Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

what is this google returns nothing. i think it is spyware [RESOLVED]


  • This topic is locked This topic is locked

#1
painter1982

painter1982

    Member

  • Member
  • PipPip
  • 54 posts
Deckard's System Scanner v20071014.68
Run by don on 2008-04-23 20:49:57
Computer is in Normal Mode.
--------------------------------------------------------------------------------



-- HijackThis (run as don.exe) -------------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:50:02 PM, on 4/23/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
G:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
G:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
G:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
G:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\dllhost.exe
G:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
I:\Program Files\SpywareGuard\sgmain.exe
I:\Program Files\SpywareGuard\sgbhp.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\WINDOWS\explorer.exe
G:\Program Files\DAEMON Tools Lite\daemon.exe
C:\PROGRA~1\Mozilla Firefox\firefox.exe
I:\dss.exe
I:\HIJACK~1\don.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = google.net-studio.org
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - I:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O4 - HKLM\..\Run: [avast!] G:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [pxiijs] c:\documents and settings\don\local settings\application data\pxiijs.exe pxiijs
O4 - HKCU\..\Run: [zevgghu] c:\windows\system32\zevgghu.exe zevgghu
O4 - Startup: SpywareGuard.lnk = I:\Program Files\SpywareGuard\sgmain.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell....iler/SysPro.CAB
O16 - DPF: {3DCEC959-378A-4922-AD7E-FD5C925D927F} (Disney Online Games ActiveX Control) - http://disney.go.com...OnlineGames.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.mi...b?1201487982218
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/.../GrooveAX27.cab
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://download-game...mjolauncher.cab
O16 - DPF: {85D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin class) - http://secure2.comne...login-devel.cab
O16 - DPF: {95D88B35-A521-472B-A182-BB1A98356421} (Pearson Installation Assistant 2) - http://asp.mathxl.co...nstallAsst2.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.m...ash/swflash.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://3dlifeplayer....l/installer.exe
O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} (TikGames Online Control) - http://www.shockwave...inematycoon.cab
O16 - DPF: {E6D23284-0E9B-417D-A782-03E4487FC947} (Pearson MathXL Player) - http://asp.mathxl.co.../MathPlayer.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - G:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - G:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - G:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - G:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

--
End of file - 6671 bytes

-- Files created between 2008-03-23 and 2008-04-23 -----------------------------

2008-04-23 20:36:47 0 d------c- C:\Documents and Settings\don\Application Data\DeepBurner
2008-04-18 00:40:04 0 d------c- C:\Program Files\tg games
2008-04-15 23:51:27 0 d------c- C:\Program Files\ReflexiveArcade
2008-04-15 22:59:16 1049650 --a----c- C:\WINDOWS\Prison Tycoon 3 Uninstaller.exe
2008-04-15 22:57:05 0 d------c- C:\Program Files\Common Files\Thraex Software
2008-04-15 22:31:12 0 d------c- C:\WINDOWS\CinemaTycoonCC
2008-04-15 22:31:12 0 d------c- C:\Program Files\CinemaTycoonCC
2008-04-15 21:32:30 0 d--hs--c- C:\WINDOWS\ftpcache
2008-04-13 20:11:40 0 d------c- C:\Program Files\Common Files\INCA Shared
2008-04-13 20:11:38 4682 --a----c- C:\WINDOWS\system32\npptNT2.sys <Not Verified; INCA Internet Co., Ltd.; nProtect NPSC Kernel Mode Driver for NT>
2008-04-13 19:53:04 0 d--h---c- C:\Documents and Settings\don\Application Data\ijjigame
2008-04-13 19:52:39 0 d------c- C:\Documents and Settings\All Users\Application Data\IJJIGame
2008-04-13 19:48:46 0 d------c- C:\ijji
2008-04-12 00:36:17 2011136 --a----c- C:\WINDOWS\system32\XTP9510Lib.dll <Not Verified; Codejock Software; Xtreme Toolkit Pro™ Dynamic Link Library>
2008-04-10 14:33:37 0 d------c- C:\Program Files\Microsoft Works
2008-04-10 14:32:05 0 d------c- C:\Program Files\Microsoft.NET
2008-04-10 14:30:18 0 d------c- C:\Program Files\Microsoft Visual Studio 8
2008-04-10 14:29:43 0 d------c- C:\WINDOWS\SHELLNEW
2008-04-10 14:28:47 0 dr-h---c- C:\MSOCache
2008-04-10 11:47:48 0 d------c- C:\Documents and Settings\don\Application Data\KompoZer
2008-03-31 19:08:21 0 d------c- C:\WINDOWS\system32\vmm32
2008-03-31 16:21:46 0 d------c- C:\Documents and Settings\All Users\Application Data\TEMP
2008-03-31 15:16:49 0 d------c- C:\Documents and Settings\don\Application Data\Malwarebytes
2008-03-31 15:16:37 0 d------c- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-03-31 15:08:10 2644 --a----c- C:\WINDOWS\system32\kill.vbs
2008-03-28 17:36:08 0 d------c- C:\WINDOWS\pss
2008-03-27 23:19:59 0 d------c- C:\Program Files\Microsoft Money 2007
2008-03-26 22:12:18 0 d------c- C:\Program Files\Selfkey Systems
2008-03-23 00:28:57 0 d------c- C:\drivers


-- Find3M Report ---------------------------------------------------------------

2008-04-23 20:08:09 0 d------c- C:\Documents and Settings\don\Application Data\Azureus
2008-04-23 18:00:58 0 d------c- C:\Program Files\Norton Security Scan
2008-04-20 18:00:39 0 d------c- C:\Program Files\Common Files\Symantec Shared
2008-04-17 12:28:58 0 d------c- C:\Documents and Settings\don\Application Data\LimeWire
2008-04-15 22:57:05 0 d------c- C:\Program Files\Common Files
2008-04-13 19:48:45 0 d--h---c- C:\Program Files\InstallShield Installation Information
2008-04-10 14:33:26 0 d------c- C:\Program Files\MSBuild
2008-04-01 08:19:06 0 d------c- C:\Program Files\Java
2008-03-27 05:48:48 14336 --a------ C:\WINDOWS\system32\svchost.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-03-24 00:22:25 0 d------c- C:\Documents and Settings\don\Application Data\U3
2008-03-22 23:54:32 0 d------c- C:\Program Files\Disney
2008-03-21 06:03:03 0 d------c- C:\Documents and Settings\don\Application Data\Move Networks
2008-03-20 21:44:21 0 d------c- C:\Program Files\Common Files\DirectX
2008-03-20 19:48:39 0 d------c- C:\Documents and Settings\don\Application Data\InstallShield
2008-03-19 22:43:16 0 d------c- C:\Program Files\Virtools
2008-03-15 16:29:22 0 d------c- C:\Program Files\Kuma Games
2008-03-11 20:47:14 0 d------c- C:\Documents and Settings\don\Application Data\Macromedia
2008-03-03 21:24:26 0 d------c- C:\Documents and Settings\don\Application Data\Help
2008-03-02 16:54:12 0 d------c- C:\Documents and Settings\don\Application Data\RipIt4Me
2008-02-29 08:00:20 0 d------c- C:\Program Files\QuickTime
2008-02-27 06:54:27 0 d------c- C:\Program Files\Reference Assemblies
2008-02-27 06:53:46 0 d------c- C:\Program Files\MSXML 6.0
2008-02-27 06:53:14 0 d------c- C:\Program Files\Windows Media Connect 2
2008-02-26 18:03:28 0 d------c- C:\Documents and Settings\don\Application Data\Leadertech
2008-02-25 23:37:36 0 d------c- C:\Program Files\GameShadow
2008-02-25 23:30:32 0 d------c- C:\Program Files\OpenAL
2008-02-25 16:51:37 0 d------c- C:\Documents and Settings\don\Application Data\Adobe
2008-02-25 16:50:31 0 d------c- C:\Program Files\Common Files\Adobe
2008-02-25 11:47:33 0 d------c- C:\Program Files\Microsoft Silverlight
2008-02-23 13:20:48 0 d------c- C:\Documents and Settings\don\Application Data\Nero
2008-02-23 13:19:48 0 d------c- C:\Program Files\Common Files\Nero
2008-02-23 13:18:39 0 d------c- C:\Program Files\Nero
2008-02-14 22:19:57 679 --a----c- C:\WINDOWS\mozver.dat
2008-01-27 22:03:18 0 --a----c- C:\WINDOWS\nsreg.dat
2008-01-27 21:57:45 1324 --a----c- C:\WINDOWS\system32\d3d9caps.dat
2008-01-27 21:03:10 0 -rahs--c- C:\MSDOS.SYS
2008-01-27 21:03:10 0 -rahs--c- C:\IO.SYS
2008-01-27 21:03:10 0 --a----c- C:\CONFIG.SYS
2008-01-27 21:03:10 0 --a----c- C:\AUTOEXEC.BAT
2008-01-27 20:59:40 21640 --a----c- C:\WINDOWS\system32\emptyregdb.dat
2008-01-27 14:53:24 62 --ahs---- C:\Documents and Settings\don\Application Data\desktop.ini


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="G:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [03/29/2008 01:37 PM]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [09/17/2007 09:07 AM]
"SigmatelSysTrayApp"="stsystra.exe" [08/24/2005 07:42 AM C:\WINDOWS\stsystra.exe]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [02/22/2008 04:25 AM]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [10/27/2006 12:47 AM]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [02/29/2008 08:00 AM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/10/2004 06:00 AM]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [10/13/2004 11:24 AM]
"pxiijs"="c:\documents and settings\don\local settings\application data\pxiijs.exe" []
"zevgghu"="c:\windows\system32\zevgghu.exe" [04/23/2008 04:02 PM]

C:\Documents and Settings\don\Start Menu\Programs\Startup\
SpywareGuard.lnk - I:\Program Files\SpywareGuard\sgmain.exe [8/29/2003 7:05:35 PM]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme
"DisableRegistryTools"=0 (0x0)
"HideLegacyLogonScripts"=0 (0x0)
"HideLogoffScripts"=0 (0x0)
"RunLogonScriptSync"=1 (0x1)
"RunStartupScriptSync"=1 (0x1)
"HideStartupScripts"=0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"HideLegacyLogonScripts"=0 (0x0)
"HideLogoffScripts"=0 (0x0)
"RunLogonScriptSync"=1 (0x1)
"RunStartupScriptSync"=1 (0x1)
"HideStartupScripts"=0 (0x0)
"disableregistrytools"=0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoLogOff"=0 (0x0)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^don^Start Menu^Programs^Startup^Kuma_Tray.lnk]
path=C:\Documents and Settings\don\Start Menu\Programs\Startup\Kuma_Tray.lnk
backup=C:\WINDOWS\pss\Kuma_Tray.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^don^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
path=C:\Documents and Settings\don\Start Menu\Programs\Startup\LimeWire On Startup.lnk
backup=C:\WINDOWS\pss\LimeWire On Startup.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
"C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
"G:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
C:\WINDOWS\ehome\ehtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
"C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
"C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5ef0961e-e560-11dc-9fc0-00137214381d}]
AutoRun\command- N:\setupSNK.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e4276fbc-d357-11dc-9fb7-00137214381d}]
AutoRun\command- N:\LaunchU3.exe

*Newly Created Service* - ERASERUTILDRV10741
*Newly Created Service* - PNKBSTRK



-- End of Deckard's System Scanner: finished at 2008-04-23 20:50:25 ------------
  • 0

Advertisements


#2
greyknight17

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
1. Download combofix at http://www.techsuppo...Bs/ComboFix.exe or http://download.blee...Bs/ComboFix.exe
2. Double-click combofix.exe & follow the prompts.
3. When finished, it will produce a log for you. Post that log in your next reply.

Note:
Do not click on combofix's window while it's running. That may cause it to stall.
  • 0

#3
painter1982

painter1982

    Member

  • Topic Starter
  • Member
  • PipPip
  • 54 posts
ran combofix ran the log. wont be back on until about 7pm tonight. thank you for all the help


ComboFix 08-04-22.5 - don 2008-04-24 7:06:20.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.625 [GMT -5:00]
Running from: C:\Documents and Settings\don\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Desktop\internetgamebox.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\InternetGameBox
C:\Documents and Settings\All Users\Start Menu\Programs\InternetGameBox\InternetGameBox.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\InternetGameBox\Privacy Policy.url
C:\Documents and Settings\All Users\Start Menu\Programs\InternetGameBox\Terms and Conditions.url
C:\Documents and Settings\All Users\Start Menu\Programs\InternetGameBox\Uninstall.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\InternetGameBox\Website.url
C:\Documents and Settings\don\Local Settings\Application Data\pxiijs.dat
C:\Documents and Settings\don\Local Settings\Application Data\pxiijs_nav.dat
C:\Documents and Settings\don\Local Settings\Application Data\pxiijs_navps.dat
C:\Documents and Settings\don\Local Settings\Temporary Internet Files\ijjistarter_verinfo.dat
C:\Documents and Settings\don\Local Settings\Temporary Internet Files\ijjistarter2FxB.exe
C:\WINDOWS\system32\nvs2.inf
C:\WINDOWS\system32\zevgghu.dat
C:\WINDOWS\system32\zevgghu.exe
C:\WINDOWS\system32\zevgghu_nav.dat
C:\WINDOWS\system32\zevgghu_navps.dat
I:\AVSDVDCopy.exe

.
((((((((((((((((((((((((( Files Created from 2008-03-24 to 2008-04-24 )))))))))))))))))))))))))))))))
.

2008-04-23 20:36 . 2008-04-23 20:44 <DIR> d----c--- C:\Documents and Settings\don\Application Data\DeepBurner
2008-04-21 07:42 . 2008-04-21 07:42 54,156 --ah-c--- C:\WINDOWS\QTFont.qfn
2008-04-21 07:42 . 2008-04-21 07:42 1,409 --a--c--- C:\WINDOWS\QTFont.for
2008-04-19 19:55 . 2008-04-19 19:55 <DIR> d----c--- C:\Deckard
2008-04-18 00:42 . 2008-04-23 23:06 148 --a--c--- C:\WINDOWS\system32\acmeinc.ini
2008-04-18 00:42 . 2008-04-23 23:06 116 --a--c--- C:\WINDOWS\system32\vxdtgm.ini
2008-04-18 00:40 . 2008-04-18 01:34 <DIR> d----c--- C:\Program Files\tg games
2008-04-15 23:51 . 2008-04-15 23:51 <DIR> d----c--- C:\Program Files\ReflexiveArcade
2008-04-15 22:59 . 2008-04-15 23:01 1,049,650 --a--c--- C:\WINDOWS\Prison Tycoon 3 Uninstaller.exe
2008-04-15 22:57 . 2008-04-15 22:57 <DIR> d----c--- C:\Program Files\Common Files\Thraex Software
2008-04-15 22:31 . 2008-04-15 22:31 <DIR> d----c--- C:\WINDOWS\CinemaTycoonCC
2008-04-15 22:31 . 2008-04-15 22:54 <DIR> d----c--- C:\Program Files\CinemaTycoonCC
2008-04-15 21:32 . 2008-04-15 21:32 <DIR> d--hsc--- C:\WINDOWS\ftpcache
2008-04-13 20:11 . 2008-04-13 20:11 <DIR> d----c--- C:\Program Files\Common Files\INCA Shared
2008-04-13 20:11 . 2003-07-19 01:17 5,174 --a--c--- C:\WINDOWS\system32\nppt9x.vxd
2008-04-13 20:11 . 2005-01-02 16:43 4,682 --a--c--- C:\WINDOWS\system32\npptNT2.sys
2008-04-13 19:53 . 2008-04-13 20:13 <DIR> d--h-c--- C:\Documents and Settings\don\Application Data\ijjigame
2008-04-13 19:52 . 2008-04-13 19:52 <DIR> d----c--- C:\Documents and Settings\All Users\Application Data\IJJIGame
2008-04-13 19:48 . 2008-04-13 19:48 <DIR> d----c--- C:\ijji
2008-04-10 14:52 . 2007-08-03 12:48 3,974,440 --a--c--- C:\WINDOWS\system\AdvrCntr3.dll
2008-04-10 14:34 . 2006-10-26 19:56 32,592 --a------ C:\WINDOWS\system32\msonpmon.dll
2008-04-10 14:33 . 2008-04-10 14:33 <DIR> d----c--- C:\Program Files\Microsoft Works
2008-04-10 14:32 . 2008-04-10 14:32 <DIR> d----c--- C:\Program Files\Microsoft.NET
2008-04-10 14:30 . 2008-04-10 14:30 <DIR> d----c--- C:\Program Files\Microsoft Visual Studio 8
2008-04-10 14:29 . 2008-04-10 14:32 <DIR> d----c--- C:\WINDOWS\SHELLNEW
2008-04-10 14:28 . 2008-04-10 14:28 <DIR> dr-h-c--- C:\MSOCache
2008-04-10 11:47 . 2008-04-10 11:47 <DIR> d----c--- C:\Documents and Settings\don\Application Data\KompoZer
2008-04-08 22:28 . 2004-08-04 00:56 159,232 --a--c--- C:\WINDOWS\system32\ptpusd.dll
2008-04-08 22:28 . 2004-08-03 22:58 15,104 --a--c--- C:\WINDOWS\system32\drivers\usbscan.sys
2008-04-08 22:28 . 2004-08-03 22:58 15,104 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys
2008-04-08 22:28 . 2001-08-17 22:36 5,632 --a--c--- C:\WINDOWS\system32\ptpusb.dll
2008-03-31 19:08 . 2008-03-31 19:08 <DIR> d----c--- C:\WINDOWS\system32\vmm32
2008-03-31 16:21 . 2008-03-31 16:21 <DIR> d----c--- C:\Documents and Settings\All Users\Application Data\TEMP
2008-03-31 15:16 . 2008-03-31 15:16 <DIR> d----c--- C:\Documents and Settings\don\Application Data\Malwarebytes
2008-03-31 15:16 . 2008-03-31 15:16 <DIR> d----c--- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-03-31 15:08 . 2008-03-31 15:08 2,644 --a--c--- C:\WINDOWS\system32\kill.vbs
2008-03-27 23:34 . 2008-03-27 23:34 372,687 -ra--c--- C:\My Money Backup_2008-03-27_233415.mbf
2008-03-27 23:19 . 2008-03-27 23:26 <DIR> d----c--- C:\Program Files\Microsoft Money 2007
2008-03-27 23:18 . 2008-03-27 23:18 0 --a--c--- C:\WINDOWS\Irremote.ini
2008-03-26 22:12 . 2008-03-26 22:12 <DIR> d----c--- C:\Program Files\Selfkey Systems

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-24 03:02 22,328 -c--a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-04-24 03:02 107,832 -c--a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-04-24 01:54 11,400 -c--a-w C:\WINDOWS\system32\drivers\sthdae.log
2008-04-24 01:08 --------- dc----w C:\Documents and Settings\don\Application Data\Azureus
2008-04-23 23:00 --------- dc----w C:\Program Files\Norton Security Scan
2008-04-20 23:00 --------- dc----w C:\Program Files\Common Files\Symantec Shared
2008-04-17 17:28 --------- dc----w C:\Documents and Settings\don\Application Data\LimeWire
2008-04-16 06:32 --------- dc----w C:\Documents and Settings\All Users\Application Data\MumboJumbo
2008-04-14 00:48 --------- dc-h--w C:\Program Files\InstallShield Installation Information
2008-04-10 19:35 --------- dc----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-04-10 19:33 --------- dc----w C:\Program Files\MSBuild
2008-04-01 13:19 --------- dc----w C:\Program Files\Java
2008-03-27 10:48 14,336 ----a-w C:\WINDOWS\system32\svchost.exe
2008-03-26 17:39 --------- dc----w C:\Documents and Settings\All Users\Application Data\DVD Shrink
2008-03-24 05:22 --------- dc----w C:\Documents and Settings\don\Application Data\U3
2008-03-23 04:54 --------- dc----w C:\Program Files\Disney
2008-03-21 11:03 --------- dc----w C:\Documents and Settings\don\Application Data\Move Networks
2008-03-21 02:44 --------- dc----w C:\Program Files\Common Files\DirectX
2008-03-21 00:48 --------- dc----w C:\Documents and Settings\don\Application Data\InstallShield
2008-03-20 16:29 --------- dc----w C:\Documents and Settings\All Users\Application Data\Trymedia
2008-03-20 03:43 --------- dc----w C:\Program Files\Virtools
2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-15 21:29 --------- dc----w C:\Program Files\Kuma Games
2008-03-14 02:25 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2008-03-02 21:54 --------- dc----w C:\Documents and Settings\don\Application Data\RipIt4Me
2008-03-01 13:06 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-02-29 13:00 --------- dc----w C:\Program Files\QuickTime
2008-02-29 12:59 --------- dc----w C:\Documents and Settings\All Users\Application Data\QuickTime
2008-02-27 11:54 --------- dc----w C:\Program Files\Reference Assemblies
2008-02-27 11:53 --------- dc----w C:\Program Files\Windows Media Connect 2
2008-02-27 11:53 --------- dc----w C:\Program Files\MSXML 6.0
2008-02-26 23:03 --------- dc----w C:\Documents and Settings\don\Application Data\Leadertech
2008-02-26 04:40 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-02-26 04:37 --------- dc----w C:\Program Files\GameShadow
2008-02-26 04:30 418,480 -c--a-w C:\WINDOWS\system32\wrap_oal.dll
2008-02-26 04:30 115,432 -c--a-w C:\WINDOWS\system32\OpenAL32.dll
2008-02-26 04:30 --------- dc----w C:\Program Files\OpenAL
2008-02-25 21:50 --------- dc----w C:\Program Files\Common Files\Adobe
2008-02-25 16:47 --------- dc----w C:\Program Files\Microsoft Silverlight
2008-02-25 03:27 --------- dc----w C:\Documents and Settings\All Users\Application Data\Cabela's Trophy Bucks Saves
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 05:32 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
.

------- Sigcheck -------

2008-03-27 05:48 14336 814d4d8993e03f5211a10870bae9d31b C:\WINDOWS\system32\svchost.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="G:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-01-17 11:51 486856]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 06:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="G:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-03-29 13:37 79224]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-09-17 09:07 8491008]

C:\Documents and Settings\don\Start Menu\Programs\Startup\
SpywareGuard.lnk - I:\Program Files\SpywareGuard\sgmain.exe [2003-08-29 19:05:35 360448]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoLogOff"= 0 (0x0)

[HKLM\~\startupfolder\C:^Documents and Settings^don^Start Menu^Programs^Startup^Kuma_Tray.lnk]
path=C:\Documents and Settings\don\Start Menu\Programs\Startup\Kuma_Tray.lnk
backup=C:\WINDOWS\pss\Kuma_Tray.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^don^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
path=C:\Documents and Settings\don\Start Menu\Programs\Startup\LimeWire On Startup.lnk
backup=C:\WINDOWS\pss\LimeWire On Startup.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a--c--- 2008-01-11 23:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2004-08-10 06:00 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2008-01-17 11:51 486856 G:\Program Files\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
--a--c--- 2005-08-05 14:56 64512 C:\WINDOWS\ehome\ehtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
--a------ 2006-10-27 00:47 31016 C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a--c--- 2007-12-13 20:10 1688872 C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
-----c--- 2004-10-13 11:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
--a--c--- 2007-12-03 15:21 2213160 C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a--c--- 2007-03-01 15:57 153136 C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a--c--- 2007-09-17 09:07 8491008 C:\WINDOWS\system32\NvCpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\pxiijs]
c:\documents and settings\don\local settings\application data\pxiijs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-02-29 08:00 77824 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]
--a--c--- 2005-08-24 07:42 393216 C:\WINDOWS\stsystra.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2008-02-22 04:25 144784 C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\zevgghu]
c:\windows\system32\zevgghu.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\WINDOWS\\system32\\dxdiag.exe"=
"F:\\Program Files\\America's Army\\System\\ArmyOps.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"G:\\Program Files\\Azureus\\Azureus.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"G:\\Program Files\\Microsoft Games\\Halo\\halo.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"G:\\Program Files\\Activision Value\\Soldier of Fortune Payback\\sof3.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"I:\\Program Files\\Eidos\\Conflict Denied Ops\\ConflictDeniedOps.exe"=
"I:\\Program Files\\Sega\\The Club\\Launcher.exe"=
"I:\\Program Files\\Sega\\The Club\\TheClub.exe"=
"G:\\Program Files\\Sierra Entertainment\\World In Conflict\\wic.exe"=
"G:\\Program Files\\Sierra Entertainment\\World In Conflict\\wic_online.exe"=
"G:\\Program Files\\Sierra Entertainment\\World In Conflict\\wic_ds.exe"=
"I:\\Program Files\\EA GAMES\\Medal of Honor Pacific Assault™\\mohpa.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\ijji\\ENGLISH\\u_sf\\soldierfront.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 13:31]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 13:35]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5ef0961e-e560-11dc-9fc0-00137214381d}]
\Shell\AutoRun\command - N:\setupSNK.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e4276fbc-d357-11dc-9fb7-00137214381d}]
\Shell\AutoRun\command - N:\LaunchU3.exe

*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder
"2008-04-23 23:01:19 C:\WINDOWS\Tasks\Norton Security Scan.job"
- C:\Program Files\Norton Security Scan\Nss.exe
.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-24 07:08:01
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-04-24 7:08:41
ComboFix-quarantined-files.txt 2008-04-24 12:08:34

Pre-Run: 7,905,910,784 bytes free
Post-Run: 8,085,975,040 bytes free

221 --- E O F --- 2008-04-09 05:43:55
  • 0

#4
greyknight17

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
Open up your Notepad editor (Start->Run, type in notepad and click OK). Copy and paste the text into the quotebox below:

File::
C:\WINDOWS\QTFont.qfn
C:\WINDOWS\QTFont.for
C:\WINDOWS\system32\acmeinc.ini
C:\WINDOWS\system32\vxdtgm.ini
c:\documents and settings\don\local settings\application data\pxiijs.exe
c:\windows\system32\zevgghu.exe
Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\pxiijs]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\zevgghu]

Save this as CFScript.txt in the same location as the ComboFix.exe tool.
Drag the CFScript.txt into ComboFix.exe
Follow the prompts. When finished, it shall produce a log for you. Post that log in your next reply.

Note: Do not click on combofix's window while it's running. That may cause it to stall.

How is it running so far?
  • 0

#5
painter1982

painter1982

    Member

  • Topic Starter
  • Member
  • PipPip
  • 54 posts
Here is the latest combofix scan with the cfsscript you told me to use. The computer itself is running fine i guess. No slow down on games or anything like that. What brought my attention to check the processes tab and hijack this log, was the fact I have never gotten any popups and then that one started to come up. As for the rest it seems to be up to speed. Internet can be slow at times but hardly ever is. I know these were not legit files and I did not put them there. Thank you so much for helping me get rid of them.


ComboFix 08-04-22.5 - don 2008-04-24 16:41:47.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.636 [GMT -5:00]
Running from: C:\Documents and Settings\don\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\don\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
c:\documents and settings\don\local settings\application data\pxiijs.exe
C:\WINDOWS\QTFont.for
C:\WINDOWS\QTFont.qfn
C:\WINDOWS\system32\acmeinc.ini
C:\WINDOWS\system32\vxdtgm.ini
c:\windows\system32\zevgghu.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\QTFont.for
C:\WINDOWS\QTFont.qfn
C:\WINDOWS\system32\acmeinc.ini
C:\WINDOWS\system32\vxdtgm.ini

.
((((((((((((((((((((((((( Files Created from 2008-03-24 to 2008-04-24 )))))))))))))))))))))))))))))))
.

2008-04-23 20:36 . 2008-04-23 20:44 <DIR> d----c--- C:\Documents and Settings\don\Application Data\DeepBurner
2008-04-19 19:55 . 2008-04-19 19:55 <DIR> d----c--- C:\Deckard
2008-04-18 00:40 . 2008-04-18 01:34 <DIR> d----c--- C:\Program Files\tg games
2008-04-15 23:51 . 2008-04-15 23:51 <DIR> d----c--- C:\Program Files\ReflexiveArcade
2008-04-15 22:59 . 2008-04-15 23:01 1,049,650 --a--c--- C:\WINDOWS\Prison Tycoon 3 Uninstaller.exe
2008-04-15 22:57 . 2008-04-15 22:57 <DIR> d----c--- C:\Program Files\Common Files\Thraex Software
2008-04-15 22:31 . 2008-04-15 22:31 <DIR> d----c--- C:\WINDOWS\CinemaTycoonCC
2008-04-15 22:31 . 2008-04-15 22:54 <DIR> d----c--- C:\Program Files\CinemaTycoonCC
2008-04-15 21:32 . 2008-04-15 21:32 <DIR> d--hsc--- C:\WINDOWS\ftpcache
2008-04-13 20:11 . 2008-04-13 20:11 <DIR> d----c--- C:\Program Files\Common Files\INCA Shared
2008-04-13 20:11 . 2003-07-19 01:17 5,174 --a--c--- C:\WINDOWS\system32\nppt9x.vxd
2008-04-13 20:11 . 2005-01-02 16:43 4,682 --a--c--- C:\WINDOWS\system32\npptNT2.sys
2008-04-13 19:53 . 2008-04-13 20:13 <DIR> d--h-c--- C:\Documents and Settings\don\Application Data\ijjigame
2008-04-13 19:52 . 2008-04-13 19:52 <DIR> d----c--- C:\Documents and Settings\All Users\Application Data\IJJIGame
2008-04-13 19:48 . 2008-04-13 19:48 <DIR> d----c--- C:\ijji
2008-04-10 14:52 . 2007-08-03 12:48 3,974,440 --a--c--- C:\WINDOWS\system\AdvrCntr3.dll
2008-04-10 14:34 . 2006-10-26 19:56 32,592 --a------ C:\WINDOWS\system32\msonpmon.dll
2008-04-10 14:33 . 2008-04-10 14:33 <DIR> d----c--- C:\Program Files\Microsoft Works
2008-04-10 14:32 . 2008-04-10 14:32 <DIR> d----c--- C:\Program Files\Microsoft.NET
2008-04-10 14:30 . 2008-04-10 14:30 <DIR> d----c--- C:\Program Files\Microsoft Visual Studio 8
2008-04-10 14:29 . 2008-04-10 14:32 <DIR> d----c--- C:\WINDOWS\SHELLNEW
2008-04-10 14:28 . 2008-04-10 14:28 <DIR> dr-h-c--- C:\MSOCache
2008-04-10 11:47 . 2008-04-10 11:47 <DIR> d----c--- C:\Documents and Settings\don\Application Data\KompoZer
2008-04-08 22:28 . 2004-08-04 00:56 159,232 --a--c--- C:\WINDOWS\system32\ptpusd.dll
2008-04-08 22:28 . 2004-08-03 22:58 15,104 --a--c--- C:\WINDOWS\system32\drivers\usbscan.sys
2008-04-08 22:28 . 2004-08-03 22:58 15,104 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys
2008-04-08 22:28 . 2001-08-17 22:36 5,632 --a--c--- C:\WINDOWS\system32\ptpusb.dll
2008-03-31 19:08 . 2008-03-31 19:08 <DIR> d----c--- C:\WINDOWS\system32\vmm32
2008-03-31 16:21 . 2008-03-31 16:21 <DIR> d----c--- C:\Documents and Settings\All Users\Application Data\TEMP
2008-03-31 15:16 . 2008-03-31 15:16 <DIR> d----c--- C:\Documents and Settings\don\Application Data\Malwarebytes
2008-03-31 15:16 . 2008-03-31 15:16 <DIR> d----c--- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-03-31 15:08 . 2008-03-31 15:08 2,644 --a--c--- C:\WINDOWS\system32\kill.vbs
2008-03-27 23:34 . 2008-03-27 23:34 372,687 -ra--c--- C:\My Money Backup_2008-03-27_233415.mbf
2008-03-27 23:19 . 2008-03-27 23:26 <DIR> d----c--- C:\Program Files\Microsoft Money 2007
2008-03-27 23:18 . 2008-03-27 23:18 0 --a--c--- C:\WINDOWS\Irremote.ini
2008-03-26 22:12 . 2008-03-26 22:12 <DIR> d----c--- C:\Program Files\Selfkey Systems

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-24 03:02 22,328 -c--a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-04-24 03:02 107,832 -c--a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-04-24 01:54 11,400 -c--a-w C:\WINDOWS\system32\drivers\sthdae.log
2008-04-24 01:08 --------- dc----w C:\Documents and Settings\don\Application Data\Azureus
2008-04-23 23:00 --------- dc----w C:\Program Files\Norton Security Scan
2008-04-20 23:00 --------- dc----w C:\Program Files\Common Files\Symantec Shared
2008-04-17 17:28 --------- dc----w C:\Documents and Settings\don\Application Data\LimeWire
2008-04-16 06:32 --------- dc----w C:\Documents and Settings\All Users\Application Data\MumboJumbo
2008-04-14 00:48 --------- dc-h--w C:\Program Files\InstallShield Installation Information
2008-04-10 19:35 --------- dc----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-04-10 19:33 --------- dc----w C:\Program Files\MSBuild
2008-04-01 13:19 --------- dc----w C:\Program Files\Java
2008-03-27 10:48 14,336 ----a-w C:\WINDOWS\system32\svchost.exe
2008-03-26 17:39 --------- dc----w C:\Documents and Settings\All Users\Application Data\DVD Shrink
2008-03-24 05:22 --------- dc----w C:\Documents and Settings\don\Application Data\U3
2008-03-23 04:54 --------- dc----w C:\Program Files\Disney
2008-03-21 11:03 --------- dc----w C:\Documents and Settings\don\Application Data\Move Networks
2008-03-21 02:44 --------- dc----w C:\Program Files\Common Files\DirectX
2008-03-21 00:48 --------- dc----w C:\Documents and Settings\don\Application Data\InstallShield
2008-03-20 16:29 --------- dc----w C:\Documents and Settings\All Users\Application Data\Trymedia
2008-03-20 03:43 --------- dc----w C:\Program Files\Virtools
2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-15 21:29 --------- dc----w C:\Program Files\Kuma Games
2008-03-14 02:25 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2008-03-02 21:54 --------- dc----w C:\Documents and Settings\don\Application Data\RipIt4Me
2008-03-01 13:06 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-02-29 13:00 --------- dc----w C:\Program Files\QuickTime
2008-02-29 12:59 --------- dc----w C:\Documents and Settings\All Users\Application Data\QuickTime
2008-02-27 11:54 --------- dc----w C:\Program Files\Reference Assemblies
2008-02-27 11:53 --------- dc----w C:\Program Files\Windows Media Connect 2
2008-02-27 11:53 --------- dc----w C:\Program Files\MSXML 6.0
2008-02-26 23:03 --------- dc----w C:\Documents and Settings\don\Application Data\Leadertech
2008-02-26 04:40 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-02-26 04:37 --------- dc----w C:\Program Files\GameShadow
2008-02-26 04:30 418,480 -c--a-w C:\WINDOWS\system32\wrap_oal.dll
2008-02-26 04:30 115,432 -c--a-w C:\WINDOWS\system32\OpenAL32.dll
2008-02-26 04:30 --------- dc----w C:\Program Files\OpenAL
2008-02-25 21:50 --------- dc----w C:\Program Files\Common Files\Adobe
2008-02-25 16:47 --------- dc----w C:\Program Files\Microsoft Silverlight
2008-02-25 03:27 --------- dc----w C:\Documents and Settings\All Users\Application Data\Cabela's Trophy Bucks Saves
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 05:32 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
.

------- Sigcheck -------

2008-03-27 05:48 14336 814d4d8993e03f5211a10870bae9d31b C:\WINDOWS\system32\svchost.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="G:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-01-17 11:51 486856]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 06:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="G:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-03-29 13:37 79224]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-09-17 09:07 8491008]

C:\Documents and Settings\don\Start Menu\Programs\Startup\
SpywareGuard.lnk - I:\Program Files\SpywareGuard\sgmain.exe [2003-08-29 19:05:35 360448]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoLogOff"= 0 (0x0)

[HKLM\~\startupfolder\C:^Documents and Settings^don^Start Menu^Programs^Startup^Kuma_Tray.lnk]
path=C:\Documents and Settings\don\Start Menu\Programs\Startup\Kuma_Tray.lnk
backup=C:\WINDOWS\pss\Kuma_Tray.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^don^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
path=C:\Documents and Settings\don\Start Menu\Programs\Startup\LimeWire On Startup.lnk
backup=C:\WINDOWS\pss\LimeWire On Startup.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a--c--- 2008-01-11 23:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2004-08-10 06:00 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2008-01-17 11:51 486856 G:\Program Files\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
--a--c--- 2005-08-05 14:56 64512 C:\WINDOWS\ehome\ehtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
--a------ 2006-10-27 00:47 31016 C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a--c--- 2007-12-13 20:10 1688872 C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
-----c--- 2004-10-13 11:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
--a--c--- 2007-12-03 15:21 2213160 C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a--c--- 2007-03-01 15:57 153136 C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a--c--- 2007-09-17 09:07 8491008 C:\WINDOWS\system32\NvCpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-02-29 08:00 77824 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]
--a--c--- 2005-08-24 07:42 393216 C:\WINDOWS\stsystra.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2008-02-22 04:25 144784 C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\WINDOWS\\system32\\dxdiag.exe"=
"F:\\Program Files\\America's Army\\System\\ArmyOps.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"G:\\Program Files\\Azureus\\Azureus.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"G:\\Program Files\\Microsoft Games\\Halo\\halo.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"G:\\Program Files\\Activision Value\\Soldier of Fortune Payback\\sof3.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"I:\\Program Files\\Eidos\\Conflict Denied Ops\\ConflictDeniedOps.exe"=
"I:\\Program Files\\Sega\\The Club\\Launcher.exe"=
"I:\\Program Files\\Sega\\The Club\\TheClub.exe"=
"G:\\Program Files\\Sierra Entertainment\\World In Conflict\\wic.exe"=
"G:\\Program Files\\Sierra Entertainment\\World In Conflict\\wic_online.exe"=
"G:\\Program Files\\Sierra Entertainment\\World In Conflict\\wic_ds.exe"=
"I:\\Program Files\\EA GAMES\\Medal of Honor Pacific Assault™\\mohpa.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\ijji\\ENGLISH\\u_sf\\soldierfront.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 13:31]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 13:35]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5ef0961e-e560-11dc-9fc0-00137214381d}]
\Shell\AutoRun\command - N:\setupSNK.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e4276fbc-d357-11dc-9fb7-00137214381d}]
\Shell\AutoRun\command - N:\LaunchU3.exe

*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder
"2008-04-23 23:01:19 C:\WINDOWS\Tasks\Norton Security Scan.job"
- C:\Program Files\Norton Security Scan\Nss.exe
.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-24 16:42:31
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-04-24 16:42:58
ComboFix-quarantined-files.txt 2008-04-24 21:42:54
ComboFix2.txt 2008-04-24 12:08:42

Pre-Run: 8,033,959,936 bytes free
Post-Run: 8,007,708,672 bytes free

208 --- E O F --- 2008-04-09 05:43:55
  • 0

#6
greyknight17

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
Good job. Your log is clean.

To help prevent future spyware infections, read the Anti-Spyware Tutorial and use the tools provided.

Are there any problems now? If none, go to Start->Run, copy/paste in combofix /u and hit OK to remove it. You should be set to go.
  • 0

#7
greyknight17

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :)

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP