINDOWS\system\bak\hpsysdrv.exe"
118784 Feb 10 2004 "C:\hp\drivers\video_Intel\hkcmd.exe"
118784 Aug 20 2004 "C:\WINDOWS\system32\bak\hkcmd.exe"
118784 Feb 10 2004 "C:\WINDOWS\system32\ReinstallBackups\0011\DriverFiles\hkcmd.exe"
155648 Feb 10 2004 "C:\hp\drivers\video_Intel\igfxtray.exe"
155648 Aug 20 2004 "C:\WINDOWS\system32\bak\igfxtray.exe"
155648 Feb 10 2004 "C:\WINDOWS\system32\ReinstallBackups\0011\DriverFiles\igfxtray.exe"
98304 Sep 12 2003 "C:\hp\drivers\keyboard\PS2.EXE"
98304 Sep 12 2003 "C:\WINDOWS\system32\bak\ps2.exe"
411648 Jan 27 2008 "C:\Program Files\Grisoft\AVG7\avgcc.exe"
341039 May 18 2005 "C:\Program Files\Grisoft\AVG7\bak\avgcc.exe"
324096 Jan 27 2008 "C:\Program Files\Grisoft\AVG7\avgemc.exe"
228404 May 18 2005 "C:\Program Files\Grisoft\AVG7\bak\avgemc.exe"
151552 Jan 22 2004 "C:\Program Files\Lexmark 4200 Series\Fax\bak\fm3032.exe"
200704 Jun 18 2003 "C:\Program Files\Microsoft Money\System\bak\mnyexpr.exe"
32881 Apr 2 2004 "C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe"
36975 Mar 4 2005 "C:\Program Files\Java\jre1.5.0_02\bin\bak\jusched.exe"


end of report


Thanks, Russ
  • 0

#8
Rorschach112

Rorschach112

    Ralphie

  • Retired Staff
  • 47,710 posts
Can you post the ComboFix log as well

Then do this

  • Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

    "C:\HP\KBD\BAK\KBD.EXE"
    "C:\PROGRA~1\LEXMAR~1\BAK\lxbmbmgr.exe"
    "C:\PROGRA~1\QUICKT~1\BAK\qttask.exe"
    "C:\WINDOWS\SMINST\BAK\RECGUARD.EXE"
    "C:\WINDOWS\SYSTEM\BAK\hpsysdrv.exe"
    "C:\WINDOWS\SYSTEM32\BAK\hkcmd.exe"
    "C:\WINDOWS\SYSTEM32\BAK\igfxtray.exe"
    "C:\WINDOWS\SYSTEM32\BAK\ps2.exe"
    "C:\PROGRA~1\GRISOFT\AVG7\BAK\avgcc.exe"
    "C:\PROGRA~1\GRISOFT\AVG7\BAK\avgemc.exe"
    "C:\PROGRA~1\LEXMAR~1\FAX\BAK\fm3032.exe"
    "C:\PROGRA~1\MICROS~4\SYSTEM\BAK\mnyexpr.exe"
    "C:\PROGRA~1\JAVA\JRE15~1.0_0\BIN\BAK\jusched.exe"



  • Double-click on the FindAWF.exe file to run it.
  • It will open a command prompt and ask you to "Press any key to continue".
  • You will be presented with a Menu.

    1. Press 1 then Enter to scan for bak folders
    2. Press 2 then Enter to restore files from bak folders
    3. Press 3 then Enter to remove bak folders
    4. Press 4 then Enter to reset domain zones
    5. Press E then Enter to EXIT

  • Press 2, then press Enter.
  • Press any key to continue.
  • A Notepad document FindAWF.txt will appear with instructions to click below the line and paste the list of files to be restored.
  • Right click below this line and select Paste, to paste the list of files copied to the clipboard earlier. Save and close the document.
  • The program will proceed to move the legit files and will perform another scan for .bak folder
  • It may take a few minutes to complete so be patient.
  • When it is complete, it will open a text file in notepad called AWF.txt.
  • Please copy and paste the contents of the AWF.txt file in your next reply.

  • 0

#9
Rabell

Rabell

    Member

  • Topic Starter
  • Member
  • PipPip
  • 29 posts
Hello,

Combofix log,

ComboFix 08-01-29.3 - Admin 2008-01-30 8:46:58.3 - NTFSx86
Running from: C:\Documents and Settings\Admin\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Admin\Desktop\CFScript.txt
* Created a new restore point

FILE
C:\WINDOWS\pskt.ini
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\pskt.ini

.
((((((((((((((((((((((((( Files Created from 2007-12-28 to 2008-01-30 )))))))))))))))))))))))))))))))
.

2008-01-30 06:53 . 2008-01-30 06:53 <DIR> d-------- C:\WINDOWS\LastGood
2008-01-29 11:59 . 2008-01-29 11:59 <DIR> d-------- C:\Program Files\Trend Micro
2008-01-29 11:03 . 2007-10-10 18:55 6,065,664 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll
2008-01-29 11:03 . 2007-06-30 22:31 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-01-29 11:03 . 2007-06-30 22:36 991,232 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-01-29 11:03 . 2007-10-10 18:55 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-01-29 11:03 . 2007-10-10 18:55 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-01-29 11:03 . 2007-10-10 18:55 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll
2008-01-29 11:03 . 2007-10-10 18:55 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll
2008-01-29 11:03 . 2007-10-10 18:55 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-01-29 11:03 . 2007-10-10 05:59 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-01-29 10:51 . 2007-08-13 18:54 33,792 --a--c--- C:\WINDOWS\system32\dllcache\custsat.dll
2008-01-29 10:44 . 2008-01-29 10:44 <DIR> d--hs---- C:\Documents and Settings\Admin\UserData
2008-01-29 08:58 . 2008-01-30 08:00 <DIR> d-------- C:\Documents and Settings\Admin\Application Data\AVG7
2008-01-29 08:56 . 2004-04-02 05:07 <DIR> d-------- C:\Documents and Settings\Admin\WINDOWS
2008-01-29 08:56 . 2004-04-03 03:05 <DIR> d-------- C:\Documents and Settings\Admin\Application Data\Symantec
2008-01-29 08:56 . 2004-04-02 20:28 <DIR> d-------- C:\Documents and Settings\Admin\Application Data\SampleView
2008-01-28 11:01 . 2008-01-28 11:55 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-01-28 09:46 . 2008-01-28 09:46 1,854 --a------ C:\WINDOWS\system32\tmp.reg
2008-01-28 09:44 . 2008-01-28 10:14 <DIR> d-------- C:\net downloads
2008-01-27 14:44 . 2008-01-27 14:46 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\AVG7
2008-01-27 14:43 . 2004-04-02 05:07 <DIR> d-------- C:\Documents and Settings\Administrator\WINDOWS
2008-01-27 14:43 . 2004-04-03 03:05 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Symantec
2008-01-27 14:43 . 2004-04-02 20:28 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\SampleView
2008-01-27 12:59 . 2006-08-21 04:14 128,896 -----c--- C:\WINDOWS\system32\dllcache\fltmgr.sys
2008-01-27 12:59 . 2006-08-21 04:14 23,040 -----c--- C:\WINDOWS\system32\dllcache\fltmc.exe
2008-01-27 12:59 . 2006-08-21 07:21 16,896 -----c--- C:\WINDOWS\system32\dllcache\fltlib.dll
2008-01-27 10:41 . 2007-07-09 08:09 584,192 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2008-01-27 10:37 . 2006-10-13 07:35 142,336 -----c--- C:\WINDOWS\system32\dllcache\nwprovau.dll
2008-01-27 10:33 . 2007-03-08 08:47 1,843,584 -----c--- C:\WINDOWS\system32\dllcache\win32k.sys
2008-01-27 10:33 . 2007-03-08 10:36 577,536 -----c--- C:\WINDOWS\system32\dllcache\user32.dll
2008-01-27 10:33 . 2007-06-19 08:31 282,112 -----c--- C:\WINDOWS\system32\dllcache\gdi32.dll
2008-01-27 10:33 . 2007-03-08 10:36 40,960 -----c--- C:\WINDOWS\system32\dllcache\mf3216.dll
2008-01-27 10:32 . 2007-08-13 18:38 491,520 --a--c--- C:\WINDOWS\system32\dllcache\jscript.dll
2008-01-27 10:30 . 2006-12-26 08:07 536,576 -----c--- C:\WINDOWS\system32\dllcache\msado15.dll
2008-01-27 10:30 . 2006-12-26 08:07 200,704 -----c--- C:\WINDOWS\system32\dllcache\msadox.dll
2008-01-27 10:30 . 2006-12-26 08:07 180,224 -----c--- C:\WINDOWS\system32\dllcache\msadomd.dll
2008-01-27 10:30 . 2006-12-26 08:07 102,400 -----c--- C:\WINDOWS\system32\dllcache\msjro.dll
2008-01-27 10:23 . 2006-10-12 06:09 256,512 -----c--- C:\WINDOWS\system32\dllcache\agentsvr.exe
2008-01-27 10:23 . 2007-03-09 08:46 57,344 --a--c--- C:\WINDOWS\system32\dllcache\agentdpv.dll
2008-01-27 10:23 . 2006-10-12 09:02 42,496 -----c--- C:\WINDOWS\system32\dllcache\agentdp2.dll
2008-01-27 10:22 . 2007-08-21 01:15 683,520 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll
2008-01-27 10:13 . 2008-01-27 10:14 <DIR> d-------- C:\Program Files\Windows Defender
2008-01-27 09:49 . 2008-01-27 09:49 127 --a------ C:\WINDOWS\system32\MRT.INI
2008-01-27 09:45 . 2006-08-17 07:28 332,288 -----c--- C:\WINDOWS\system32\dllcache\netapi32.dll
2008-01-27 09:45 . 2006-08-17 07:28 132,096 -----c--- C:\WINDOWS\system32\dllcache\wkssvc.dll
2008-01-27 09:44 . 2007-11-07 04:26 721,920 -----c--- C:\WINDOWS\system32\dllcache\lsasrv.dll
2008-01-27 01:58 . 2008-01-27 01:58 <DIR> d-------- C:\WINDOWS\provisioning
2008-01-27 01:54 . 2008-01-27 01:54 <DIR> d-------- C:\WINDOWS\ServicePackFiles
2008-01-27 01:46 . 2004-07-17 11:40 19,528 --a------ C:\WINDOWS\002386_.tmp
2008-01-27 01:41 . 2008-01-27 01:41 <DIR> d-------- C:\WINDOWS\EHome
2008-01-26 10:18 . 2008-01-29 08:00 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\AVG7
2008-01-26 10:17 . 2008-01-26 10:17 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
2008-01-26 10:15 . 2008-01-26 10:15 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-01-26 10:15 . 2008-01-27 20:36 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg7
2008-01-14 19:22 . 2002-08-29 04:41 150,528 --a------ C:\WINDOWS\system32\ptpusd.dll
2008-01-14 19:22 . 2001-08-17 23:36 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll
2008-01-11 18:09 . 2008-01-27 09:23 16,600 --a------ C:\WINDOWS\BM6fc0a1b1.xml
2008-01-09 19:22 . 2008-01-09 19:22 <DIR> d-------- C:\Program Files\RcvSystem
2007-12-24 10:27 . 2007-12-24 10:27 355 --ahs---- C:\WINDOWS\system32\sqfreqxl.ini
2007-12-24 10:18 . 2007-12-24 10:18 294 --ahs---- C:\WINDOWS\system32\falgxahc.ini
2007-12-18 19:56 . 2006-05-05 04:41 453,120 -----c--- C:\WINDOWS\system32\dllcache\mrxsmb.sys
2007-12-18 19:56 . 2006-05-05 04:47 174,592 -----c--- C:\WINDOWS\system32\dllcache\rdbss.sys
2007-12-18 18:33 . 2007-12-18 18:33 4 --a------ C:\WINDOWS\system32\jpewocmz.ini
2007-12-17 11:46 . 2006-06-22 00:06 1,435,648 -----c--- C:\WINDOWS\system32\dllcache\query.dll
2007-12-17 11:46 . 2006-06-22 00:06 69,120 -----c--- C:\WINDOWS\system32\dllcache\ciodm.dll
2007-12-16 17:59 . 2004-08-04 00:56 294,912 --a------ C:\WINDOWS\system32\msh263.drv
2007-12-16 17:59 . 2004-08-04 00:56 53,760 --a------ C:\WINDOWS\system32\vfwwdm32.dll
2007-12-16 17:59 . 2004-08-04 00:56 47,616 --a------ C:\WINDOWS\system32\iyuv_32.dll
2007-12-16 17:59 . 2001-08-17 23:36 8,192 --a------ C:\WINDOWS\system32\tsbyuv.dll
2007-12-16 17:59 . 2001-08-17 23:36 8,192 --a--c--- C:\WINDOWS\system32\dllcache\tsbyuv.dll
2007-12-16 17:56 . 2007-12-16 17:56 <DIR> d-------- C:\Program Files\Veo Stingray
2007-12-16 17:56 . 2002-04-01 16:13 36,864 --a------ C:\WINDOWS\system32\VeoSetup532.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-27 14:21 --------- d-----w C:\Program Files\MSN Messenger
2007-12-22 00:40 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-11-07 09:26 721,920 ----a-w C:\WINDOWS\system32\lsasrv.dll
2007-10-31 19:03 245,408 ----a-w C:\WINDOWS\system32\unicows.dll
2007-10-29 22:43 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
2007-10-27 22:39 230,912 ----a-w C:\WINDOWS\system32\wmasf.dll
2007-10-10 23:56 824,832 ----a-w C:\WINDOWS\system32\wininet.dll
.

((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{13fabf7b-a416-4648-8393-601a4ef7feb0}]
C:\WINDOWS\System32\yrqqesfh.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{477840F3-BA52-44D9-8E41-38D61CAA010F}]
C:\WINDOWS\system32\egmulhxk.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{875A1348-7674-42aa-ADAC-B4F36A004A2D}]
C:\Program Files\QdrDrive\QdrDrive8.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A81BEEC5-0AB7-45C3-9F71-DB3543E31BD8}]
C:\WINDOWS\System32\ssttu.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D0CDEF78-1FA0-5874-946D-0E5B280C28FD}]
C:\WINDOWS\System32\pscigks.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FBE22921-89FD-CE7B-9218-C9A707C006F4}]
C:\WINDOWS\System32\qjiknof.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VTTimer"="VTTimer.exe" []
"QBCD Autorun"="E:\autorun.exe" [ ]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2004-04-02 04:43 151597]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-01-27 20:37 411648]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20 866584]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-01-27 20:37 145920]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 16:38 39264]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
QuickBooks Delivery Agent.lnk - C:\Program Files\Intuit\QuickBooks\Components\QBAgent\QBDAgent.exe [2005-01-29 11:14:42 118784]
Quicken Scheduled Updates.lnk - C:\Program Files\Quicken\bagent.exe [2003-07-30 07:49:48 57344]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mljkiih]
mljkiih.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=

R1 crlscsi;crlscsi;C:\WINDOWS\system32\drivers\crlscsi.sys [1995-11-07 04:57]
S3 DCamUSBVeo532;Veo Web Camera;C:\WINDOWS\system32\Drivers\ubVeo532.sys [2002-07-01 19:30]

.
Contents of the 'Scheduled Tasks' folder
"2004-11-14 19:22:00 C:\WINDOWS\Tasks\Easy Internet Sign-up.job"
- C:\Program Files\Easy Internet signup\HPSdpApp.exe
"2008-01-30 07:14:42 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
"2008-01-30 13:04:02 C:\WINDOWS\Tasks\Symantec NetDetect.job"
- C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-30 08:53:28
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-30 8:57:20
ComboFix-quarantined-files.txt 2008-01-30 13:56:52
ComboFix2.txt 2008-01-29 20:30:14
ComboFix3.txt 2008-01-29 19:41:27
.
2008-01-28 15:22:26 --- E O F ---
  • 0

#10
Rabell

Rabell

    Member

  • Topic Starter
  • Member
  • PipPip
  • 29 posts
Ok just posted Combofix log and now the AWF.....


Find AWF report by noahdfear ©2006
Version 1.40
Option 2 run successfully

The current date is: Wed 01/30/2008
The current time is: 10:03:10.04


bak folders found
~~~~~~~~~~~


Directory of C:\HP\KBD\BAK

02/11/2003 10:02 PM 61,440 KBD.EXE
1 File(s) 61,440 bytes

Directory of C:\PROGRA~1\LEXMAR~1\BAK

01/16/2004 05:04 AM 57,344 lxbmbmgr.exe
1 File(s) 57,344 bytes

Directory of C:\PROGRA~1\QUICKT~1\BAK

04/02/2004 05:04 AM 98,304 qttask.exe
1 File(s) 98,304 bytes

Directory of C:\WINDOWS\SMINST\BAK

04/13/2004 11:43 PM 233,472 RECGUARD.EXE
1 File(s) 233,472 bytes

Directory of C:\WINDOWS\SYSTEM\BAK

05/07/1998 07:04 PM 52,736 hpsysdrv.exe
1 File(s) 52,736 bytes

Directory of C:\WINDOWS\SYSTEM32\BAK

08/20/2004 03:51 PM 118,784 hkcmd.exe
08/20/2004 03:55 PM 155,648 igfxtray.exe
09/12/2003 10:13 PM 98,304 ps2.exe
3 File(s) 372,736 bytes

Directory of C:\PROGRA~1\GRISOFT\AVG7\BAK

05/18/2005 09:31 AM 341,039 avgcc.exe
05/18/2005 09:31 AM 228,404 avgemc.exe
2 File(s) 569,443 bytes

Directory of C:\PROGRA~1\LEXMAR~1\FAX\BAK

01/22/2004 10:59 AM 151,552 fm3032.exe
1 File(s) 151,552 bytes

Directory of C:\PROGRA~1\MICROS~4\SYSTEM\BAK

06/18/2003 10:00 PM 200,704 mnyexpr.exe
1 File(s) 200,704 bytes

Directory of C:\PROGRA~1\JAVA\JRE15~1.0_0\BIN\BAK

03/04/2005 04:36 AM 36,975 jusched.exe
1 File(s) 36,975 bytes


Duplicate files of bak directory contents
~~~~~~~~~~~~~~~~~~~~~~~

61440 Feb 11 2003 "C:\hp\KBD\KBD.EXE"
61440 Feb 11 2003 "C:\hp\KBD\bak\KBD.EXE"
57344 Jan 16 2004 "C:\Program Files\Lexmark 4200 Series\lxbmbmgr.exe"
57344 Jan 16 2004 "C:\Program Files\Lexmark 4200 Series\bak\lxbmbmgr.exe"
98304 Apr 2 2004 "C:\Program Files\QuickTime\qttask.exe"
98304 Apr 2 2004 "C:\Program Files\QuickTime\bak\qttask.exe"
233472 Apr 13 2004 "C:\WINDOWS\SMINST\RECGUARD.EXE"
233472 Apr 13 2004 "C:\WINDOWS\SMINST\bak\RECGUARD.EXE"
233472 Apr 13 2004 "C:\hp\patches\43WW3OWN\files\UP\Recguard.exe"
233472 Apr 13 2004 "D:\hp\patches\43WW3OWN\files\UP\Recguard.exe"
52736 May 7 1998 "C:\WINDOWS\system\hpsysdrv.exe"
52736 May 7 1998 "C:\WINDOWS\system\bak\hpsysdrv.exe"
118784 Aug 20 2004 "C:\WINDOWS\system32\hkcmd.exe"
118784 Feb 10 2004 "C:\hp\drivers\video_Intel\hkcmd.exe"
118784 Aug 20 2004 "C:\WINDOWS\system32\bak\hkcmd.exe"
118784 Feb 10 2004 "C:\WINDOWS\system32\ReinstallBackups\0011\DriverFiles\hkcmd.exe"
155648 Aug 20 2004 "C:\WINDOWS\system32\igfxtray.exe"
155648 Feb 10 2004 "C:\hp\drivers\video_Intel\igfxtray.exe"
155648 Aug 20 2004 "C:\WINDOWS\system32\bak\igfxtray.exe"
155648 Feb 10 2004 "C:\WINDOWS\system32\ReinstallBackups\0011\DriverFiles\igfxtray.exe"
98304 Sep 12 2003 "C:\WINDOWS\system32\ps2.exe"
98304 Sep 12 2003 "C:\hp\drivers\keyboard\PS2.EXE"
98304 Sep 12 2003 "C:\WINDOWS\system32\bak\ps2.exe"
341039 May 18 2005 "C:\Program Files\Grisoft\AVG7\avgcc.exe"
341039 May 18 2005 "C:\Program Files\Grisoft\AVG7\bak\avgcc.exe"
228404 May 18 2005 "C:\Program Files\Grisoft\AVG7\avgemc.exe"
228404 May 18 2005 "C:\Program Files\Grisoft\AVG7\bak\avgemc.exe"
151552 Jan 22 2004 "C:\Program Files\Lexmark 4200 Series\Fax\fm3032.exe"
151552 Jan 22 2004 "C:\Program Files\Lexmark 4200 Series\Fax\bak\fm3032.exe"
200704 Jun 18 2003 "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
200704 Jun 18 2003 "C:\Program Files\Microsoft Money\System\bak\mnyexpr.exe"
32881 Apr 2 2004 "C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe"
36975 Mar 4 2005 "C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe"
36975 Mar 4 2005 "C:\Program Files\Java\jre1.5.0_02\bin\bak\jusched.exe"


end of report
  • 0

#11
Rorschach112

Rorschach112

    Ralphie

  • Retired Staff
  • 47,710 posts
Hello

  • Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

    C:\hp\KBD\bak
    C:\Program Files\Lexmark 4200 Series\bak
    C:\Program Files\QuickTime\bak
    C:\WINDOWS\SMINST\bak
    C:\WINDOWS\system\bak
    C:\WINDOWS\system32\bak
    C:\Program Files\Grisoft\AVG7\bak
    C:\Program Files\Lexmark 4200 Series\Fax\bak
    C:\Program Files\Microsoft Money\System\bak
    C:\Program Files\Java\jre1.5.0_02\bin\bak



  • Double-click on the FindAWF.exe file to run it.
  • It will open a command prompt and ask you to "Press any key to continue".
  • You will be presented with a Menu.

    1. Press 1 then Enter to scan for bak folders
    2. Press 2 then Enter to restore files from bak folders
    3. Press 3 then Enter to remove bak folders
    4. Press 4 then Enter to reset domain zones
    5. Press E then Enter to EXIT

  • Press 3, then press Enter.
    [*Press any key to continue.
  • A Notepad document FindAWF.txt will appear with instructions to click below the line and paste the list of folders to be removed.
  • Right click below this line and select Paste, to paste the list of folders copied to the clipboard earlier. Save and close the document.
  • The program will proceed to remove the bad folders and will perform another scan for .bak folder
  • It may take a few minutes to complete so be patient.
  • When it is complete, it will open a text file in notepad called AWF.txt.
  • Please copy and paste the contents of the AWF.txt file in your next reply.

  • 0

#12
Rabell

Rabell

    Member

  • Topic Starter
  • Member
  • PipPip
  • 29 posts
Hello,


Find AWF report by noahdfear ©2006
Version 1.40
Option 3 run successfully

The current date is: Wed 01/30/2008
The current time is: 10:26:33.01


bak folders found
~~~~~~~~~~~



Duplicate files of bak directory contents
~~~~~~~~~~~~~~~~~~~~~~~



end of report
  • 0

#13
Rorschach112

Rorschach112

    Ralphie

  • Retired Staff
  • 47,710 posts
Hello

Please do an online scan with Kaspersky WebScanner

Click on Kaspersky Online Scanner and click Accept

You will be prompted to install an ActiveX component from Kaspersky, Click Yes.
  • The program will launch and then begin downloading the latest definition files:
  • Once the files have been downloaded click on NEXT
  • Now click on Scan Settings
  • In the scan settings make that the following are selected:
    • Scan using the following Anti-Virus database:
    Extended (if available otherwise Standard)
    • Scan Options:
    Scan Archives
    Scan Mail Bases
  • Click OK
  • Now under select a target to scan:Select My Computer
  • This will program will start and scan your system.
  • The scan will take a while so be patient and let it run.
  • Once the scan is complete it will display if your system has been infected.
    • Now click on the Save as Text button:
  • Save the file to your desktop.
  • Copy and paste that information in your next post.


Please download Deckard's System Scanner (DSS) and save it to your Desktop.
  • Close all other windows before proceeding.
  • Double-click on dss.exe and follow the prompts.
  • If your anti-virus or firewall complains, please allow this script to run as it is not malicious.
  • When it has finished, dss will open two Notepads main.txt and extra.txt -- please copy (CTRL+A and then CTRL+C) and paste (CTRL+V) the contents of main.txt and extra.txt in your next reply.

  • 0

#14
Rorschach112

Rorschach112

    Ralphie

  • Retired Staff
  • 47,710 posts
Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP