Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Version of Spyaxe infecting my PC (No cleaners working) [CLOSED]

Started by Mswei , Mar 05 2008 10:51 PM

This topic is locked

#16
Mswei

Posted 10 March 2008 - 12:44 AM

Member

Topic Starter
Member
23 posts

Attached is the screenshot of what is infected on my computer. Hope it helps!!

Attached Thumbnails

#17
Mswei

Posted 10 March 2008 - 12:59 AM

Member

Topic Starter
Member
23 posts

test.

#18
sarahw

Posted 10 March 2008 - 06:35 AM

Malware Staff

Member
2,781 posts

1.
Please re-open HiJackThis and choose do a system scan only. Check the boxes next to ONLY the entries listed below:

R3 - URLSearchHook: (no name) - {D73F49B6-B51B-4d32-A3B7-BD04B8342F53} - (no file)
O3 - Toolbar: (no name) - {37B85A29-692B-4205-9CAD-2626E4993404} - (no file)
O3 - Toolbar: (no name) - {71B6ACF7-4F0F-4FD8-BB69-6D1A4D271CB7} - (no file)
O3 - Toolbar: (no name) - {3F3714A9-89A4-46be-8AF3-D0C9D1FB03F9} - (no file)
O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.8.0\IEViewBar.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O16 - DPF: {160837A9-67E0-4E3F-8DD6-065361150FDA} (CollaborationCtl Class) - http://hdtelwebpa1.i...borationInf.cab
O16 - DPF: {4C563F3F-5621-4F23-BAC8-6B84DCA61AB2} (GoonzuGlobal_downloader Control) - http://cdn.goonzu.co...nloader1222.cab
O21 - SSODL: zip - {31f9e817-78f3-43f6-a2b9-6be4db1f4c6d} - C:\WINDOWS\Installer\{31f9e817-78f3-43f6-a2b9-6be4db1f4c6d}\zip.dll
O21 - SSODL: BootRam - {9f548e5a-2138-4a5f-b37d-c8f8ed5d0082} - C:\WINDOWS\Installer\{9f548e5a-2138-4a5f-b37d-c8f8ed5d0082}\BootRam.dll

Now close all windows other than HiJackThis, including browsers, so that nothing other than HijackThis is open, then click Fix Checked. A box will pop up asking you if you wish to fix the selected items. Please choose YES. Once it has fixed them, please exit/close HijackThis.

2.
1. Please open Notepad

Click Start , then Run
Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

SysRst::

File::
C:\WINDOWS\nod32se.exe
C:\Program Files\SysCleaner
C:\Program Files\udefender_setup.exe
C:\Program Files\IE Extensions
C:\Program Files\tmp208970250.exe
C:\Program Files\tmp208974140.exe
C:\WINDOWS\system32\VCCLSID.exe
C:\WINDOWS\system32\SrchSTS.exe
C:\WINDOWS\system32\VACFix.exe
C:\WINDOWS\system32\IEDFix.exe
C:\WINDOWS\system32\Process.exe
C:\WINDOWS\system32\WS2Fix.exe

Rootkit::
C:\WINDOWS\inf\accctsggw.cat

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"zip"=
"BootRam"=-
[-HKEY_LOCAL_MACHINE\system\ControlSet001\Services\accctsggw]

3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

Posted Image

5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

Combofix.txt
A new HijackThis log.

#19
Mswei

Posted 10 March 2008 - 06:55 AM

Member

Topic Starter
Member
23 posts

Hi again! As per the last post, here's what I've got from HJT:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:54, on 2008-03-10
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\arservice.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\UTSCSI.EXE
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\ARPWRMSG.EXE
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Philips\Philips Device Transfer Pop-up\PDeviceConn.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\HP\KBD\KBD.EXE
c:\windows\system\hpsysdrv.exe
C:\Program Files\Trend Micro\Hija\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.h...a...&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [LaunchPDeviceConn] "C:\Program Files\Philips\Philips Device Transfer Pop-up\PDeviceConn.exe"
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - Global Startup: Updates From HP.lnk = C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=67633
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?LinkID=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1148076574859
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://technisource...ort/ieatgpc.cab
O21 - SSODL: zip - {31f9e817-78f3-43f6-a2b9-6be4db1f4c6d} - C:\WINDOWS\Installer\{31f9e817-78f3-43f6-a2b9-6be4db1f4c6d}\zip.dll
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: CLCV0 (UTSCSI) - Unknown owner - C:\WINDOWS\system32\UTSCSI.EXE
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--
End of file - 7490 bytes

And here's the new combofix log as well:
ComboFix 08-03-09.1 - HP_Administrator 2008-03-10 8:41:45.7 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.552 [GMT -4:00]
Running from: C:\Documents and Settings\HP_Administrator\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\HP_Administrator\Desktop\CFScript.txt
* Created a new restore point

FILE ::
C:\Program Files\IE Extensions
C:\Program Files\SysCleaner
C:\Program Files\tmp208970250.exe
C:\Program Files\tmp208974140.exe
C:\Program Files\udefender_setup.exe
C:\WINDOWS\nod32se.exe
C:\WINDOWS\system32\IEDFix.exe
C:\WINDOWS\system32\Process.exe
C:\WINDOWS\system32\SrchSTS.exe
C:\WINDOWS\system32\VACFix.exe
C:\WINDOWS\system32\VCCLSID.exe
C:\WINDOWS\system32\WS2Fix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\tmp208970250.exe
C:\Program Files\tmp208974140.exe
C:\Program Files\udefender_setup.exe
C:\WINDOWS\inf\accctsggw.cat
C:\WINDOWS\nod32se.exe
C:\WINDOWS\system32\IEDFix.exe
C:\WINDOWS\system32\Process.exe
C:\WINDOWS\system32\SrchSTS.exe
C:\WINDOWS\system32\VACFix.exe
C:\WINDOWS\system32\VCCLSID.exe
C:\WINDOWS\system32\WS2Fix.exe

.
((((((((((((((((((((((((( Files Created from 2008-02-10 to 2008-03-10 )))))))))))))))))))))))))))))))
.

2008-03-10 01:37 . 2008-03-10 00:13 102,664 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys
2008-03-10 00:13 . 2008-03-10 01:37 <DIR> d-------- C:\Documents and Settings\HP_Administrator\.housecall6.6
2008-03-10 00:11 . 2008-03-10 00:11 <DIR> d-------- C:\_OTMoveIt
2008-03-09 15:47 . 2008-03-09 15:47 <DIR> d-------- C:\Documents and Settings\HP_Administrator\Application Data\Grisoft
2008-03-09 15:27 . 2008-03-09 15:44 <DIR> d-------- C:\Mr Wacky's Adventure
2008-03-08 11:09 . 2008-03-08 11:09 <DIR> d-------- C:\Program Files\SysCleaner
2008-03-08 10:59 . 2008-03-08 10:59 <DIR> d-------- C:\Program Files\IE Extensions
2008-03-06 00:55 . 2008-03-06 00:55 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\acccore
2008-03-05 22:37 . 2008-03-06 00:33 <DIR> d-------- C:\Program Files\Trend Micro
2008-03-05 22:28 . 2007-01-18 08:00 3,968 --a------ C:\WINDOWS\system32\drivers\AvgArCln.sys
2008-03-05 22:27 . 2007-05-30 08:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-03-05 22:26 . 2008-03-06 00:38 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-03-05 22:19 . 2008-03-06 01:35 4,038 --a------ C:\WINDOWS\system32\tmp.reg
2008-03-05 22:07 . 2008-03-05 22:07 <DIR> d---s---- C:\Documents and Settings\Administrator\UserData
2008-03-03 22:46 . 2008-03-03 22:46 <DIR> d-------- C:\Program Files\Your Company Name
2008-03-03 22:46 . 2008-03-03 22:46 <DIR> d-------- C:\Program Files\Total Seminars
2008-02-22 12:02 . 2008-02-22 12:02 202,827 --a------ C:\WINDOWS\system32\atasnt40.dll
2008-02-22 12:01 . 2008-02-22 12:01 51,304 --a------ C:\WINDOWS\system32\drivers\atnt40k.sys
2008-02-22 00:25 . 2008-02-22 00:25 <DIR> d-------- C:\Program Files\OGPlanet
2008-02-14 03:08 . 2008-02-14 03:08 <DIR> d-------- C:\Program Files\MSECache
2008-02-14 03:08 . 2008-02-14 03:08 <DIR> d-------- C:\Program Files\Microsoft Office Outlook Connector
2008-02-14 03:07 . 2008-02-14 03:07 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-09 17:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-03-06 02:10 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-03-05 13:45 --------- d-----w C:\Program Files\Incomplete
2008-03-05 13:35 --------- d-----w C:\Program Files\LimeWire
2008-03-05 13:35 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\LimeWire
2008-03-05 06:24 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\gtk-2.0
2008-03-03 23:08 --------- d-----w C:\Program Files\AIM6
2008-03-03 23:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-03-03 23:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL
2008-03-03 04:31 --------- d-----w C:\Program Files\World of Warcraft
2008-02-29 23:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL Downloads
2008-02-26 07:54 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-26 07:52 --------- d-----w C:\Program Files\Sword of The New World
2008-02-26 07:51 --------- d-----w C:\Program Files\MasterOfDefense_at
2008-02-22 14:24 --------- d-----w C:\Documents and Settings\Technisource VPN\Application Data\ICAClient
2008-02-14 07:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-02-14 07:24 --------- d-----w C:\Program Files\Microsoft ActiveSync
2008-02-08 21:56 --------- d-----w C:\Documents and Settings\Technisource VPN\Application Data\acccore
2008-02-08 19:40 --------- d-----w C:\Documents and Settings\Technisource VPN\Application Data\DWRCC
2008-02-08 19:37 --------- d-----w C:\Documents and Settings\Technisource VPN\Application Data\DameWare Development
2008-02-08 19:36 --------- d-----w C:\Program Files\DameWare Development
2008-02-08 19:24 --------- d-----w C:\Program Files\SJLabs
2008-02-08 19:24 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-02-08 19:14 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-08 19:14 --------- d-----w C:\Program Files\Common Files\Crystal Decisions
2008-02-08 19:14 --------- d-----w C:\Program Files\AR System
2008-02-08 19:14 --------- d-----w C:\Documents and Settings\Technisource VPN\Application Data\AR System
2008-02-05 06:28 --------- d-----w C:\Program Files\WowGasm
2008-02-05 04:31 --------- d-----w C:\Program Files\Warcraft III
2008-02-04 06:48 139,264 ----a-w C:\WINDOWS\War3Unin.exe
2008-02-01 00:46 --------- d-----w C:\Program Files\support.com
2008-02-01 00:46 --------- d-----w C:\Program Files\Common Files\SupportSoft
2008-01-25 13:42 --------- d-----w C:\Program Files\Google
2008-01-25 02:58 --------- d-----w C:\Program Files\CCleaner
2008-01-23 06:33 --------- d-----w C:\Program Files\Common Files\INCA Shared
2008-01-16 07:17 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\ICAClient
2008-01-16 04:21 --------- d-----w C:\Program Files\Java
2007-12-20 03:47 846,504 ----a-w C:\Documents and Settings\HP_Administrator\JNativeCpp.dll
2007-04-23 05:51 32 ----a-r C:\Documents and Settings\All Users\hash.dat
2006-05-03 09:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll
2007-02-21 10:47 31,232 --sh--r C:\WINDOWS\system32\msfDX.dll
.
Files Infected - Win32.Agent.zb
c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
C:\WINDOWS\SMINST\RECGUARD.EXE
C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Philips\Philips Device Transfer Pop-up\PDeviceConn.exe
C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
C:\WINDOWS\system32\NeroCheck.exe
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.

((((((((((((((((((((((((((((((((((((((( System Restore )))))))))))))))))))))))))))))))))))))))))))))))))))
.

2006-12-06 09:06 4096 C:\Documents and Settings\All Users\Application Data\Grisoft\AVG Anti-Spyware 7.5\Downloads\help.dll
2006-12-06 09:06 4096 {106CF321-99A3-4E3A-9103-1BD027606A99}\RP1\A0000003.dll
2006-12-06 09:06 4096 {106CF321-99A3-4E3A-9103-1BD027606A99}\RP3\A0000247.dll

C:\Documents and Settings\HP_Administrator\Application Data\printer.exe
2005-07-08 07:20 9728 {106CF321-99A3-4E3A-9103-1BD027606A99}\RP1\A0000017.exe

C:\Documents and Settings\HP_Administrator\Desktop\Old Desktop Crap\nero\Nero 7 Keygen from Paradox\Nero7Keygen.exe
2005-09-15 19:27 219648 {106CF321-99A3-4E3A-9103-1BD027606A99}\RP3\A0000255.exe

C:\mhyvfa.exe
2008-03-05 09:45 58368 {106CF321-99A3-4E3A-9103-1BD027606A99}\RP2\A0000129.exe

C:\mmesckoj.exe
2008-03-05 09:45 59392 {106CF321-99A3-4E3A-9103-1BD027606A99}\RP2\A0000130.exe

C:\Program Files\delete.exe
2004-11-30 03:23 40960 {106CF321-99A3-4E3A-9103-1BD027606A99}\RP2\A0000131.exe

2008-03-09 15:48 6731312 C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
2008-03-05 22:36 6731312 {106CF321-99A3-4E3A-9103-1BD027606A99}\RP1\A0000007.exe

C:\Program Files\SetAttrib.exe
2005-01-20 20:53 45056 {106CF321-99A3-4E3A-9103-1BD027606A99}\RP2\A0000132.exe

C:\Program Files\tmp208970250.exe
2008-03-08 10:59 16480 {106CF321-99A3-4E3A-9103-1BD027606A99}\RP4\A0000299.exe

C:\Program Files\tmp208974140.exe
2008-03-08 10:59 13580 {106CF321-99A3-4E3A-9103-1BD027606A99}\RP4\A0000300.exe

C:\Program Files\tmp208979125.exe
2008-03-08 10:59 35732 {106CF321-99A3-4E3A-9103-1BD027606A99}\RP2\A0000133.exe

C:\Program Files\tmp208980750.exe
2008-03-08 10:59 35732 {106CF321-99A3-4E3A-9103-1BD027606A99}\RP2\A0000134.exe

C:\Program Files\tmp230156.exe
2008-03-09 13:39 13496 {106CF321-99A3-4E3A-9103-1BD027606A99}\RP2\A0000135.exe

C:\Program Files\tmp234734.exe
2008-03-09 13:39 13556 {106CF321-99A3-4E3A-9103-1BD027606A99}\RP2\A0000136.exe

C:\Program Files\udefender_setup.exe
2008-03-09 13:44 98709 {106CF321-99A3-4E3A-9103-1BD027606A99}\RP4\A0000301.exe

C:\WINDOWS\nod32se.exe
2008-03-09 13:42 16384 {106CF321-99A3-4E3A-9103-1BD027606A99}\RP4\A0000302.exe

2004-08-09 17:00 13824 C:\WINDOWS\system32\dllcache\wscntfy.exe
2004-08-09 17:00 13824 {106CF321-99A3-4E3A-9103-1BD027606A99}\RP2\A0000142.exe
2004-08-09 17:00 13824 {106CF321-99A3-4E3A-9103-1BD027606A99}\RP2\A0000143.exe

C:\WINDOWS\system32\drvlon.dll
2008-03-08 10:59 18944 {106CF321-99A3-4E3A-9103-1BD027606A99}\RP3\A0000210.dll

C:\WINDOWS\system32\dumphive.exe
2004-07-31 18:50 51200 {106CF321-99A3-4E3A-9103-1BD027606A99}\RP3\A0000254.exe

C:\WINDOWS\system32\IEDFix.exe
2008-03-05 23:29 82432 {106CF321-99A3-4E3A-9103-1BD027606A99}\RP4\A0000303.exe

C:\WINDOWS\system32\Process.exe
2003-06-05 21:13 53248 {106CF321-99A3-4E3A-9103-1BD027606A99}\RP4\A0000304.exe

C:\WINDOWS\system32\SrchSTS.exe
2006-04-27 17:49 288417 {106CF321-99A3-4E3A-9103-1BD027606A99}\RP4\A0000305.exe

C:\WINDOWS\system32\VACFix.exe
2008-03-02 00:12 86016 {106CF321-99A3-4E3A-9103-1BD027606A99}\RP4\A0000306.exe

C:\WINDOWS\system32\VCCLSID.exe
2007-09-06 00:22 289144 {106CF321-99A3-4E3A-9103-1BD027606A99}\RP4\A0000307.exe

C:\WINDOWS\system32\WS2Fix.exe
2007-10-04 00:36 25600 {106CF321-99A3-4E3A-9103-1BD027606A99}\RP4\A0000308.exe

C:\WINDOWS\system32\wscntfy.exe
2004-08-09 17:00 13824 {106CF321-99A3-4E3A-9103-1BD027606A99}\RP2\A0000139.exe
2004-08-09 17:00 13824 {106CF321-99A3-4E3A-9103-1BD027606A99}\RP2\A0000153.exe

C:\xlth.exe
2008-03-05 09:45 3584 {106CF321-99A3-4E3A-9103-1BD027606A99}\RP2\A0000140.exe

C:\xoipvs.exe
2008-03-05 09:45 51712 {106CF321-99A3-4E3A-9103-1BD027606A99}\RP2\A0000141.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Aim6"="" []
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-09 17:00 15360]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 14:39 1289000]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-03-05 22:36 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-05 17:56 64512]
"AlwaysReady Power Message APP"="ARPWRMSG.EXE" [2005-08-02 20:19 77312 C:\WINDOWS\arpwrmsg.exe]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-10-04 18:14 8491008]
"nwiz"="nwiz.exe" [2008-03-05 22:50 1626112 C:\WINDOWS\system32\nwiz.exe]
"HPHUPD08"="c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe" [2008-03-05 22:36 49152]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2008-03-05 22:36 237568]
"PCDrProfiler"="" []
"HPBootOp"="C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2008-03-05 22:36 249856]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPwuSchd2.exe" [2005-05-12 03:12 49152]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2008-03-05 22:36 132496]
"LaunchPDeviceConn"="C:\Program Files\Philips\Philips Device Transfer Pop-up\PDeviceConn.exe" [2008-03-05 22:36 299008]
"IPHSend"="C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe" [2008-03-05 22:36 124520]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2008-03-05 22:36 155648]
"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2008-03-05 22:36 249856]
"RTHDCPL"="RTHDCPL.EXE" [2006-01-23 06:53 15969280 C:\WINDOWS\RTHDCPL.EXE]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2008-03-05 22:36 81920]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-03-05 22:36 180269]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\point32.exe" [2005-06-10 05:21 217088]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-10-04 18:14 81920]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2004-08-09 17:00 53760 C:\WINDOWS\system32\narrator.exe]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Updates From HP.lnk - C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe [2006-02-22 17:58:29 36903]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"zip"= {31f9e817-78f3-43f6-a2b9-6be4db1f4c6d} - C:\WINDOWS\Installer\{31f9e817-78f3-43f6-a2b9-6be4db1f4c6d}\zip.dll [2008-03-08 10:59 38438]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, wowfx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DISCover]
--a------ 2005-11-11 17:11 1064960 C:\Program Files\DISC\DISCover.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DiscUpdateManager]
--a------ 2005-11-11 17:10 61440 C:\Program Files\DISC\DiscUpdateMgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMAScheduler]
--a------ 2005-11-01 06:01 90112 c:\Program Files\Sonic\DigitalMedia Plus\DigitalMedia Archive\DMAScheduler.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
--a------ 2006-05-09 20:24 50760 C:\Program Files\Common Files\AOL\1147572088\ee\AOLSoftware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2007-07-10 09:18 270648 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2008-03-05 22:36 180269 C:\Program Files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Veoh]
C:\Program Files\Veoh Networks\Veoh\VeohClient.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Viewpoint Manager Service"=2 (0x2)
"iPod Service"=3 (0x3)
"gusvc"=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"C:\\Program Files\\DISC\\DISCover.exe"=
"C:\\Program Files\\DISC\\DiscStreamHub.exe"=
"C:\\Program Files\\DISC\\myFTP.exe"=
"C:\\Program Files\\Updates from HP\\9972322\\Program\\Updates from HP.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"C:\\Program Files\\Common Files\\AOL\\1147572088\\ee\\aolsoftware.exe"=
"C:\\Program Files\\Common Files\\AOL\\1147572088\\ee\\aim6.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Electronic Arts\\Battlefield 2142\\BF2142.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\NCsoft\\Exteel\\System\\Exteel.exe"=
"C:\\Program Files\\Warcraft III\\Warcraft III.exe"=
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"= C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"= C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"= C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9842:TCP"= 9842:TCP:*:Disabled:SolidNetworkManager
"9842:UDP"= 9842:UDP:*:Disabled:SolidNetworkManager
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R2 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" [2007-01-04 17:38]
S3 inwrdr;inwrdr;C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\inwrdr.sys []
S3 nenum13E;nenum13E;C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\nenum13E.sys []
S3 tbcspud;Santa Cruz Driver;C:\WINDOWS\system32\drivers\tbcspud.sys []
S3 tbcwdm;Santa Cruz WDM Driver;C:\WINDOWS\system32\drivers\tbcwdm.sys []
S3 vtdg46xx;vtdg46xx;C:\PROGRA~1\TURTLE~1\SANTAC~1\CONTRO~1\vtdg46xx.sys []
S3 XDva020;XDva020;C:\WINDOWS\system32\XDva020.sys []
S3 XDva037;XDva037;C:\WINDOWS\system32\XDva037.sys []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J]
\Shell\AutoRun\command - J:\autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{47876b4c-f72b-11da-8a91-0015f2eb0b2a}]
\Shell\AutoRun\command - J:\JDSecure\Windows\JDSecure20.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{56ac6ba3-ef32-11da-8a81-0015f2eb0b2a}]
\Shell\AutoRun\command - J:\JDSecure\Windows\JDSecure20.exe

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-10 08:48:21
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\explorer.exe [6.00.2900.3156]
-> C:\WINDOWS\Installer\{31f9e817-78f3-43f6-a2b9-6be4db1f4c6d}\zip.dll
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\arservice.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\UTSCSI.EXE
C:\WINDOWS\ehome\mcrdsvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
.
**************************************************************************
.
Completion time: 2008-03-10 8:53:58 - machine was rebooted
ComboFix-quarantined-files.txt 2008-03-10 12:53:56
ComboFix2.txt 2008-03-10 05:33:26
ComboFix3.txt 2008-03-10 03:15:37
ComboFix4.txt 2008-03-10 02:57:05
ComboFix5.txt 2008-03-10 02:41:09
.
2007-11-28 06:53:27 --- E O F ---

Let me know whats next!

Edited by Mswei, 10 March 2008 - 06:55 AM.

#20
sarahw

Posted 10 March 2008 - 07:54 AM

Malware Staff

Member
2,781 posts

I need to know if you have the HP Application Recovery.
click Start , All Programs , HP Tools , Compaq Tools , or PC Help and Tools , and Application Recovery .
You do not need it yet, I just need to know if you can access it without a disk.

Go to Control Panel, then Add\Remove Programs.
Uninstall the following:
Java 1.6.0_03
GoogleToolbar
Nero
Photosmart_Essential_Software

Run combofix normally and post a log.

Edited by sarahw, 10 March 2008 - 07:54 AM.

#21
Mswei

Posted 10 March 2008 - 06:20 PM

Member

Topic Starter
Member
23 posts

Hi Sarah! Hope you had a decent day

I managed to uninstall everything from Add/Remove Programs. Let me know if I inadvertantly missed something!

Also, I am able to access Application recovery without a disk

Here's my combofix log:
ComboFix 08-03-09.1 - HP_Administrator 2008-03-10 20:22:55.9 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.612 [GMT -4:00]
Running from: C:\Documents and Settings\HP_Administrator\Desktop\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2008-02-11 to 2008-03-11 )))))))))))))))))))))))))))))))
.

2008-03-10 19:48 . 2006-10-12 04:10 49,265 --a------ C:\WINDOWS\system32\jpicpl32.cpl
2008-03-10 01:37 . 2008-03-10 00:13 102,664 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys
2008-03-10 00:13 . 2008-03-10 01:37 <DIR> d-------- C:\Documents and Settings\HP_Administrator\.housecall6.6
2008-03-10 00:11 . 2008-03-10 00:11 <DIR> d-------- C:\_OTMoveIt
2008-03-09 15:47 . 2008-03-09 15:47 <DIR> d-------- C:\Documents and Settings\HP_Administrator\Application Data\Grisoft
2008-03-09 15:27 . 2008-03-09 15:44 <DIR> d-------- C:\Mr Wacky's Adventure
2008-03-08 11:09 . 2008-03-08 11:09 <DIR> d-------- C:\Program Files\SysCleaner
2008-03-08 10:59 . 2008-03-08 10:59 <DIR> d-------- C:\Program Files\IE Extensions
2008-03-06 00:55 . 2008-03-06 00:55 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\acccore
2008-03-05 22:37 . 2008-03-06 00:33 <DIR> d-------- C:\Program Files\Trend Micro
2008-03-05 22:28 . 2007-01-18 08:00 3,968 --a------ C:\WINDOWS\system32\drivers\AvgArCln.sys
2008-03-05 22:27 . 2007-05-30 08:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-03-05 22:26 . 2008-03-06 00:38 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-03-05 22:19 . 2008-03-06 01:35 4,038 --a------ C:\WINDOWS\system32\tmp.reg
2008-03-05 22:07 . 2008-03-05 22:07 <DIR> d---s---- C:\Documents and Settings\Administrator\UserData
2008-03-03 22:46 . 2008-03-03 22:46 <DIR> d-------- C:\Program Files\Your Company Name
2008-03-03 22:46 . 2008-03-03 22:46 <DIR> d-------- C:\Program Files\Total Seminars
2008-02-22 12:02 . 2008-02-22 12:02 202,827 --a------ C:\WINDOWS\system32\atasnt40.dll
2008-02-22 12:01 . 2008-02-22 12:01 51,304 --a------ C:\WINDOWS\system32\drivers\atnt40k.sys
2008-02-22 00:25 . 2008-02-22 00:25 <DIR> d-------- C:\Program Files\OGPlanet
2008-02-14 03:08 . 2008-02-14 03:08 <DIR> d-------- C:\Program Files\MSECache
2008-02-14 03:08 . 2008-02-14 03:08 <DIR> d-------- C:\Program Files\Microsoft Office Outlook Connector
2008-02-14 03:07 . 2008-02-14 03:07 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-10 23:57 --------- d-----w C:\Program Files\Common Files\Ahead
2008-03-10 23:54 --------- d-----w C:\Program Files\Common Files\Sonic Shared
2008-03-10 23:54 --------- d-----w C:\Program Files\Common Files\HP
2008-03-10 23:48 --------- d-----w C:\Program Files\Java
2008-03-10 23:47 --------- d-----w C:\Program Files\Google
2008-03-06 02:50 1,626,112 ----a-w C:\WINDOWS\system32\nwiz.exe
2008-03-06 02:10 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-03-05 13:45 --------- d-----w C:\Program Files\Incomplete
2008-03-05 13:35 --------- d-----w C:\Program Files\LimeWire
2008-03-05 13:35 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\LimeWire
2008-03-05 06:24 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\gtk-2.0
2008-03-03 23:08 --------- d-----w C:\Program Files\AIM6
2008-03-03 23:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-03-03 23:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL
2008-03-03 04:31 --------- d-----w C:\Program Files\World of Warcraft
2008-02-29 23:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL Downloads
2008-02-26 07:54 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-26 07:52 --------- d-----w C:\Program Files\Sword of The New World
2008-02-26 07:51 --------- d-----w C:\Program Files\MasterOfDefense_at
2008-02-22 14:24 --------- d-----w C:\Documents and Settings\Technisource VPN\Application Data\ICAClient
2008-02-14 07:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-02-14 07:24 --------- d-----w C:\Program Files\Microsoft ActiveSync
2008-02-08 21:56 --------- d-----w C:\Documents and Settings\Technisource VPN\Application Data\acccore
2008-02-08 19:40 --------- d-----w C:\Documents and Settings\Technisource VPN\Application Data\DWRCC
2008-02-08 19:37 --------- d-----w C:\Documents and Settings\Technisource VPN\Application Data\DameWare Development
2008-02-08 19:36 --------- d-----w C:\Program Files\DameWare Development
2008-02-08 19:24 --------- d-----w C:\Program Files\SJLabs
2008-02-08 19:24 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-02-08 19:14 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-08 19:14 --------- d-----w C:\Program Files\Common Files\Crystal Decisions
2008-02-08 19:14 --------- d-----w C:\Program Files\AR System
2008-02-08 19:14 --------- d-----w C:\Documents and Settings\Technisource VPN\Application Data\AR System
2008-02-05 06:28 --------- d-----w C:\Program Files\WowGasm
2008-02-05 04:31 --------- d-----w C:\Program Files\Warcraft III
2008-02-04 23:23 693,792 ----a-w C:\WINDOWS\system32\OGACheckControl.DLL
2008-02-04 06:48 139,264 ----a-w C:\WINDOWS\War3Unin.exe
2008-02-01 01:44 45,056 ----a-w C:\WINDOWS\system32\UTSCSI.EXE
2008-02-01 00:46 --------- d-----w C:\Program Files\support.com
2008-02-01 00:46 --------- d-----w C:\Program Files\Common Files\SupportSoft
2008-01-25 02:58 --------- d-----w C:\Program Files\CCleaner
2008-01-23 06:33 --------- d-----w C:\Program Files\Common Files\INCA Shared
2008-01-16 07:17 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\ICAClient
2007-12-20 03:47 846,504 ----a-w C:\Documents and Settings\HP_Administrator\JNativeCpp.dll
2007-12-11 19:46 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2007-12-11 19:46 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2007-12-11 19:46 129,784 ------w C:\WINDOWS\system32\pxafs.dll
2007-12-11 19:46 120,056 ------w C:\WINDOWS\system32\pxcpyi64.exe
2007-12-11 19:46 118,520 ------w C:\WINDOWS\system32\pxinsi64.exe
2007-12-11 19:45 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2007-12-11 19:45 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2007-12-11 19:43 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2007-04-23 05:51 32 ----a-r C:\Documents and Settings\All Users\hash.dat
2006-05-03 09:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll
2007-02-21 10:47 31,232 --sh--r C:\WINDOWS\system32\msfDX.dll
.
Files Infected - Win32.Agent.zb
C:\WINDOWS\SMINST\RECGUARD.EXE
C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe
C:\Program Files\Philips\Philips Device Transfer Pop-up\PDeviceConn.exe
C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
.

((((((((((((((((((((((((((((( snapshot@2008-03-09_17.09.36.06 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-09-25 03:30:28 135,168 ----a-w C:\WINDOWS\system32\java.exe
+ 2006-10-12 06:35:14 49,248 ----a-w C:\WINDOWS\system32\java.exe
- 2007-09-25 03:30:30 135,168 ----a-w C:\WINDOWS\system32\javaw.exe
+ 2006-10-12 06:35:24 53,346 ----a-w C:\WINDOWS\system32\javaw.exe
- 2007-09-25 04:31:42 139,264 ----a-w C:\WINDOWS\system32\javaws.exe
+ 2006-10-12 08:10:56 127,078 ----a-w C:\WINDOWS\system32\javaws.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Aim6"="" []
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-09 17:00 15360]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 14:39 1289000]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-05 17:56 64512]
"AlwaysReady Power Message APP"="ARPWRMSG.EXE" [2005-08-02 20:19 77312 C:\WINDOWS\arpwrmsg.exe]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-10-04 18:14 8491008]
"nwiz"="nwiz.exe" [2008-03-05 22:50 1626112 C:\WINDOWS\system32\nwiz.exe]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2008-03-05 22:36 237568]
"PCDrProfiler"="" []
"HPBootOp"="C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2008-03-05 22:36 249856]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPwuSchd2.exe" [2005-05-12 03:12 49152]
"LaunchPDeviceConn"="C:\Program Files\Philips\Philips Device Transfer Pop-up\PDeviceConn.exe" [2008-03-05 22:36 299008]
"IPHSend"="C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe" [2008-03-05 22:36 124520]
"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2008-03-05 22:36 249856]
"RTHDCPL"="RTHDCPL.EXE" [2006-01-23 06:53 15969280 C:\WINDOWS\RTHDCPL.EXE]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2008-03-05 22:36 81920]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-03-05 22:36 180269]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\point32.exe" [2005-06-10 05:21 217088]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-10-04 18:14 81920]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" [2006-10-12 04:10 49263]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2004-08-09 17:00 53760 C:\WINDOWS\system32\narrator.exe]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Updates From HP.lnk - C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe [2006-02-22 17:58:29 36903]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"zip"= {31f9e817-78f3-43f6-a2b9-6be4db1f4c6d} - C:\WINDOWS\Installer\{31f9e817-78f3-43f6-a2b9-6be4db1f4c6d}\zip.dll [2008-03-08 10:59 38438]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, wowfx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DISCover]
--a------ 2005-11-11 17:11 1064960 C:\Program Files\DISC\DISCover.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DiscUpdateManager]
--a------ 2005-11-11 17:10 61440 C:\Program Files\DISC\DiscUpdateMgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMAScheduler]
--a------ 2005-11-01 06:01 90112 c:\Program Files\Sonic\DigitalMedia Plus\DigitalMedia Archive\DMAScheduler.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
--a------ 2006-05-09 20:24 50760 C:\Program Files\Common Files\AOL\1147572088\ee\AOLSoftware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2007-07-10 09:18 270648 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2008-03-05 22:36 180269 C:\Program Files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Veoh]
C:\Program Files\Veoh Networks\Veoh\VeohClient.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Viewpoint Manager Service"=2 (0x2)
"iPod Service"=3 (0x3)
"gusvc"=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"C:\\Program Files\\DISC\\DISCover.exe"=
"C:\\Program Files\\DISC\\DiscStreamHub.exe"=
"C:\\Program Files\\DISC\\myFTP.exe"=
"C:\\Program Files\\Updates from HP\\9972322\\Program\\Updates from HP.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"C:\\Program Files\\Common Files\\AOL\\1147572088\\ee\\aolsoftware.exe"=
"C:\\Program Files\\Common Files\\AOL\\1147572088\\ee\\aim6.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Electronic Arts\\Battlefield 2142\\BF2142.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\NCsoft\\Exteel\\System\\Exteel.exe"=
"C:\\Program Files\\Warcraft III\\Warcraft III.exe"=
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"= C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"= C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"= C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9842:TCP"= 9842:TCP:*:Disabled:SolidNetworkManager
"9842:UDP"= 9842:UDP:*:Disabled:SolidNetworkManager
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R2 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" [2007-01-04 17:38]
S3 inwrdr;inwrdr;C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\inwrdr.sys []
S3 nenum13E;nenum13E;C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\nenum13E.sys []
S3 tbcspud;Santa Cruz Driver;C:\WINDOWS\system32\drivers\tbcspud.sys []
S3 tbcwdm;Santa Cruz WDM Driver;C:\WINDOWS\system32\drivers\tbcwdm.sys []
S3 vtdg46xx;vtdg46xx;C:\PROGRA~1\TURTLE~1\SANTAC~1\CONTRO~1\vtdg46xx.sys []
S3 XDva020;XDva020;C:\WINDOWS\system32\XDva020.sys []
S3 XDva037;XDva037;C:\WINDOWS\system32\XDva037.sys []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J]
\Shell\AutoRun\command - J:\autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{47876b4c-f72b-11da-8a91-0015f2eb0b2a}]
\Shell\AutoRun\command - J:\JDSecure\Windows\JDSecure20.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{56ac6ba3-ef32-11da-8a81-0015f2eb0b2a}]
\Shell\AutoRun\command - J:\JDSecure\Windows\JDSecure20.exe

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-10 20:23:34
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\explorer.exe [6.00.2900.3156]
-> C:\WINDOWS\Installer\{31f9e817-78f3-43f6-a2b9-6be4db1f4c6d}\zip.dll
.
Completion time: 2008-03-10 20:24:20
ComboFix-quarantined-files.txt 2008-03-11 00:24:12
ComboFix2.txt 2008-03-11 00:10:05
ComboFix3.txt 2008-03-10 12:53:59
ComboFix4.txt 2008-03-10 05:33:26
ComboFix5.txt 2008-03-10 03:15:37
.
2007-11-28 06:53:27 --- E O F ---

And here's the HJT log as well:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:21, on 2008-03-10
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\arservice.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\UTSCSI.EXE
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\ARPWRMSG.EXE
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
C:\Program Files\Philips\Philips Device Transfer Pop-up\PDeviceConn.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\HP\KBD\KBD.EXE
c:\windows\system\hpsysdrv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\Hija\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.h...a...&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
O4 - HKLM\..\Run: [LaunchPDeviceConn] "C:\Program Files\Philips\Philips Device Transfer Pop-up\PDeviceConn.exe"
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - Global Startup: Updates From HP.lnk = C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=67633
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?LinkID=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1148076574859
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://technisource...ort/ieatgpc.cab
O21 - SSODL: zip - {31f9e817-78f3-43f6-a2b9-6be4db1f4c6d} - C:\WINDOWS\Installer\{31f9e817-78f3-43f6-a2b9-6be4db1f4c6d}\zip.dll
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: CLCV0 (UTSCSI) - Unknown owner - C:\WINDOWS\system32\UTSCSI.EXE
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--
End of file - 7046 bytes

I'll be in chat in about 2 hours, gonna go eat dinner and get some work done around the apartment.

See ya soon!

Edited by Mswei, 10 March 2008 - 06:25 PM.

#22
Mswei

Posted 10 March 2008 - 10:57 PM

Member

Topic Starter
Member
23 posts

Here's the update:

From the chat you had me do the following:
* Uninstall AIM
* Uninstall Philips Popup
* Uninstall Realplayer
* Uninstall RECGUARD.EXE
* Uninstall issch.exe
* Uninstall isuspm.exe

Here's my fresh combofix log

ComboFix 08-03-10.1 - HP_Administrator 2008-03-11 0:50:32.10 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.611 [GMT -4:00]
Running from: C:\Documents and Settings\HP_Administrator\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2008-02-11 to 2008-03-11 )))))))))))))))))))))))))))))))
.

2008-03-10 19:48 . 2006-10-12 04:10 49,265 --a------ C:\WINDOWS\system32\jpicpl32.cpl
2008-03-10 01:37 . 2008-03-10 00:13 102,664 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys
2008-03-10 00:13 . 2008-03-10 01:37 <DIR> d-------- C:\Documents and Settings\HP_Administrator\.housecall6.6
2008-03-09 15:47 . 2008-03-09 15:47 <DIR> d-------- C:\Documents and Settings\HP_Administrator\Application Data\Grisoft
2008-03-09 15:27 . 2008-03-09 15:44 <DIR> d-------- C:\Mr Wacky's Adventure
2008-03-08 11:09 . 2008-03-08 11:09 <DIR> d-------- C:\Program Files\SysCleaner
2008-03-08 10:59 . 2008-03-08 10:59 <DIR> d-------- C:\Program Files\IE Extensions
2008-03-06 00:55 . 2008-03-06 00:55 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\acccore
2008-03-05 22:37 . 2008-03-06 00:33 <DIR> d-------- C:\Program Files\Trend Micro
2008-03-05 22:28 . 2007-01-18 08:00 3,968 --a------ C:\WINDOWS\system32\drivers\AvgArCln.sys
2008-03-05 22:27 . 2007-05-30 08:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-03-05 22:26 . 2008-03-06 00:38 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-03-05 22:07 . 2008-03-05 22:07 <DIR> d---s---- C:\Documents and Settings\Administrator\UserData
2008-03-03 22:46 . 2008-03-03 22:46 <DIR> d-------- C:\Program Files\Your Company Name
2008-03-03 22:46 . 2008-03-03 22:46 <DIR> d-------- C:\Program Files\Total Seminars
2008-02-22 12:02 . 2008-02-22 12:02 202,827 --a------ C:\WINDOWS\system32\atasnt40.dll
2008-02-22 12:01 . 2008-02-22 12:01 51,304 --a------ C:\WINDOWS\system32\drivers\atnt40k.sys
2008-02-22 00:25 . 2008-02-22 00:25 <DIR> d-------- C:\Program Files\OGPlanet
2008-02-14 03:08 . 2008-02-14 03:08 <DIR> d-------- C:\Program Files\MSECache
2008-02-14 03:08 . 2008-02-14 03:08 <DIR> d-------- C:\Program Files\Microsoft Office Outlook Connector
2008-02-14 03:07 . 2008-02-14 03:07 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-11 04:46 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-11 04:46 --------- d-----w C:\Program Files\Philips
2008-03-11 04:46 --------- d-----w C:\Program Files\Google
2008-03-11 03:53 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL
2008-03-11 03:49 --------- d-----w C:\Program Files\Common Files\Real
2008-03-10 23:57 --------- d-----w C:\Program Files\Common Files\Ahead
2008-03-10 23:54 --------- d-----w C:\Program Files\Common Files\Sonic Shared
2008-03-10 23:54 --------- d-----w C:\Program Files\Common Files\HP
2008-03-10 23:48 --------- d-----w C:\Program Files\Java
2008-03-06 02:50 1,626,112 ----a-w C:\WINDOWS\system32\nwiz.exe
2008-03-06 02:10 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-03-05 13:45 --------- d-----w C:\Program Files\Incomplete
2008-03-05 13:35 --------- d-----w C:\Program Files\LimeWire
2008-03-05 13:35 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\LimeWire
2008-03-05 06:24 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\gtk-2.0
2008-03-03 23:08 --------- d-----w C:\Program Files\AIM6
2008-03-03 23:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-03-03 04:31 --------- d-----w C:\Program Files\World of Warcraft
2008-02-29 23:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL Downloads
2008-02-26 07:54 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-26 07:52 --------- d-----w C:\Program Files\Sword of The New World
2008-02-26 07:51 --------- d-----w C:\Program Files\MasterOfDefense_at
2008-02-22 14:24 --------- d-----w C:\Documents and Settings\Technisource VPN\Application Data\ICAClient
2008-02-14 07:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-02-14 07:24 --------- d-----w C:\Program Files\Microsoft ActiveSync
2008-02-08 21:56 --------- d-----w C:\Documents and Settings\Technisource VPN\Application Data\acccore
2008-02-08 19:40 --------- d-----w C:\Documents and Settings\Technisource VPN\Application Data\DWRCC
2008-02-08 19:37 --------- d-----w C:\Documents and Settings\Technisource VPN\Application Data\DameWare Development
2008-02-08 19:36 --------- d-----w C:\Program Files\DameWare Development
2008-02-08 19:24 --------- d-----w C:\Program Files\SJLabs
2008-02-08 19:24 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-02-08 19:14 --------- d-----w C:\Program Files\Common Files\Crystal Decisions
2008-02-08 19:14 --------- d-----w C:\Program Files\AR System
2008-02-08 19:14 --------- d-----w C:\Documents and Settings\Technisource VPN\Application Data\AR System
2008-02-05 06:28 --------- d-----w C:\Program Files\WowGasm
2008-02-05 04:31 --------- d-----w C:\Program Files\Warcraft III
2008-02-04 23:23 693,792 ----a-w C:\WINDOWS\system32\OGACheckControl.DLL
2008-02-04 06:48 139,264 ----a-w C:\WINDOWS\War3Unin.exe
2008-02-01 01:44 45,056 ----a-w C:\WINDOWS\system32\UTSCSI.EXE
2008-02-01 00:46 --------- d-----w C:\Program Files\support.com
2008-02-01 00:46 --------- d-----w C:\Program Files\Common Files\SupportSoft
2008-01-25 02:58 --------- d-----w C:\Program Files\CCleaner
2008-01-23 06:33 --------- d-----w C:\Program Files\Common Files\INCA Shared
2008-01-16 07:17 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\ICAClient
2007-12-20 03:47 846,504 ----a-w C:\Documents and Settings\HP_Administrator\JNativeCpp.dll
2007-12-11 19:46 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2007-12-11 19:46 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2007-12-11 19:46 129,784 ------w C:\WINDOWS\system32\pxafs.dll
2007-12-11 19:46 120,056 ------w C:\WINDOWS\system32\pxcpyi64.exe
2007-12-11 19:46 118,520 ------w C:\WINDOWS\system32\pxinsi64.exe
2007-12-11 19:45 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2007-12-11 19:45 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2007-12-11 19:43 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2007-04-23 05:51 32 ----a-r C:\Documents and Settings\All Users\hash.dat
2007-06-21 23:38 30,280 ----a-w C:\Program Files\mozilla firefox\plugins\cgpcfg.dll
2007-06-21 23:38 79,432 ----a-w C:\Program Files\mozilla firefox\plugins\CgpCore.dll
2007-06-21 23:38 71,240 ----a-w C:\Program Files\mozilla firefox\plugins\confmgr.dll
2007-06-21 23:38 140,872 ----a-w C:\Program Files\mozilla firefox\plugins\ctxmui.dll
2007-06-21 23:39 38,472 ----a-w C:\Program Files\mozilla firefox\plugins\icafile.dll
2007-06-21 23:39 46,664 ----a-w C:\Program Files\mozilla firefox\plugins\icalogon.dll
2007-06-21 23:39 34,376 ----a-w C:\Program Files\mozilla firefox\plugins\logging.dll
2007-06-21 23:39 685,640 ----a-w C:\Program Files\mozilla firefox\plugins\sslsdk_b.dll
2007-06-21 23:40 30,280 ----a-w C:\Program Files\mozilla firefox\plugins\TcpPServ.dll
2006-05-03 09:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll
2007-02-21 10:47 31,232 --sh--r C:\WINDOWS\system32\msfDX.dll
.
Files Infected - Win32.Agent.zb
C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-09 17:00 15360]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 14:39 1289000]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-05 17:56 64512]
"AlwaysReady Power Message APP"="ARPWRMSG.EXE" [2005-08-02 20:19 77312 C:\WINDOWS\arpwrmsg.exe]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-10-04 18:14 8491008]
"nwiz"="nwiz.exe" [2008-03-05 22:50 1626112 C:\WINDOWS\system32\nwiz.exe]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [ ]
"PCDrProfiler"="" []
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPwuSchd2.exe" [2005-05-12 03:12 49152]
"IPHSend"="C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe" [2008-03-05 22:36 124520]
"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [ ]
"RTHDCPL"="RTHDCPL.EXE" [2006-01-23 06:53 15969280 C:\WINDOWS\RTHDCPL.EXE]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [ ]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [ ]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\point32.exe" [2005-06-10 05:21 217088]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-10-04 18:14 81920]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe" [2005-08-26 22:14 36975]
"KBD"="C:\HP\KBD\KBD.EXE" [2005-02-02 11:44 61440]
"ps2"="C:\WINDOWS\system32\ps2.exe" [2004-10-25 09:17 90112]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 05:04 52736]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-07-10 09:18 270648]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2004-08-09 17:00 53760 C:\WINDOWS\system32\narrator.exe]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Updates From HP.lnk - C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe [2006-02-22 17:58:29 36903]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"zip"= {31f9e817-78f3-43f6-a2b9-6be4db1f4c6d} - C:\WINDOWS\Installer\{31f9e817-78f3-43f6-a2b9-6be4db1f4c6d}\zip.dll [2008-03-08 10:59 38438]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, wowfx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DISCover]
--a------ 2005-11-11 17:11 1064960 C:\Program Files\DISC\DISCover.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DiscUpdateManager]
--a------ 2005-11-11 17:10 61440 C:\Program Files\DISC\DiscUpdateMgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMAScheduler]
--a------ 2005-11-01 06:01 90112 c:\Program Files\Sonic\DigitalMedia Plus\DigitalMedia Archive\DMAScheduler.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
--a------ 2006-05-09 20:24 50760 C:\Program Files\Common Files\AOL\1147572088\ee\AOLSoftware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2007-07-10 09:18 270648 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
C:\Program Files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Veoh]
C:\Program Files\Veoh Networks\Veoh\VeohClient.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Viewpoint Manager Service"=2 (0x2)
"iPod Service"=3 (0x3)
"gusvc"=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"C:\\Program Files\\DISC\\DISCover.exe"=
"C:\\Program Files\\DISC\\DiscStreamHub.exe"=
"C:\\Program Files\\DISC\\myFTP.exe"=
"C:\\Program Files\\Updates from HP\\9972322\\Program\\Updates from HP.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"C:\\Program Files\\Common Files\\AOL\\1147572088\\ee\\aolsoftware.exe"=
"C:\\Program Files\\Common Files\\AOL\\1147572088\\ee\\aim6.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Electronic Arts\\Battlefield 2142\\BF2142.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\NCsoft\\Exteel\\System\\Exteel.exe"=
"C:\\Program Files\\Warcraft III\\Warcraft III.exe"=
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"= C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"= C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"= C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9842:TCP"= 9842:TCP:*:Disabled:SolidNetworkManager
"9842:UDP"= 9842:UDP:*:Disabled:SolidNetworkManager
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R2 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" [2007-01-04 17:38]
S3 inwrdr;inwrdr;C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\inwrdr.sys []
S3 nenum13E;nenum13E;C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\nenum13E.sys []
S3 tbcspud;Santa Cruz Driver;C:\WINDOWS\system32\drivers\tbcspud.sys []
S3 tbcwdm;Santa Cruz WDM Driver;C:\WINDOWS\system32\drivers\tbcwdm.sys []
S3 vtdg46xx;vtdg46xx;C:\PROGRA~1\TURTLE~1\SANTAC~1\CONTRO~1\vtdg46xx.sys []
S3 XDva020;XDva020;C:\WINDOWS\system32\XDva020.sys []
S3 XDva037;XDva037;C:\WINDOWS\system32\XDva037.sys []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J]
\Shell\AutoRun\command - J:\autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{47876b4c-f72b-11da-8a91-0015f2eb0b2a}]
\Shell\AutoRun\command - J:\JDSecure\Windows\JDSecure20.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{56ac6ba3-ef32-11da-8a81-0015f2eb0b2a}]
\Shell\AutoRun\command - J:\JDSecure\Windows\JDSecure20.exe

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-11 00:54:22
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\explorer.exe [6.00.2900.3156]
-> C:\WINDOWS\Installer\{31f9e817-78f3-43f6-a2b9-6be4db1f4c6d}\zip.dll
.
Completion time: 2008-03-11 0:55:08
.
2007-11-28 06:53:27 --- E O F ---

#23
sarahw

Posted 10 March 2008 - 11:05 PM

Malware Staff

Member
2,781 posts

1. Please open Notepad

Click Start , then Run
Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

File::
C:\WINDOWS\Installer\{31f9e817-78f3-43f6-a2b9-6be4db1f4c6d}\zip.dll

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"zip"=-

3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

Posted Image

5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

Combofix.txt
A new HijackThis log.

#24
Mswei

Posted 10 March 2008 - 11:11 PM

Member

Topic Starter
Member
23 posts

Almost there methinks! Thank you a million times over!!

Here's the updated logs:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:10, on 2008-03-11
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\arservice.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\UTSCSI.EXE
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\ARPWRMSG.EXE
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
C:\HP\KBD\KBD.EXE
C:\windows\system\hpsysdrv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\Hija\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.h...a...&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [ps2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - Global Startup: Updates From HP.lnk = C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=67633
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?LinkID=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1148076574859
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://technisource...ort/ieatgpc.cab
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: CLCV0 (UTSCSI) - Unknown owner - C:\WINDOWS\system32\UTSCSI.EXE
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--
End of file - 6940 bytes

And combofix:
ComboFix 08-03-10.1 - HP_Administrator 2008-03-11 1:09:06.11 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.585 [GMT -4:00]
Running from: C:\Documents and Settings\HP_Administrator\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\HP_Administrator\Desktop\CFScript.txt
* Created a new restore point

FILE ::
C:\WINDOWS\Installer\{31f9e817-78f3-43f6-a2b9-6be4db1f4c6d}\zip.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\Installer\{31f9e817-78f3-43f6-a2b9-6be4db1f4c6d}\zip.dll

.
((((((((((((((((((((((((( Files Created from 2008-02-11 to 2008-03-11 )))))))))))))))))))))))))))))))
.

2008-03-10 19:48 . 2006-10-12 04:10 49,265 --a------ C:\WINDOWS\system32\jpicpl32.cpl
2008-03-10 01:37 . 2008-03-10 00:13 102,664 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys
2008-03-10 00:13 . 2008-03-10 01:37 <DIR> d-------- C:\Documents and Settings\HP_Administrator\.housecall6.6
2008-03-09 15:47 . 2008-03-09 15:47 <DIR> d-------- C:\Documents and Settings\HP_Administrator\Application Data\Grisoft
2008-03-09 15:27 . 2008-03-09 15:44 <DIR> d-------- C:\Mr Wacky's Adventure
2008-03-08 11:09 . 2008-03-08 11:09 <DIR> d-------- C:\Program Files\SysCleaner
2008-03-08 10:59 . 2008-03-08 10:59 <DIR> d-------- C:\Program Files\IE Extensions
2008-03-06 00:55 . 2008-03-06 00:55 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\acccore
2008-03-05 22:37 . 2008-03-06 00:33 <DIR> d-------- C:\Program Files\Trend Micro
2008-03-05 22:28 . 2007-01-18 08:00 3,968 --a------ C:\WINDOWS\system32\drivers\AvgArCln.sys
2008-03-05 22:27 . 2007-05-30 08:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-03-05 22:26 . 2008-03-06 00:38 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-03-05 22:07 . 2008-03-05 22:07 <DIR> d---s---- C:\Documents and Settings\Administrator\UserData
2008-03-03 22:46 . 2008-03-03 22:46 <DIR> d-------- C:\Program Files\Your Company Name
2008-03-03 22:46 . 2008-03-03 22:46 <DIR> d-------- C:\Program Files\Total Seminars
2008-02-22 12:02 . 2008-02-22 12:02 202,827 --a------ C:\WINDOWS\system32\atasnt40.dll
2008-02-22 12:01 . 2008-02-22 12:01 51,304 --a------ C:\WINDOWS\system32\drivers\atnt40k.sys
2008-02-22 00:25 . 2008-02-22 00:25 <DIR> d-------- C:\Program Files\OGPlanet
2008-02-14 03:08 . 2008-02-14 03:08 <DIR> d-------- C:\Program Files\MSECache
2008-02-14 03:08 . 2008-02-14 03:08 <DIR> d-------- C:\Program Files\Microsoft Office Outlook Connector
2008-02-14 03:07 . 2008-02-14 03:07 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-11 04:46 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-11 04:46 --------- d-----w C:\Program Files\Philips
2008-03-11 04:46 --------- d-----w C:\Program Files\Google
2008-03-11 03:53 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL
2008-03-11 03:49 --------- d-----w C:\Program Files\Common Files\Real
2008-03-10 23:57 --------- d-----w C:\Program Files\Common Files\Ahead
2008-03-10 23:54 --------- d-----w C:\Program Files\Common Files\Sonic Shared
2008-03-10 23:54 --------- d-----w C:\Program Files\Common Files\HP
2008-03-10 23:48 --------- d-----w C:\Program Files\Java
2008-03-06 02:50 1,626,112 ----a-w C:\WINDOWS\system32\nwiz.exe
2008-03-06 02:10 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-03-05 13:45 --------- d-----w C:\Program Files\Incomplete
2008-03-05 13:35 --------- d-----w C:\Program Files\LimeWire
2008-03-05 13:35 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\LimeWire
2008-03-05 06:24 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\gtk-2.0
2008-03-03 23:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-03-03 04:31 --------- d-----w C:\Program Files\World of Warcraft
2008-02-29 23:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL Downloads
2008-02-26 07:54 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-26 07:52 --------- d-----w C:\Program Files\Sword of The New World
2008-02-26 07:51 --------- d-----w C:\Program Files\MasterOfDefense_at
2008-02-22 14:24 --------- d-----w C:\Documents and Settings\Technisource VPN\Application Data\ICAClient
2008-02-14 07:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-02-14 07:24 --------- d-----w C:\Program Files\Microsoft ActiveSync
2008-02-08 21:56 --------- d-----w C:\Documents and Settings\Technisource VPN\Application Data\acccore
2008-02-08 19:40 --------- d-----w C:\Documents and Settings\Technisource VPN\Application Data\DWRCC
2008-02-08 19:37 --------- d-----w C:\Documents and Settings\Technisource VPN\Application Data\DameWare Development
2008-02-08 19:36 --------- d-----w C:\Program Files\DameWare Development
2008-02-08 19:24 --------- d-----w C:\Program Files\SJLabs
2008-02-08 19:24 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-02-08 19:14 --------- d-----w C:\Program Files\Common Files\Crystal Decisions
2008-02-08 19:14 --------- d-----w C:\Program Files\AR System
2008-02-08 19:14 --------- d-----w C:\Documents and Settings\Technisource VPN\Application Data\AR System
2008-02-05 06:28 --------- d-----w C:\Program Files\WowGasm
2008-02-05 04:31 --------- d-----w C:\Program Files\Warcraft III
2008-02-04 23:23 693,792 ----a-w C:\WINDOWS\system32\OGACheckControl.DLL
2008-02-04 06:48 139,264 ----a-w C:\WINDOWS\War3Unin.exe
2008-02-01 01:44 45,056 ----a-w C:\WINDOWS\system32\UTSCSI.EXE
2008-02-01 00:46 --------- d-----w C:\Program Files\support.com
2008-02-01 00:46 --------- d-----w C:\Program Files\Common Files\SupportSoft
2008-01-25 02:58 --------- d-----w C:\Program Files\CCleaner
2008-01-23 06:33 --------- d-----w C:\Program Files\Common Files\INCA Shared
2008-01-16 07:17 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\ICAClient
2007-12-20 03:47 846,504 ----a-w C:\Documents and Settings\HP_Administrator\JNativeCpp.dll
2007-12-11 19:46 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2007-12-11 19:46 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2007-12-11 19:46 129,784 ------w C:\WINDOWS\system32\pxafs.dll
2007-12-11 19:46 120,056 ------w C:\WINDOWS\system32\pxcpyi64.exe
2007-12-11 19:46 118,520 ------w C:\WINDOWS\system32\pxinsi64.exe
2007-12-11 19:45 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2007-12-11 19:45 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2007-12-11 19:43 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2007-04-23 05:51 32 ----a-r C:\Documents and Settings\All Users\hash.dat
2007-06-21 23:38 30,280 ----a-w C:\Program Files\mozilla firefox\plugins\cgpcfg.dll
2007-06-21 23:38 79,432 ----a-w C:\Program Files\mozilla firefox\plugins\CgpCore.dll
2007-06-21 23:38 71,240 ----a-w C:\Program Files\mozilla firefox\plugins\confmgr.dll
2007-06-21 23:38 140,872 ----a-w C:\Program Files\mozilla firefox\plugins\ctxmui.dll
2007-06-21 23:39 38,472 ----a-w C:\Program Files\mozilla firefox\plugins\icafile.dll
2007-06-21 23:39 46,664 ----a-w C:\Program Files\mozilla firefox\plugins\icalogon.dll
2007-06-21 23:39 34,376 ----a-w C:\Program Files\mozilla firefox\plugins\logging.dll
2007-06-21 23:39 685,640 ----a-w C:\Program Files\mozilla firefox\plugins\sslsdk_b.dll
2007-06-21 23:40 30,280 ----a-w C:\Program Files\mozilla firefox\plugins\TcpPServ.dll
2006-05-03 09:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll
2007-02-21 10:47 31,232 --sh--r C:\WINDOWS\system32\msfDX.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-09 17:00 15360]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 14:39 1289000]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-05 17:56 64512]
"AlwaysReady Power Message APP"="ARPWRMSG.EXE" [2005-08-02 20:19 77312 C:\WINDOWS\arpwrmsg.exe]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-10-04 18:14 8491008]
"nwiz"="nwiz.exe" [2008-03-05 22:50 1626112 C:\WINDOWS\system32\nwiz.exe]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [ ]
"PCDrProfiler"="" []
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPwuSchd2.exe" [2005-05-12 03:12 49152]
"IPHSend"="C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe" [ ]
"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [ ]
"RTHDCPL"="RTHDCPL.EXE" [2006-01-23 06:53 15969280 C:\WINDOWS\RTHDCPL.EXE]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [ ]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [ ]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\point32.exe" [2005-06-10 05:21 217088]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-10-04 18:14 81920]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe" [2005-08-26 22:14 36975]
"KBD"="C:\HP\KBD\KBD.EXE" [2005-02-02 11:44 61440]
"ps2"="C:\WINDOWS\system32\ps2.exe" [2004-10-25 09:17 90112]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 05:04 52736]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-07-10 09:18 270648]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2004-08-09 17:00 53760 C:\WINDOWS\system32\narrator.exe]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Updates From HP.lnk - C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe [2006-02-22 17:58:29 36903]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, wowfx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DISCover]
--a------ 2005-11-11 17:11 1064960 C:\Program Files\DISC\DISCover.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DiscUpdateManager]
--a------ 2005-11-11 17:10 61440 C:\Program Files\DISC\DiscUpdateMgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMAScheduler]
--a------ 2005-11-01 06:01 90112 c:\Program Files\Sonic\DigitalMedia Plus\DigitalMedia Archive\DMAScheduler.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
--a------ 2006-05-09 20:24 50760 C:\Program Files\Common Files\AOL\1147572088\ee\AOLSoftware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2007-07-10 09:18 270648 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
C:\Program Files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Veoh]
C:\Program Files\Veoh Networks\Veoh\VeohClient.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Viewpoint Manager Service"=2 (0x2)
"iPod Service"=3 (0x3)
"gusvc"=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"C:\\Program Files\\DISC\\DISCover.exe"=
"C:\\Program Files\\DISC\\DiscStreamHub.exe"=
"C:\\Program Files\\DISC\\myFTP.exe"=
"C:\\Program Files\\Updates from HP\\9972322\\Program\\Updates from HP.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"C:\\Program Files\\Common Files\\AOL\\1147572088\\ee\\aolsoftware.exe"=
"C:\\Program Files\\Common Files\\AOL\\1147572088\\ee\\aim6.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Electronic Arts\\Battlefield 2142\\BF2142.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\NCsoft\\Exteel\\System\\Exteel.exe"=
"C:\\Program Files\\Warcraft III\\Warcraft III.exe"=
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"= C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"= C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"= C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9842:TCP"= 9842:TCP:*:Disabled:SolidNetworkManager
"9842:UDP"= 9842:UDP:*:Disabled:SolidNetworkManager
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R2 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" [2007-01-04 17:38]
S3 inwrdr;inwrdr;C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\inwrdr.sys []
S3 nenum13E;nenum13E;C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\nenum13E.sys []
S3 tbcspud;Santa Cruz Driver;C:\WINDOWS\system32\drivers\tbcspud.sys []
S3 tbcwdm;Santa Cruz WDM Driver;C:\WINDOWS\system32\drivers\tbcwdm.sys []
S3 vtdg46xx;vtdg46xx;C:\PROGRA~1\TURTLE~1\SANTAC~1\CONTRO~1\vtdg46xx.sys []
S3 XDva020;XDva020;C:\WINDOWS\system32\XDva020.sys []
S3 XDva037;XDva037;C:\WINDOWS\system32\XDva037.sys []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J]
\Shell\AutoRun\command - J:\autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{47876b4c-f72b-11da-8a91-0015f2eb0b2a}]
\Shell\AutoRun\command - J:\JDSecure\Windows\JDSecure20.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{56ac6ba3-ef32-11da-8a81-0015f2eb0b2a}]
\Shell\AutoRun\command - J:\JDSecure\Windows\JDSecure20.exe

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-11 01:09:47
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-03-11 1:10:24
ComboFix-quarantined-files.txt 2008-03-11 05:10:23
ComboFix2.txt 2008-03-11 04:55:09
.
2007-11-28 06:53:27 --- E O F ---

#25
sarahw

Posted 11 March 2008 - 12:36 AM

Malware Staff

Member
2,781 posts

1.
First download AVG Anti-Spyware from HERE and save that file to your desktop.
This is a 30 day trial of the program

Once you have downloaded AVG Anti-Spyware, locate the icon on the desktop and double-click it to launch the set up program.
Once the setup is complete you will need run AVG Anti-Spyware and update the definition files.
On the main screen select the icon "Update" then select the "Update now" link.
- Next select the "Start Update" button, the update will start and a progress bar will show the updates being installed.
Once the update has completed select the "Scanner" icon at the top of the screen, then select the "Settings" tab.
Once in the Settings screen click on "Recommended actions" and then select "Quarantine".
Under "Reports"
- Select "Automatically generate report after every scan"
- Un-Select "Only if threats were found"

Close AVG Anti-Spyware, Do Not run a scan just yet, we will shortly.

2.
Please download ATF Cleaner by Atribune.
This program is for XP and Windows 2000 only
Do not Run it yet, we will use it later. Save it somewhere you will remember, like your desktop.

3.
Reboot into Safe Mode by continuously tapping the F8 key as soon as the computer begins to boot. A menu should come up where you will be given the option to enter Safe Mode.

4.
Please open ATF Cleaner by Atribune.
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

5.

IMPORTANT: Do not open any other windows or programs while AVG Anti-Spyware is scanning, it may interfere with the scanning proccess:
Lauch AVG Anti-Spyware by double-clicking the icon on your desktop.
Select the "Scanner" icon at the top and then the "Scan" tab then click on "Complete System Scan".
AVG Anti-Spyware will now begin the scanning process, be patient this may take a little time.
Once the scan is complete do the following:
If you have any infections you will prompted, then select "Apply all actions"
Next select the "Reports" icon at the top.
Select the "Save report as" button in the lower left hand of the screen and save it to a text file on your system (make sure to remember where you saved that file, this is important).
Close AVG Anti-Spyware and reboot your system back into Normal Mode and post the results of the AVG Anti-Spyware report scan.

6.
Please do an online scan with Kaspersky WebScanner

Click on Kaspersky Online Scanner

You will be promted to install an ActiveX component from Kaspersky, Click Yes.

The program will launch and then begin downloading the latest definition files:
Once the files have been downloaded click on NEXT
Now click on Scan Settings
In the scan settings make that the following are selected:
- Scan using the following Anti-Virus database:
Extended (if available otherwise Standard)
- Scan Options:
Scan Archives
Scan Mail Bases
Click OK
Now under select a target to scan:Select My Computer
This will program will start and scan your system.
The scan will take a while so be patient and let it run.
Once the scan is complete it will display if your system has been infected.
- Now click on the Save as Text button:
Save the file to your desktop.
Copy and paste that information in your next post.

#26
Mswei

Posted 11 March 2008 - 07:27 PM

Member

Topic Starter
Member
23 posts

Hi again

here's the latest round of logs:

Kaspersky log:
-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
2008-03-11 19:41
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 11/03/2008
Kaspersky Anti-Virus database records: 623805
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\
E:\
F:\
G:\
H:\
I:\

Scan Statistics:
Total number of scanned objects: 135853
Number of viruses found: 21
Number of infected objects: 61
Number of suspicious objects: 0
Duration of the scan process: 02:12:41

Infected Object Name / Virus Name / Last Action
C:\ddd188945be5cea4537625c7a334\Jet Li - Fearless - 2006 - english subs - DVDRip DivX - TRUS.avi.3GP Object is locked skipped
C:\Documents and Settings\Administrator\Desktop\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\Administrator\Desktop\SmitfraudFix.exe/data.rar/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\Administrator\Desktop\SmitfraudFix.exe/data.rar Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\Administrator\Desktop\SmitfraudFix.exe RarSFX: infected - 2 skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\511a0f3f9e960fa97de3d0b74adfc574_45d8759b-b288-4ac5-ac0c-2d9146699c63 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\9ae7dbf3e956892ad6f0fa4a7df110c3_45d8759b-b288-4ac5-ac0c-2d9146699c63 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\eHome\logs\ehRecvr.log Object is locked skipped
C:\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\5d37d31e-4899d11a.bac_a03656/GetAccess.class Infected: Trojan-Downloader.Java.OpenConnection.aj skipped
C:\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\5d37d31e-4899d11a.bac_a03656/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.aj skipped
C:\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\5d37d31e-4899d11a.bac_a03656/NewSecurityClassLoader.class Infected: Exploit.Java.ByteVerify skipped
C:\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\5d37d31e-4899d11a.bac_a03656/NewURLClassLoader.class Infected: Exploit.Java.ByteVerify skipped
C:\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\5d37d31e-4899d11a.bac_a03656 ZIP: infected - 4 skipped
C:\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\5d37d31e-4899d11a.bac_a03656 CryptFF.b: infected - 4 skipped
C:\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\6217252a-672c5c96.bac_a03656/Matrix.class Infected: Trojan-Downloader.Java.OpenStream.c skipped
C:\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\6217252a-672c5c96.bac_a03656/Counter.class Infected: Trojan.Java.ClassLoader.h skipped
C:\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\6217252a-672c5c96.bac_a03656/Parser.class Infected: Trojan.Java.ClassLoader.d skipped
C:\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\6217252a-672c5c96.bac_a03656 ZIP: infected - 3 skipped
C:\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\6217252a-672c5c96.bac_a03656 CryptFF.b: infected - 3 skipped
C:\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\catchme2008-03-09_170311.32.zip.bac_a03656/wowfx.dll Infected: Trojan.Win32.Qhost.abh skipped
C:\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\catchme2008-03-09_170311.32.zip.bac_a03656/efcbcya.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\catchme2008-03-09_170311.32.zip.bac_a03656 ZIP: infected - 2 skipped
C:\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\catchme2008-03-09_170311.32.zip.bac_a03656 CryptFF.b: infected - 2 skipped
C:\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\cru629.dat.vir.bac_a03656 Infected: Backdoor.Win32.Small.cyb skipped
C:\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\ddcdcdc.dll.vir.bac_a03656 Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\drvlon.dll.vir.bac_a03656 Infected: Trojan.Win32.Dialer.yz skipped
C:\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\gwbktpmt.dll.vir.bac_a03656 Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\hkerklck.dll.vir.bac_a03656 Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\mgqnhusi.dll.vir.bac_a03656 Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\mmesckoj.exe.vir.bac_a03656 Infected: Trojan.Win32.Agent.giy skipped
C:\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\ohlgqwrj.dll.vir.bac_a03656 Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\printer.exe.vir.bac_a03656 Infected: Trojan.Win32.Qhost.aes skipped
C:\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\vuvxcryc.dll.vir.bac_a03656 Infected: not-a-virus:AdWare.Win32.Virtumonde.jxa skipped
C:\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\wowfx.dll.vir.bac_a03656 Infected: Trojan.Win32.Qhost.abh skipped
C:\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\xlth.exe.vir.bac_a03656 Infected: Trojan-Downloader.Win32.Agent.hyy skipped
C:\Documents and Settings\HP_Administrator\Application Data\$_hpcst$.hpc Object is locked skipped
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\30\5d37d31e-4899d11a/GetAccess.class Infected: Trojan-Downloader.Java.OpenConnection.aj skipped
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\30\5d37d31e-4899d11a/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.aj skipped
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\30\5d37d31e-4899d11a/NewSecurityClassLoader.class Infected: Exploit.Java.ByteVerify skipped
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\30\5d37d31e-4899d11a/NewURLClassLoader.class Infected: Exploit.Java.ByteVerify skipped
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\30\5d37d31e-4899d11a ZIP: infected - 4 skipped
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\42\6217252a-672c5c96/Matrix.class Infected: Trojan-Downloader.Java.OpenStream.c skipped
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\42\6217252a-672c5c96/Counter.class Infected: Trojan.Java.ClassLoader.h skipped
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\42\6217252a-672c5c96/Parser.class Infected: Trojan.Java.ClassLoader.d skipped
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\42\6217252a-672c5c96 ZIP: infected - 3 skipped
C:\Documents and Settings\HP_Administrator\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\HP_Administrator\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\HP_Administrator\Local Settings\Temp\WCESLog.log Object is locked skipped
C:\Documents and Settings\HP_Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\HP_Administrator\ntuser.dat Object is locked skipped
C:\Documents and Settings\HP_Administrator\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Technisource VPN\taw\othread2.dll Infected: not-a-virus:RemoteAdmin.Win32.WinVNC-based.c skipped
C:\Documents and Settings\Technisource VPN\taw\vnchooks.dll Infected: not-a-virus:RemoteAdmin.Win32.WinVNC-based.c skipped
C:\Program Files\BearShare\Installer\BSInstall5.2.5.1.exe/WISE0026.BIN/clientax.dll Infected: not-a-virus:AdWare.Win32.180Solutions.ao skipped
C:\Program Files\BearShare\Installer\BSInstall5.2.5.1.exe/WISE0026.BIN Infected: not-a-virus:AdWare.Win32.180Solutions.ao skipped
C:\Program Files\BearShare\Installer\BSInstall5.2.5.1.exe WiseSFX: infected - 2 skipped
C:\Program Files\BearShare\Installer\BSInstall5.2.5.1.exe WiseSFXDropper: infected - 2 skipped
C:\Program Files\Updates from HP\9972322\Users\Default\Data\chandir.dat Object is locked skipped
C:\Program Files\Updates from HP\9972322\Users\Default\Data\chandir.idx Object is locked skipped
C:\Program Files\Updates from HP\9972322\Users\Default\Data\chn.dat Object is locked skipped
C:\Program Files\Updates from HP\9972322\Users\Default\Data\chn.idx Object is locked skipped
C:\Program Files\Updates from HP\9972322\Users\Default\Data\D0000000.FCS Object is locked skipped
C:\Program Files\Updates from HP\9972322\Users\Default\Data\inuse.txt Object is locked skipped
C:\Program Files\Updates from HP\9972322\Users\Default\Data\L0000001.FCS Object is locked skipped
C:\Program Files\Updates from HP\9972322\Users\Default\Data\main.log Object is locked skipped
C:\Program Files\Updates from HP\9972322\Users\Default\Data\prs.dat Object is locked skipped
C:\Program Files\Updates from HP\9972322\Users\Default\Data\prs.idx Object is locked skipped
C:\Program Files\Updates from HP\9972322\Users\Default\Data\prs_die.dat Object is locked skipped
C:\Program Files\Updates from HP\9972322\Users\Default\Data\prs_die.idx Object is locked skipped
C:\Program Files\Updates from HP\9972322\Users\Default\Data\prs_dnd.dat Object is locked skipped
C:\Program Files\Updates from HP\9972322\Users\Default\Data\prs_dnd.idx Object is locked skipped
C:\Program Files\Updates from HP\9972322\Users\Default\Data\prs_ext.dat Object is locked skipped
C:\Program Files\Updates from HP\9972322\Users\Default\Data\prs_ext.idx Object is locked skipped
C:\Program Files\Updates from HP\9972322\Users\Default\Data\prs_rcv.dat Object is locked skipped
C:\Program Files\Updates from HP\9972322\Users\Default\Data\prs_rcv.idx Object is locked skipped
C:\Program Files\Updates from HP\9972322\Users\Default\Data\storydb.dat Object is locked skipped
C:\Program Files\Updates from HP\9972322\Users\Default\Data\storydb.idx Object is locked skipped
C:\QooBox\Quarantine\C\WINDOWS\Installer\{31f9e817-78f3-43f6-a2b9-6be4db1f4c6d}\zip.dll.vir Infected: Trojan-Downloader.Win32.BHO.ct skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP13\A0002457.dll Infected: Trojan-Downloader.Win32.BHO.ct skipped
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP13\change.log Object is locked skipped
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP2\A0000129.exe Infected: Trojan-Downloader.Win32.Agent.knf skipped
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP2\A0000130.exe Infected: Trojan.Win32.Agent.giy skipped
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP2\A0000133.exe Infected: Trojan-Dropper.Win32.Agent.ftu skipped
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP2\A0000134.exe Infected: Trojan-Dropper.Win32.Agent.ftu skipped
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP2\A0000135.exe Infected: Trojan-Dropper.Win32.Agent.ftu skipped
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP2\A0000136.exe Infected: Trojan-Dropper.Win32.Agent.ftu skipped
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP2\A0000141.exe Infected: Trojan-Dropper.Win32.FriJoiner.lx skipped
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP3\A0000210.dll Infected: Trojan.Win32.Dialer.yz skipped
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP4\A0000299.exe Infected: Trojan-Dropper.Win32.Agent.ftu skipped
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP4\A0000300.exe Infected: Trojan-Dropper.Win32.Agent.ftu skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\Installer\{25252fb4-a995-4532-b207-87c853dd4b17}\zip.dll Infected: Trojan-Dropper.Win32.Agent.ftu skipped
C:\WINDOWS\Installer\{4cf02772-dab1-4018-a7ee-5bbb9ea36771}\zip.dll Infected: Trojan-Dropper.Win32.Agent.ftu skipped
C:\WINDOWS\Installer\{9f548e5a-2138-4a5f-b37d-c8f8ed5d0082}\BootRam.dll Infected: Trojan.Win32.Agent.feh skipped
C:\WINDOWS\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{BF2A1EF7-5922-406B-956B-C25D58117271}.crmlog Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{A447B749-D66C-4EE2-A3DE-8AB22FD01486}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\Media Ce.evt Object is locked skipped
C:\WINDOWS\system32\config\ODiag.evt Object is locked skipped
C:\WINDOWS\system32\config\OSession.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\LogFiles\HTTPERR\httperr1.log Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.

Newest HJT:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:26, on 2008-03-11
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
C:\HP\KBD\KBD.EXE
C:\windows\system\hpsysdrv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\WINDOWS\arservice.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\UTSCSI.EXE
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\Hija\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.h...a...&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [ps2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - Global Startup: Updates From HP.lnk = C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=67633
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky...can_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?LinkID=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1148076574859
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://technisource...ort/ieatgpc.cab
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: CLCV0 (UTSCSI) - Unknown owner - C:\WINDOWS\system32\UTSCSI.EXE
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--
End of file - 7173 bytes

I wasn't able to save the report from AVG. It was set to automatically generate a report, and nothing came up =/ no files found except a tracking cookie from 180solutions.

Be in the chat again tonight, ill look forward to speaking with you on this matter there!

#27
sarahw

Posted 12 March 2008 - 03:35 PM

Malware Staff

Member
2,781 posts

1. Please open Notepad

Click Start , then Run
Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

Folder::
C:\Documents and Settings\HP_Administrator\Application Data\Sun
C:\Documents and Settings\HP_Administrator\.housecall6.6
C:\WINDOWS\Installer\{25252fb4-a995-4532-b207-87c853dd4b17}
C:\WINDOWS\Installer\{4cf02772-dab1-4018-a7ee-5bbb9ea36771}
C:\WINDOWS\Installer\{9f548e5a-2138-4a5f-b37d-c8f8ed5d0082}

3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

Posted Image

5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

Combofix.txt
A new HijackThis log.

#28
Mswei

Posted 12 March 2008 - 09:17 PM

Member

Topic Starter
Member
23 posts

Hi Sarah!! Here's the next couple of logfiles: Enjoy!

ComboFix 08-03-10.1 - HP_Administrator 2008-03-12 23:11:59.12 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.613 [GMT -4:00]
Running from: C:\Documents and Settings\HP_Administrator\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\HP_Administrator\Desktop\CFScript.txt
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\HP_Administrator\.housecall6.6
C:\Documents and Settings\HP_Administrator\.housecall6.6\8ball.txt
C:\Documents and Settings\HP_Administrator\.housecall6.6\AU_Log\TmuDump.txt
C:\Documents and Settings\HP_Administrator\.housecall6.6\aucfg.ini
C:\Documents and Settings\HP_Administrator\.housecall6.6\BPMNT.dll
C:\Documents and Settings\HP_Administrator\.housecall6.6\ciussi32.dll
C:\Documents and Settings\HP_Administrator\.housecall6.6\dsvout.dll
C:\Documents and Settings\HP_Administrator\.housecall6.6\engine.stat
C:\Documents and Settings\HP_Administrator\.housecall6.6\getMac.exe
C:\Documents and Settings\HP_Administrator\.housecall6.6\GetServer.ini
C:\Documents and Settings\HP_Administrator\.housecall6.6\jsapi.dll
C:\Documents and Settings\HP_Administrator\.housecall6.6\jupdate.dll
C:\Documents and Settings\HP_Administrator\.housecall6.6\local.conf
C:\Documents and Settings\HP_Administrator\.housecall6.6\log\2008-03-10-00-13-10.infections
C:\Documents and Settings\HP_Administrator\.housecall6.6\log\2008-03-10-01-36-20.temp
C:\Documents and Settings\HP_Administrator\.housecall6.6\log\dsvout.log
C:\Documents and Settings\HP_Administrator\.housecall6.6\log\engine0.log
C:\Documents and Settings\HP_Administrator\.housecall6.6\log\engine0.log.lck
C:\Documents and Settings\HP_Administrator\.housecall6.6\log\error0.log
C:\Documents and Settings\HP_Administrator\.housecall6.6\log\error0.log.lck
C:\Documents and Settings\HP_Administrator\.housecall6.6\log\execution0.log
C:\Documents and Settings\HP_Administrator\.housecall6.6\log\execution0.log.lck
C:\Documents and Settings\HP_Administrator\.housecall6.6\patch.exe
C:\Documents and Settings\HP_Administrator\.housecall6.6\PATCHW32.DLL
C:\Documents and Settings\HP_Administrator\.housecall6.6\Pattern\lpt$vpn.147
C:\Documents and Settings\HP_Administrator\.housecall6.6\Pattern\lpt$vpn.149
C:\Documents and Settings\HP_Administrator\.housecall6.6\Pattern\tmaptn.587
C:\Documents and Settings\HP_Administrator\.housecall6.6\Pattern\tmvamain.ptn
C:\Documents and Settings\HP_Administrator\.housecall6.6\Pattern\tsc.ptn
C:\Documents and Settings\HP_Administrator\.housecall6.6\ssapi32.dll
C:\Documents and Settings\HP_Administrator\.housecall6.6\ssapiptn.da5
C:\Documents and Settings\HP_Administrator\.housecall6.6\tmcomm.sys
C:\Documents and Settings\HP_Administrator\.housecall6.6\TmEngDrv.dll
C:\Documents and Settings\HP_Administrator\.housecall6.6\TmUpdate.dll
C:\Documents and Settings\HP_Administrator\.housecall6.6\TSC.exe
C:\Documents and Settings\HP_Administrator\.housecall6.6\Update\AU_Cache\housecall65.trendmicro.com\ini_xml.zip
C:\Documents and Settings\HP_Administrator\.housecall6.6\Update\AU_Cache\housecall65.trendmicro.com\ini_xml.zip.etag
C:\Documents and Settings\HP_Administrator\.housecall6.6\Update\AU_Cache\housecall65.trendmicro.com\server.ini
C:\Documents and Settings\HP_Administrator\.housecall6.6\Update\AU_Cache\housecall65.trendmicro.com\server.ini.etag
C:\Documents and Settings\HP_Administrator\.housecall6.6\usrbl.dat
C:\Documents and Settings\HP_Administrator\.housecall6.6\usrwl.dat
C:\Documents and Settings\HP_Administrator\.housecall6.6\vsapi32.dll
C:\Documents and Settings\HP_Administrator\.housecall6.6\vscan.dat
C:\Documents and Settings\HP_Administrator\Application Data\Sun
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\0\1f813880-46e5b0ce
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\0\1f813880-46e5b0ce.idx
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\10\38b5ad4a-65f43162
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\10\38b5ad4a-65f43162.idx
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\10\66afa8ca-23a81b92
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\10\66afa8ca-23a81b92.idx
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\17\31eb5491-217030ac
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\17\31eb5491-217030ac.idx
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\22\7f082b16-55485225
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\22\7f082b16-55485225.idx
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\22\bbe58d6-41bd43d0
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\22\bbe58d6-41bd43d0.idx
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\23\53d711d7-7f3d84ec
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\23\53d711d7-7f3d84ec.idx
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\25\10c08519-6c51acd4
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\25\10c08519-6c51acd4.idx
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\25\1baccf99-24b3d823
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\25\1baccf99-24b3d823.idx
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\27\100bd9b-6a55bb2e
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\27\100bd9b-6a55bb2e.idx
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\28\7e354cdc-64134a66
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\28\7e354cdc-64134a66.idx
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\30\5d37d31e-4899d11a
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\30\5d37d31e-4899d11a.idx
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\30\630b711e-53fa28f7
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\30\630b711e-53fa28f7.idx
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\31\7d32ed9f-44f79317
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\31\7d32ed9f-44f79317.idx
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\32\3c4f68e0-54961942
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\32\3c4f68e0-54961942.idx
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\32\4332d3e0-182794a6
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\32\4332d3e0-182794a6.idx
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\38\2dbf59e6-38af6caa
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\38\2dbf59e6-38af6caa.idx
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\4\2ccc2e84-66779420
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\4\2ccc2e84-66779420.idx
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\40\3daf01e8-6b69c5f0
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\40\3daf01e8-6b69c5f0.idx
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\41\697257e9-7fd2f8ec
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\41\697257e9-7fd2f8ec.idx
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\42\532e282a-5d676e75
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\42\532e282a-5d676e75.idx
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\42\6217252a-672c5c96
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\42\6217252a-672c5c96.idx
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\43\7bee282b-3d2c26a4
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\43\7bee282b-3d2c26a4.idx
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\47\4b46a2ef-27721caa
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\47\4b46a2ef-27721caa.idx
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\5\412ac385-5a3decf6
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\5\412ac385-5a3decf6.idx
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\50\7570acf2-4a7ca105
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\50\7570acf2-4a7ca105.idx
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\51\19eec2f3-6608d972
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\51\19eec2f3-6608d972.idx
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\51\7f4efbf3-10c4bf9b
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\51\7f4efbf3-10c4bf9b.idx
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\52\8c793f4-553e1246
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\52\8c793f4-553e1246.idx
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\57\41580779-2f472b1a
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\57\41580779-2f472b1a.idx
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\59\656d0dfb-35443bb5
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\59\656d0dfb-35443bb5.idx
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\6\4498f886-453c8860
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\6\4498f886-453c8860.idx
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\60\4c4627fc-4efd7530
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\60\4c4627fc-4efd7530.idx
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\61\4e9f9bbd-49576d40
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\61\4e9f9bbd-49576d40.idx
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\7\7d9bbfc7-7ee3ba12
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\7\7d9bbfc7-7ee3ba12.idx
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\9\3c0ee589-34a9c490
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\9\3c0ee589-34a9c490.idx
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\9\578cba89-37ae8cbb
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\9\578cba89-37ae8cbb.idx
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\host\14451435-51a11d9a.hst
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\host\2744bac0-446a8eeb.hst
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\host\3ee22d56-1ec5d994.hst
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\host\65dad791-5dd52121.hst
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\host\774946aa-67901691.hst
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\host\7b705e20-79d0835e.hst
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\lastAccessed
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\deployment.properties
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\log\plugin150_05.trace
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\log\plugin150_06.trace
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\log\plugin150_09.trace
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\security\auth.dat
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\security\trusted.certs
C:\WINDOWS\Installer\{25252fb4-a995-4532-b207-87c853dd4b17}
C:\WINDOWS\Installer\{25252fb4-a995-4532-b207-87c853dd4b17}\zip.dll
C:\WINDOWS\Installer\{4cf02772-dab1-4018-a7ee-5bbb9ea36771}
C:\WINDOWS\Installer\{4cf02772-dab1-4018-a7ee-5bbb9ea36771}\zip.dll
C:\WINDOWS\Installer\{9f548e5a-2138-4a5f-b37d-c8f8ed5d0082}
C:\WINDOWS\Installer\{9f548e5a-2138-4a5f-b37d-c8f8ed5d0082}\BootRam.dll

.
((((((((((((((((((((((((( Files Created from 2008-02-13 to 2008-03-13 )))))))))))))))))))))))))))))))
.

2008-03-11 07:47 . 2008-03-11 07:47 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-03-11 07:47 . 2008-03-11 07:47 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-03-10 19:48 . 2006-10-12 04:10 49,265 --a------ C:\WINDOWS\system32\jpicpl32.cpl
2008-03-10 01:37 . 2008-03-10 00:13 102,664 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys
2008-03-09 15:47 . 2008-03-09 15:47 <DIR> d-------- C:\Documents and Settings\HP_Administrator\Application Data\Grisoft
2008-03-09 15:27 . 2008-03-09 15:44 <DIR> d-------- C:\Mr Wacky's Adventure
2008-03-08 11:09 . 2008-03-08 11:09 <DIR> d-------- C:\Program Files\SysCleaner
2008-03-08 10:59 . 2008-03-08 10:59 <DIR> d-------- C:\Program Files\IE Extensions
2008-03-06 00:55 . 2008-03-06 00:55 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\acccore
2008-03-05 22:37 . 2008-03-06 00:33 <DIR> d-------- C:\Program Files\Trend Micro
2008-03-05 22:28 . 2007-01-18 08:00 3,968 --a------ C:\WINDOWS\system32\drivers\AvgArCln.sys
2008-03-05 22:27 . 2007-05-30 08:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-03-05 22:26 . 2008-03-06 00:38 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-03-05 22:07 . 2008-03-05 22:07 <DIR> d---s---- C:\Documents and Settings\Administrator\UserData
2008-03-03 22:46 . 2008-03-03 22:46 <DIR> d-------- C:\Program Files\Your Company Name
2008-03-03 22:46 . 2008-03-03 22:46 <DIR> d-------- C:\Program Files\Total Seminars
2008-02-22 12:02 . 2008-02-22 12:02 202,827 --a------ C:\WINDOWS\system32\atasnt40.dll
2008-02-22 12:01 . 2008-02-22 12:01 51,304 --a------ C:\WINDOWS\system32\drivers\atnt40k.sys
2008-02-22 00:25 . 2008-02-22 00:25 <DIR> d-------- C:\Program Files\OGPlanet
2008-02-14 03:08 . 2008-02-14 03:08 <DIR> d-------- C:\Program Files\MSECache
2008-02-14 03:08 . 2008-02-14 03:08 <DIR> d-------- C:\Program Files\Microsoft Office Outlook Connector
2008-02-14 03:07 . 2008-02-14 03:07 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-11 06:09 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-03-11 04:46 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-11 04:46 --------- d-----w C:\Program Files\Philips
2008-03-11 04:46 --------- d-----w C:\Program Files\Google
2008-03-11 03:53 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL
2008-03-11 03:49 --------- d-----w C:\Program Files\Common Files\Real
2008-03-10 23:57 --------- d-----w C:\Program Files\Common Files\Ahead
2008-03-10 23:54 --------- d-----w C:\Program Files\Common Files\Sonic Shared
2008-03-10 23:54 --------- d-----w C:\Program Files\Common Files\HP
2008-03-10 23:48 --------- d-----w C:\Program Files\Java
2008-03-06 02:50 1,626,112 ----a-w C:\WINDOWS\system32\nwiz.exe
2008-03-06 02:10 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-03-05 13:45 --------- d-----w C:\Program Files\Incomplete
2008-03-05 13:35 --------- d-----w C:\Program Files\LimeWire
2008-03-05 13:35 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\LimeWire
2008-03-05 06:24 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\gtk-2.0
2008-03-03 23:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-03-03 04:31 --------- d-----w C:\Program Files\World of Warcraft
2008-02-29 23:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL Downloads
2008-02-26 07:52 --------- d-----w C:\Program Files\Sword of The New World
2008-02-26 07:51 --------- d-----w C:\Program Files\MasterOfDefense_at
2008-02-22 14:24 --------- d-----w C:\Documents and Settings\Technisource VPN\Application Data\ICAClient
2008-02-14 07:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-02-14 07:24 --------- d-----w C:\Program Files\Microsoft ActiveSync
2008-02-08 21:56 --------- d-----w C:\Documents and Settings\Technisource VPN\Application Data\acccore
2008-02-08 19:40 --------- d-----w C:\Documents and Settings\Technisource VPN\Application Data\DWRCC
2008-02-08 19:37 --------- d-----w C:\Documents and Settings\Technisource VPN\Application Data\DameWare Development
2008-02-08 19:36 --------- d-----w C:\Program Files\DameWare Development
2008-02-08 19:24 --------- d-----w C:\Program Files\SJLabs
2008-02-08 19:24 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-02-08 19:14 --------- d-----w C:\Program Files\Common Files\Crystal Decisions
2008-02-08 19:14 --------- d-----w C:\Program Files\AR System
2008-02-08 19:14 --------- d-----w C:\Documents and Settings\Technisource VPN\Application Data\AR System
2008-02-05 06:28 --------- d-----w C:\Program Files\WowGasm
2008-02-05 04:31 --------- d-----w C:\Program Files\Warcraft III
2008-02-04 23:23 693,792 ----a-w C:\WINDOWS\system32\OGACheckControl.DLL
2008-02-04 06:48 139,264 ----a-w C:\WINDOWS\War3Unin.exe
2008-02-01 01:44 45,056 ----a-w C:\WINDOWS\system32\UTSCSI.EXE
2008-02-01 00:46 --------- d-----w C:\Program Files\support.com
2008-02-01 00:46 --------- d-----w C:\Program Files\Common Files\SupportSoft
2008-01-25 02:58 --------- d-----w C:\Program Files\CCleaner
2008-01-23 06:33 --------- d-----w C:\Program Files\Common Files\INCA Shared
2008-01-16 07:17 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\ICAClient
2007-12-20 03:47 846,504 ----a-w C:\Documents and Settings\HP_Administrator\JNativeCpp.dll
2007-04-23 05:51 32 ----a-r C:\Documents and Settings\All Users\hash.dat
2007-06-21 23:38 30,280 ----a-w C:\Program Files\mozilla firefox\plugins\cgpcfg.dll
2007-06-21 23:38 79,432 ----a-w C:\Program Files\mozilla firefox\plugins\CgpCore.dll
2007-06-21 23:38 71,240 ----a-w C:\Program Files\mozilla firefox\plugins\confmgr.dll
2007-06-21 23:38 140,872 ----a-w C:\Program Files\mozilla firefox\plugins\ctxmui.dll
2007-06-21 23:39 38,472 ----a-w C:\Program Files\mozilla firefox\plugins\icafile.dll
2007-06-21 23:39 46,664 ----a-w C:\Program Files\mozilla firefox\plugins\icalogon.dll
2007-06-21 23:39 34,376 ----a-w C:\Program Files\mozilla firefox\plugins\logging.dll
2007-06-21 23:39 685,640 ----a-w C:\Program Files\mozilla firefox\plugins\sslsdk_b.dll
2007-06-21 23:40 30,280 ----a-w C:\Program Files\mozilla firefox\plugins\TcpPServ.dll
2006-05-03 09:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll
2007-02-21 10:47 31,232 --sh--r C:\WINDOWS\system32\msfDX.dll
.

((((((((((((((((((((((((((((( snapshot@2008-03-11_ 0.54.39.42 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-05-24 16:27:16 213,048 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll
+ 2007-08-29 19:47:20 94,208 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
+ 2007-08-29 19:49:54 950,272 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-09 17:00 15360]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 14:39 1289000]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-05 17:56 64512]
"AlwaysReady Power Message APP"="ARPWRMSG.EXE" [2005-08-02 20:19 77312 C:\WINDOWS\arpwrmsg.exe]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-10-04 18:14 8491008]
"nwiz"="nwiz.exe" [2008-03-05 22:50 1626112 C:\WINDOWS\system32\nwiz.exe]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [ ]
"PCDrProfiler"="" []
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPwuSchd2.exe" [2005-05-12 03:12 49152]
"IPHSend"="C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe" [ ]
"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [ ]
"RTHDCPL"="RTHDCPL.EXE" [2006-01-23 06:53 15969280 C:\WINDOWS\RTHDCPL.EXE]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [ ]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [ ]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\point32.exe" [2005-06-10 05:21 217088]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-10-04 18:14 81920]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe" [2005-08-26 22:14 36975]
"KBD"="C:\HP\KBD\KBD.EXE" [2005-02-02 11:44 61440]
"ps2"="C:\WINDOWS\system32\ps2.exe" [2004-10-25 09:17 90112]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 05:04 52736]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-07-10 09:18 270648]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2004-08-09 17:00 53760 C:\WINDOWS\system32\narrator.exe]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Updates From HP.lnk - C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe [2006-02-22 17:58:29 36903]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DISCover]
--a------ 2005-11-11 17:11 1064960 C:\Program Files\DISC\DISCover.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DiscUpdateManager]
--a------ 2005-11-11 17:10 61440 C:\Program Files\DISC\DiscUpdateMgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMAScheduler]
--a------ 2005-11-01 06:01 90112 c:\Program Files\Sonic\DigitalMedia Plus\DigitalMedia Archive\DMAScheduler.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
--a------ 2006-05-09 20:24 50760 C:\Program Files\Common Files\AOL\1147572088\ee\AOLSoftware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2007-07-10 09:18 270648 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
C:\Program Files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Veoh]
C:\Program Files\Veoh Networks\Veoh\VeohClient.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Viewpoint Manager Service"=2 (0x2)
"iPod Service"=3 (0x3)
"gusvc"=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"C:\\Program Files\\DISC\\DISCover.exe"=
"C:\\Program Files\\DISC\\DiscStreamHub.exe"=
"C:\\Program Files\\DISC\\myFTP.exe"=
"C:\\Program Files\\Updates from HP\\9972322\\Program\\Updates from HP.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"C:\\Program Files\\Common Files\\AOL\\1147572088\\ee\\aolsoftware.exe"=
"C:\\Program Files\\Common Files\\AOL\\1147572088\\ee\\aim6.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Electronic Arts\\Battlefield 2142\\BF2142.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\NCsoft\\Exteel\\System\\Exteel.exe"=
"C:\\Program Files\\Warcraft III\\Warcraft III.exe"=
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"= C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"= C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"= C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9842:TCP"= 9842:TCP:*:Disabled:SolidNetworkManager
"9842:UDP"= 9842:UDP:*:Disabled:SolidNetworkManager
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R2 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" [2007-01-04 17:38]
S3 inwrdr;inwrdr;C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\inwrdr.sys []
S3 nenum13E;nenum13E;C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\nenum13E.sys []
S3 tbcspud;Santa Cruz Driver;C:\WINDOWS\system32\drivers\tbcspud.sys []
S3 tbcwdm;Santa Cruz WDM Driver;C:\WINDOWS\system32\drivers\tbcwdm.sys []
S3 vtdg46xx;vtdg46xx;C:\PROGRA~1\TURTLE~1\SANTAC~1\CONTRO~1\vtdg46xx.sys []
S3 XDva020;XDva020;C:\WINDOWS\system32\XDva020.sys []
S3 XDva037;XDva037;C:\WINDOWS\system32\XDva037.sys []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J]
\Shell\AutoRun\command - J:\autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{47876b4c-f72b-11da-8a91-0015f2eb0b2a}]
\Shell\AutoRun\command - J:\JDSecure\Windows\JDSecure20.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{56ac6ba3-ef32-11da-8a81-0015f2eb0b2a}]
\Shell\AutoRun\command - J:\JDSecure\Windows\JDSecure20.exe

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-12 23:16:15
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-03-12 23:16:45
ComboFix-quarantined-files.txt 2008-03-13 03:16:44
ComboFix2.txt 2008-03-11 05:10:25
ComboFix3.txt 2008-03-11 04:55:09
.
2007-11-28 06:53:27 --- E O F ---

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:18, on 2008-03-12
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
C:\HP\KBD\KBD.EXE
C:\windows\system\hpsysdrv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\WINDOWS\arservice.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\UTSCSI.EXE
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\imapi.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\Hija\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.h...a...&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [ps2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - Global Startup: Updates From HP.lnk = C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=67633
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky...can_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?LinkID=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1148076574859
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://technisource...ort/ieatgpc.cab
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: CLCV0 (UTSCSI) - Unknown owner - C:\WINDOWS\system32\UTSCSI.EXE
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--
End of file - 7136 bytes

#29
Mswei

Posted 13 March 2008 - 01:03 AM

Member

Topic Starter
Member
23 posts

Hi again, here's the Kaspersky log...looks like there's still some small bugs infecting the system. Let me know how I should proceed!

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
2008-03-13 03:03
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 13/03/2008
Kaspersky Anti-Virus database records: 626915
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\
E:\
F:\
G:\
H:\
I:\

Scan Statistics:
Total number of scanned objects: 136252
Number of viruses found: 21
Number of infected objects: 70
Number of suspicious objects: 0
Duration of the scan process: 02:14:09

Infected Object Name / Virus Name / Last Action
C:\ddd188945be5cea4537625c7a334\Jet Li - Fearless - 2006 - english subs - DVDRip DivX - TRUS.avi.3GP Object is locked skipped
C:\Documents and Settings\Administrator\Desktop\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\Administrator\Desktop\SmitfraudFix.exe/data.rar/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\Administrator\Desktop\SmitfraudFix.exe/data.rar Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\Administrator\Desktop\SmitfraudFix.exe RarSFX: infected - 2 skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\511a0f3f9e960fa97de3d0b74adfc574_45d8759b-b288-4ac5-ac0c-2d9146699c63 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\9ae7dbf3e956892ad6f0fa4a7df110c3_45d8759b-b288-4ac5-ac0c-2d9146699c63 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\eHome\logs\ehRecvr.log Object is locked skipped
C:\Documents and Settings\HP_Administrator\Application Data\$_hpcst$.hpc Object is locked skipped
C:\Documents and Settings\HP_Administrator\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\HP_Administrator\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\HP_Administrator\Local Settings\History\History.IE5\MSHist012008031320080314\index.dat Object is locked skipped
C:\Documents and Settings\HP_Administrator\Local Settings\Temp\WCESLog.log Object is locked skipped
C:\Documents and Settings\HP_Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\HP_Administrator\ntuser.dat Object is locked skipped
C:\Documents and Settings\HP_Administrator\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Technisource VPN\taw\othread2.dll Infected: not-a-virus:RemoteAdmin.Win32.WinVNC-based.c skipped
C:\Documents and Settings\Technisource VPN\taw\vnchooks.dll Infected: not-a-virus:RemoteAdmin.Win32.WinVNC-based.c skipped
C:\Program Files\BearShare\Installer\BSInstall5.2.5.1.exe/WISE0026.BIN/clientax.dll Infected: not-a-virus:AdWare.Win32.180Solutions.ao skipped
C:\Program Files\BearShare\Installer\BSInstall5.2.5.1.exe/WISE0026.BIN Infected: not-a-virus:AdWare.Win32.180Solutions.ao skipped
C:\Program Files\BearShare\Installer\BSInstall5.2.5.1.exe WiseSFX: infected - 2 skipped
C:\Program Files\BearShare\Installer\BSInstall5.2.5.1.exe WiseSFXDropper: infected - 2 skipped
C:\Program Files\Updates from HP\9972322\Users\Default\Data\chandir.dat Object is locked skipped
C:\Program Files\Updates from HP\9972322\Users\Default\Data\chandir.idx Object is locked skipped
C:\Program Files\Updates from HP\9972322\Users\Default\Data\chn.dat Object is locked skipped
C:\Program Files\Updates from HP\9972322\Users\Default\Data\chn.idx Object is locked skipped
C:\Program Files\Updates from HP\9972322\Users\Default\Data\D0000000.FCS Object is locked skipped
C:\Program Files\Updates from HP\9972322\Users\Default\Data\inuse.txt Object is locked skipped
C:\Program Files\Updates from HP\9972322\Users\Default\Data\L0000001.FCS Object is locked skipped
C:\Program Files\Updates from HP\9972322\Users\Default\Data\main.log Object is locked skipped
C:\Program Files\Updates from HP\9972322\Users\Default\Data\prs.dat Object is locked skipped
C:\Program Files\Updates from HP\9972322\Users\Default\Data\prs.idx Object is locked skipped
C:\Program Files\Updates from HP\9972322\Users\Default\Data\prs_die.dat Object is locked skipped
C:\Program Files\Updates from HP\9972322\Users\Default\Data\prs_die.idx Object is locked skipped
C:\Program Files\Updates from HP\9972322\Users\Default\Data\prs_dnd.dat Object is locked skipped
C:\Program Files\Updates from HP\9972322\Users\Default\Data\prs_dnd.idx Object is locked skipped
C:\Program Files\Updates from HP\9972322\Users\Default\Data\prs_ext.dat Object is locked skipped
C:\Program Files\Updates from HP\9972322\Users\Default\Data\prs_ext.idx Object is locked skipped
C:\Program Files\Updates from HP\9972322\Users\Default\Data\prs_rcv.dat Object is locked skipped
C:\Program Files\Updates from HP\9972322\Users\Default\Data\prs_rcv.idx Object is locked skipped
C:\Program Files\Updates from HP\9972322\Users\Default\Data\storydb.dat Object is locked skipped
C:\Program Files\Updates from HP\9972322\Users\Default\Data\storydb.idx Object is locked skipped
C:\QooBox\Quarantine\C\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\5d37d31e-4899d11a.bac_a03656.vir/GetAccess.class Infected: Trojan-Downloader.Java.OpenConnection.aj skipped
C:\QooBox\Quarantine\C\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\5d37d31e-4899d11a.bac_a03656.vir/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.aj skipped
C:\QooBox\Quarantine\C\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\5d37d31e-4899d11a.bac_a03656.vir/NewSecurityClassLoader.class Infected: Exploit.Java.ByteVerify skipped
C:\QooBox\Quarantine\C\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\5d37d31e-4899d11a.bac_a03656.vir/NewURLClassLoader.class Infected: Exploit.Java.ByteVerify skipped
C:\QooBox\Quarantine\C\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\5d37d31e-4899d11a.bac_a03656.vir ZIP: infected - 4 skipped
C:\QooBox\Quarantine\C\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\5d37d31e-4899d11a.bac_a03656.vir CryptFF.b: infected - 4 skipped
C:\QooBox\Quarantine\C\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\6217252a-672c5c96.bac_a03656.vir/Matrix.class Infected: Trojan-Downloader.Java.OpenStream.c skipped
C:\QooBox\Quarantine\C\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\6217252a-672c5c96.bac_a03656.vir/Counter.class Infected: Trojan.Java.ClassLoader.h skipped
C:\QooBox\Quarantine\C\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\6217252a-672c5c96.bac_a03656.vir/Parser.class Infected: Trojan.Java.ClassLoader.d skipped
C:\QooBox\Quarantine\C\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\6217252a-672c5c96.bac_a03656.vir ZIP: infected - 3 skipped
C:\QooBox\Quarantine\C\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\6217252a-672c5c96.bac_a03656.vir CryptFF.b: infected - 3 skipped
C:\QooBox\Quarantine\C\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\aujlbctb.dll.vir.bac_a03656.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\catchme2008-03-09_170311.32.zip.bac_a03656.vir/wowfx.dll Infected: Trojan.Win32.Qhost.abh skipped
C:\QooBox\Quarantine\C\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\catchme2008-03-09_170311.32.zip.bac_a03656.vir/efcbcya.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\catchme2008-03-09_170311.32.zip.bac_a03656.vir/jkhhg.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\catchme2008-03-09_170311.32.zip.bac_a03656.vir ZIP: infected - 3 skipped
C:\QooBox\Quarantine\C\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\catchme2008-03-09_170311.32.zip.bac_a03656.vir CryptFF.b: infected - 3 skipped
C:\QooBox\Quarantine\C\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\cru629.dat.vir.bac_a03656.vir Infected: Backdoor.Win32.Small.cyb skipped
C:\QooBox\Quarantine\C\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\ddcdcdc.dll.vir.bac_a03656.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\djsixvbj.dll.vir.bac_a03656.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\drvlon.dll.vir.bac_a03656.vir Infected: Trojan.Win32.Dialer.yz skipped
C:\QooBox\Quarantine\C\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\gwbktpmt.dll.vir.bac_a03656.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\hkerklck.dll.vir.bac_a03656.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\korouiaj.dll.vir.bac_a03656.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\mgqnhusi.dll.vir.bac_a03656.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\mmesckoj.exe.vir.bac_a03656.vir Infected: Trojan.Win32.Agent.giy skipped
C:\QooBox\Quarantine\C\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\ohlgqwrj.dll.vir.bac_a03656.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\printer.exe.vir.bac_a03656.vir Infected: Trojan.Win32.Qhost.aes skipped
C:\QooBox\Quarantine\C\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\ujpcthre.dll.vir.bac_a03656.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\uuskqjij.dll.vir.bac_a03656.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\vuvxcryc.dll.vir.bac_a03656.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.jxa skipped
C:\QooBox\Quarantine\C\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\wowfx.dll.vir.bac_a03656.vir Infected: Trojan.Win32.Qhost.abh skipped
C:\QooBox\Quarantine\C\Documents and Settings\HP_Administrator\.housecall6.6\Quarantine\xlth.exe.vir.bac_a03656.vir Infected: Trojan-Downloader.Win32.Agent.hyy skipped
C:\QooBox\Quarantine\C\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\30\5d37d31e-4899d11a.vir/GetAccess.class Infected: Trojan-Downloader.Java.OpenConnection.aj skipped
C:\QooBox\Quarantine\C\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\30\5d37d31e-4899d11a.vir/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.aj skipped
C:\QooBox\Quarantine\C\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\30\5d37d31e-4899d11a.vir/NewSecurityClassLoader.class Infected: Exploit.Java.ByteVerify skipped
C:\QooBox\Quarantine\C\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\30\5d37d31e-4899d11a.vir/NewURLClassLoader.class Infected: Exploit.Java.ByteVerify skipped
C:\QooBox\Quarantine\C\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\30\5d37d31e-4899d11a.vir ZIP: infected - 4 skipped
C:\QooBox\Quarantine\C\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\42\6217252a-672c5c96.vir/Matrix.class Infected: Trojan-Downloader.Java.OpenStream.c skipped
C:\QooBox\Quarantine\C\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\42\6217252a-672c5c96.vir/Counter.class Infected: Trojan.Java.ClassLoader.h skipped
C:\QooBox\Quarantine\C\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\42\6217252a-672c5c96.vir/Parser.class Infected: Trojan.Java.ClassLoader.d skipped
C:\QooBox\Quarantine\C\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\42\6217252a-672c5c96.vir ZIP: infected - 3 skipped
C:\QooBox\Quarantine\C\WINDOWS\Installer\{25252fb4-a995-4532-b207-87c853dd4b17}\zip.dll.vir Infected: Trojan-Dropper.Win32.Agent.ftu skipped
C:\QooBox\Quarantine\C\WINDOWS\Installer\{31f9e817-78f3-43f6-a2b9-6be4db1f4c6d}\zip.dll.vir Infected: Trojan-Downloader.Win32.BHO.ct skipped
C:\QooBox\Quarantine\C\WINDOWS\Installer\{4cf02772-dab1-4018-a7ee-5bbb9ea36771}\zip.dll.vir Infected: Trojan-Dropper.Win32.Agent.ftu skipped
C:\QooBox\Quarantine\C\WINDOWS\Installer\{9f548e5a-2138-4a5f-b37d-c8f8ed5d0082}\BootRam.dll.vir Infected: Trojan.Win32.Agent.feh skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP13\A0002457.dll Infected: Trojan-Downloader.Win32.BHO.ct skipped
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP15\A0002631.dll Infected: Trojan-Dropper.Win32.Agent.ftu skipped
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP15\A0002632.dll Infected: Trojan-Dropper.Win32.Agent.ftu skipped
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP15\A0002633.dll Infected: Trojan.Win32.Agent.feh skipped
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP15\change.log Object is locked skipped
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP2\A0000129.exe Infected: Trojan-Downloader.Win32.Agent.knf skipped
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP2\A0000130.exe Infected: Trojan.Win32.Agent.giy skipped
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP2\A0000133.exe Infected: Trojan-Dropper.Win32.Agent.ftu skipped
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP2\A0000134.exe Infected: Trojan-Dropper.Win32.Agent.ftu skipped
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP2\A0000135.exe Infected: Trojan-Dropper.Win32.Agent.ftu skipped
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP2\A0000136.exe Infected: Trojan-Dropper.Win32.Agent.ftu skipped
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP2\A0000141.exe Infected: Trojan-Dropper.Win32.FriJoiner.lx skipped
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP3\A0000210.dll Infected: Trojan.Win32.Dialer.yz skipped
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP4\A0000299.exe Infected: Trojan-Dropper.Win32.Agent.ftu skipped
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP4\A0000300.exe Infected: Trojan-Dropper.Win32.Agent.ftu skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{1F508497-FF0B-4008-89F9-143CE6C9FD9D}.crmlog Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\Media Ce.evt Object is locked skipped
C:\WINDOWS\system32\config\ODiag.evt Object is locked skipped
C:\WINDOWS\system32\config\OSession.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\LogFiles\HTTPERR\httperr1.log Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
D:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP15\change.log Object is locked skipped

Scan process completed.

#30
sarahw

Posted 13 March 2008 - 03:54 PM

Malware Staff

Member
2,781 posts

The only thing I need to know is if you installed this:
Technisource VPN

1.
Disabling System Restore

NOTE: You need to be logged in as an Administrator to administer System Restore. If you are not logged in as an administrator you will not be able to follow these steps

WARNING: By disabling system restore you will delete all stored restore points.

You should first go into the Control Panel and then double click on the System icon. If you are in the control panel and do not see the System icon, click on the link that says "Switch to classic view" in the upper left hand side of the window. Now you should be able to see the System icon. After you double click on it you should then click on the System Restore tab. If system restore is enabled you will see an image like the one below:
Posted Image

If you see in the Status section, designated by the green box, that it is Turned off , then system restore is already disabled and you do not have to do anything further. If it is showing that it is monitoring as seen above, then you should check the checkbox labeled "Turn off System Restore", designated by the red box. You should then click on the Apply button to disable system restore.

2.
Enabling System Restore

To enable system restore you should follow these steps.

You should first go into the Control Panel and then double click on the System icon. If you are in the control panel and do not see the System icon, then click on the link that says "Switch to classic view" in the upper left hand side of the window. Now you should be able to see the System icon. After you double click on it you should then click on the System Restore tab. If system restore is turned off you will see an image like the one below:
Posted Image

If you see in the Status section, designated by the green box, that it is Monitoring a partition, then system restore is already enabled and you do not have to do anything further. If it is showing that it is turned off as seen in the picture above, then you should uncheck the checkbox labeled "Turn off System Restore", designated by the red box, and then adjust how much disk space you want to allow system restore to use, which is by default 12 percent of your entire disk space.

When you are done with making your settings, you should click on the apply button. Since you are turning system restore back on, a new restore point will automatically be made. After the new restore point is made, you should see in the status section that system restore is monitoring the partition; which means it is enabled.

3.

Please download OTCleanUp from HERE to your desktop.
Double click to run it. It will clean up the assortment of tools used during malware removal. When it has finnished, it will ask you to reboot so it can remove itself.

Congratulations, your log is now clean.

A well protected computer should have at least an Anti Virus and Firewall, an Anti Spyware is also great addition to your computers security. Here is a list of tools I like to recommend to people that will help ensure safe surfing on the internet, and to help you from getting infected again.
Note: DO NOT install more than one antivirus or Firewall program. They will conflict, and provide less protection, not more. Uninstall any existing Anti Virus\Firewall programs if you're going to install a new one.

Free Online Scans:
Free Active X and Java based online scans. You can use these scans from other companies and it will not interfere with your current Anti Virus. If you find that you are infected, post a Hijack This log in the forums.

Free Temp Cleaners:
Use these tools to clean temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders. ATF cleaner recommended.

Free Firewall Downloads:
You must have a Firewall installed on your computer. This helps stop anything from leaving or entering your computer without your permission.

Free Anti Spyware Downloads:
An Antispyware is a great tool that can help remove infections along side your Anti Virus. Some include real time protection, scheduled scans and automatic definition updates.

Free Anti Virus Downloads:
A must have for all computers. Avast! recommended.

Other:

SpywareGuard
Works as a Spyware "Shield" to protect your computer from getting malware in the first place.
IE-SpyAd
This tool puts over 5000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all.
Memtest86
Great memory testing software.
CPU-Z
This application gives detailed information about your system in a nice layout
Speedfan
Returns and monitors system temperatures.
Windows Updates
It is very important to make sure that both Internet Explorer and Windows are kept current with the latest critical security patches from Microsoft. To do this just start Internet Explorer and select Tools > Windows Update, and follow the online instructions from there.

You can now Rehide your system files by using the reversal of these instructions HERE

To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read THIS article by Tony Klein.

If you have any other problems or questions be sure to ask.