Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Getting fustrated [RESOLVED]


  • This topic is locked This topic is locked

#16
Noitora

Noitora

    Member

  • Topic Starter
  • Member
  • PipPip
  • 45 posts
currently at the moment I am disposed, ill be back within a day or 2 witht he log
  • 0

Advertisements


#17
Noitora

Noitora

    Member

  • Topic Starter
  • Member
  • PipPip
  • 45 posts
ComboFix 08-02-20.2 - Owner 2008-02-25 0:38:01.19 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.602 [GMT -8:00]
Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
C:\Program Files\AIM6\aim6.exe
C:\Program Files\Veoh Networks\Veoh\VeohClient.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr .Exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\aareqmap.ini
C:\WINDOWS\system32\bbeeg.ini
C:\WINDOWS\system32\bbeeg.ini2
C:\WINDOWS\system32\geebb.dll
C:\WINDOWS\system32\geebb.exe
C:\WINDOWS\system32\meehuvyx.dll
C:\WINDOWS\system32\sohnwpju.dll
C:\WINDOWS\system32\vwrgqtem.dll
C:\WINDOWS\system32\xyvuheem.ini

.
((((((((((((((((((((((((( Files Created from 2008-01-25 to 2008-02-25 )))))))))))))))))))))))))))))))
.

2008-02-21 02:47 . 2008-02-21 02:47 268 --ah----- C:\sqmdata03.sqm
2008-02-21 02:47 . 2008-02-21 02:47 244 --ah----- C:\sqmnoopt03.sqm
2008-02-20 15:51 . 2008-02-21 12:32 388,608 --a------ C:\WINDOWS\system32\kmd .exe
2008-02-20 15:49 . 2008-02-20 17:48 158,208 --a------ C:\WINDOWS\system32\dllcache\msconfig .exe
2008-02-20 01:15 . 2008-02-20 01:15 36,734 --a------ C:\WINDOWS\system32\OggDSuninst.exe
2008-02-20 01:10 . 2008-02-20 01:10 <DIR> d-------- C:\Program Files\RadLight Company
2008-02-20 01:10 . 2008-02-20 01:10 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\RadLight Company
2008-02-19 16:56 . 2008-02-20 18:17 <DIR> d-------- C:\VundoFix Backups
2008-02-19 00:50 . 2008-02-19 00:50 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-02-19 00:50 . 2008-02-19 00:50 1,409 --a------ C:\WINDOWS\QTFont.for
2008-02-16 22:52 . 2008-02-17 23:54 202 --a------ C:\WINDOWS\wininit.ini
2008-02-16 22:30 . 2008-02-20 15:46 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-02-16 22:30 . 2008-02-16 22:46 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-16 22:20 . 2008-02-16 22:20 6,029,648 --a------ C:\Program Files\Firefox Setup 2.0.0.12.exe
2008-02-15 00:01 . 2008-02-24 23:32 157,383 --a------ C:\WINDOWS\BM2fdf5f1a.xml
2008-02-15 00:01 . 2008-02-25 00:02 21 --a------ C:\WINDOWS\pskt.ini
2008-02-14 22:27 . 2008-02-14 22:27 <DIR> d-------- C:\WINDOWS\cache
2008-02-14 21:15 . 2008-02-14 23:06 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Google Updater
2008-02-13 11:08 . 2008-02-13 11:08 22 --a------ C:\WINDOWS\system32\ati64hlp.stb
2008-02-11 16:35 . 2008-02-11 23:57 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
2008-02-10 19:25 . 2008-02-10 19:25 <DIR> d-------- C:\Program Files\Trend Micro
2008-02-08 00:11 . 2008-02-08 03:04 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\Azureus
2008-02-06 14:07 . 2008-02-06 14:07 <DIR> d---s---- C:\Documents and Settings\Hossea\UserData
2008-02-02 21:57 . 2008-02-14 22:27 <DIR> dr-h----- C:\Documents and Settings\Hossea\Application Data\yahoo!
2008-02-02 19:47 . 2008-02-02 19:48 <DIR> d-------- C:\Documents and Settings\Hossea\Shared
2008-02-02 19:47 . 2008-02-02 19:49 <DIR> d-------- C:\Documents and Settings\Hossea\Incomplete
2008-02-02 19:47 . 2008-02-18 23:59 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\LimeWire
2008-02-02 19:45 . 2007-04-12 06:52 <DIR> d-------- C:\Documents and Settings\Hossea\WINDOWS
2008-02-02 19:45 . 2007-04-12 07:40 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\You've Got Pictures Screensaver
2008-02-02 19:45 . 2007-04-12 07:39 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\SampleView
2008-02-02 19:45 . 2007-04-12 07:43 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\McAfee
2008-02-02 19:45 . 2007-04-13 23:11 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\AOL
2008-01-28 17:08 . 2008-01-28 17:08 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\acccore
2008-01-28 17:05 . 2008-02-25 00:05 <DIR> d-------- C:\Program Files\AIM6
2008-01-27 15:56 . 2008-01-27 15:56 <DIR> d--h----- C:\WINDOWS\PIF

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-22 00:33 --------- d-----w C:\Program Files\Warcraft III
2008-02-21 10:46 --------- d-----w C:\Program Files\Windows Live
2008-02-21 10:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-02-20 23:46 --------- d-----w C:\Program Files\Windows Defender
2008-02-20 09:08 --------- d-----w C:\Program Files\DivX
2008-02-15 10:44 --------- d-----w C:\Program Files\Google
2008-02-15 07:21 --------- d--h--r C:\Documents and Settings\Owner\Application Data\yahoo!
2008-02-15 07:05 497,152 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe.tmp
2008-02-15 06:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-02-15 05:22 --------- d-----w C:\Program Files\WC3Banlist
2008-02-08 20:23 --------- d-----w C:\Program Files\QuickTime
2008-02-04 21:52 --------- d-----w C:\Program Files\LimeWire
2008-01-31 18:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-01-30 23:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\yahoo!
2008-01-29 01:06 --------- d-----w C:\Program Files\Common Files\AOL
2008-01-29 01:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL
2008-01-26 21:58 --------- d-----w C:\Program Files\World of Warcraft
2008-01-21 23:33 --------- d-----w C:\Documents and Settings\Guest\Application Data\Ventrilo
2008-01-20 19:26 --------- d-----w C:\Documents and Settings\Owner\Application Data\Azureus
2008-01-15 08:27 --------- d-----w C:\Program Files\Opera
2008-01-11 06:27 --------- d-----w C:\Program Files\Steam
2008-01-04 21:59 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2008-01-04 21:58 43,528 ----a-w C:\WINDOWS\system32\drivers\pxhelp20.sys
2008-01-04 21:58 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2008-01-04 21:58 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-01-04 21:58 129,784 ----a-w C:\WINDOWS\system32\pxafs.dll
2008-01-04 21:58 120,056 ----a-w C:\WINDOWS\system32\pxcpyi64.exe
2008-01-04 21:58 118,520 ----a-w C:\WINDOWS\system32\pxinsi64.exe
2008-01-04 21:58 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2008-01-04 21:57 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2008-01-04 21:57 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2008-01-04 21:57 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2008-01-04 21:57 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2008-01-04 21:57 682,496 ----a-w C:\WINDOWS\system32\DivX.dll
2008-01-04 21:57 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2008-01-04 21:57 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2008-01-04 21:57 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2008-01-04 21:57 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2008-01-04 21:57 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2008-01-04 21:57 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2008-01-04 21:57 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2008-01-04 21:56 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-01-04 21:56 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2008-01-04 19:59 --------- d--h--r C:\Documents and Settings\Guest\Application Data\yahoo!
2007-12-28 09:06 --------- d-----w C:\Program Files\Azureus
2007-12-27 09:59 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2007-12-25 02:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft
2007-12-25 01:56 --------- d-----w C:\Program Files\Alwil Software
2007-12-21 04:01 58,904 ----a-w C:\WINDOWS\system32\sysfolderazipcnt.dll
2007-12-21 04:01 58,904 ----a-w C:\WINDOWS\system32\azipcontmn.dll
2007-12-07 01:07 659,456 ----a-w C:\WINDOWS\system32\wininet.dll
2007-12-04 18:38 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr
2007-11-20 09:52 7,292,416 ----a-w C:\Program Files\NETGEAR WG311v3 PCI Adapter.msi
2006-03-15 22:19 212,992 ----a-w C:\WINDOWS\inf\WG311v3\CopyWHQLDriver.exe
2006-01-27 01:55 280,576 ----a-w C:\WINDOWS\inf\WG311v3\WG311v3.sys
2005-10-06 23:17 280,576 ----a-w C:\WINDOWS\inf\WG311v3\WG311v3XP.sys
.
<pre>
----a-w			50,528 2008-02-25 07:54:28  C:\Program Files\AIM6\aim6 .exe
----a-w		 3,497,984 2008-02-25 07:30:33  C:\Program Files\Veoh Networks\Veoh\VeohClient .exe
----a-w		   388,608 2008-02-21 20:32:40  C:\WINDOWS\system32\kmd .exe
----a-w		   158,208 2008-02-21 01:48:35  C:\WINDOWS\system32\dllcache\msconfig .exe
</pre>


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [ ]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CHotkey"="zHotkey.exe" [2005-05-03 13:02 543232 C:\WINDOWS\zHotkey.exe]
"Recguard"="%WINDIR%\SMINST\RECGUARD.EXE" [ ]
"SoundMan"="SOUNDMAN.EXE" [2006-11-17 04:42 577536 C:\WINDOWS\soundman.exe]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2005-04-25 12:45 36040]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk
backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NETGEAR WG311v3 Smart Wizard.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\NETGEAR WG311v3 Smart Wizard.lnk
backup=C:\WINDOWS\pss\NETGEAR WG311v3 Smart Wizard.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
C:\Program Files\AIM6\aim6 .exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!]
--a------ 2007-12-04 05:00 79224 C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
--a------ 2005-08-05 12:56 64512 C:\WINDOWS\ehome\ehtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2006-09-25 13:54 229952 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe]
c:\PROGRA~1\mcafee.com\agent\mcagent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe]
C:\PROGRA~1\mcafee.com\agent\mcupdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSConfig]
C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig .exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2008-02-21 02:36 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
C:\Program Files\Windows Live\Messenger\MsnMsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 10:50 155648 C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Reminder]
%WINDIR%\Creator\Remind_XP.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--------- 2004-11-02 19:24 32768 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
--a------ 2008-02-19 14:00 2441216 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
--a------ 2007-12-01 14:01 1266936 c:\program files\steam\steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-09-25 01:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunKistEM]
--a------ 2004-11-15 14:04 135168 C:\Program Files\Digital Media Reader\shwiconem.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2008-02-17 23:24 526848 C:\Program Files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Veoh]
C:\Program Files\Veoh Networks\Veoh\VeohClient.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zune Launcher]
--a------ 2007-03-14 16:03 24104 C:\Program Files\Zune\ZuneLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\_AntiSpyware]
C:\Program Files\McAfee\McAfee AntiSpyware\MssCli.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"AVG Anti-Spyware Guard"=2 (0x2)
"Viewpoint Manager Service"=2 (0x2)
"avast! Mail Scanner"=3 (0x3)
"avast! Antivirus"=2 (0x2)
"ZuneNetworkSvc"=2 (0x2)
"WMPNetworkSvc"=3 (0x3)
"WLSetupSvc"=3 (0x3)
"WinDefend"=2 (0x2)
"usnjsvc"=3 (0x3)
"rpcapd"=3 (0x3)
"ose"=3 (0x3)
"iPod Service"=3 (0x3)
"idsvc"=3 (0x3)
"gusvc"=2 (0x2)
"avast! Web Scanner"=3 (0x3)
"aswUpdSv"=2 (0x2)
"Adobe LM Service"=3 (0x3)

S3 ASPI;Advanced SCSI Programming Interface Driver;C:\WINDOWS\System32\DRIVERS\ASPI32.sys [2002-07-17 08:05]
S3 BEL;Belkin 11Mbps Wireless LAN Driver;C:\WINDOWS\system32\DRIVERS\BELNDS.sys []
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [2007-01-25 09:31]

.
Contents of the 'Scheduled Tasks' folder
"2008-02-25 08:31:09 C:\WINDOWS\Tasks\ATF-Cleaner.job"
- C:\Documents and Settings\Owner\Desktop\Stuff\Anti Virus and Protectors\ATF-Cleaner.exe
"2008-02-21 10:31:14 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-25 00:40:51
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-25 0:42:35
ComboFix-quarantined-files.txt 2008-02-25 08:42:33
ComboFix2.txt 2008-02-22 01:45:15
ComboFix3.txt 2008-02-21 21:06:18
ComboFix4.txt 2008-02-20 23:35:17
ComboFix5.txt 2008-02-20 22:49:49
.
2008-02-15 07:24:30 --- E O F ---
How am I getting geebb.exe back over and over? I keep deleting it constantly

Edited by Noitora, 25 February 2008 - 02:44 AM.

  • 0

#18
Rorschach112

Rorschach112

    Ralphie

  • Retired Staff
  • 47,710 posts
Hello

1. Close any open browsers.

2. Open notepad and copy/paste the text in the quotebox below into it:

File::
----a-w			50,528 2008-02-25 07:54:28  C:\Program Files\AIM6\aim6 .exe
----a-w		 3,497,984 2008-02-25 07:30:33  C:\Program Files\Veoh Networks\Veoh\VeohClient .exe
----a-w		   388,608 2008-02-21 20:32:40  C:\WINDOWS\system32\kmd .exe
----a-w		   158,208 2008-02-21 01:48:35  C:\WINDOWS\system32\dllcache\msconfig .exe

RenV::
----a-w			50,528 2008-02-25 07:54:28  C:\Program Files\AIM6\aim6 .exe
----a-w		 3,497,984 2008-02-25 07:30:33  C:\Program Files\Veoh Networks\Veoh\VeohClient .exe
----a-w		   388,608 2008-02-21 20:32:40  C:\WINDOWS\system32\kmd .exe
----a-w		   158,208 2008-02-21 01:48:35  C:\WINDOWS\system32\dllcache\msconfig .exe

Save this as CFScript.txt, in the same location as ComboFix.exe


Posted Image

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at "C:\ComboFix.txt"

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall




Please do an online scan with Kaspersky WebScanner

Click on Kaspersky Online Scanner and click Accept

You will be prompted to install an ActiveX component from Kaspersky, Click Yes.
  • The program will launch and then begin downloading the latest definition files:
  • Once the files have been downloaded click on NEXT
  • Now click on Scan Settings
  • In the scan settings make that the following are selected:
    • Scan using the following Anti-Virus database:
    Extended (if available otherwise Standard)
    • Scan Options:
    Scan Archives
    Scan Mail Bases
  • Click OK
  • Now under select a target to scan:Select My Computer
  • This will program will start and scan your system.
  • The scan will take a while so be patient and let it run.
  • Once the scan is complete it will display if your system has been infected.
    • Now click on the Save as Text button:
  • Save the file to your desktop.
  • Copy and paste that information in your next post.

Edited by Rorschach112, 25 February 2008 - 08:40 AM.

  • 0

#19
Noitora

Noitora

    Member

  • Topic Starter
  • Member
  • PipPip
  • 45 posts
ComboFix 08-02-20.2 - Owner 2008-02-25 12:36:45.20 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.541 [GMT -8:00]
Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Owner\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
----a-w 50,528 2008-02-25 07:54:28 C:\Program Files\AIM6\aim6 .exe
.

((((((((((((((((((((((((( Files Created from 2008-01-25 to 2008-02-25 )))))))))))))))))))))))))))))))
.

2008-02-21 02:47 . 2008-02-21 02:47 268 --ah----- C:\sqmdata03.sqm
2008-02-21 02:47 . 2008-02-21 02:47 244 --ah----- C:\sqmnoopt03.sqm
2008-02-20 15:51 . 2008-02-21 12:32 388,608 --a------ C:\WINDOWS\system32\kmd .exe
2008-02-20 15:49 . 2008-02-20 17:48 158,208 --a------ C:\WINDOWS\system32\dllcache\msconfig .exe
2008-02-20 01:15 . 2008-02-20 01:15 36,734 --a------ C:\WINDOWS\system32\OggDSuninst.exe
2008-02-20 01:10 . 2008-02-20 01:10 <DIR> d-------- C:\Program Files\RadLight Company
2008-02-20 01:10 . 2008-02-20 01:10 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\RadLight Company
2008-02-19 16:56 . 2008-02-20 18:17 <DIR> d-------- C:\VundoFix Backups
2008-02-19 00:50 . 2008-02-19 00:50 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-02-19 00:50 . 2008-02-19 00:50 1,409 --a------ C:\WINDOWS\QTFont.for
2008-02-16 22:52 . 2008-02-17 23:54 202 --a------ C:\WINDOWS\wininit.ini
2008-02-16 22:30 . 2008-02-20 15:46 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-02-16 22:30 . 2008-02-16 22:46 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-16 22:20 . 2008-02-16 22:20 6,029,648 --a------ C:\Program Files\Firefox Setup 2.0.0.12.exe
2008-02-15 00:01 . 2008-02-24 23:32 157,383 --a------ C:\WINDOWS\BM2fdf5f1a.xml
2008-02-15 00:01 . 2008-02-25 00:02 21 --a------ C:\WINDOWS\pskt.ini
2008-02-14 22:27 . 2008-02-14 22:27 <DIR> d-------- C:\WINDOWS\cache
2008-02-14 21:15 . 2008-02-14 23:06 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Google Updater
2008-02-13 11:08 . 2008-02-13 11:08 22 --a------ C:\WINDOWS\system32\ati64hlp.stb
2008-02-11 16:35 . 2008-02-25 12:33 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
2008-02-10 19:25 . 2008-02-10 19:25 <DIR> d-------- C:\Program Files\Trend Micro
2008-02-08 00:11 . 2008-02-08 03:04 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\Azureus
2008-02-06 14:07 . 2008-02-06 14:07 <DIR> d---s---- C:\Documents and Settings\Hossea\UserData
2008-02-02 21:57 . 2008-02-14 22:27 <DIR> dr-h----- C:\Documents and Settings\Hossea\Application Data\yahoo!
2008-02-02 19:47 . 2008-02-02 19:48 <DIR> d-------- C:\Documents and Settings\Hossea\Shared
2008-02-02 19:47 . 2008-02-02 19:49 <DIR> d-------- C:\Documents and Settings\Hossea\Incomplete
2008-02-02 19:47 . 2008-02-18 23:59 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\LimeWire
2008-02-02 19:45 . 2007-04-12 06:52 <DIR> d-------- C:\Documents and Settings\Hossea\WINDOWS
2008-02-02 19:45 . 2007-04-12 07:40 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\You've Got Pictures Screensaver
2008-02-02 19:45 . 2007-04-12 07:39 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\SampleView
2008-02-02 19:45 . 2007-04-12 07:43 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\McAfee
2008-02-02 19:45 . 2007-04-13 23:11 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\AOL
2008-01-28 17:08 . 2008-01-28 17:08 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\acccore
2008-01-28 17:05 . 2008-02-25 12:36 <DIR> d-------- C:\Program Files\AIM6
2008-01-27 15:56 . 2008-01-27 15:56 <DIR> d--h----- C:\WINDOWS\PIF

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-25 11:02 --------- d-----w C:\Program Files\Warcraft III
2008-02-25 10:08 --------- d-----w C:\Program Files\Windows Live
2008-02-25 10:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-02-20 23:46 --------- d-----w C:\Program Files\Windows Defender
2008-02-20 09:08 --------- d-----w C:\Program Files\DivX
2008-02-15 10:44 --------- d-----w C:\Program Files\Google
2008-02-15 07:21 --------- d--h--r C:\Documents and Settings\Owner\Application Data\yahoo!
2008-02-15 07:05 497,152 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe.tmp
2008-02-15 06:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-02-15 05:22 --------- d-----w C:\Program Files\WC3Banlist
2008-02-08 20:23 --------- d-----w C:\Program Files\QuickTime
2008-02-04 21:52 --------- d-----w C:\Program Files\LimeWire
2008-01-31 18:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-01-30 23:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\yahoo!
2008-01-29 01:06 --------- d-----w C:\Program Files\Common Files\AOL
2008-01-29 01:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL
2008-01-26 21:58 --------- d-----w C:\Program Files\World of Warcraft
2008-01-21 23:33 --------- d-----w C:\Documents and Settings\Guest\Application Data\Ventrilo
2008-01-20 19:26 --------- d-----w C:\Documents and Settings\Owner\Application Data\Azureus
2008-01-15 08:27 --------- d-----w C:\Program Files\Opera
2008-01-11 06:27 --------- d-----w C:\Program Files\Steam
2008-01-04 21:59 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2008-01-04 21:58 43,528 ----a-w C:\WINDOWS\system32\drivers\pxhelp20.sys
2008-01-04 21:58 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2008-01-04 21:58 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-01-04 21:58 129,784 ----a-w C:\WINDOWS\system32\pxafs.dll
2008-01-04 21:58 120,056 ----a-w C:\WINDOWS\system32\pxcpyi64.exe
2008-01-04 21:58 118,520 ----a-w C:\WINDOWS\system32\pxinsi64.exe
2008-01-04 21:58 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2008-01-04 21:57 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2008-01-04 21:57 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2008-01-04 21:57 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2008-01-04 21:57 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2008-01-04 21:57 682,496 ----a-w C:\WINDOWS\system32\DivX.dll
2008-01-04 21:57 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2008-01-04 21:57 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2008-01-04 21:57 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2008-01-04 21:57 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2008-01-04 21:57 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2008-01-04 21:57 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2008-01-04 21:57 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2008-01-04 21:56 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-01-04 21:56 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2008-01-04 19:59 --------- d--h--r C:\Documents and Settings\Guest\Application Data\yahoo!
2007-12-28 09:06 --------- d-----w C:\Program Files\Azureus
2007-12-27 09:59 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2007-12-25 02:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft
2007-12-25 01:56 --------- d-----w C:\Program Files\Alwil Software
2007-12-21 04:01 58,904 ----a-w C:\WINDOWS\system32\sysfolderazipcnt.dll
2007-12-21 04:01 58,904 ----a-w C:\WINDOWS\system32\azipcontmn.dll
2007-12-07 01:07 659,456 ----a-w C:\WINDOWS\system32\wininet.dll
2007-12-04 18:38 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr
2007-11-20 09:52 7,292,416 ----a-w C:\Program Files\NETGEAR WG311v3 PCI Adapter.msi
2006-03-15 22:19 212,992 ----a-w C:\WINDOWS\inf\WG311v3\CopyWHQLDriver.exe
2006-01-27 01:55 280,576 ----a-w C:\WINDOWS\inf\WG311v3\WG311v3.sys
2005-10-06 23:17 280,576 ----a-w C:\WINDOWS\inf\WG311v3\WG311v3XP.sys
.
<pre>
----a-w		 3,497,984 2008-02-25 07:30:33  C:\Program Files\Veoh Networks\Veoh\VeohClient .exe
----a-w		   388,608 2008-02-21 20:32:40  C:\WINDOWS\system32\kmd .exe
----a-w		   158,208 2008-02-21 01:48:35  C:\WINDOWS\system32\dllcache\msconfig .exe
</pre>


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [ ]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [2008-02-24 23:54 50528]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CHotkey"="zHotkey.exe" [2005-05-03 13:02 543232 C:\WINDOWS\zHotkey.exe]
"Recguard"="%WINDIR%\SMINST\RECGUARD.EXE" [ ]
"SoundMan"="SOUNDMAN.EXE" [2006-11-17 04:42 577536 C:\WINDOWS\soundman.exe]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2005-04-25 12:45 36040]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk
backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NETGEAR WG311v3 Smart Wizard.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\NETGEAR WG311v3 Smart Wizard.lnk
backup=C:\WINDOWS\pss\NETGEAR WG311v3 Smart Wizard.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
C:\Program Files\AIM6\aim6 .exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!]
--a------ 2007-12-04 05:00 79224 C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
--a------ 2005-08-05 12:56 64512 C:\WINDOWS\ehome\ehtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2006-09-25 13:54 229952 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe]
c:\PROGRA~1\mcafee.com\agent\mcagent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe]
C:\PROGRA~1\mcafee.com\agent\mcupdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSConfig]
C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig .exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2008-02-21 02:36 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-10-18 11:34 5724184 C:\Program Files\Windows Live\Messenger\MsnMsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 10:50 155648 C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Reminder]
%WINDIR%\Creator\Remind_XP.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--------- 2004-11-02 19:24 32768 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
--a------ 2008-02-19 14:00 2441216 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
--a------ 2007-12-01 14:01 1266936 c:\program files\steam\steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-09-25 01:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunKistEM]
--a------ 2004-11-15 14:04 135168 C:\Program Files\Digital Media Reader\shwiconem.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2008-02-17 23:24 526848 C:\Program Files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Veoh]
C:\Program Files\Veoh Networks\Veoh\VeohClient.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zune Launcher]
--a------ 2007-03-14 16:03 24104 C:\Program Files\Zune\ZuneLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\_AntiSpyware]
C:\Program Files\McAfee\McAfee AntiSpyware\MssCli.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"AVG Anti-Spyware Guard"=2 (0x2)
"Viewpoint Manager Service"=2 (0x2)
"avast! Mail Scanner"=3 (0x3)
"avast! Antivirus"=2 (0x2)
"ZuneNetworkSvc"=2 (0x2)
"WMPNetworkSvc"=3 (0x3)
"WLSetupSvc"=3 (0x3)
"WinDefend"=2 (0x2)
"usnjsvc"=3 (0x3)
"rpcapd"=3 (0x3)
"ose"=3 (0x3)
"iPod Service"=3 (0x3)
"idsvc"=3 (0x3)
"gusvc"=2 (0x2)
"avast! Web Scanner"=3 (0x3)
"aswUpdSv"=2 (0x2)
"Adobe LM Service"=3 (0x3)

S3 ASPI;Advanced SCSI Programming Interface Driver;C:\WINDOWS\System32\DRIVERS\ASPI32.sys [2002-07-17 08:05]
S3 BEL;Belkin 11Mbps Wireless LAN Driver;C:\WINDOWS\system32\DRIVERS\BELNDS.sys []
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [2007-01-25 09:31]

.
Contents of the 'Scheduled Tasks' folder
"2008-02-25 20:33:49 C:\WINDOWS\Tasks\ATF-Cleaner.job"
- C:\Documents and Settings\Owner\Desktop\Stuff\Anti Virus and Protectors\ATF-Cleaner.exe
"2008-02-25 10:30:46 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-25 12:39:39
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-25 12:41:14
ComboFix-quarantined-files.txt 2008-02-25 20:41:12
ComboFix2.txt 2008-02-25 08:42:36
ComboFix3.txt 2008-02-22 01:45:15
ComboFix4.txt 2008-02-21 21:06:18
ComboFix5.txt 2008-02-20 23:35:17
.
2008-02-15 07:24:30 --- E O F ---
Ok the other one is next
  • 0

#20
Noitora

Noitora

    Member

  • Topic Starter
  • Member
  • PipPip
  • 45 posts
-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Monday, February 25, 2008 2:59:46 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 25/02/2008
Kaspersky Anti-Virus database records: 580494
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\
E:\
F:\
H:\
I:\
J:\
K:\

Scan Statistics:
Total number of scanned objects: 137896
Number of viruses found: 13
Number of infected objects: 264
Number of suspicious objects: 0
Duration of the scan process: 01:55:37

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\eHome\logs\ehRecvr.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Owner\Application Data\Opera\Opera\mail\indexer\indexer.dat Object is locked skipped
C:\Documents and Settings\Owner\Application Data\Opera\Opera\mail\lexicon\lexicon.dat Object is locked skipped
C:\Documents and Settings\Owner\Application Data\Opera\Opera\mail\mailbase.dat Object is locked skipped
C:\Documents and Settings\Owner\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Owner\Desktop\[4][email protected]/geebb.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\Documents and Settings\Owner\Desktop\[4][email protected] ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\CardSpace\CardSpace.db Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\CardSpace\CardSpace.db.shadow Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Media Player\CurrentDatabase_360.wmdb Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Owner\ntuser.dat Object is locked skipped
C:\Documents and Settings\Owner\ntuser.dat.LOG Object is locked skipped
C:\My Backup -- 07-04-02 0547PM\WINDOWS\system32\VB6STKIT.DLL Object is locked skipped
C:\Program Files\Common Files\Real\Update_OB\realsched.exe Infected: Virus.Win32.Trats.d skipped
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\AIM6\aim6 .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\AIM6\aim6.exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\Veoh Networks\Veoh\VeohClient.exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\Windows Live\Messenger\MsnMsgr .Exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\Windows Live\Messenger\MsnMsgr .Exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\Windows Live\Messenger\MsnMsgr.Exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\WINDOWS\pchealth\helpctr\binaries\MSConfig .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\birukjre.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\bmvudvbn.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\dllcache\msconfig .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\doekppdk.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\gadgoiue.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\geebb.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\geebb.exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\hxdgdfwr.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\kvjnjusr.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\mfojmken.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\nciicxhm.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\oepycktq.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\podagohq.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\RCX1B.tmp.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\RCX4.tmp.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\RCX42.tmp.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\RCX5.tmp.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\sbgndwip.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\tpvqcedp.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\tvnykkvg.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\vtmuwjyy.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\vwrgqtem.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\wnrryxay.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\xbqkekxl.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\xkaeqrqg.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\catchme2008-02-20_140715.18.zip/geebb.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\catchme2008-02-20_140715.18.zip ZIP: infected - 1 skipped
C:\QooBox\Quarantine\catchme2008-02-20_155545.70.zip/geebb.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\catchme2008-02-20_155545.70.zip ZIP: infected - 1 skipped
C:\QooBox\Quarantine\catchme2008-02-21_130018.20.zip/geebb.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\catchme2008-02-21_130018.20.zip ZIP: infected - 1 skipped
C:\RECYCLER\S-1-5-21-1813564023-1912572731-1404579102-1007\Dc1.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP131\A0090407.exe Infected: Trojan-Downloader.Win32.Agent.hvx skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP131\A0090447.exe Infected: Trojan-Downloader.Win32.PurityScan.fn skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP131\A0090456.exe Infected: not-a-virus:AdWare.Win32.Agent.aev skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP131\A0090461.exe Infected: not-a-virus:AdWare.Win32.PurityScan.gs skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP131\A0090468.dll Infected: not-a-virus:AdWare.Win32.ZenoSearch.ad skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP131\A0090469.exe Infected: not-a-virus:AdWare.Win32.Agent.adm skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP131\A0090471.exe/data0001 Infected: not-a-virus:AdWare.Win32.PurityScan.gp skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP131\A0090471.exe NSIS: infected - 1 skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP131\A0090472.exe Infected: Trojan.Win32.Scapur.k skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP132\A0092700.exe/data0001 Infected: not-a-virus:AdWare.Win32.PurityScan.gp skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP132\A0092700.exe NSIS: infected - 1 skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP136\A0093101.exe Infected: Trojan-Downloader.Win32.Agent.hvx skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP139\A0097114.exe Infected: not-a-virus:Downloader.Win32.AdvancedCleaner.c skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP141\A0099357.dll Infected: not-a-virus:FraudTool.Win32.DeusCleaner.b skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP141\A0099358.exe Infected: not-a-virus:FraudTool.Win32.DeusCleaner.b skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP141\A0101336.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP141\A0102347.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP141\A0102349.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP141\A0102350.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP141\A0103356.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP141\A0103357.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP141\A0103358.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP141\A0103359.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP141\A0103384.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP141\A0103385.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP141\A0103392.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP141\A0103394.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP141\A0103412.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP143\A0103573.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP143\A0103574.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP143\A0103580.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP143\A0103581.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP143\A0104566.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP143\A0104570.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP143\A0104572.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP144\A0104581.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP144\A0104582.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP144\A0104586.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP144\A0104588.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP144\A0105584.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP144\A0105586.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP144\A0105594.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP144\A0105596.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP144\A0105608.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP144\A0105610.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP144\A0105624.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP144\A0105625.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP144\A0105629.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP144\A0105631.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP144\A0105643.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP144\A0105645.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP144\A0105691.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0105743.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0105744.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0105745.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0105775.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0106768.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0106770.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0106771.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0106777.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0106782.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0106783.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0106784.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0106785.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0106786.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0106787.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0106788.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0106789.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0106790.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0106791.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0106811.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0106819.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0106824.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0106834.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP146\A0107842.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP146\A0107843.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP146\A0107846.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP146\A0107856.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP146\A0107857.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP146\A0107861.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP146\A0107863.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP146\A0107864.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP146\A0107865.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP146\A0107897.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP146\A0107903.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP146\A0107904.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP146\A0107914.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP146\A0107916.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP146\A0107919.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP146\A0107920.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP147\A0107940.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP147\A0107959.exe Infected: Trojan-Downloader.Win32.Agent.auv skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP147\A0107960.exe Infected: Trojan-Downloader.Win32.Agent.auv skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP147\A0107975.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP147\A0107978.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP147\A0108002.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP147\A0108005.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP147\A0108007.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP147\A0108019.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP147\A0108021.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP147\A0108026.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP147\A0108028.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP147\A0108030.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP147\A0108031.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108043.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108044.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108045.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108046.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108047.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108048.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108049.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108050.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108051.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108052.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108053.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108054.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108055.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108056.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108057.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108058.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108060.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108061.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108062.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108063.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108067.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108073.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108074.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108199.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108200.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0109154.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP149\A0109159.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP149\A0109160.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP149\A0109177.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP149\A0110177.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP149\A0110424.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP149\A0110425.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP150\A0110476.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP150\A0110478.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP150\A0110485.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP150\A0110486.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP150\A0110487.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP150\A0110492.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP151\A0110515.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP151\A0110516.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP151\A0110521.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP151\A0110630.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP152\A0110649.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP152\A0110693.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP153\A0110730.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP153\A0110731.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP153\A0110732.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP153\A0110733.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP153\A0110734.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP154\A0110880.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP156\A0110901.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP156\A0110912.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP156\A0110913.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP156\A0110918.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP157\A0110931.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP157\A0110974.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP157\A0110983.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP157\A0110985.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP158\A0111026.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP158\A0111027.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP158\A0111028.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP158\A0111034.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP159\A0111055.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP159\A0111057.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP159\A0111068.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP159\A0111069.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP159\A0111070.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP159\A0111071.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP159\A0111077.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP161\A0115170.Exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP161\A0115173.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP161\A0115184.Exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP161\A0115186.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP161\A0115187.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP162\A0115229.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP162\A0115230.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP162\A0115231.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP162\A0115232.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP162\A0115235.Exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP162\A0115240.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP163\A0115384.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP164\A0116401.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP164\A0116402.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP164\A0116406.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP164\A0116418.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP164\A0116419.Exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP164\A0116420.Exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP167\change.log Object is locked skipped
C:\VundoFix Backups\aqfvvwfy.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\ctcydkqq.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\frlscxtd.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\gautpxrv.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\geebb.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\geebb.exe.bad Infected: Virus.Win32.Trats.d skipped
C:\VundoFix Backups\ghsdlqgy.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\gqkflxqv.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\ihseygtq.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\jkkhhif.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\kjjmqsfj.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\kmd.exe.bad Infected: Virus.Win32.Trats.d skipped
C:\VundoFix Backups\leiwjhve.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\MSConfig.exe.bad Infected: Virus.Win32.Trats.d skipped
C:\VundoFix Backups\nmjhrsst.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\nwiyxdtu.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\otlcuxnk.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\pgpgopkk.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\qfnwxcba.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\sskqosbc.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\sstqq.exe.bad Infected: Virus.Win32.Trats.d skipped
C:\VundoFix Backups\tpvmewey.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\wlwlyfvd.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\xgiisrax.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\yaaaxfgt.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\ymrlpohi.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\yuyeuutv.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\ModemLog_SoftV92 Data Fax Modem with SmartCP.txt Object is locked skipped
C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe.tmp Infected: Virus.Win32.Trats.d skipped
C:\WINDOWS\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{8819B2E5-2504-4F6E-9C7C-32B19344FC7E}.crmlog Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{01A2EF39-2FCE-47CD-8A9F-117F4E17E210}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Media Ce.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
D:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP167\change.log Object is locked skipped

Scan process completed.
  • 0

#21
Noitora

Noitora

    Member

  • Topic Starter
  • Member
  • PipPip
  • 45 posts
kk theres both :)
  • 0

#22
Noitora

Noitora

    Member

  • Topic Starter
  • Member
  • PipPip
  • 45 posts
ComboFix 08-02-20.2 - 2008-02-25 16:14:22.21 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.471 [GMT -8:00]
Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Owner\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\Program Files\Windows Live\Messenger\MsnMsgr .Exe
C:\WINDOWS\system32\dllcache\msconfig .exe
C:\WINDOWS\system32\kmd .exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\dllcache\msconfig .exe
C:\WINDOWS\system32\kmd .exe

.
((((((((((((((((((((((((( Files Created from 2008-01-26 to 2008-02-26 )))))))))))))))))))))))))))))))
.

2008-02-25 12:47 . 2008-02-25 12:47 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-02-25 12:47 . 2008-02-25 12:47 <DIR> d-------- C:\WINDOWS\LastGood
2008-02-25 12:47 . 2008-02-25 12:47 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-02-21 02:47 . 2008-02-21 02:47 268 --ah----- C:\sqmdata03.sqm
2008-02-21 02:47 . 2008-02-21 02:47 244 --ah----- C:\sqmnoopt03.sqm
2008-02-20 01:15 . 2008-02-20 01:15 36,734 --a------ C:\WINDOWS\system32\OggDSuninst.exe
2008-02-20 01:10 . 2008-02-20 01:10 <DIR> d-------- C:\Program Files\RadLight Company
2008-02-20 01:10 . 2008-02-20 01:10 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\RadLight Company
2008-02-19 16:56 . 2008-02-20 18:17 <DIR> d-------- C:\VundoFix Backups
2008-02-19 00:50 . 2008-02-19 00:50 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-02-19 00:50 . 2008-02-19 00:50 1,409 --a------ C:\WINDOWS\QTFont.for
2008-02-16 22:52 . 2008-02-17 23:54 202 --a------ C:\WINDOWS\wininit.ini
2008-02-16 22:30 . 2008-02-20 15:46 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-02-16 22:30 . 2008-02-16 22:46 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-16 22:20 . 2008-02-16 22:20 6,029,648 --a------ C:\Program Files\Firefox Setup 2.0.0.12.exe
2008-02-15 00:01 . 2008-02-24 23:32 157,383 --a------ C:\WINDOWS\BM2fdf5f1a.xml
2008-02-15 00:01 . 2008-02-25 00:02 21 --a------ C:\WINDOWS\pskt.ini
2008-02-14 22:27 . 2008-02-14 22:27 <DIR> d-------- C:\WINDOWS\cache
2008-02-14 21:15 . 2008-02-14 23:06 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Google Updater
2008-02-13 11:08 . 2008-02-13 11:08 22 --a------ C:\WINDOWS\system32\ati64hlp.stb
2008-02-11 16:35 . 2008-02-25 12:33 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
2008-02-10 19:25 . 2008-02-10 19:25 <DIR> d-------- C:\Program Files\Trend Micro
2008-02-08 00:11 . 2008-02-08 03:04 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\Azureus
2008-02-06 14:07 . 2008-02-06 14:07 <DIR> d---s---- C:\Documents and Settings\Hossea\UserData
2008-02-02 21:57 . 2008-02-14 22:27 <DIR> dr-h----- C:\Documents and Settings\Hossea\Application Data\yahoo!
2008-02-02 19:47 . 2008-02-02 19:48 <DIR> d-------- C:\Documents and Settings\Hossea\Shared
2008-02-02 19:47 . 2008-02-02 19:49 <DIR> d-------- C:\Documents and Settings\Hossea\Incomplete
2008-02-02 19:47 . 2008-02-18 23:59 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\LimeWire
2008-02-02 19:45 . 2007-04-12 06:52 <DIR> d-------- C:\Documents and Settings\Hossea\WINDOWS
2008-02-02 19:45 . 2007-04-12 07:40 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\You've Got Pictures Screensaver
2008-02-02 19:45 . 2007-04-12 07:39 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\SampleView
2008-02-02 19:45 . 2007-04-12 07:43 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\McAfee
2008-02-02 19:45 . 2007-04-13 23:11 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\AOL
2008-01-28 17:08 . 2008-01-28 17:08 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\acccore
2008-01-28 17:05 . 2008-02-25 12:36 <DIR> d-------- C:\Program Files\AIM6
2008-01-27 15:56 . 2008-01-27 15:56 <DIR> d--h----- C:\WINDOWS\PIF

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-25 11:02 --------- d-----w C:\Program Files\Warcraft III
2008-02-25 10:08 --------- d-----w C:\Program Files\Windows Live
2008-02-25 10:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-02-20 23:46 --------- d-----w C:\Program Files\Windows Defender
2008-02-20 09:08 --------- d-----w C:\Program Files\DivX
2008-02-15 10:44 --------- d-----w C:\Program Files\Google
2008-02-15 07:21 --------- d--h--r C:\Documents and Settings\Owner\Application Data\yahoo!
2008-02-15 07:05 497,152 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe.tmp
2008-02-15 06:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-02-15 05:22 --------- d-----w C:\Program Files\WC3Banlist
2008-02-08 20:23 --------- d-----w C:\Program Files\QuickTime
2008-02-04 21:52 --------- d-----w C:\Program Files\LimeWire
2008-01-31 18:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-01-30 23:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\yahoo!
2008-01-29 01:06 --------- d-----w C:\Program Files\Common Files\AOL
2008-01-29 01:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL
2008-01-26 21:58 --------- d-----w C:\Program Files\World of Warcraft
2008-01-21 23:33 --------- d-----w C:\Documents and Settings\Guest\Application Data\Ventrilo
2008-01-20 19:26 --------- d-----w C:\Documents and Settings\Owner\Application Data\Azureus
2008-01-15 08:27 --------- d-----w C:\Program Files\Opera
2008-01-11 06:27 --------- d-----w C:\Program Files\Steam
2008-01-04 21:59 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2008-01-04 21:58 43,528 ----a-w C:\WINDOWS\system32\drivers\pxhelp20.sys
2008-01-04 21:58 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2008-01-04 21:58 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-01-04 21:58 129,784 ----a-w C:\WINDOWS\system32\pxafs.dll
2008-01-04 21:58 120,056 ----a-w C:\WINDOWS\system32\pxcpyi64.exe
2008-01-04 21:58 118,520 ----a-w C:\WINDOWS\system32\pxinsi64.exe
2008-01-04 21:58 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2008-01-04 21:57 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2008-01-04 21:57 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2008-01-04 21:57 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2008-01-04 21:57 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2008-01-04 21:57 682,496 ----a-w C:\WINDOWS\system32\DivX.dll
2008-01-04 21:57 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2008-01-04 21:57 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2008-01-04 21:57 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2008-01-04 21:57 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2008-01-04 21:57 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2008-01-04 21:57 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2008-01-04 21:57 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2008-01-04 21:56 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-01-04 21:56 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2008-01-04 19:59 --------- d--h--r C:\Documents and Settings\Guest\Application Data\yahoo!
2007-12-28 09:06 --------- d-----w C:\Program Files\Azureus
2007-12-27 09:59 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2007-12-21 04:01 58,904 ----a-w C:\WINDOWS\system32\sysfolderazipcnt.dll
2007-12-21 04:01 58,904 ----a-w C:\WINDOWS\system32\azipcontmn.dll
2007-12-07 01:07 659,456 ----a-w C:\WINDOWS\system32\wininet.dll
2007-12-04 18:38 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr
2007-11-20 09:52 7,292,416 ----a-w C:\Program Files\NETGEAR WG311v3 PCI Adapter.msi
2006-03-15 22:19 212,992 ----a-w C:\WINDOWS\inf\WG311v3\CopyWHQLDriver.exe
2006-01-27 01:55 280,576 ----a-w C:\WINDOWS\inf\WG311v3\WG311v3.sys
2005-10-06 23:17 280,576 ----a-w C:\WINDOWS\inf\WG311v3\WG311v3XP.sys
.
<pre>
----a-w		 3,497,984 2008-02-25 07:30:33  C:\Program Files\Veoh Networks\Veoh\VeohClient .exe
</pre>


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [ ]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [2008-02-24 23:54 50528]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CHotkey"="zHotkey.exe" [2005-05-03 13:02 543232 C:\WINDOWS\zHotkey.exe]
"Recguard"="%WINDIR%\SMINST\RECGUARD.EXE" [ ]
"SoundMan"="SOUNDMAN.EXE" [2006-11-17 04:42 577536 C:\WINDOWS\soundman.exe]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2005-04-25 12:45 36040]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk
backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NETGEAR WG311v3 Smart Wizard.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\NETGEAR WG311v3 Smart Wizard.lnk
backup=C:\WINDOWS\pss\NETGEAR WG311v3 Smart Wizard.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
C:\Program Files\AIM6\aim6 .exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!]
--a------ 2007-12-04 05:00 79224 C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
--a------ 2005-08-05 12:56 64512 C:\WINDOWS\ehome\ehtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2006-09-25 13:54 229952 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe]
c:\PROGRA~1\mcafee.com\agent\mcagent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe]
C:\PROGRA~1\mcafee.com\agent\mcupdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSConfig]
C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig .exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2008-02-21 02:36 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-10-18 11:34 5724184 C:\Program Files\Windows Live\Messenger\MsnMsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 10:50 155648 C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Reminder]
%WINDIR%\Creator\Remind_XP.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--------- 2004-11-02 19:24 32768 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
--a------ 2008-02-19 14:00 2441216 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
--a------ 2007-12-01 14:01 1266936 c:\program files\steam\steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-09-25 01:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunKistEM]
--a------ 2004-11-15 14:04 135168 C:\Program Files\Digital Media Reader\shwiconem.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2008-02-17 23:24 526848 C:\Program Files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Veoh]
C:\Program Files\Veoh Networks\Veoh\VeohClient.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zune Launcher]
--a------ 2007-03-14 16:03 24104 C:\Program Files\Zune\ZuneLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\_AntiSpyware]
C:\Program Files\McAfee\McAfee AntiSpyware\MssCli.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"AVG Anti-Spyware Guard"=2 (0x2)
"Viewpoint Manager Service"=2 (0x2)
"avast! Mail Scanner"=3 (0x3)
"avast! Antivirus"=2 (0x2)
"ZuneNetworkSvc"=2 (0x2)
"WMPNetworkSvc"=3 (0x3)
"WLSetupSvc"=3 (0x3)
"WinDefend"=2 (0x2)
"usnjsvc"=3 (0x3)
"rpcapd"=3 (0x3)
"ose"=3 (0x3)
"iPod Service"=3 (0x3)
"idsvc"=3 (0x3)
"gusvc"=2 (0x2)
"avast! Web Scanner"=3 (0x3)
"aswUpdSv"=2 (0x2)
"Adobe LM Service"=3 (0x3)

S3 ASPI;Advanced SCSI Programming Interface Driver;C:\WINDOWS\System32\DRIVERS\ASPI32.sys [2002-07-17 08:05]
S3 BEL;Belkin 11Mbps Wireless LAN Driver;C:\WINDOWS\system32\DRIVERS\BELNDS.sys []
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [2007-01-25 09:31]

.
Contents of the 'Scheduled Tasks' folder
"2008-02-25 20:33:49 C:\WINDOWS\Tasks\ATF-Cleaner.job"
- C:\Documents and Settings\Owner\Desktop\Stuff\Anti Virus and Protectors\ATF-Cleaner.exe
"2008-02-25 10:30:46 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-25 16:16:57
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-25 16:18:27
ComboFix-quarantined-files.txt 2008-02-26 00:18:19
ComboFix2.txt 2008-02-25 20:41:15
ComboFix3.txt 2008-02-25 08:42:36
ComboFix4.txt 2008-02-22 01:45:15
ComboFix5.txt 2008-02-21 21:06:18
.
2008-02-15 07:24:30 --- E O F ---
  • 0

#23
Rorschach112

Rorschach112

    Ralphie

  • Retired Staff
  • 47,710 posts
Hello


1. Close any open browsers.

2. Open notepad and copy/paste the text in the quotebox below into it:

KillAll::

File::
C:\Program Files\Common Files\Real\Update_OB\realsched.exe 
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe.tmp
C:\Program Files\Veoh Networks\Veoh\VeohClient .exe
C:\WINDOWS\system32\kmd .exe
C:\WINDOWS\system32\dllcache\msconfig .exe

Folder::
C:\Documents and Settings\Owner\Desktop\[4][email protected]

RenV::
----a-w		 3,497,984 2008-02-25 07:30:33  C:\Program Files\Veoh Networks\Veoh\VeohClient .exe
----a-w		   388,608 2008-02-21 20:32:40  C:\WINDOWS\system32\kmd .exe
----a-w		   158,208 2008-02-21 01:48:35  C:\WINDOWS\system32\dllcache\msconfig .exe

Save this as CFScript.txt, in the same location as ComboFix.exe


Posted Image

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at "C:\ComboFix.txt"

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Edited by Rorschach112, 25 February 2008 - 06:36 PM.

  • 0

#24
Noitora

Noitora

    Member

  • Topic Starter
  • Member
  • PipPip
  • 45 posts
ComboFix 08-02-20.2 - 2008-02-25 16:14:22.21 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.471 [GMT -8:00]
Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Owner\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\Program Files\Windows Live\Messenger\MsnMsgr .Exe
C:\WINDOWS\system32\dllcache\msconfig .exe
C:\WINDOWS\system32\kmd .exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\dllcache\msconfig .exe
C:\WINDOWS\system32\kmd .exe

.
((((((((((((((((((((((((( Files Created from 2008-01-26 to 2008-02-26 )))))))))))))))))))))))))))))))
.

2008-02-25 12:47 . 2008-02-25 12:47 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-02-25 12:47 . 2008-02-25 12:47 <DIR> d-------- C:\WINDOWS\LastGood
2008-02-25 12:47 . 2008-02-25 12:47 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-02-21 02:47 . 2008-02-21 02:47 268 --ah----- C:\sqmdata03.sqm
2008-02-21 02:47 . 2008-02-21 02:47 244 --ah----- C:\sqmnoopt03.sqm
2008-02-20 01:15 . 2008-02-20 01:15 36,734 --a------ C:\WINDOWS\system32\OggDSuninst.exe
2008-02-20 01:10 . 2008-02-20 01:10 <DIR> d-------- C:\Program Files\RadLight Company
2008-02-20 01:10 . 2008-02-20 01:10 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\RadLight Company
2008-02-19 16:56 . 2008-02-20 18:17 <DIR> d-------- C:\VundoFix Backups
2008-02-19 00:50 . 2008-02-19 00:50 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-02-19 00:50 . 2008-02-19 00:50 1,409 --a------ C:\WINDOWS\QTFont.for
2008-02-16 22:52 . 2008-02-17 23:54 202 --a------ C:\WINDOWS\wininit.ini
2008-02-16 22:30 . 2008-02-20 15:46 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-02-16 22:30 . 2008-02-16 22:46 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-16 22:20 . 2008-02-16 22:20 6,029,648 --a------ C:\Program Files\Firefox Setup 2.0.0.12.exe
2008-02-15 00:01 . 2008-02-24 23:32 157,383 --a------ C:\WINDOWS\BM2fdf5f1a.xml
2008-02-15 00:01 . 2008-02-25 00:02 21 --a------ C:\WINDOWS\pskt.ini
2008-02-14 22:27 . 2008-02-14 22:27 <DIR> d-------- C:\WINDOWS\cache
2008-02-14 21:15 . 2008-02-14 23:06 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Google Updater
2008-02-13 11:08 . 2008-02-13 11:08 22 --a------ C:\WINDOWS\system32\ati64hlp.stb
2008-02-11 16:35 . 2008-02-25 12:33 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
2008-02-10 19:25 . 2008-02-10 19:25 <DIR> d-------- C:\Program Files\Trend Micro
2008-02-08 00:11 . 2008-02-08 03:04 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\Azureus
2008-02-06 14:07 . 2008-02-06 14:07 <DIR> d---s---- C:\Documents and Settings\Hossea\UserData
2008-02-02 21:57 . 2008-02-14 22:27 <DIR> dr-h----- C:\Documents and Settings\Hossea\Application Data\yahoo!
2008-02-02 19:47 . 2008-02-02 19:48 <DIR> d-------- C:\Documents and Settings\Hossea\Shared
2008-02-02 19:47 . 2008-02-02 19:49 <DIR> d-------- C:\Documents and Settings\Hossea\Incomplete
2008-02-02 19:47 . 2008-02-18 23:59 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\LimeWire
2008-02-02 19:45 . 2007-04-12 06:52 <DIR> d-------- C:\Documents and Settings\Hossea\WINDOWS
2008-02-02 19:45 . 2007-04-12 07:40 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\You've Got Pictures Screensaver
2008-02-02 19:45 . 2007-04-12 07:39 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\SampleView
2008-02-02 19:45 . 2007-04-12 07:43 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\McAfee
2008-02-02 19:45 . 2007-04-13 23:11 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\AOL
2008-01-28 17:08 . 2008-01-28 17:08 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\acccore
2008-01-28 17:05 . 2008-02-25 12:36 <DIR> d-------- C:\Program Files\AIM6
2008-01-27 15:56 . 2008-01-27 15:56 <DIR> d--h----- C:\WINDOWS\PIF

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-25 11:02 --------- d-----w C:\Program Files\Warcraft III
2008-02-25 10:08 --------- d-----w C:\Program Files\Windows Live
2008-02-25 10:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-02-20 23:46 --------- d-----w C:\Program Files\Windows Defender
2008-02-20 09:08 --------- d-----w C:\Program Files\DivX
2008-02-15 10:44 --------- d-----w C:\Program Files\Google
2008-02-15 07:21 --------- d--h--r C:\Documents and Settings\Owner\Application Data\yahoo!
2008-02-15 07:05 497,152 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe.tmp
2008-02-15 06:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-02-15 05:22 --------- d-----w C:\Program Files\WC3Banlist
2008-02-08 20:23 --------- d-----w C:\Program Files\QuickTime
2008-02-04 21:52 --------- d-----w C:\Program Files\LimeWire
2008-01-31 18:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-01-30 23:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\yahoo!
2008-01-29 01:06 --------- d-----w C:\Program Files\Common Files\AOL
2008-01-29 01:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL
2008-01-26 21:58 --------- d-----w C:\Program Files\World of Warcraft
2008-01-21 23:33 --------- d-----w C:\Documents and Settings\Guest\Application Data\Ventrilo
2008-01-20 19:26 --------- d-----w C:\Documents and Settings\Owner\Application Data\Azureus
2008-01-15 08:27 --------- d-----w C:\Program Files\Opera
2008-01-11 06:27 --------- d-----w C:\Program Files\Steam
2008-01-04 21:59 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2008-01-04 21:58 43,528 ----a-w C:\WINDOWS\system32\drivers\pxhelp20.sys
2008-01-04 21:58 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2008-01-04 21:58 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-01-04 21:58 129,784 ----a-w C:\WINDOWS\system32\pxafs.dll
2008-01-04 21:58 120,056 ----a-w C:\WINDOWS\system32\pxcpyi64.exe
2008-01-04 21:58 118,520 ----a-w C:\WINDOWS\system32\pxinsi64.exe
2008-01-04 21:58 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2008-01-04 21:57 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2008-01-04 21:57 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2008-01-04 21:57 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2008-01-04 21:57 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2008-01-04 21:57 682,496 ----a-w C:\WINDOWS\system32\DivX.dll
2008-01-04 21:57 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2008-01-04 21:57 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2008-01-04 21:57 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2008-01-04 21:57 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2008-01-04 21:57 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2008-01-04 21:57 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2008-01-04 21:57 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2008-01-04 21:56 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-01-04 21:56 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2008-01-04 19:59 --------- d--h--r C:\Documents and Settings\Guest\Application Data\yahoo!
2007-12-28 09:06 --------- d-----w C:\Program Files\Azureus
2007-12-27 09:59 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2007-12-21 04:01 58,904 ----a-w C:\WINDOWS\system32\sysfolderazipcnt.dll
2007-12-21 04:01 58,904 ----a-w C:\WINDOWS\system32\azipcontmn.dll
2007-12-07 01:07 659,456 ----a-w C:\WINDOWS\system32\wininet.dll
2007-12-04 18:38 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr
2007-11-20 09:52 7,292,416 ----a-w C:\Program Files\NETGEAR WG311v3 PCI Adapter.msi
2006-03-15 22:19 212,992 ----a-w C:\WINDOWS\inf\WG311v3\CopyWHQLDriver.exe
2006-01-27 01:55 280,576 ----a-w C:\WINDOWS\inf\WG311v3\WG311v3.sys
2005-10-06 23:17 280,576 ----a-w C:\WINDOWS\inf\WG311v3\WG311v3XP.sys
.
<pre>
----a-w		 3,497,984 2008-02-25 07:30:33  C:\Program Files\Veoh Networks\Veoh\VeohClient .exe
</pre>


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [ ]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [2008-02-24 23:54 50528]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CHotkey"="zHotkey.exe" [2005-05-03 13:02 543232 C:\WINDOWS\zHotkey.exe]
"Recguard"="%WINDIR%\SMINST\RECGUARD.EXE" [ ]
"SoundMan"="SOUNDMAN.EXE" [2006-11-17 04:42 577536 C:\WINDOWS\soundman.exe]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2005-04-25 12:45 36040]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk
backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NETGEAR WG311v3 Smart Wizard.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\NETGEAR WG311v3 Smart Wizard.lnk
backup=C:\WINDOWS\pss\NETGEAR WG311v3 Smart Wizard.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
C:\Program Files\AIM6\aim6 .exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!]
--a------ 2007-12-04 05:00 79224 C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
--a------ 2005-08-05 12:56 64512 C:\WINDOWS\ehome\ehtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2006-09-25 13:54 229952 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe]
c:\PROGRA~1\mcafee.com\agent\mcagent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe]
C:\PROGRA~1\mcafee.com\agent\mcupdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSConfig]
C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig .exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2008-02-21 02:36 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-10-18 11:34 5724184 C:\Program Files\Windows Live\Messenger\MsnMsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 10:50 155648 C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Reminder]
%WINDIR%\Creator\Remind_XP.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--------- 2004-11-02 19:24 32768 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
--a------ 2008-02-19 14:00 2441216 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
--a------ 2007-12-01 14:01 1266936 c:\program files\steam\steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-09-25 01:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunKistEM]
--a------ 2004-11-15 14:04 135168 C:\Program Files\Digital Media Reader\shwiconem.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2008-02-17 23:24 526848 C:\Program Files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Veoh]
C:\Program Files\Veoh Networks\Veoh\VeohClient.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zune Launcher]
--a------ 2007-03-14 16:03 24104 C:\Program Files\Zune\ZuneLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\_AntiSpyware]
C:\Program Files\McAfee\McAfee AntiSpyware\MssCli.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"AVG Anti-Spyware Guard"=2 (0x2)
"Viewpoint Manager Service"=2 (0x2)
"avast! Mail Scanner"=3 (0x3)
"avast! Antivirus"=2 (0x2)
"ZuneNetworkSvc"=2 (0x2)
"WMPNetworkSvc"=3 (0x3)
"WLSetupSvc"=3 (0x3)
"WinDefend"=2 (0x2)
"usnjsvc"=3 (0x3)
"rpcapd"=3 (0x3)
"ose"=3 (0x3)
"iPod Service"=3 (0x3)
"idsvc"=3 (0x3)
"gusvc"=2 (0x2)
"avast! Web Scanner"=3 (0x3)
"aswUpdSv"=2 (0x2)
"Adobe LM Service"=3 (0x3)

S3 ASPI;Advanced SCSI Programming Interface Driver;C:\WINDOWS\System32\DRIVERS\ASPI32.sys [2002-07-17 08:05]
S3 BEL;Belkin 11Mbps Wireless LAN Driver;C:\WINDOWS\system32\DRIVERS\BELNDS.sys []
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [2007-01-25 09:31]

.
Contents of the 'Scheduled Tasks' folder
"2008-02-25 20:33:49 C:\WINDOWS\Tasks\ATF-Cleaner.job"
- C:\Documents and Settings\Owner\Desktop\Stuff\Anti Virus and Protectors\ATF-Cleaner.exe
"2008-02-25 10:30:46 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-25 16:16:57
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-25 16:18:27
ComboFix-quarantined-files.txt 2008-02-26 00:18:19
ComboFix2.txt 2008-02-25 20:41:15
ComboFix3.txt 2008-02-25 08:42:36
ComboFix4.txt 2008-02-22 01:45:15
ComboFix5.txt 2008-02-21 21:06:18
.
2008-02-15 07:24:30 --- E O F ---
  • 0

#25
Rorschach112

Rorschach112

    Ralphie

  • Retired Staff
  • 47,710 posts
One thing is refusing to go

1. Close any open browsers.

2. Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\Program Files\Veoh Networks\Veoh\VeohClient .exe

RenV::
----a-w		 3,497,984 2008-02-25 07:30:33  C:\Program Files\Veoh Networks\Veoh\VeohClient .exe

Save this as CFScript.txt, in the same location as ComboFix.exe


Posted Image

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at "C:\ComboFix.txt"

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Edited by Rorschach112, 25 February 2008 - 08:02 PM.

  • 0

Advertisements


#26
Noitora

Noitora

    Member

  • Topic Starter
  • Member
  • PipPip
  • 45 posts
Veoh is my video client lol
  • 0

#27
Rorschach112

Rorschach112

    Ralphie

  • Retired Staff
  • 47,710 posts
Were you taking that out of the fix all this time ?

The above Veoh file is a Vundo file infecter, it is not your legitimate file. We need to remove it or we can't fix your PC

So please go ahead and follow my above instructions
  • 0

#28
Noitora

Noitora

    Member

  • Topic Starter
  • Member
  • PipPip
  • 45 posts
Nah I wasnt, just saying. but I did follow the directions, here is the log
ComboFix 08-02-20.2 - Owner 2008-02-25 18:15:46.22 - NTFSx86
Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Owner\Desktop\CFScript.txt

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\Program Files\Veoh Networks\Veoh\VeohClient .exe
.

((((((((((((((((((((((((( Files Created from 2008-01-26 to 2008-02-26 )))))))))))))))))))))))))))))))
.

2008-02-25 12:47 . 2008-02-25 12:47 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-02-25 12:47 . 2008-02-25 12:47 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-02-21 02:47 . 2008-02-21 02:47 268 --ah----- C:\sqmdata03.sqm
2008-02-21 02:47 . 2008-02-21 02:47 244 --ah----- C:\sqmnoopt03.sqm
2008-02-20 01:15 . 2008-02-20 01:15 36,734 --a------ C:\WINDOWS\system32\OggDSuninst.exe
2008-02-20 01:10 . 2008-02-20 01:10 <DIR> d-------- C:\Program Files\RadLight Company
2008-02-20 01:10 . 2008-02-20 01:10 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\RadLight Company
2008-02-19 16:56 . 2008-02-20 18:17 <DIR> d-------- C:\VundoFix Backups
2008-02-19 00:50 . 2008-02-19 00:50 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-02-19 00:50 . 2008-02-19 00:50 1,409 --a------ C:\WINDOWS\QTFont.for
2008-02-16 22:52 . 2008-02-17 23:54 202 --a------ C:\WINDOWS\wininit.ini
2008-02-16 22:30 . 2008-02-20 15:46 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-02-16 22:30 . 2008-02-16 22:46 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-16 22:20 . 2008-02-16 22:20 6,029,648 --a------ C:\Program Files\Firefox Setup 2.0.0.12.exe
2008-02-15 00:01 . 2008-02-24 23:32 157,383 --a------ C:\WINDOWS\BM2fdf5f1a.xml
2008-02-15 00:01 . 2008-02-25 00:02 21 --a------ C:\WINDOWS\pskt.ini
2008-02-14 22:27 . 2008-02-14 22:27 <DIR> d-------- C:\WINDOWS\cache
2008-02-14 21:15 . 2008-02-14 23:06 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Google Updater
2008-02-13 11:08 . 2008-02-13 11:08 22 --a------ C:\WINDOWS\system32\ati64hlp.stb
2008-02-11 16:35 . 2008-02-25 12:33 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
2008-02-10 19:25 . 2008-02-10 19:25 <DIR> d-------- C:\Program Files\Trend Micro
2008-02-08 00:11 . 2008-02-08 03:04 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\Azureus
2008-02-06 14:07 . 2008-02-06 14:07 <DIR> d---s---- C:\Documents and Settings\Hossea\UserData
2008-02-02 21:57 . 2008-02-14 22:27 <DIR> dr-h----- C:\Documents and Settings\Hossea\Application Data\yahoo!
2008-02-02 19:47 . 2008-02-02 19:48 <DIR> d-------- C:\Documents and Settings\Hossea\Shared
2008-02-02 19:47 . 2008-02-02 19:49 <DIR> d-------- C:\Documents and Settings\Hossea\Incomplete
2008-02-02 19:47 . 2008-02-18 23:59 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\LimeWire
2008-02-02 19:45 . 2007-04-12 06:52 <DIR> d-------- C:\Documents and Settings\Hossea\WINDOWS
2008-02-02 19:45 . 2007-04-12 07:40 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\You've Got Pictures Screensaver
2008-02-02 19:45 . 2007-04-12 07:39 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\SampleView
2008-02-02 19:45 . 2007-04-12 07:43 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\McAfee
2008-02-02 19:45 . 2007-04-13 23:11 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\AOL
2008-01-28 17:08 . 2008-01-28 17:08 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\acccore
2008-01-28 17:05 . 2008-02-25 12:36 <DIR> d-------- C:\Program Files\AIM6
2008-01-27 15:56 . 2008-01-27 15:56 <DIR> d--h----- C:\WINDOWS\PIF

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-25 11:02 --------- d-----w C:\Program Files\Warcraft III
2008-02-25 10:08 --------- d-----w C:\Program Files\Windows Live
2008-02-25 10:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-02-20 23:46 --------- d-----w C:\Program Files\Windows Defender
2008-02-20 09:08 --------- d-----w C:\Program Files\DivX
2008-02-15 10:44 --------- d-----w C:\Program Files\Google
2008-02-15 07:21 --------- d--h--r C:\Documents and Settings\Owner\Application Data\yahoo!
2008-02-15 07:05 497,152 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe.tmp
2008-02-15 06:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-02-15 05:22 --------- d-----w C:\Program Files\WC3Banlist
2008-02-08 20:23 --------- d-----w C:\Program Files\QuickTime
2008-02-04 21:52 --------- d-----w C:\Program Files\LimeWire
2008-01-31 18:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-01-30 23:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\yahoo!
2008-01-29 01:06 --------- d-----w C:\Program Files\Common Files\AOL
2008-01-29 01:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL
2008-01-26 21:58 --------- d-----w C:\Program Files\World of Warcraft
2008-01-21 23:33 --------- d-----w C:\Documents and Settings\Guest\Application Data\Ventrilo
2008-01-20 19:26 --------- d-----w C:\Documents and Settings\Owner\Application Data\Azureus
2008-01-15 08:27 --------- d-----w C:\Program Files\Opera
2008-01-11 06:27 --------- d-----w C:\Program Files\Steam
2008-01-04 21:59 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2008-01-04 21:58 43,528 ----a-w C:\WINDOWS\system32\drivers\pxhelp20.sys
2008-01-04 21:58 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2008-01-04 21:58 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-01-04 21:58 129,784 ----a-w C:\WINDOWS\system32\pxafs.dll
2008-01-04 21:58 120,056 ----a-w C:\WINDOWS\system32\pxcpyi64.exe
2008-01-04 21:58 118,520 ----a-w C:\WINDOWS\system32\pxinsi64.exe
2008-01-04 21:58 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2008-01-04 21:57 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2008-01-04 21:57 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2008-01-04 21:57 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2008-01-04 21:57 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2008-01-04 21:57 682,496 ----a-w C:\WINDOWS\system32\DivX.dll
2008-01-04 21:57 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2008-01-04 21:57 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2008-01-04 21:57 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2008-01-04 21:57 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2008-01-04 21:57 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2008-01-04 21:57 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2008-01-04 21:57 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2008-01-04 21:56 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-01-04 21:56 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2008-01-04 19:59 --------- d--h--r C:\Documents and Settings\Guest\Application Data\yahoo!
2007-12-28 09:06 --------- d-----w C:\Program Files\Azureus
2007-12-27 09:59 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2007-12-21 04:01 58,904 ----a-w C:\WINDOWS\system32\sysfolderazipcnt.dll
2007-12-21 04:01 58,904 ----a-w C:\WINDOWS\system32\azipcontmn.dll
2007-12-07 01:07 659,456 ----a-w C:\WINDOWS\system32\wininet.dll
2007-12-04 18:38 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr
2007-11-20 09:52 7,292,416 ----a-w C:\Program Files\NETGEAR WG311v3 PCI Adapter.msi
2006-03-15 22:19 212,992 ----a-w C:\WINDOWS\inf\WG311v3\CopyWHQLDriver.exe
2006-01-27 01:55 280,576 ----a-w C:\WINDOWS\inf\WG311v3\WG311v3.sys
2005-10-06 23:17 280,576 ----a-w C:\WINDOWS\inf\WG311v3\WG311v3XP.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [ ]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [2008-02-24 23:54 50528]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CHotkey"="zHotkey.exe" [2005-05-03 13:02 543232 C:\WINDOWS\zHotkey.exe]
"Recguard"="%WINDIR%\SMINST\RECGUARD.EXE" [ ]
"SoundMan"="SOUNDMAN.EXE" [2006-11-17 04:42 577536 C:\WINDOWS\soundman.exe]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2005-04-25 12:45 36040]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk
backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NETGEAR WG311v3 Smart Wizard.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\NETGEAR WG311v3 Smart Wizard.lnk
backup=C:\WINDOWS\pss\NETGEAR WG311v3 Smart Wizard.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
C:\Program Files\AIM6\aim6 .exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!]
--a------ 2007-12-04 05:00 79224 C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
--a------ 2005-08-05 12:56 64512 C:\WINDOWS\ehome\ehtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2006-09-25 13:54 229952 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe]
c:\PROGRA~1\mcafee.com\agent\mcagent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe]
C:\PROGRA~1\mcafee.com\agent\mcupdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSConfig]
C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig .exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2008-02-21 02:36 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-10-18 11:34 5724184 C:\Program Files\Windows Live\Messenger\MsnMsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 10:50 155648 C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Reminder]
%WINDIR%\Creator\Remind_XP.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--------- 2004-11-02 19:24 32768 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
--a------ 2008-02-19 14:00 2441216 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
--a------ 2007-12-01 14:01 1266936 c:\program files\steam\steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-09-25 01:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunKistEM]
--a------ 2004-11-15 14:04 135168 C:\Program Files\Digital Media Reader\shwiconem.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2008-02-17 23:24 526848 C:\Program Files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Veoh]
--a------ 2008-02-24 23:30 3497984 C:\Program Files\Veoh Networks\Veoh\VeohClient.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zune Launcher]
--a------ 2007-03-14 16:03 24104 C:\Program Files\Zune\ZuneLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\_AntiSpyware]
C:\Program Files\McAfee\McAfee AntiSpyware\MssCli.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"AVG Anti-Spyware Guard"=2 (0x2)
"Viewpoint Manager Service"=2 (0x2)
"avast! Mail Scanner"=3 (0x3)
"avast! Antivirus"=2 (0x2)
"ZuneNetworkSvc"=2 (0x2)
"WMPNetworkSvc"=3 (0x3)
"WLSetupSvc"=3 (0x3)
"WinDefend"=2 (0x2)
"usnjsvc"=3 (0x3)
"rpcapd"=3 (0x3)
"ose"=3 (0x3)
"iPod Service"=3 (0x3)
"idsvc"=3 (0x3)
"gusvc"=2 (0x2)
"avast! Web Scanner"=3 (0x3)
"aswUpdSv"=2 (0x2)
"Adobe LM Service"=3 (0x3)

S3 ASPI;Advanced SCSI Programming Interface Driver;C:\WINDOWS\System32\DRIVERS\ASPI32.sys [2002-07-17 08:05]
S3 BEL;Belkin 11Mbps Wireless LAN Driver;C:\WINDOWS\system32\DRIVERS\BELNDS.sys []
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [2007-01-25 09:31]

.
Contents of the 'Scheduled Tasks' folder
"2008-02-26 02:00:12 C:\WINDOWS\Tasks\ATF-Cleaner.job"
- C:\Documents and Settings\Owner\Desktop\Stuff\Anti Virus and Protectors\ATF-Cleaner.exe
"2008-02-25 10:30:46 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-25 18:27:28
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\Explorer.exe [6.00.2900.2180]
-> C:\WINDOWS\HKNTDLL.dll
.
Completion time: 2008-02-25 18:29:01
ComboFix-quarantined-files.txt 2008-02-26 02:28:52
ComboFix2.txt 2008-02-26 00:18:27
ComboFix3.txt 2008-02-25 20:41:15
ComboFix4.txt 2008-02-25 08:42:36
ComboFix5.txt 2008-02-22 01:45:15
.
2008-02-15 07:24:30 --- E O F ---
  • 0

#29
Rorschach112

Rorschach112

    Ralphie

  • Retired Staff
  • 47,710 posts
That has done the job

Can you post a new HijackThis log and tell me how your PC is running
  • 0

#30
Noitora

Noitora

    Member

  • Topic Starter
  • Member
  • PipPip
  • 45 posts
Ok here is the Result:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:39:30 PM, on 2/25/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\zHotkey.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Opera\Opera.exe
C:\Program Files\Ventrilo\Ventrilo.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [CHotkey] zHotkey.exe
O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky...can_unicode.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS

--
End of file - 4039 bytes

Its running fine now, just still wondering where I encountered that geebb.exe

Edited by Noitora, 25 February 2008 - 08:41 PM.

  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP