Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Trojan.Downloader.Small.ulg? [RESOLVED]


  • This topic is locked This topic is locked

#1
Tony_S

Tony_S

    New Member

  • Member
  • Pip
  • 4 posts
Hi all, I'm new to the forum so pleased to meet you all.

I've picked up a very nasty malware, the first symptoms I've noticed are
1. giving me a "page error in nonpaged area" stop blue screen whenever I try to boot windows normally. (0x00000050)
2. Changed all google and other search engine results to the address at http://58.65.234.196...***************
3. Certain sites I just can't go to directly, IE returns with an server error under safe mode, firefox simply don't start at all.
4. my research indicate that it seems to reside in a file named clbdll.dll under system32 folder, but I can't even find this file even with all the system files option enabled under folder option. this is some kind of stealthy malware?
5. Whenever the save as option is selected in notepad, notepad just quits itself
6. cannot run norton live update for unknown reason, full norton scan didn't comeup with anything

I've done a Comboscan, and the logs are as follows:


Thank you so much for your help!


Deckard's System Scanner v20071014.68

Run by Administrator on 2008-05-24 17:57:48

Computer is in Safe Mode with Networking.

--------------------------------------------------------------------------------







-- HijackThis (run as Administrator.exe) ---------------------------------------



Unable to find log (file not found); running clone.

-- HijackThis Clone ------------------------------------------------------------





Emulating logfile of Trend Micro HijackThis v2.0.2

Scan saved at 2008-05-24 17:58:55

Platform: Windows XP Service Pack 2 (5.01.2600)

MSIE: Internet Explorer (7.00.6000.16574)

Boot mode: Safe mode with network support



Running processes:

L:\WINDOWS\system32\smss.exe

L:\WINDOWS\system32\winlogon.exe

L:\WINDOWS\system32\services.exe

L:\WINDOWS\system32\lsass.exe

L:\WINDOWS\system32\svchost.exe

L:\WINDOWS\system32\svchost.exe

L:\WINDOWS\explorer.exe

L:\WINDOWS\system32\ctfmon.exe

L:\WINDOWS\system32\conime.exe

L:\WINDOWS\system32\rundll32.exe

L:\WINDOWS\system32\rundll32.exe

L:\Program Files\Internet Explorer\iexplore.exe

D:\dss.exe

E:\Raw\Programs\hijackthis\Administrator.exe



R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft....k/?LinkId=74005

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - L:\p\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: AddTask Class - {24F06550-65E3-4D1C-8CFE-839C296B5530} - C:\Program Files\eREAD6.0\eREAD6.0\IEeREAD.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - L:\p\Spybot - Search & Destroy\SDHelper.dll

O2 - BHO: (no name) - {53E91E47-C649-4811-9BEA-A337736904F5} - L:\WINDOWS\system32\tuvUlMFV.dll (file missing)

O2 - BHO: (no name) - {61A1C2F2-E1A9-4871-B4E2-493A90705E12} - L:\WINDOWS\system32\kbduzb32.dll

O2 - BHO: (no name) - {663656DF-6BAE-460C-A612-8133DF519346} - L:\WINDOWS\system32\byXPGvuu.dll

O2 - BHO: AddTask Class - {6A19C29D-ED45-4483-8999-9F939C8161F2} - C:\Program Files\eREAD6.0\eREAD6.0\WebHook.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - L:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - L:\p\FlashGet\getflash.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - L:\p\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O3 - Toolbar: øÏ≥µ(FlashGet) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - L:\p\FlashGet\fgiebar.dll (file missing)

O4 - HKLM\..\Run: [IMJPMIG8.1] "L:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

O4 - HKLM\..\Run: [PHIME2002ASync] L:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC

O4 - HKLM\..\Run: [PHIME2002A] L:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [amd_dc_opt] L:\P\Dual-Core Optimizer\amd_dc_opt.exe

O4 - HKLM\..\Run: [QuickTime Task] "L:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "L:\P\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"

O4 - HKLM\..\Run: [StormCodec_Helper] "L:\p\Storm Codec\StormSet.exe" /S /opti

O4 - HKLM\..\Run: [IMSCMIG40W] L:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40W\IMSCMIG.EXE /SetPreload /Log

O4 - HKLM\..\Run: [ccApp] "L:\Program Files\Common Files\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [osCheck] "L:\p\Norton\osCheck.exe"

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE L:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE L:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [BM5fd38cdc] Rundll32.exe "L:\WINDOWS\system32\tleqifrd.dll",s

O4 - HKLM\..\Run: [04856f1a] rundll32.exe "L:\WINDOWS\system32\qfneucsj.dll",b

O4 - HKLM\..\RunOnce: [Spybot - Search & Destroy] "L:\P\Spybot - Search & Destroy\SpybotSD.exe" /autocheck

O4 - HKLM\..\RunOnce: [SpybotDeletingA1774] command /c del "L:\WINDOWS\system32\tuvUlMFV.dll_old"

O4 - HKLM\..\RunOnce: [SpybotDeletingC5020] cmd /c del "L:\WINDOWS\system32\tuvUlMFV.dll_old"

O4 - HKCU\..\Run: [ctfmon.exe] L:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] L:\WINDOWS\system32\Macromed\Flash\FlashUtil9b.exe

O4 - HKCU\..\RunOnce: [SpybotDeletingB3549] command /c del "L:\WINDOWS\system32\tuvUlMFV.dll_old"

O4 - HKCU\..\RunOnce: [SpybotDeletingD4810] cmd /c del "L:\WINDOWS\system32\tuvUlMFV.dll_old"

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] L:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] L:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] L:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] L:\WINDOWS\system32\ctfmon.exe (User 'Default user')

O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - L:\p\Microsoft Office\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - L:\p\Microsoft Office\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing)

O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://L:\p\BitComet100\tools\BitCometBHO_1.2.2.28.dll/206 (file missing)

O9 - Extra button: øÏ≥µ - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - L:\p\FlashGet\flashget.exe

O9 - Extra 'Tools' menuitem: øÏ≥µ(FlashGet) - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - L:\p\FlashGet\flashget.exe

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - L:\p\Spybot - Search & Destroy\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - L:\p\Spybot - Search & Destroy\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - L:\WINDOWS\network diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - L:\WINDOWS\network diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - L:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - L:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} () - http://download.micr...922/wmv9VCM.CAB

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - L:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll

O18 - Protocol: ms-help - {314111c7-a502-11d2-bbca-00c04f8ec294} - L:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - L:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll

O18 - Filter: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - L:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL

O20 - Winlogon Notify: AtiExtEvent - L:\WINDOWS\system32\

O20 - Winlogon Notify: byXPGvuu - L:\WINDOWS\system32\byXPGvuu.dll

O23 - Service: Adobe LM Service - Adobe Systems - L:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Apple Mobile Device - Apple, Inc. - L:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - L:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - L:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

O23 - Service: Contrl Center of Storm Media (ccosm) - ±±æ©±©∑ÁÕ¯º ø∆ºº”–œfiπ´Àæ - L:\p\StormII\stormliv.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - L:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - L:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - L:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPod Service - Apple Inc. - L:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - L:\p\Norton\isPwdSvc.exe

O23 - Service: LiveUpdate - Symantec Corporation - L:\Program Files\Symantec\LiveUpdate\LuComServer_3_1.EXE

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - L:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Pml Driver HPZ12 - HP - L:\WINDOWS\system32\HPZipm12.exe

O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - L:\p\Sandra\Win32\RpcDataSrv.exe

O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - L:\p\Sandra\RpcSandraSrv.exe

O23 - Service: FrontLine Drivers Auto Removal (v2) (sfrem02) - Protection Technology (StarForce) - L:\WINDOWS\system32\sfrem02.exe

O23 - Service: Symantec Core LC - Symantec Corporation - L:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - L:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe





--

End of file - 9499 bytes



-- Files created between 2008-04-24 and 2008-05-24 -----------------------------



2008-05-24 16:19:24 136192 --a------ L:\WINDOWS\system32\fnlncjpq.dll

2008-05-24 16:16:28 2560 --a------ L:\WINDOWS\system32\iiwphnrx.exe

2008-05-24 16:13:32 115200 --a------ L:\WINDOWS\system32\qfneucsj.dll

2008-05-24 16:13:24 126464 --a------ L:\WINDOWS\system32\tleqifrd.dll

2008-05-24 15:40:14 0 d-------- L:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy

2008-05-24 05:53:11 0 d--hs---- L:\System Volume Information

2008-05-24 04:11:05 891793 --ahs---- L:\WINDOWS\system32\VFMlUvut.ini2

2008-05-24 03:56:49 59392 --a------ L:\WINDOWS\system32\pmnnOFvS.dll

2008-05-24 03:55:24 7168 --a------ L:\WINDOWS\system32\beep.sys

2008-05-24 03:55:20 221184 --a------ L:\WINDOWS\system32\nvrsma.dll

2008-05-24 03:55:18 93696 --a------ L:\WINDOWS\system32\ntpl.bin

2008-05-24 03:55:16 69042 --a------ L:\WINDOWS\system32\sywtdxaz.sys

2008-05-24 03:55:09 59392 --a------ L:\WINDOWS\system32\byXPGvuu.dll

2008-05-24 03:30:59 0 d-------- L:\3gptemp

2008-05-24 03:28:12 0 d-------- L:\Program Files\MIKSOFT

2008-05-10 18:19:53 57344 --a------ L:\WINDOWS\system32\sticversion.exe <Not Verified; SoftTech InterCorp; pRegFix>

2008-05-10 18:19:53 561152 --a------ L:\WINDOWS\system32\AltST.dll <Not Verified; SoftTech InterCorp; AltST>

2008-05-10 18:19:53 0 d-------- L:\Program Files\Common Files\SoftTech InterCorp

2008-05-10 02:58:23 3543 --a------ L:\WINDOWS\system32\drivers\XSpaceWg.sys <Not Verified; SPACE INT'L, Inc.; CDSpace>

2008-05-10 02:58:23 11120 --a------ L:\WINDOWS\system32\drivers\TwoRabts.sys <Not Verified; Two Rabbits, Inc.; Two Rabbits live bus>

2008-05-10 02:58:23 22570 --a------ L:\WINDOWS\system32\drivers\CDSPACEX.sys <Not Verified; SPACE INT'L, Inc.; CDSpace5>

2008-05-10 02:58:23 22048 --a------ L:\WINDOWS\system32\cocpyinf.dll <Not Verified; Windows ® 2000 DDK provider; Windows ® 2000 DDK driver>

2008-05-06 21:19:44 0 d-------- L:\WINDOWS\Downloaded Installations

2008-05-05 13:56:25 0 d-------- L:\Documents and Settings\Roi\Application Data\HP

2008-05-05 13:55:03 0 d-------- L:\Program Files\Hewlett-Packard

2008-05-05 13:40:53 11634 --a------ L:\WINDOWS\hpomdl11.dat

2008-05-01 19:51:05 0 d-------- L:\WINDOWS\Ω¿∞ƒ “∆≠∞

2008-05-01 17:09:58 0 d-------- L:\WINDOWS\nview

2008-04-30 03:41:00 2368 --a------ L:\WINDOWS\system32\STEC3.sys <Not Verified; AntiCracking; SVKP driver for NT>





-- Find3M Report ---------------------------------------------------------------



2008-05-24 03:55:21 577536 --a------ L:\WINDOWS\system32\user32.DLL <Not Verified; Microsoft Corporation; Microsoft? Windows? Operating System>

2008-05-21 13:34:41 0 d-------- L:\Program Files\Common Files\Symantec Shared

2008-05-18 21:22:04 43520 --a------ L:\WINDOWS\system32\CmdLineExt03.dll

2008-05-15 02:04:17 0 d--h----- L:\Program Files\InstallShield Installation Information

2008-05-10 18:19:53 0 d-------- L:\Program Files\Common Files

2008-05-07 16:03:59 98304 --a------ L:\WINDOWS\system32\CmdLineExt.dll <Not Verified; Sony DADC Austria AG.; >

2008-05-05 13:56:03 116976 --a------ L:\WINDOWS\hpoins11.dat

2008-04-01 20:20:08 2560 --a------ L:\WINDOWS\system32\bitcometres.dll <Not Verified; BitComet; BitComet BCTP Helper>

2008-03-29 18:09:46 409600 --a------ L:\WINDOWS\system32\wrap_oal.dll <Not Verified; Creative Labs; Creative Labs OpenAL32>

2008-03-29 18:09:46 114688 --a------ L:\WINDOWS\system32\OpenAL32.dll <Not Verified; Portions © Creative Labs Inc. and NVIDIA Corp.; Standard OpenAL™ Library>

2008-03-29 18:09:46 0 d-------- L:\Program Files\OpenAL

2008-03-10 11:55:54 14848 --a------ L:\WINDOWS\system32\kbduzb32.dll





-- Registry Dump ---------------------------------------------------------------



*Note* empty entries & legit default entries are not shown





[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{24F06550-65E3-4D1C-8CFE-839C296B5530}]

06/28/2007 05:25 PM 57344 --a------ C:\Program Files\eREAD6.0\eREAD6.0\IEeREAD.dll



[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{53E91E47-C649-4811-9BEA-A337736904F5}]

L:\WINDOWS\system32\tuvUlMFV.dll



[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{61A1C2F2-E1A9-4871-B4E2-493A90705E12}]

03/10/2008 11:55 AM 14848 --a------ L:\WINDOWS\system32\kbduzb32.dll



[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{663656DF-6BAE-460C-A612-8133DF519346}]

05/24/2008 03:55 AM 59392 --a------ L:\WINDOWS\system32\byXPGvuu.dll



[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6A19C29D-ED45-4483-8999-9F939C8161F2}]

02/22/2008 05:57 PM 58960 --a------ C:\Program Files\eREAD6.0\eREAD6.0\WebHook.dll



[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IMJPMIG8.1"="L:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [08/04/2004 08:00 AM]

"PHIME2002ASync"="L:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [08/04/2004 08:00 AM]

"PHIME2002A"="L:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [08/04/2004 08:00 AM]

"RTHDCPL"="RTHDCPL.EXE" [08/10/2007 03:21 AM L:\WINDOWS\RTHDCPL.exe]

"amd_dc_opt"="L:\P\Dual-Core Optimizer\amd_dc_opt.exe" [07/23/2007 12:06 PM]

"QuickTime Task"="L:\Program Files\QuickTime\QTTask.exe" [11/15/2007 12:43 AM]

"Acrobat Assistant 7.0"="L:\P\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [12/14/2004 03:12 AM]

"StormCodec_Helper"="L:\p\Storm Codec\StormSet.exe" [11/26/2006 02:30 PM]

"IMSCMIG40W"="L:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40W\IMSCMIG.exe" [03/20/2006 05:10 PM]

"ccApp"="L:\Program Files\Common Files\Symantec Shared\ccApp.exe" [01/23/2008 10:02 PM]

"osCheck"="L:\p\Norton\osCheck.exe" [01/23/2008 09:07 PM]

"NvCplDaemon"="L:\WINDOWS\system32\NvCpl.dll" [12/05/2007 01:41 AM]

"nwiz"="nwiz.exe" [12/05/2007 01:41 AM L:\WINDOWS\system32\nwiz.exe]

"NvMediaCenter"="L:\WINDOWS\system32\NvMcTray.dll" [12/05/2007 01:41 AM]

"KernelFaultCheck"="L:\WINDOWS\system32\dumprep 0 -k" []

"BM5fd38cdc"="L:\WINDOWS\system32\tleqifrd.dll" [05/24/2008 04:13 PM]

"04856f1a"="L:\WINDOWS\system32\qfneucsj.dll" [05/24/2008 04:13 PM]



[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="L:\WINDOWS\system32\ctfmon.exe" [08/04/2004 08:00 AM]



[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runonce]

"FlashPlayerUpdate"=L:\WINDOWS\system32\Macromed\Flash\FlashUtil9b.exe

"SpybotDeletingB3549"=command /c del "L:\WINDOWS\system32\tuvUlMFV.dll_old"

"SpybotDeletingD4810"=cmd /c del "L:\WINDOWS\system32\tuvUlMFV.dll_old"



[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce]

"Spybot - Search & Destroy"="L:\P\Spybot - Search & Destroy\SpybotSD.exe" /autocheck

"SpybotDeletingA1774"=command /c del "L:\WINDOWS\system32\tuvUlMFV.dll_old"

"SpybotDeletingC5020"=cmd /c del "L:\WINDOWS\system32\tuvUlMFV.dll_old"



L:\Documents and Settings\All Users\Start Menu\Programs\Startup\

Adobe Acrobat Speed Launcher.lnk - L:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [11/25/2007 1:55:20 PM]



[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]

"DisableRegistryTools"=0 (0x0)



[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]

"DisableRegistryTools"=0 (0x0)



[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]

"{663656DF-6BAE-460C-A612-8133DF519346}"= L:\WINDOWS\system32\byXPGvuu.dll [05/24/2008 03:55 AM 59392]



[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\byXPGvuu]

byXPGvuu.dll 05/24/2008 03:55 AM 59392 L:\WINDOWS\system32\byXPGvuu.dll



[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

"Authentication Packages"= msv1_0 L:\WINDOWS\system32\tuvUlMFV



[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\L:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk]

path=L:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk

backup=L:\WINDOWS\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup



[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\L:^Documents and Settings^All Users^Start Menu^Programs^Startup^Call of Duty® 4 - Modern Warfare™ Multiplayer.lnk]

path=L:\Documents and Settings\All Users\Start Menu\Programs\Startup\Call of Duty® 4 - Modern Warfare™ Multiplayer.lnk

backup=L:\WINDOWS\pss\Call of Duty® 4 - Modern Warfare™ Multiplayer.lnkCommon Startup



[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\L:^Documents and Settings^All Users^Start Menu^Programs^Startup^Call of Duty® 4 - Modern Warfare™ Singleplayer.lnk]

path=L:\Documents and Settings\All Users\Start Menu\Programs\Startup\Call of Duty® 4 - Modern Warfare™ Singleplayer.lnk

backup=L:\WINDOWS\pss\Call of Duty® 4 - Modern Warfare™ Singleplayer.lnkCommon Startup



[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\L:^Documents and Settings^All Users^Start Menu^Programs^Startup^LCDPlayer.lnk]

path=L:\Documents and Settings\All Users\Start Menu\Programs\Startup\LCDPlayer.lnk

backup=L:\WINDOWS\pss\LCDPlayer.lnkCommon Startup



[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\L:^Documents and Settings^All Users^Start Menu^Programs^Startup^Uninstall Call of Duty® 4 - Modern Warfare™.lnk]

path=L:\Documents and Settings\All Users\Start Menu\Programs\Startup\Uninstall Call of Duty® 4 - Modern Warfare™.lnk

backup=L:\WINDOWS\pss\Uninstall Call of Duty® 4 - Modern Warfare™.lnkCommon Startup





[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\04856f1a]

rundll32.exe "L:\WINDOWS\system32\ukwsqnsm.dll",b



[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]

ALCMTR.EXE



[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]

L:\WINDOWS\system32\ctfmon.exe



[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]

L:\P\HP\HP Software Update\HPWuSchd2.exe



[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

"L:\P\iTunes\iTunesHelper.exe"



[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LiveMonitor]

L:\Program Files\MSI\Live Update 3\LMonitor.exe



[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]

"L:\Program Files\Messenger\msmsgs.exe" /background



[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]

"L:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background



[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]

L:\WINDOWS\system32\NeroCheck.exe



[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]

L:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe



[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"usnjsvc"=3 (0x3)

"sfrem02"=2 (0x2)

"Pml Driver HPZ12"=2 (0x2)



[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"MSConfig"=L:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto





[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\M]

AutoRun\command- M:\autorun.exe









-- End of Deckard's System Scanner: finished at 2008-05-24 17:59:51 ------------

Edited by Tony_S, 24 May 2008 - 06:55 PM.

  • 0

Advertisements


#2
fenzodahl512

fenzodahl512

  • Malware Removal
  • 9,863 posts
Hello Tony, my name is fenzodahl512 and welcome to Geekstogo.. Please do the following..


Please visit below webpage for instructions for downloading and running ComboFix

http://www.bleepingc...to-use-combofix

This includes installing the Windows XP Recovery Console in case you have not installed it yet.

For more information on the Windows XP Recovery Console read http://support.microsoft.com/kb/314058.

Once you install the Recovery Console, when you reboot your computer, you'll see the option for the Recovery Console now as well. DO NOT select Recovery Console as we don't need it. By default, your main OS is selected there. The screen stays for 2 seconds and then it proceeds to load Windows. That is normal.

Post the log from ComboFix (located in C:\combofix.txt) when you've accomplished that, along with a new HijackThis log.

Please post the logs as it is.. Please do not alter the log.. It will make me easier to read it..

Thank you :)
  • 0

#3
Tony_S

Tony_S

    New Member

  • Topic Starter
  • Member
  • Pip
  • 4 posts
Hi fenzodahl512, thank you for helping me, I need the computer really bad so I just reinstalled windows. Please close this thread, and hopefully whoever else have this problem will be able to fix it without reinstall the system.
  • 0

#4
fenzodahl512

fenzodahl512

  • Malware Removal
  • 9,863 posts
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :)

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP