Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Vundo+others please advise!

Started by tim1283 , May 11 2008 04:15 PM

Please log in to reply

#1
tim1283

Posted 11 May 2008 - 04:15 PM

New Member

Member
9 posts

I believe I am having the same registry/wallpaper hack that everyone else seems to be getting. This hack would automatically open up an IE browser to an antispyware ad, it would disable access to regedit and taskmanager, reset wallpaper and change my default homepage for IE automatically randomly every 5-10 min. Anyway one of you super smart people want to take a look at my logs and find out whats up?

I have read the previous forum posts and followed the basic instructions of log creating and pre-scans and just wanted to make sure I have completed all the steps necessary to resolve this issue.

#2
kahdah

Posted 11 May 2008 - 05:15 PM

GeekU Teacher

Retired Staff
15,822 posts

Hello tim1283

Welcome to G2Go.

=====================
* Click here to download HJTsetup.exe

Save HJTsetup.exe to your desktop.
Doubleclick on the HJTsetup.exe icon on your desktop.
By default it will install to C:\Program Files\Trend Micro\Hijack This.
Click on I agree
Then Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
Come back here to this thread and Paste the log in your next reply.
DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required.

#3
tim1283

Posted 11 May 2008 - 05:51 PM

New Member

Topic Starter
Member
9 posts

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:00:26 PM, on 5/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\AVG7\avgrssvc.exe
C:\AVG7\avgamsvr.exe
C:\AVG7\avgupsvc.exe
C:\AVG7\avgrssvc.exe
C:\AVG7\avgemc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\SOUNDMAN.EXE
D:\Keyboard driver\KbdAp32A.exe
D:\Browser Mouse\mouse32a.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\AVG7\avgcc.exe
C:\Program Files\Java\bin\jusched.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\rundll32.exe
C:\Office\OFFICE11\WINWORD.EXE
C:\WINDOWS\rundll32.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Virus Protection\Trend Micro-HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://c:/windows/homepage.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = file://c:/windows/homepage.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = file://c:/windows/homepage.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://c:/windows/homepage.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = file://c:/windows/homepage.html
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [FLMK08KB] D:\Keyboard driver\KbdAp32A.exe
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] D:\Browser Mouse\mouse32a.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG7_CC] C:\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\bin\jusched.exe"
O4 - HKLM\..\Run: [BM17fa9fd5] Rundll32.exe "C:\WINDOWS\system32\dnbvqeqp.dll",s
O4 - HKLM\..\Run: [14c9ac49] rundll32.exe "C:\WINDOWS\system32\jpkrurnj.dll",b
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\AVG7\avgw.exe /RUNONCE (User 'Default user')
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\Office\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Office\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.mi...b?1210404462990
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.mi...b?1210436609531
O21 - SSODL: WebProxy - {66186F05-BBBB-4a39-864F-72D84615C679} - sockins32.dll (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\AVG7\avgupsvc.exe
O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\AVG7\avgrssvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\AVG7\avgemc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 4696 bytes

#4
tim1283

Posted 11 May 2008 - 05:52 PM

New Member

Topic Starter
Member
9 posts

SmitFraudFix v2.320

Scan done at 13:39:00.57, Sun 05/11/2008
Run from C:\Documents and Settings\Tim\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process

»»»»»»»»»»»»»»»»»»»»»»»» hosts

127.0.0.1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» 404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{E0D46777-11D0-4524-8816-97B4AF56A636}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{E0D46777-11D0-4524-8816-97B4AF56A636}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{E0D46777-11D0-4524-8816-97B4AF56A636}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1

»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» End

#5
tim1283

Posted 11 May 2008 - 05:53 PM

New Member

Topic Starter
Member
9 posts

Then did it in Safemode,

SmitFraudFix v2.320

Scan done at 13:39:00.57, Sun 05/11/2008
Run from C:\Documents and Settings\Tim\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process

»»»»»»»»»»»»»»»»»»»»»»»» hosts

127.0.0.1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» 404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{E0D46777-11D0-4524-8816-97B4AF56A636}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{E0D46777-11D0-4524-8816-97B4AF56A636}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{E0D46777-11D0-4524-8816-97B4AF56A636}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1

»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» End

Then,

ComboFix 08-05-11.1 - Tim 2008-05-11 13:43:18.1 - NTFSx86 MINIMAL
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1694 [GMT -7:00]
Running from: C:\Documents and Settings\Tim\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\pskt.ini
C:\WINDOWS\rundll32.exe
C:\WINDOWS\system32\adult.txt
C:\WINDOWS\system32\finance.txt
C:\WINDOWS\system32\jnrurkpj.ini
C:\WINDOWS\system32\KRsCcfii.ini
C:\WINDOWS\system32\KRsCcfii.ini2
C:\WINDOWS\system32\lt.res
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\other.txt
C:\WINDOWS\system32\pharma.txt
C:\WINDOWS\system32\sft.res

.
((((((((((((((((((((((((( Files Created from 2008-04-11 to 2008-05-11 )))))))))))))))))))))))))))))))
.

2008-05-11 13:03 . 2008-05-11 13:39 2,220 --a------ C:\WINDOWS\system32\tmp.reg
2008-05-11 13:00 . 2008-05-11 13:00 <DIR> d-------- C:\Virus Protection
2008-05-11 12:32 . 2008-05-11 12:32 <DIR> d-------- C:\Deckard
2008-05-11 12:32 . 2008-05-11 12:32 116,736 --a------ C:\WINDOWS\system32\jpkrurnj.dll
2008-05-11 12:26 . 2008-05-11 12:26 133,120 --a------ C:\WINDOWS\system32\udmatrio.dll
2008-05-11 12:24 . 2008-05-11 12:24 126,976 --a------ C:\WINDOWS\system32\dnbvqeqp.dll
2008-05-11 12:24 . 2008-05-11 13:09 109,816 --a------ C:\WINDOWS\BM17fa9fd5.xml
2008-05-11 12:23 . 2008-05-11 13:30 2,148 --a------ C:\WINDOWS\system32\wpa.dbl
2008-05-11 05:42 . 2008-05-11 05:43 <DIR> d-------- C:\Program Files\Java
2008-05-11 02:30 . 2008-05-11 02:30 <DIR> d-------- C:\WINDOWS\Sun
2008-05-11 02:30 . 2008-05-11 02:43 <DIR> d-------- C:\Documents and Settings\Tim\.housecall6.6
2008-05-11 02:30 . 2008-05-11 02:30 102,664 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys
2008-05-11 02:29 . 2008-05-11 02:29 <DIR> d-------- C:\Java
2008-05-11 02:29 . 2008-03-25 02:37 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-05-11 02:28 . 2008-05-11 02:28 <DIR> d-------- C:\Program Files\Common Files\Java
2008-05-11 00:48 . 2008-05-11 00:48 <DIR> d--h----- C:\WINDOWS\system32\GroupPolicy
2008-05-10 23:49 . 2008-05-10 23:49 372,736 --a------ C:\WINDOWS\system32\iifcCsRK.dll
2008-05-10 23:44 . 2008-05-10 23:44 59,904 --a------ C:\WINDOWS\system32\qoMcbcAT.dll
2008-05-10 23:10 . 2008-05-10 23:15 94,208 --a------ C:\WINDOWS\ScUnin.exe
2008-05-10 23:10 . 2008-05-10 23:15 32,702 --a------ C:\WINDOWS\scunin.dat
2008-05-10 23:10 . 2008-05-10 23:15 967 --a------ C:\WINDOWS\ScUnin.pif
2008-05-10 17:21 . 2008-05-10 17:22 <DIR> d-------- C:\MacroQuest
2008-05-10 15:51 . 2008-05-11 12:30 <DIR> dr-h----- C:\$VAULT$.AVG
2008-05-10 14:53 . 2008-05-10 14:53 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-05-10 14:53 . 2008-05-11 12:24 <DIR> d-------- C:\AVG7
2008-05-10 14:53 . 2008-05-10 14:53 9,216 --a------ C:\WINDOWS\system32\avgwlntf.dll
2008-05-10 14:44 . 2008-05-11 04:32 <DIR> d-------- C:\Documents and Settings\Tim\Application Data\AVG7
2008-05-10 14:44 . 2008-05-11 00:12 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg7
2008-05-10 14:42 . 2008-05-10 14:43 <DIR> d-------- C:\Winrar
2008-05-10 14:23 . 2008-05-10 14:23 <DIR> d-------- C:\Program Files\uTorrent
2008-05-10 14:23 . 2008-05-10 22:47 <DIR> d-------- C:\Documents and Settings\Tim\Application Data\uTorrent
2008-05-10 12:52 . 2008-05-10 12:52 <DIR> d-------- C:\Temp
2008-05-10 12:52 . 2008-05-10 12:52 <DIR> d-------- C:\Program Files\Sony
2008-05-10 12:46 . 2008-05-11 03:57 <DIR> d-------- C:\WinEQ2
2008-05-10 12:32 . 2008-05-10 12:32 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\nView_Profiles
2008-05-10 12:28 . 2008-05-10 12:28 <DIR> d-------- C:\WINDOWS\nview
2008-05-10 12:28 . 2008-05-10 12:28 <DIR> d-------- C:\Nvidia
2008-05-10 12:28 . 2007-12-05 01:41 356,352 --a------ C:\WINDOWS\system32\nvudisp.exe
2008-05-10 12:28 . 2008-05-10 12:32 163,353 --a------ C:\WINDOWS\system32\nvapps.xml
2008-05-10 12:28 . 2007-12-05 01:41 17,737 --a------ C:\WINDOWS\system32\nvdisp.nvu
2008-05-10 12:16 . 2008-05-10 12:16 <DIR> d-------- C:\Documents and Settings\Tim\.assistant
2008-05-10 11:46 . 2008-05-10 13:56 <DIR> d-------- C:\Everquest
2008-05-10 11:46 . 2008-05-10 11:46 <DIR> d-------- C:\Documents and Settings\Tim\Application Data\InstallShield
2008-05-10 11:31 . 2005-08-03 14:54 466,944 --a------ C:\WINDOWS\system32\CapabilityTable.exe
2008-05-10 11:31 . 2005-08-18 02:52 289,792 -ra------ C:\WINDOWS\system32\idecoins.dll
2008-05-10 11:31 . 2005-08-18 02:52 289,792 -ra------ C:\WINDOWS\system32\idecoi.dll
2008-05-10 11:31 . 2005-08-02 23:51 176,128 --------- C:\WINDOWS\system32\nvuide.exe
2008-05-10 11:31 . 2005-08-18 02:52 93,568 -ra------ C:\WINDOWS\system32\drivers\nvata.sys
2008-05-10 11:31 . 2005-08-02 23:52 33,280 -ra------ C:\WINDOWS\system32\NVCOI.DLL
2008-05-10 11:31 . 2005-06-29 09:26 1,537 --------- C:\WINDOWS\system32\nvide.nvu
2008-05-10 11:28 . 2008-05-10 11:28 <DIR> d--h----- C:\Documents and Settings\All Users\Application Data\CanonBJ
2008-05-10 11:28 . 2006-11-05 22:00 198,656 --a------ C:\WINDOWS\system32\CNMLM8O.DLL
2008-05-10 11:26 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-05-10 11:26 . 2004-08-03 23:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2008-05-10 11:23 . 2007-04-09 13:23 28,040 --a------ C:\WINDOWS\system32\mdimon.dll
2008-05-10 11:23 . 2008-05-10 11:23 376 --a------ C:\WINDOWS\ODBC.INI
2008-05-10 11:22 . 2008-05-10 11:22 <DIR> d-------- C:\WINDOWS\SHELLNEW
2008-05-10 11:22 . 2008-05-10 11:22 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-05-10 11:22 . 2008-05-10 11:22 <DIR> d-------- C:\Program Files\Microsoft ActiveSync
2008-05-10 11:22 . 2008-05-10 15:16 <DIR> d-------- C:\Office
2008-05-10 11:15 . 2008-05-10 23:12 <DIR> d-------- C:\Starcraft
2008-05-10 11:13 . 2005-06-24 17:05 16,958 --a------ C:\WINDOWS\system32\evga.ico
2008-05-10 11:12 . 2008-05-10 11:12 <DIR> d-------- C:\WINDOWS\system32\EVGA
2008-05-10 11:10 . 2008-05-10 11:10 6,205 --a------ C:\WINDOWS\system\KBDVX32A.VXD
2008-05-10 11:04 . 2008-05-10 11:04 <DIR> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-05-10 10:31 . 2008-05-10 10:31 <DIR> d-------- C:\Documents and Settings\Tim\Application Data\vlc
2008-05-10 09:55 . 2008-05-10 09:55 <DIR> d-------- C:\WINDOWS\ASUS_Ai_Proactive_Screensaver (E) dir
2008-05-10 09:55 . 2008-05-10 09:55 606,848 --a------ C:\WINDOWS\flashax.exe
2008-05-10 09:55 . 2008-05-10 09:55 194,560 --a------ C:\WINDOWS\ASUS_Ai_Proactive_Screensaver (E).scr
2008-05-10 09:55 . 2008-05-10 09:55 12,288 --a------ C:\WINDOWS\impborl.dll
2008-05-10 09:51 . 2008-05-10 09:51 <DIR> d-------- C:\Documents and Settings\Tim\Application Data\Symantec
2008-05-10 09:50 . 2008-05-10 10:22 <DIR> d-------- C:\Program Files\Symantec
2008-05-10 09:50 . 2008-05-10 10:22 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared
2008-05-10 09:48 . 1998-10-29 16:45 306,688 --a------ C:\WINDOWS\IsUninst.exe
2008-05-10 09:45 . 2008-05-10 09:48 <DIR> d-------- C:\Program Files\ASUS
2008-05-10 09:45 . 2004-02-27 00:00 962,612 --a------ C:\WINDOWS\system32\mfc42d.dll
2008-05-10 09:45 . 2004-02-17 00:00 434,252 --a------ C:\WINDOWS\system32\MSVCRTD.DLL
2008-05-10 09:45 . 2005-01-28 01:44 24,576 -ra------ C:\WINDOWS\system32\AsIO.dll
2008-05-10 09:45 . 2004-09-07 11:41 5,120 --a------ C:\WINDOWS\system32\drivers\AsInsHelp64.sys
2008-05-10 09:45 . 2004-10-14 02:52 4,962 -ra------ C:\WINDOWS\system32\drivers\AsIO.sys
2008-05-10 09:45 . 2004-03-10 14:31 3,328 --a------ C:\WINDOWS\system32\drivers\AsInsHelp32.sys
2008-05-10 09:41 . 2008-05-10 09:41 <DIR> d-------- C:\Documents and Settings\Tim\Application Data\Lavasoft
2008-05-10 09:33 . 2002-12-04 11:03 54,784 --a------ C:\WINDOWS\system32\drivers\amdcon.exe
2008-05-10 09:33 . 2005-03-09 15:53 36,352 --a------ C:\WINDOWS\system32\drivers\AmdK8.sys
2008-05-10 09:33 . 2005-03-14 15:18 18,071 --a------ C:\WINDOWS\system32\drivers\readme.rtf
2008-05-10 09:33 . 2005-03-09 15:53 7,243 --a------ C:\WINDOWS\system32\drivers\AmdK8.cat
2008-05-10 09:33 . 2005-03-09 15:53 1,831 --a------ C:\WINDOWS\system32\drivers\amdk8.inf
2008-05-10 09:27 . 2008-05-10 09:27 <DIR> d-------- C:\Documents and Settings\Tim\Application Data\DAEMON Tools
2008-05-10 09:26 . 2008-05-10 09:26 <DIR> d-------- C:\Program Files\Microsoft Silverlight
2008-05-10 09:09 . 2008-05-10 09:09 <DIR> d-------- C:\Program Files\MSBuild
2008-05-10 09:08 . 2008-05-10 11:04 <DIR> d-------- C:\WINDOWS\system32\XPSViewer
2008-05-10 08:36 . 2007-08-13 18:54 33,792 --a--c--- C:\WINDOWS\system32\dllcache\custsat.dll
2008-05-10 08:11 . 2006-10-04 07:06 1,197,294 -----c--- C:\WINDOWS\system32\dllcache\sysmain.sdb
2008-05-10 08:11 . 2006-10-04 07:06 764,868 -----c--- C:\WINDOWS\system32\dllcache\apph_sp.sdb
2008-05-10 08:11 . 2006-10-04 07:06 217,118 -----c--- C:\WINDOWS\system32\dllcache\apphelp.sdb
2008-05-10 08:10 . 2008-05-10 08:11 <DIR> d-------- C:\Program Files\Windows Media Connect 2
2008-05-10 08:08 . 2008-05-10 08:08 <DIR> d-------- C:\Program Files\MSXML 6.0
2008-05-10 07:57 . 2008-05-10 07:57 <DIR> d-------- C:\WINDOWS\system32\Lang
2008-05-10 07:57 . 2008-05-10 07:57 940,794 --a------ C:\WINDOWS\system32\LoopyMusic.wav
2008-05-10 07:57 . 2008-05-10 07:57 146,650 --a------ C:\WINDOWS\system32\BuzzingBee.wav
2008-05-10 07:57 . 2008-05-10 07:57 60,416 --a------ C:\WINDOWS\ALCFDRTM.VER
2008-05-10 07:57 . 2008-05-10 07:57 60,416 --a------ C:\WINDOWS\ALCFDRTM.EXE
2008-05-10 02:43 . 2008-05-10 02:43 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2008-05-10 02:43 . 2008-05-10 02:43 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF
2008-05-10 02:39 . 2008-05-10 02:39 <DIR> d-------- C:\Program Files\Reference Assemblies
2008-05-10 02:30 . 2006-10-18 21:47 2,450,944 -----c--- C:\WINDOWS\system32\dllcache\wmvcore.dll
2008-05-10 02:30 . 2007-07-09 06:16 582,656 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2008-05-10 02:28 . 2006-11-12 23:02 288,768 --------- C:\WINDOWS\system32\rhttpaa.dll
2008-05-10 02:28 . 2006-11-12 23:02 116,736 --------- C:\WINDOWS\system32\aaclient.dll
2008-05-10 02:28 . 2006-11-12 23:02 36,352 --------- C:\WINDOWS\system32\tsgqec.dll
2008-05-10 02:00 . 2008-05-10 02:00 <DIR> d-------- C:\WINDOWS\provisioning
2008-05-10 01:43 . 2004-08-04 00:56 11,776 --------- C:\WINDOWS\system32\spnpinst.exe
2008-05-10 01:43 . 2004-08-02 14:20 7,208 --------- C:\WINDOWS\system32\secupd.sig
2008-05-10 01:43 . 2004-08-02 14:20 4,569 --------- C:\WINDOWS\system32\secupd.dat
2008-05-10 01:14 . 2008-05-10 02:19 316,640 --a------ C:\WINDOWS\WMSysPr9.prx
2008-05-10 01:12 . 2004-08-04 00:56 614,912 --a------ C:\WINDOWS\system32\h323msp.dll
2008-05-10 01:12 . 2004-08-04 00:56 331,264 --a------ C:\WINDOWS\system32\ipnathlp.dll
2008-05-10 01:12 . 2004-08-04 00:56 265,728 --a------ C:\WINDOWS\system32\h323.tsp
2008-05-10 01:12 . 2007-03-08 08:36 40,960 --a------ C:\WINDOWS\system32\mf3216.dll
2008-05-10 01:07 . 2004-08-04 00:56 33,792 --a------ C:\WINDOWS\system32\msgsvc.dll
2008-05-10 01:06 . 2004-04-10 12:24 26,112 --a------ C:\WINDOWS\system32\xpsp1hfm.exe
2008-05-10 01:05 . 2008-05-10 02:00 <DIR> d-------- C:\WINDOWS\PeerNet
2008-05-10 01:04 . 2008-05-10 01:04 <DIR> d-------- C:\WINDOWS\system32\URTTemp
2008-05-10 01:04 . 2006-10-18 21:47 4,096 --a------ C:\WINDOWS\system32\MPG4DMOD.dll
2008-05-10 01:04 . 2006-10-18 21:47 4,096 --a------ C:\WINDOWS\system32\MP4SDMOD.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-10 18:47 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-10 16:46 --------- d-----w C:\Program Files\Marvell
2008-05-10 16:45 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-05-10 07:28 --------- d-----w C:\Program Files\Realtek Sound Manager
2008-05-10 07:28 --------- d-----w C:\Program Files\Realtek AC97
2008-05-10 07:28 --------- d-----w C:\Program Files\AvRack
2008-05-10 07:14 --------- d-----w C:\Program Files\microsoft frontpage
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5285464f-a95a-48fc-9456-ef622eb53b04}]
2008-05-11 12:26 133120 --a------ C:\WINDOWS\system32\udmatrio.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8389B3E9-9168-4462-A09E-6BAD8B9A64E9}]
2008-05-10 23:49 372736 --a------ C:\WINDOWS\system32\iifcCsRK.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F1B2B165-FBF2-4EB3-98FF-9CF5506062B5}]
2008-05-10 23:44 59904 --a------ C:\WINDOWS\system32\qoMcbcAT.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FFFFFFFF-BBBB-4146-86FD-A722E8AB3489}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 09:24 1694208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2005-08-17 03:39 90112 C:\WINDOWS\SOUNDMAN.EXE]
"FLMK08KB"="D:\Keyboard driver\KbdAp32A.exe" [2008-05-10 11:10 383488]
"FLMOFFICE4DMOUSE"="D:\Browser Mouse\mouse32a.exe" [2008-05-10 11:10 360448]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776]
"nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920]
"AVG7_CC"="C:\AVG7\avgcc.exe" [2008-05-10 15:01 579584]
"SunJavaUpdateSched"="C:\Program Files\Java\bin\jusched.exe" [2008-03-25 04:28 144784]
"14c9ac49"="C:\WINDOWS\system32\jpkrurnj.dll" [2008-05-11 12:32 116736]
"BM17fa9fd5"="C:\WINDOWS\system32\dnbvqeqp.dll" [2008-05-11 12:24 126976]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\AVG7\avgw.exe" [2008-05-10 14:53 219136]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{F1B2B165-FBF2-4EB3-98FF-9CF5506062B5}"= C:\WINDOWS\system32\qoMcbcAT.dll [2008-05-10 23:44 59904]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"WebProxy"= {66186F05-BBBB-4a39-864F-72D84615C679} - sockins32.dll [ ]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgwlntf]
avgwlntf.dll 2008-05-10 14:53 9216 C:\WINDOWS\system32\avgwlntf.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\qoMcbcAT]
qoMcbcAT.dll 2008-05-10 23:44 59904 C:\WINDOWS\system32\qoMcbcAT.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Sony\\Station\\LaunchPad\\LaunchPad.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\AVG7\\avginet.exe"=
"C:\\AVG7\\avgamsvr.exe"=
"C:\\AVG7\\avgcc.exe"=
"C:\\AVG7\\avgemc.exe"=
"C:\\Starcraft\\Starcraft\\StarCraft.exe"=
"D:\\Lavasoft\\Ad-Aware SE Personal\\Ad-Aware.exe"=
"C:\\WINDOWS\\system32\\sessmgr.exe"=

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{66186F05-BBBB-4a39-864F-72D84615C679}]
rundll32 sockins32.dll,InitModule
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-11 13:47:29
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\qoMcbcAT.dll
.
------------------------ Other Running Processes ------------------------
.
C:\AVG7\avgrssvc.exe
C:\AVG7\avgamsvr.exe
C:\AVG7\avgupsvc.exe
C:\AVG7\avgrssvc.exe
C:\AVG7\avgemc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\WgaTray.exe
.
**************************************************************************
.
Completion time: 2008-05-11 13:49:48 - machine was rebooted
ComboFix-quarantined-files.txt 2008-05-11 20:49:45

Pre-Run: 52,134,379,520 bytes free
Post-Run: 52,069,736,448 bytes free

244

Edited by tim1283, 11 May 2008 - 05:58 PM.

#6
kahdah

Posted 11 May 2008 - 05:54 PM

GeekU Teacher

Retired Staff
15,822 posts

We now suggest that you install the Windows Recovery Console. The Windows recovery console will allow you to boot up into a special recovery mode that allows us to help you in the case that your computer has a problem after an attempted removal of malware.

Go to Microsoft's website => http://support.microsoft.com/kb/310994
Select the download that's appropriate for your Operating System.

Posted Image

Download the file & save it as it's originally named, next to ComboFix.exe.

Posted Image

Now close all open windows and programs, then drag the setup package onto ComboFix.exe and drop it. Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console. When prompted to scan for infected files chose no, when done a log named CF_RC.txt will open. Please post the contents of that log.

Please do not reboot your machine until we have reviewed the log.

#7
tim1283

Posted 11 May 2008 - 05:59 PM

New Member

Topic Starter
Member
9 posts

That is all I have done so far and it seems to have fixed my issue, but I want to make sure there is nothing else in the scripts I haven't taken care of.

#8
kahdah

Posted 11 May 2008 - 06:01 PM

GeekU Teacher

Retired Staff
15,822 posts

You still have malware present please install the Recovery Console as previously instructed and we will finish up.

#9
tim1283

Posted 11 May 2008 - 06:07 PM

New Member

Topic Starter
Member
9 posts

We now suggest that you install the Windows Recovery Console. The Windows recovery console will allow you to boot up into a special recovery mode that allows us to help you in the case that your computer has a problem after an attempted removal of malware.

Go to Microsoft's website => http://support.microsoft.com/kb/310994
Select the download that's appropriate for your Operating System.

Download the file & save it as it's originally named, next to ComboFix.exe.

What is the appropriate download source? My XP CD is the original version without any service packs on it, but my current computer has service pack 2 on it, Which should I download?

#10
kahdah

Posted 11 May 2008 - 06:09 PM

GeekU Teacher

Retired Staff
15,822 posts

For service pack 2

#11
tim1283

Posted 11 May 2008 - 06:19 PM

New Member

Topic Starter
Member
9 posts

Sorry, I accidentally clicked yes and then it scanned for additional files and then rebooted. here is the log from that run, I hope I didnt mess anything up. heading out to dinner will check back later.

ComboFix 08-05-11.1 - Tim 2008-05-11 17:12:28.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1620 [GMT -7:00]
Running from: C:\Documents and Settings\Tim\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Tim\Desktop\WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\KRsCcfii.ini

.
((((((((((((((((((((((((( Files Created from 2008-04-12 to 2008-05-12 )))))))))))))))))))))))))))))))
.

2008-05-11 13:57 . 2008-05-11 13:57 <DIR> d-------- C:\Documents and Settings\Tim\Application Data\Malwarebytes
2008-05-11 13:56 . 2008-05-11 13:56 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-05-11 13:56 . 2008-05-05 20:46 27,048 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-05-11 13:56 . 2008-05-05 20:46 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-05-11 13:53 . 2008-05-11 13:53 133,120 --a------ C:\WINDOWS\system32\rxnhukyg.dll
2008-05-11 13:53 . 2008-05-11 13:53 2,048 --a------ C:\WINDOWS\system32\nsahbqua.exe
2008-05-11 13:51 . 2008-05-11 15:04 126,976 --------- C:\WINDOWS\system32\xbgkvgnf.dll
2008-05-11 13:51 . 2008-05-11 15:04 116,736 --------- C:\WINDOWS\system32\cvnenmuw.dll
2008-05-11 13:03 . 2008-05-11 13:39 2,220 --a------ C:\WINDOWS\system32\tmp.reg
2008-05-11 13:00 . 2008-05-11 13:56 <DIR> d-------- C:\Virus Protection
2008-05-11 12:32 . 2008-05-11 12:32 <DIR> d-------- C:\Deckard
2008-05-11 12:26 . 2008-05-11 12:26 133,120 --a------ C:\WINDOWS\system32\udmatrio.dll
2008-05-11 12:24 . 2008-05-11 12:24 126,976 --a------ C:\WINDOWS\system32\dnbvqeqp.dll
2008-05-11 12:24 . 2008-05-11 13:53 109,825 --a------ C:\WINDOWS\BM17fa9fd5.xml
2008-05-11 12:23 . 2008-05-11 15:06 2,148 --a------ C:\WINDOWS\system32\wpa.dbl
2008-05-11 05:42 . 2008-05-11 05:43 <DIR> d-------- C:\Program Files\Java
2008-05-11 02:30 . 2008-05-11 02:30 <DIR> d-------- C:\WINDOWS\Sun
2008-05-11 02:30 . 2008-05-11 02:43 <DIR> d-------- C:\Documents and Settings\Tim\.housecall6.6
2008-05-11 02:30 . 2008-05-11 02:30 102,664 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys
2008-05-11 02:29 . 2008-05-11 02:29 <DIR> d-------- C:\Java
2008-05-11 02:29 . 2008-03-25 02:37 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-05-11 02:28 . 2008-05-11 02:28 <DIR> d-------- C:\Program Files\Common Files\Java
2008-05-11 00:48 . 2008-05-11 00:48 <DIR> d--h----- C:\WINDOWS\system32\GroupPolicy
2008-05-10 23:49 . 2008-05-11 15:04 372,736 --------- C:\WINDOWS\system32\iifcCsRK.dll
2008-05-10 23:44 . 2008-05-11 15:04 59,904 --------- C:\WINDOWS\system32\qoMcbcAT.dll
2008-05-10 23:10 . 2008-05-10 23:15 94,208 --a------ C:\WINDOWS\ScUnin.exe
2008-05-10 23:10 . 2008-05-10 23:15 32,702 --a------ C:\WINDOWS\scunin.dat
2008-05-10 23:10 . 2008-05-10 23:15 967 --a------ C:\WINDOWS\ScUnin.pif
2008-05-10 17:21 . 2008-05-10 17:22 <DIR> d-------- C:\MacroQuest
2008-05-10 15:51 . 2008-05-11 12:30 <DIR> dr-h----- C:\$VAULT$.AVG
2008-05-10 14:53 . 2008-05-10 14:53 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-05-10 14:53 . 2008-05-11 15:04 <DIR> d-------- C:\AVG7
2008-05-10 14:53 . 2008-05-10 14:53 9,216 --a------ C:\WINDOWS\system32\avgwlntf.dll
2008-05-10 14:44 . 2008-05-11 04:32 <DIR> d-------- C:\Documents and Settings\Tim\Application Data\AVG7
2008-05-10 14:44 . 2008-05-11 00:12 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg7
2008-05-10 14:42 . 2008-05-10 14:43 <DIR> d-------- C:\Winrar
2008-05-10 14:23 . 2008-05-10 14:23 <DIR> d-------- C:\Program Files\uTorrent
2008-05-10 14:23 . 2008-05-10 22:47 <DIR> d-------- C:\Documents and Settings\Tim\Application Data\uTorrent
2008-05-10 12:52 . 2008-05-10 12:52 <DIR> d-------- C:\Temp
2008-05-10 12:52 . 2008-05-10 12:52 <DIR> d-------- C:\Program Files\Sony
2008-05-10 12:46 . 2008-05-11 03:57 <DIR> d-------- C:\WinEQ2
2008-05-10 12:32 . 2008-05-10 12:32 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\nView_Profiles
2008-05-10 12:28 . 2008-05-10 12:28 <DIR> d-------- C:\WINDOWS\nview
2008-05-10 12:28 . 2008-05-10 12:28 <DIR> d-------- C:\Nvidia
2008-05-10 12:28 . 2007-12-05 01:41 356,352 --a------ C:\WINDOWS\system32\nvudisp.exe
2008-05-10 12:28 . 2008-05-10 12:32 163,353 --a------ C:\WINDOWS\system32\nvapps.xml
2008-05-10 12:28 . 2007-12-05 01:41 17,737 --a------ C:\WINDOWS\system32\nvdisp.nvu
2008-05-10 12:16 . 2008-05-10 12:16 <DIR> d-------- C:\Documents and Settings\Tim\.assistant
2008-05-10 11:46 . 2008-05-10 13:56 <DIR> d-------- C:\Everquest
2008-05-10 11:46 . 2008-05-10 11:46 <DIR> d-------- C:\Documents and Settings\Tim\Application Data\InstallShield
2008-05-10 11:31 . 2005-08-03 14:54 466,944 --a------ C:\WINDOWS\system32\CapabilityTable.exe
2008-05-10 11:31 . 2005-08-18 02:52 289,792 -ra------ C:\WINDOWS\system32\idecoins.dll
2008-05-10 11:31 . 2005-08-18 02:52 289,792 -ra------ C:\WINDOWS\system32\idecoi.dll
2008-05-10 11:31 . 2005-08-02 23:51 176,128 --------- C:\WINDOWS\system32\nvuide.exe
2008-05-10 11:31 . 2005-08-18 02:52 93,568 -ra------ C:\WINDOWS\system32\drivers\nvata.sys
2008-05-10 11:31 . 2005-08-02 23:52 33,280 -ra------ C:\WINDOWS\system32\NVCOI.DLL
2008-05-10 11:31 . 2005-06-29 09:26 1,537 --------- C:\WINDOWS\system32\nvide.nvu
2008-05-10 11:28 . 2008-05-10 11:28 <DIR> d--h----- C:\Documents and Settings\All Users\Application Data\CanonBJ
2008-05-10 11:28 . 2006-11-05 22:00 198,656 --a------ C:\WINDOWS\system32\CNMLM8O.DLL
2008-05-10 11:26 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-05-10 11:26 . 2004-08-03 23:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2008-05-10 11:23 . 2007-04-09 13:23 28,040 --a------ C:\WINDOWS\system32\mdimon.dll
2008-05-10 11:23 . 2008-05-10 11:23 376 --a------ C:\WINDOWS\ODBC.INI
2008-05-10 11:22 . 2008-05-10 11:22 <DIR> d-------- C:\WINDOWS\SHELLNEW
2008-05-10 11:22 . 2008-05-10 11:22 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-05-10 11:22 . 2008-05-10 11:22 <DIR> d-------- C:\Program Files\Microsoft ActiveSync
2008-05-10 11:22 . 2008-05-10 15:16 <DIR> d-------- C:\Office
2008-05-10 11:15 . 2008-05-10 23:12 <DIR> d-------- C:\Starcraft
2008-05-10 11:13 . 2005-06-24 17:05 16,958 --a------ C:\WINDOWS\system32\evga.ico
2008-05-10 11:12 . 2008-05-10 11:12 <DIR> d-------- C:\WINDOWS\system32\EVGA
2008-05-10 11:10 . 2008-05-10 11:10 6,205 --a------ C:\WINDOWS\system\KBDVX32A.VXD
2008-05-10 11:04 . 2008-05-10 11:04 <DIR> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-05-10 10:31 . 2008-05-10 10:31 <DIR> d-------- C:\Documents and Settings\Tim\Application Data\vlc
2008-05-10 09:55 . 2008-05-10 09:55 <DIR> d-------- C:\WINDOWS\ASUS_Ai_Proactive_Screensaver (E) dir
2008-05-10 09:55 . 2008-05-10 09:55 606,848 --a------ C:\WINDOWS\flashax.exe
2008-05-10 09:55 . 2008-05-10 09:55 194,560 --a------ C:\WINDOWS\ASUS_Ai_Proactive_Screensaver (E).scr
2008-05-10 09:55 . 2008-05-10 09:55 12,288 --a------ C:\WINDOWS\impborl.dll
2008-05-10 09:51 . 2008-05-10 09:51 <DIR> d-------- C:\Documents and Settings\Tim\Application Data\Symantec
2008-05-10 09:50 . 2008-05-10 10:22 <DIR> d-------- C:\Program Files\Symantec
2008-05-10 09:50 . 2008-05-10 10:22 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared
2008-05-10 09:48 . 1998-10-29 16:45 306,688 --a------ C:\WINDOWS\IsUninst.exe
2008-05-10 09:45 . 2008-05-10 09:48 <DIR> d-------- C:\Program Files\ASUS
2008-05-10 09:45 . 2004-02-27 00:00 962,612 --a------ C:\WINDOWS\system32\mfc42d.dll
2008-05-10 09:45 . 2004-02-17 00:00 434,252 --a------ C:\WINDOWS\system32\MSVCRTD.DLL
2008-05-10 09:45 . 2005-01-28 01:44 24,576 -ra------ C:\WINDOWS\system32\AsIO.dll
2008-05-10 09:45 . 2004-09-07 11:41 5,120 --a------ C:\WINDOWS\system32\drivers\AsInsHelp64.sys
2008-05-10 09:45 . 2004-10-14 02:52 4,962 -ra------ C:\WINDOWS\system32\drivers\AsIO.sys
2008-05-10 09:45 . 2004-03-10 14:31 3,328 --a------ C:\WINDOWS\system32\drivers\AsInsHelp32.sys
2008-05-10 09:41 . 2008-05-10 09:41 <DIR> d-------- C:\Documents and Settings\Tim\Application Data\Lavasoft
2008-05-10 09:33 . 2002-12-04 11:03 54,784 --a------ C:\WINDOWS\system32\drivers\amdcon.exe
2008-05-10 09:33 . 2005-03-09 15:53 36,352 --a------ C:\WINDOWS\system32\drivers\AmdK8.sys
2008-05-10 09:33 . 2005-03-14 15:18 18,071 --a------ C:\WINDOWS\system32\drivers\readme.rtf
2008-05-10 09:33 . 2005-03-09 15:53 7,243 --a------ C:\WINDOWS\system32\drivers\AmdK8.cat
2008-05-10 09:33 . 2005-03-09 15:53 1,831 --a------ C:\WINDOWS\system32\drivers\amdk8.inf
2008-05-10 09:27 . 2008-05-10 09:27 <DIR> d-------- C:\Documents and Settings\Tim\Application Data\DAEMON Tools
2008-05-10 09:26 . 2008-05-10 09:26 <DIR> d-------- C:\Program Files\Microsoft Silverlight
2008-05-10 09:09 . 2008-05-10 09:09 <DIR> d-------- C:\Program Files\MSBuild
2008-05-10 09:08 . 2008-05-10 11:04 <DIR> d-------- C:\WINDOWS\system32\XPSViewer
2008-05-10 08:36 . 2007-08-13 18:54 33,792 --a--c--- C:\WINDOWS\system32\dllcache\custsat.dll
2008-05-10 08:11 . 2006-10-04 07:06 1,197,294 -----c--- C:\WINDOWS\system32\dllcache\sysmain.sdb
2008-05-10 08:11 . 2006-10-04 07:06 764,868 -----c--- C:\WINDOWS\system32\dllcache\apph_sp.sdb
2008-05-10 08:11 . 2006-10-04 07:06 217,118 -----c--- C:\WINDOWS\system32\dllcache\apphelp.sdb
2008-05-10 08:10 . 2008-05-10 08:11 <DIR> d-------- C:\Program Files\Windows Media Connect 2
2008-05-10 08:08 . 2008-05-10 08:08 <DIR> d-------- C:\Program Files\MSXML 6.0
2008-05-10 07:57 . 2008-05-10 07:57 <DIR> d-------- C:\WINDOWS\system32\Lang
2008-05-10 07:57 . 2008-05-10 07:57 940,794 --a------ C:\WINDOWS\system32\LoopyMusic.wav
2008-05-10 07:57 . 2008-05-10 07:57 146,650 --a------ C:\WINDOWS\system32\BuzzingBee.wav
2008-05-10 07:57 . 2008-05-10 07:57 60,416 --a------ C:\WINDOWS\ALCFDRTM.VER
2008-05-10 07:57 . 2008-05-10 07:57 60,416 --a------ C:\WINDOWS\ALCFDRTM.EXE
2008-05-10 02:43 . 2008-05-10 02:43 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2008-05-10 02:43 . 2008-05-10 02:43 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF
2008-05-10 02:39 . 2008-05-10 02:39 <DIR> d-------- C:\Program Files\Reference Assemblies
2008-05-10 02:30 . 2006-10-18 21:47 2,450,944 -----c--- C:\WINDOWS\system32\dllcache\wmvcore.dll
2008-05-10 02:30 . 2007-07-09 06:16 582,656 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2008-05-10 02:28 . 2006-11-12 23:02 288,768 --------- C:\WINDOWS\system32\rhttpaa.dll
2008-05-10 02:28 . 2006-11-12 23:02 116,736 --------- C:\WINDOWS\system32\aaclient.dll
2008-05-10 02:28 . 2006-11-12 23:02 36,352 --------- C:\WINDOWS\system32\tsgqec.dll
2008-05-10 02:00 . 2008-05-10 02:00 <DIR> d-------- C:\WINDOWS\provisioning
2008-05-10 01:43 . 2004-08-04 00:56 11,776 --------- C:\WINDOWS\system32\spnpinst.exe
2008-05-10 01:43 . 2004-08-02 14:20 7,208 --------- C:\WINDOWS\system32\secupd.sig
2008-05-10 01:43 . 2004-08-02 14:20 4,569 --------- C:\WINDOWS\system32\secupd.dat
2008-05-10 01:14 . 2008-05-10 02:19 316,640 --a------ C:\WINDOWS\WMSysPr9.prx
2008-05-10 01:12 . 2004-08-04 00:56 614,912 --a------ C:\WINDOWS\system32\h323msp.dll
2008-05-10 01:12 . 2004-08-04 00:56 331,264 --a------ C:\WINDOWS\system32\ipnathlp.dll
2008-05-10 01:12 . 2004-08-04 00:56 265,728 --a------ C:\WINDOWS\system32\h323.tsp

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-10 18:47 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-10 16:46 --------- d-----w C:\Program Files\Marvell
2008-05-10 16:45 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-05-10 07:28 --------- d-----w C:\Program Files\Realtek Sound Manager
2008-05-10 07:28 --------- d-----w C:\Program Files\Realtek AC97
2008-05-10 07:28 --------- d-----w C:\Program Files\AvRack
2008-05-10 07:14 --------- d-----w C:\Program Files\microsoft frontpage
.

((((((((((((((((((((((((((((( snapshot@2008-05-11_13.49.31.35 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-11 20:47:19 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-12 00:14:25 2,048 --s-a-w C:\WINDOWS\bootstat.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{b1655257-5526-46ae-91e6-75d02a335066}]
2008-05-11 13:53 133120 --a------ C:\WINDOWS\system32\rxnhukyg.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 09:24 1694208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2005-08-17 03:39 90112 C:\WINDOWS\SOUNDMAN.EXE]
"FLMK08KB"="D:\Keyboard driver\KbdAp32A.exe" [2008-05-10 11:10 383488]
"FLMOFFICE4DMOUSE"="D:\Browser Mouse\mouse32a.exe" [2008-05-10 11:10 360448]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776]
"nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920]
"AVG7_CC"="C:\AVG7\avgcc.exe" [2008-05-10 15:01 579584]
"SunJavaUpdateSched"="C:\Program Files\Java\bin\jusched.exe" [2008-03-25 04:28 144784]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\AVG7\avgw.exe" [2008-05-10 14:53 219136]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgwlntf]
avgwlntf.dll 2008-05-10 14:53 9216 C:\WINDOWS\system32\avgwlntf.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Sony\\Station\\LaunchPad\\LaunchPad.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\AVG7\\avginet.exe"=
"C:\\AVG7\\avgamsvr.exe"=
"C:\\AVG7\\avgcc.exe"=
"C:\\AVG7\\avgemc.exe"=
"C:\\Starcraft\\Starcraft\\StarCraft.exe"=
"D:\\Lavasoft\\Ad-Aware SE Personal\\Ad-Aware.exe"=
"C:\\WINDOWS\\system32\\sessmgr.exe"=

.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-11 17:14:40
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\AVG7\avgrssvc.exe
C:\WINDOWS\system32\rundll32.exe
C:\AVG7\avgamsvr.exe
C:\AVG7\avgupsvc.exe
C:\AVG7\avgrssvc.exe
C:\AVG7\avgemc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2008-05-11 17:16:42 - machine was rebooted
ComboFix-quarantined-files.txt 2008-05-12 00:16:40
ComboFix2.txt 2008-05-11 20:49:48

Pre-Run: 52,088,619,008 bytes free
Post-Run: 52,089,327,616 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn /usepmtimer
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

224

#12
kahdah

Posted 11 May 2008 - 06:27 PM

GeekU Teacher

Retired Staff
15,822 posts

1. Please open Notepad

Click Start , then Run
type in notepad in the Run Box then hit ok.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

File::
C:\WINDOWS\system32\rxnhukyg.dll
C:\WINDOWS\system32\nsahbqua.exe
C:\WINDOWS\system32\xbgkvgnf.dll
C:\WINDOWS\system32\cvnenmuw.dll
C:\WINDOWS\system32\udmatrio.dll
C:\WINDOWS\system32\dnbvqeqp.dll
C:\WINDOWS\BM17fa9fd5.xml
C:\WINDOWS\system32\iifcCsRK.dll
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{b1655257-5526-46ae-91e6-75d02a335066}]

3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

Posted Image

5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

Combofix.txt
A new HijackThis log.

#13
tim1283

Posted 11 May 2008 - 08:54 PM

New Member

Topic Starter
Member
9 posts

ComboFix 08-05-11.1 - Tim 2008-05-11 19:48:45.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1667 [GMT -7:00]
Running from: C:\Documents and Settings\Tim\Desktop\ComboFix.exe
Command switches used :: C:\CFScript.txt
* Created a new restore point

FILE ::
C:\WINDOWS\BM17fa9fd5.xml
C:\WINDOWS\system32\cvnenmuw.dll
C:\WINDOWS\system32\dnbvqeqp.dll
C:\WINDOWS\system32\iifcCsRK.dll
C:\WINDOWS\system32\nsahbqua.exe
C:\WINDOWS\system32\rxnhukyg.dll
C:\WINDOWS\system32\udmatrio.dll
C:\WINDOWS\system32\xbgkvgnf.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\BM17fa9fd5.xml
C:\WINDOWS\system32\cvnenmuw.dll
C:\WINDOWS\system32\dnbvqeqp.dll
C:\WINDOWS\system32\iifcCsRK.dll
C:\WINDOWS\system32\nsahbqua.exe
C:\WINDOWS\system32\rxnhukyg.dll
C:\WINDOWS\system32\udmatrio.dll
C:\WINDOWS\system32\xbgkvgnf.dll

.
((((((((((((((((((((((((( Files Created from 2008-04-12 to 2008-05-12 )))))))))))))))))))))))))))))))
.

2008-05-11 13:57 . 2008-05-11 13:57 <DIR> d-------- C:\Documents and Settings\Tim\Application Data\Malwarebytes
2008-05-11 13:56 . 2008-05-11 13:56 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-05-11 13:56 . 2008-05-05 20:46 27,048 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-05-11 13:56 . 2008-05-05 20:46 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-05-11 13:03 . 2008-05-11 13:39 2,220 --a------ C:\WINDOWS\system32\tmp.reg
2008-05-11 13:00 . 2008-05-11 13:56 <DIR> d-------- C:\Virus Protection
2008-05-11 12:32 . 2008-05-11 12:32 <DIR> d-------- C:\Deckard
2008-05-11 12:23 . 2008-05-11 17:16 2,148 --a------ C:\WINDOWS\system32\wpa.dbl
2008-05-11 05:42 . 2008-05-11 05:43 <DIR> d-------- C:\Program Files\Java
2008-05-11 02:30 . 2008-05-11 02:30 <DIR> d-------- C:\WINDOWS\Sun
2008-05-11 02:30 . 2008-05-11 02:43 <DIR> d-------- C:\Documents and Settings\Tim\.housecall6.6
2008-05-11 02:30 . 2008-05-11 02:30 102,664 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys
2008-05-11 02:29 . 2008-05-11 02:29 <DIR> d-------- C:\Java
2008-05-11 02:29 . 2008-03-25 02:37 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-05-11 02:28 . 2008-05-11 02:28 <DIR> d-------- C:\Program Files\Common Files\Java
2008-05-11 00:48 . 2008-05-11 00:48 <DIR> d--h----- C:\WINDOWS\system32\GroupPolicy
2008-05-10 23:44 . 2008-05-11 15:04 59,904 --------- C:\WINDOWS\system32\qoMcbcAT.dll
2008-05-10 23:10 . 2008-05-10 23:15 94,208 --a------ C:\WINDOWS\ScUnin.exe
2008-05-10 23:10 . 2008-05-10 23:15 32,702 --a------ C:\WINDOWS\scunin.dat
2008-05-10 23:10 . 2008-05-10 23:15 967 --a------ C:\WINDOWS\ScUnin.pif
2008-05-10 17:21 . 2008-05-10 17:22 <DIR> d-------- C:\MacroQuest
2008-05-10 15:51 . 2008-05-11 12:30 <DIR> dr-h----- C:\$VAULT$.AVG
2008-05-10 14:53 . 2008-05-10 14:53 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-05-10 14:53 . 2008-05-11 15:04 <DIR> d-------- C:\AVG7
2008-05-10 14:53 . 2008-05-10 14:53 9,216 --a------ C:\WINDOWS\system32\avgwlntf.dll
2008-05-10 14:44 . 2008-05-11 04:32 <DIR> d-------- C:\Documents and Settings\Tim\Application Data\AVG7
2008-05-10 14:44 . 2008-05-11 00:12 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg7
2008-05-10 14:42 . 2008-05-10 14:43 <DIR> d-------- C:\Winrar
2008-05-10 14:23 . 2008-05-10 14:23 <DIR> d-------- C:\Program Files\uTorrent
2008-05-10 14:23 . 2008-05-10 22:47 <DIR> d-------- C:\Documents and Settings\Tim\Application Data\uTorrent
2008-05-10 12:52 . 2008-05-10 12:52 <DIR> d-------- C:\Temp
2008-05-10 12:52 . 2008-05-10 12:52 <DIR> d-------- C:\Program Files\Sony
2008-05-10 12:46 . 2008-05-11 03:57 <DIR> d-------- C:\WinEQ2
2008-05-10 12:32 . 2008-05-10 12:32 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\nView_Profiles
2008-05-10 12:28 . 2008-05-10 12:28 <DIR> d-------- C:\WINDOWS\nview
2008-05-10 12:28 . 2008-05-10 12:28 <DIR> d-------- C:\Nvidia
2008-05-10 12:28 . 2007-12-05 01:41 356,352 --a------ C:\WINDOWS\system32\nvudisp.exe
2008-05-10 12:28 . 2008-05-10 12:32 163,353 --a------ C:\WINDOWS\system32\nvapps.xml
2008-05-10 12:28 . 2007-12-05 01:41 17,737 --a------ C:\WINDOWS\system32\nvdisp.nvu
2008-05-10 12:16 . 2008-05-10 12:16 <DIR> d-------- C:\Documents and Settings\Tim\.assistant
2008-05-10 11:46 . 2008-05-10 13:56 <DIR> d-------- C:\Everquest
2008-05-10 11:46 . 2008-05-10 11:46 <DIR> d-------- C:\Documents and Settings\Tim\Application Data\InstallShield
2008-05-10 11:31 . 2005-08-03 14:54 466,944 --a------ C:\WINDOWS\system32\CapabilityTable.exe
2008-05-10 11:31 . 2005-08-18 02:52 289,792 -ra------ C:\WINDOWS\system32\idecoins.dll
2008-05-10 11:31 . 2005-08-18 02:52 289,792 -ra------ C:\WINDOWS\system32\idecoi.dll
2008-05-10 11:31 . 2005-08-02 23:51 176,128 --------- C:\WINDOWS\system32\nvuide.exe
2008-05-10 11:31 . 2005-08-18 02:52 93,568 -ra------ C:\WINDOWS\system32\drivers\nvata.sys
2008-05-10 11:31 . 2005-08-02 23:52 33,280 -ra------ C:\WINDOWS\system32\NVCOI.DLL
2008-05-10 11:31 . 2005-06-29 09:26 1,537 --------- C:\WINDOWS\system32\nvide.nvu
2008-05-10 11:28 . 2008-05-10 11:28 <DIR> d--h----- C:\Documents and Settings\All Users\Application Data\CanonBJ
2008-05-10 11:28 . 2006-11-05 22:00 198,656 --a------ C:\WINDOWS\system32\CNMLM8O.DLL
2008-05-10 11:26 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-05-10 11:26 . 2004-08-03 23:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2008-05-10 11:23 . 2007-04-09 13:23 28,040 --a------ C:\WINDOWS\system32\mdimon.dll
2008-05-10 11:23 . 2008-05-10 11:23 376 --a------ C:\WINDOWS\ODBC.INI
2008-05-10 11:22 . 2008-05-10 11:22 <DIR> d-------- C:\WINDOWS\SHELLNEW
2008-05-10 11:22 . 2008-05-10 11:22 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-05-10 11:22 . 2008-05-10 11:22 <DIR> d-------- C:\Program Files\Microsoft ActiveSync
2008-05-10 11:22 . 2008-05-10 15:16 <DIR> d-------- C:\Office
2008-05-10 11:15 . 2008-05-10 23:12 <DIR> d-------- C:\Starcraft
2008-05-10 11:13 . 2005-06-24 17:05 16,958 --a------ C:\WINDOWS\system32\evga.ico
2008-05-10 11:12 . 2008-05-10 11:12 <DIR> d-------- C:\WINDOWS\system32\EVGA
2008-05-10 11:10 . 2008-05-10 11:10 6,205 --a------ C:\WINDOWS\system\KBDVX32A.VXD
2008-05-10 11:04 . 2008-05-10 11:04 <DIR> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-05-10 10:31 . 2008-05-10 10:31 <DIR> d-------- C:\Documents and Settings\Tim\Application Data\vlc
2008-05-10 09:55 . 2008-05-10 09:55 <DIR> d-------- C:\WINDOWS\ASUS_Ai_Proactive_Screensaver (E) dir
2008-05-10 09:55 . 2008-05-10 09:55 606,848 --a------ C:\WINDOWS\flashax.exe
2008-05-10 09:55 . 2008-05-10 09:55 194,560 --a------ C:\WINDOWS\ASUS_Ai_Proactive_Screensaver (E).scr
2008-05-10 09:55 . 2008-05-10 09:55 12,288 --a------ C:\WINDOWS\impborl.dll
2008-05-10 09:51 . 2008-05-10 09:51 <DIR> d-------- C:\Documents and Settings\Tim\Application Data\Symantec
2008-05-10 09:50 . 2008-05-10 10:22 <DIR> d-------- C:\Program Files\Symantec
2008-05-10 09:50 . 2008-05-10 10:22 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared
2008-05-10 09:48 . 1998-10-29 16:45 306,688 --a------ C:\WINDOWS\IsUninst.exe
2008-05-10 09:45 . 2008-05-10 09:48 <DIR> d-------- C:\Program Files\ASUS
2008-05-10 09:45 . 2004-02-27 00:00 962,612 --a------ C:\WINDOWS\system32\mfc42d.dll
2008-05-10 09:45 . 2004-02-17 00:00 434,252 --a------ C:\WINDOWS\system32\MSVCRTD.DLL
2008-05-10 09:45 . 2005-01-28 01:44 24,576 -ra------ C:\WINDOWS\system32\AsIO.dll
2008-05-10 09:45 . 2004-09-07 11:41 5,120 --a------ C:\WINDOWS\system32\drivers\AsInsHelp64.sys
2008-05-10 09:45 . 2004-10-14 02:52 4,962 -ra------ C:\WINDOWS\system32\drivers\AsIO.sys
2008-05-10 09:45 . 2004-03-10 14:31 3,328 --a------ C:\WINDOWS\system32\drivers\AsInsHelp32.sys
2008-05-10 09:41 . 2008-05-10 09:41 <DIR> d-------- C:\Documents and Settings\Tim\Application Data\Lavasoft
2008-05-10 09:33 . 2002-12-04 11:03 54,784 --a------ C:\WINDOWS\system32\drivers\amdcon.exe
2008-05-10 09:33 . 2005-03-09 15:53 36,352 --a------ C:\WINDOWS\system32\drivers\AmdK8.sys
2008-05-10 09:33 . 2005-03-14 15:18 18,071 --a------ C:\WINDOWS\system32\drivers\readme.rtf
2008-05-10 09:33 . 2005-03-09 15:53 7,243 --a------ C:\WINDOWS\system32\drivers\AmdK8.cat
2008-05-10 09:33 . 2005-03-09 15:53 1,831 --a------ C:\WINDOWS\system32\drivers\amdk8.inf
2008-05-10 09:27 . 2008-05-10 09:27 <DIR> d-------- C:\Documents and Settings\Tim\Application Data\DAEMON Tools
2008-05-10 09:26 . 2008-05-10 09:26 <DIR> d-------- C:\Program Files\Microsoft Silverlight
2008-05-10 09:09 . 2008-05-10 09:09 <DIR> d-------- C:\Program Files\MSBuild
2008-05-10 09:08 . 2008-05-10 11:04 <DIR> d-------- C:\WINDOWS\system32\XPSViewer
2008-05-10 08:36 . 2007-08-13 18:54 33,792 --a--c--- C:\WINDOWS\system32\dllcache\custsat.dll
2008-05-10 08:11 . 2006-10-04 07:06 1,197,294 -----c--- C:\WINDOWS\system32\dllcache\sysmain.sdb
2008-05-10 08:11 . 2006-10-04 07:06 764,868 -----c--- C:\WINDOWS\system32\dllcache\apph_sp.sdb
2008-05-10 08:11 . 2006-10-04 07:06 217,118 -----c--- C:\WINDOWS\system32\dllcache\apphelp.sdb
2008-05-10 08:10 . 2008-05-10 08:11 <DIR> d-------- C:\Program Files\Windows Media Connect 2
2008-05-10 08:08 . 2008-05-10 08:08 <DIR> d-------- C:\Program Files\MSXML 6.0
2008-05-10 07:57 . 2008-05-10 07:57 <DIR> d-------- C:\WINDOWS\system32\Lang
2008-05-10 07:57 . 2008-05-10 07:57 940,794 --a------ C:\WINDOWS\system32\LoopyMusic.wav
2008-05-10 07:57 . 2008-05-10 07:57 146,650 --a------ C:\WINDOWS\system32\BuzzingBee.wav
2008-05-10 07:57 . 2008-05-10 07:57 60,416 --a------ C:\WINDOWS\ALCFDRTM.VER
2008-05-10 07:57 . 2008-05-10 07:57 60,416 --a------ C:\WINDOWS\ALCFDRTM.EXE
2008-05-10 02:43 . 2008-05-10 02:43 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2008-05-10 02:43 . 2008-05-10 02:43 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF
2008-05-10 02:39 . 2008-05-10 02:39 <DIR> d-------- C:\Program Files\Reference Assemblies
2008-05-10 02:30 . 2006-10-18 21:47 2,450,944 -----c--- C:\WINDOWS\system32\dllcache\wmvcore.dll
2008-05-10 02:30 . 2007-07-09 06:16 582,656 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2008-05-10 02:28 . 2006-11-12 23:02 288,768 --------- C:\WINDOWS\system32\rhttpaa.dll
2008-05-10 02:28 . 2006-11-12 23:02 116,736 --------- C:\WINDOWS\system32\aaclient.dll
2008-05-10 02:28 . 2006-11-12 23:02 36,352 --------- C:\WINDOWS\system32\tsgqec.dll
2008-05-10 02:00 . 2008-05-10 02:00 <DIR> d-------- C:\WINDOWS\provisioning
2008-05-10 01:43 . 2004-08-04 00:56 11,776 --------- C:\WINDOWS\system32\spnpinst.exe
2008-05-10 01:43 . 2004-08-02 14:20 7,208 --------- C:\WINDOWS\system32\secupd.sig
2008-05-10 01:43 . 2004-08-02 14:20 4,569 --------- C:\WINDOWS\system32\secupd.dat
2008-05-10 01:14 . 2008-05-10 02:19 316,640 --a------ C:\WINDOWS\WMSysPr9.prx
2008-05-10 01:12 . 2004-08-04 00:56 614,912 --a------ C:\WINDOWS\system32\h323msp.dll
2008-05-10 01:12 . 2004-08-04 00:56 331,264 --a------ C:\WINDOWS\system32\ipnathlp.dll
2008-05-10 01:12 . 2004-08-04 00:56 265,728 --a------ C:\WINDOWS\system32\h323.tsp
2008-05-10 01:12 . 2007-03-08 08:36 40,960 --a------ C:\WINDOWS\system32\mf3216.dll
2008-05-10 01:07 . 2004-08-04 00:56 33,792 --a------ C:\WINDOWS\system32\msgsvc.dll
2008-05-10 01:06 . 2004-04-10 12:24 26,112 --a------ C:\WINDOWS\system32\xpsp1hfm.exe
2008-05-10 01:05 . 2008-05-10 02:00 <DIR> d-------- C:\WINDOWS\PeerNet
2008-05-10 01:04 . 2008-05-10 01:04 <DIR> d-------- C:\WINDOWS\system32\URTTemp
2008-05-10 01:04 . 2006-10-18 21:47 4,096 --a------ C:\WINDOWS\system32\MPG4DMOD.dll
2008-05-10 01:04 . 2006-10-18 21:47 4,096 --a------ C:\WINDOWS\system32\MP4SDMOD.dll
2008-05-10 01:04 . 2006-10-18 21:47 4,096 --a------ C:\WINDOWS\system32\MP43DMOD.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-10 18:47 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-10 16:46 --------- d-----w C:\Program Files\Marvell
2008-05-10 16:45 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-05-10 07:28 --------- d-----w C:\Program Files\Realtek Sound Manager
2008-05-10 07:28 --------- d-----w C:\Program Files\Realtek AC97
2008-05-10 07:28 --------- d-----w C:\Program Files\AvRack
2008-05-10 07:14 --------- d-----w C:\Program Files\microsoft frontpage
2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-12 20:10 633,344 ------w C:\WINDOWS\system32\gpprefcl.dll
2008-03-01 13:06 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 05:32 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
.

((((((((((((((((((((((((((((( snapshot@2008-05-11_13.49.31.35 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-11 20:47:19 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-12 00:14:25 2,048 --s-a-w C:\WINDOWS\bootstat.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 09:24 1694208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2005-08-17 03:39 90112 C:\WINDOWS\SOUNDMAN.EXE]
"FLMK08KB"="D:\Keyboard driver\KbdAp32A.exe" [2008-05-10 11:10 383488]
"FLMOFFICE4DMOUSE"="D:\Browser Mouse\mouse32a.exe" [2008-05-10 11:10 360448]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776]
"nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920]
"AVG7_CC"="C:\AVG7\avgcc.exe" [2008-05-10 15:01 579584]
"SunJavaUpdateSched"="C:\Program Files\Java\bin\jusched.exe" [2008-03-25 04:28 144784]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\AVG7\avgw.exe" [2008-05-10 14:53 219136]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgwlntf]
avgwlntf.dll 2008-05-10 14:53 9216 C:\WINDOWS\system32\avgwlntf.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Sony\\Station\\LaunchPad\\LaunchPad.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\AVG7\\avginet.exe"=
"C:\\AVG7\\avgamsvr.exe"=
"C:\\AVG7\\avgcc.exe"=
"C:\\AVG7\\avgemc.exe"=
"C:\\Starcraft\\Starcraft\\StarCraft.exe"=
"D:\\Lavasoft\\Ad-Aware SE Personal\\Ad-Aware.exe"=
"C:\\WINDOWS\\system32\\sessmgr.exe"=

.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-11 19:49:24
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-05-11 19:50:12
ComboFix-quarantined-files.txt 2008-05-12 02:50:09
ComboFix2.txt 2008-05-12 00:16:43
ComboFix3.txt 2008-05-11 20:49:48

Pre-Run: 52,089,712,640 bytes free
Post-Run: 52,077,854,720 bytes free

223

Then,

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:51:19 PM, on 5/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\AVG7\avgrssvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
D:\Keyboard driver\KbdAp32A.exe
D:\Browser Mouse\mouse32a.exe
C:\AVG7\avgcc.exe
C:\Program Files\Java\bin\jusched.exe
C:\AVG7\avgamsvr.exe
C:\AVG7\avgupsvc.exe
C:\AVG7\avgrssvc.exe
C:\AVG7\avgemc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\Virus Protection\Trend Micro-HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://everquest.all...com/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\bin\ssv.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [FLMK08KB] D:\Keyboard driver\KbdAp32A.exe
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] D:\Browser Mouse\mouse32a.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG7_CC] C:\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\bin\jusched.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\AVG7\avgw.exe /RUNONCE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\Office\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Office\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.mi...b?1210404462990
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.mi...b?1210436609531
O20 - Winlogon Notify: avgwlntf - C:\WINDOWS\SYSTEM32\avgwlntf.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\AVG7\avgupsvc.exe
O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\AVG7\avgrssvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\AVG7\avgemc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 4233 bytes

#14
kahdah

Posted 11 May 2008 - 09:13 PM

GeekU Teacher

Retired Staff
15,822 posts

Please download ATF Cleaner by Atribune.
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.
=============================================
Please do an online scan with Kaspersky WebScanner
(This scanner is for use with internet explorer only)
Click on "Accept"

You will be promted to install an ActiveX component from Kaspersky, Click Yes.

The program will launch and then begin downloading the latest definition files:
Once the files have been downloaded click on NEXT
Now click on Scan Settings
In the scan settings make that the following are selected:
- Scan using the following Anti-Virus database:
Extended (if available otherwise Standard)
- Scan Options:
Scan Archives
Scan Mail Bases
Click OK
Now under select a target to scan:Select My Computer
This will program will start and scan your system.
The scan will take a while so be patient and let it run.
Once the scan is complete it will display if your system has been infected.
- Now click on the Save as button:
Save the file in txt format to your desktop.
Post that information in your next post.

#15
tim1283

Posted 12 May 2008 - 02:34 AM

New Member

Topic Starter
Member
9 posts

Monday, May 12, 2008 1:30:51 AM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 12/05/2008
Kaspersky Anti-Virus database records: 761047

Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true

Scan Target My Computer
A:\
C:\
D:\
E:\
F:\
G:\
H:\
I:\
J:\

Scan Statistics
Total number of scanned objects 51582
Number of viruses found 3
Number of infected objects 8
Number of suspicious objects 0
Duration of the scan process 01:01:24

Infected Object Name Virus Name Last Action
C:\Deckard\System Scanner\20080511133838\backup\DOCUME~1\Tim\LOCALS~1\Temp\ie.exe Object is locked skipped

C:\Documents and Settings\All Users\Application Data\avg7\Log\emc.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped

C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\Tim\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\Tim\Desktop\SmitfraudFix\IEDFix.exe Infected: Constructor.Win32.Binder.bn skipped

C:\Documents and Settings\Tim\Desktop\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped

C:\Documents and Settings\Tim\Desktop\SmitfraudFix.exe/SmitfraudFix/IEDFix.exe Infected: Constructor.Win32.Binder.bn skipped

C:\Documents and Settings\Tim\Desktop\SmitfraudFix.exe/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped

C:\Documents and Settings\Tim\Desktop\SmitfraudFix.exe RAR: infected - 2 skipped

C:\Documents and Settings\Tim\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\Tim\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\Tim\Local Settings\History\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\Tim\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped

C:\Documents and Settings\Tim\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\Tim\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\Tim\ntuser.dat.LOG Object is locked skipped

C:\QooBox\Quarantine\C\WINDOWS\system32\nsahbqua.exe.vir Object is locked skipped

C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

C:\System Volume Information\_restore{5C065A26-82FF-41C6-B878-B0DE000C2881}\RP179\A0016454.exe Infected: Constructor.Win32.Binder.bn skipped

C:\System Volume Information\_restore{5C065A26-82FF-41C6-B878-B0DE000C2881}\RP179\A0016456.exe Infected: Constructor.Win32.Binder.bn skipped

C:\System Volume Information\_restore{5C065A26-82FF-41C6-B878-B0DE000C2881}\RP182\A0016601.exe Object is locked skipped

C:\System Volume Information\_restore{5C065A26-82FF-41C6-B878-B0DE000C2881}\RP182\change.log Object is locked skipped

C:\WINDOWS\CSC\00000001 Object is locked skipped

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

C:\WINDOWS\SchedLgU.Txt Object is locked skipped

C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped

C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped

C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped

C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\default Object is locked skipped

C:\WINDOWS\system32\config\DEFAULT.LOG Object is locked skipped

C:\WINDOWS\system32\config\Internet.evt Object is locked skipped

C:\WINDOWS\system32\config\SAM Object is locked skipped

C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SECURITY Object is locked skipped

C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

C:\WINDOWS\system32\config\software Object is locked skipped

C:\WINDOWS\system32\config\SOFTWARE.LOG Object is locked skipped

C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\system Object is locked skipped

C:\WINDOWS\system32\config\SYSTEM.LOG Object is locked skipped

C:\WINDOWS\system32\h323log.txt Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped

C:\WINDOWS\WindowsUpdate.log Object is locked skipped

D:\Daemon tools\DAEMON Tools Lite\SRSAI.exe Infected: not-a-virus:AdWare.Win32.Shopper.r skipped

D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

D:\System Volume Information\_restore{5C065A26-82FF-41C6-B878-B0DE000C2881}\RP182\change.log Object is locked skipped

E:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

E:\System Volume Information\_restore{5C065A26-82FF-41C6-B878-B0DE000C2881}\RP182\change.log Object is locked skipped

H:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

H:\System Volume Information\_restore{5C065A26-82FF-41C6-B878-B0DE000C2881}\RP182\change.log Object is locked skipped

I:\00bac9fcc7a1ab43e2\%temp%dd_msxml_retMSI.txt Object is locked skipped

I:\1aee358d0845263bc3884e\BaseLine.DAT Object is locked skipped

I:\1aee358d0845263bc3884e\DefFactory.DAT Object is locked skipped

I:\1aee358d0845263bc3884e\DeleteTemp.exe Object is locked skipped

I:\1aee358d0845263bc3884e\dlmgr.dll Object is locked skipped

I:\1aee358d0845263bc3884e\EULA.1025.RTF Object is locked skipped

I:\1aee358d0845263bc3884e\EULA.1028.RTF Object is locked skipped

I:\1aee358d0845263bc3884e\EULA.1029.RTF Object is locked skipped

I:\1aee358d0845263bc3884e\EULA.1030.RTF Object is locked skipped

I:\1aee358d0845263bc3884e\EULA.1031.RTF Object is locked skipped

I:\1aee358d0845263bc3884e\EULA.1032.RTF Object is locked skipped

I:\1aee358d0845263bc3884e\EULA.1033.RTF Object is locked skipped

I:\1aee358d0845263bc3884e\EULA.1035.RTF Object is locked skipped

I:\1aee358d0845263bc3884e\EULA.1036.RTF Object is locked skipped

I:\1aee358d0845263bc3884e\EULA.1037.RTF Object is locked skipped

I:\1aee358d0845263bc3884e\EULA.1038.RTF Object is locked skipped

I:\1aee358d0845263bc3884e\EULA.1040.RTF Object is locked skipped

I:\1aee358d0845263bc3884e\EULA.1041.RTF Object is locked skipped

I:\1aee358d0845263bc3884e\EULA.1042.RTF Object is locked skipped

I:\1aee358d0845263bc3884e\EULA.1043.RTF Object is locked skipped

I:\1aee358d0845263bc3884e\EULA.1044.RTF Object is locked skipped

I:\1aee358d0845263bc3884e\EULA.1045.RTF Object is locked skipped

I:\1aee358d0845263bc3884e\EULA.1046.RTF Object is locked skipped

I:\1aee358d0845263bc3884e\EULA.1049.RTF Object is locked skipped

I:\1aee358d0845263bc3884e\EULA.1053.RTF Object is locked skipped

I:\1aee358d0845263bc3884e\EULA.1055.RTF Object is locked skipped

I:\1aee358d0845263bc3884e\EULA.2052.RTF Object is locked skipped

I:\1aee358d0845263bc3884e\EULA.2070.RTF Object is locked skipped

I:\1aee358d0845263bc3884e\EULA.3082.RTF Object is locked skipped

I:\1aee358d0845263bc3884e\GenComp.dll Object is locked skipped

I:\1aee358d0845263bc3884e\HtmlLite.dll Object is locked skipped

I:\1aee358d0845263bc3884e\locdata.1025.ini Object is locked skipped

I:\1aee358d0845263bc3884e\locdata.1028.ini Object is locked skipped

I:\1aee358d0845263bc3884e\locdata.1029.ini Object is locked skipped

I:\1aee358d0845263bc3884e\locdata.1030.ini Object is locked skipped

I:\1aee358d0845263bc3884e\locdata.1031.ini Object is locked skipped

I:\1aee358d0845263bc3884e\locdata.1032.ini Object is locked skipped

I:\1aee358d0845263bc3884e\locdata.1035.ini Object is locked skipped

I:\1aee358d0845263bc3884e\locdata.1036.ini Object is locked skipped

I:\1aee358d0845263bc3884e\locdata.1037.ini Object is locked skipped

I:\1aee358d0845263bc3884e\locdata.1038.ini Object is locked skipped

I:\1aee358d0845263bc3884e\locdata.1040.ini Object is locked skipped

I:\1aee358d0845263bc3884e\locdata.1041.ini Object is locked skipped

I:\1aee358d0845263bc3884e\locdata.1042.ini Object is locked skipped

I:\1aee358d0845263bc3884e\locdata.1043.ini Object is locked skipped

I:\1aee358d0845263bc3884e\locdata.1044.ini Object is locked skipped

I:\1aee358d0845263bc3884e\locdata.1045.ini Object is locked skipped

I:\1aee358d0845263bc3884e\locdata.1046.ini Object is locked skipped

I:\1aee358d0845263bc3884e\locdata.1049.ini Object is locked skipped

I:\1aee358d0845263bc3884e\locdata.1053.ini Object is locked skipped

I:\1aee358d0845263bc3884e\locdata.1055.ini Object is locked skipped

I:\1aee358d0845263bc3884e\locdata.2052.ini Object is locked skipped

I:\1aee358d0845263bc3884e\locdata.2070.ini Object is locked skipped

I:\1aee358d0845263bc3884e\locdata.3082.ini Object is locked skipped

I:\1aee358d0845263bc3884e\LocData.INI Object is locked skipped

I:\1aee358d0845263bc3884e\logo.bmp Object is locked skipped

I:\1aee358d0845263bc3884e\Setup.EXE Object is locked skipped

I:\1aee358d0845263bc3884e\Setup.SDB Object is locked skipped

I:\1aee358d0845263bc3884e\setupres.1025.dll Object is locked skipped

I:\1aee358d0845263bc3884e\setupres.1028.dll Object is locked skipped

I:\1aee358d0845263bc3884e\setupres.1029.dll Object is locked skipped

I:\1aee358d0845263bc3884e\setupres.1030.dll Object is locked skipped

I:\1aee358d0845263bc3884e\setupres.1031.dll Object is locked skipped

I:\1aee358d0845263bc3884e\setupres.1032.dll Object is locked skipped

I:\1aee358d0845263bc3884e\setupres.1035.dll Object is locked skipped

I:\1aee358d0845263bc3884e\setupres.1036.dll Object is locked skipped

I:\1aee358d0845263bc3884e\setupres.1037.dll Object is locked skipped

I:\1aee358d0845263bc3884e\setupres.1038.dll Object is locked skipped

I:\1aee358d0845263bc3884e\setupres.1040.dll Object is locked skipped

I:\1aee358d0845263bc3884e\setupres.1041.dll Object is locked skipped

I:\1aee358d0845263bc3884e\setupres.1042.dll Object is locked skipped

I:\1aee358d0845263bc3884e\setupres.1043.dll Object is locked skipped

I:\1aee358d0845263bc3884e\setupres.1044.dll Object is locked skipped

I:\1aee358d0845263bc3884e\setupres.1045.dll Object is locked skipped

I:\1aee358d0845263bc3884e\setupres.1046.dll Object is locked skipped

I:\1aee358d0845263bc3884e\setupres.1049.dll Object is locked skipped

I:\1aee358d0845263bc3884e\setupres.1053.dll Object is locked skipped

I:\1aee358d0845263bc3884e\setupres.1055.dll Object is locked skipped

I:\1aee358d0845263bc3884e\setupres.2052.dll Object is locked skipped

I:\1aee358d0845263bc3884e\setupres.2070.dll Object is locked skipped

I:\1aee358d0845263bc3884e\setupres.3082.dll Object is locked skipped

I:\1aee358d0845263bc3884e\setupres.dll Object is locked skipped

I:\1aee358d0845263bc3884e\SitSetup.DLL Object is locked skipped

I:\1aee358d0845263bc3884e\VS70UIMgr.dll Object is locked skipped

I:\1aee358d0845263bc3884e\VSBaseReqs.dll Object is locked skipped

I:\1aee358d0845263bc3884e\VSScenario.dll Object is locked skipped

I:\1aee358d0845263bc3884e\VS_Setup.dll Object is locked skipped

I:\1aee358d0845263bc3884e\vs_setup.msi Object is locked skipped

I:\1aee358d0845263bc3884e\VS_Setup.PDI Object is locked skipped

I:\1aee358d0845263bc3884e\WapRes.1025.dll Object is locked skipped

I:\1aee358d0845263bc3884e\WapRes.1028.dll Object is locked skipped

I:\1aee358d0845263bc3884e\WapRes.1029.dll Object is locked skipped

I:\1aee358d0845263bc3884e\WapRes.1030.dll Object is locked skipped

I:\1aee358d0845263bc3884e\WapRes.1031.dll Object is locked skipped

I:\1aee358d0845263bc3884e\WapRes.1032.dll Object is locked skipped

I:\1aee358d0845263bc3884e\WapRes.1035.dll Object is locked skipped

I:\1aee358d0845263bc3884e\WapRes.1036.dll Object is locked skipped

I:\1aee358d0845263bc3884e\WapRes.1037.dll Object is locked skipped

I:\1aee358d0845263bc3884e\WapRes.1038.dll Object is locked skipped

I:\1aee358d0845263bc3884e\WapRes.1040.dll Object is locked skipped

I:\1aee358d0845263bc3884e\WapRes.1041.dll Object is locked skipped

I:\1aee358d0845263bc3884e\WapRes.1042.dll Object is locked skipped

I:\1aee358d0845263bc3884e\WapRes.1043.dll Object is locked skipped

I:\1aee358d0845263bc3884e\WapRes.1044.dll Object is locked skipped

I:\1aee358d0845263bc3884e\WapRes.1045.dll Object is locked skipped

I:\1aee358d0845263bc3884e\WapRes.1046.dll Object is locked skipped

I:\1aee358d0845263bc3884e\WapRes.1049.dll Object is locked skipped

I:\1aee358d0845263bc3884e\WapRes.1053.dll Object is locked skipped

I:\1aee358d0845263bc3884e\WapRes.1055.dll Object is locked skipped

I:\1aee358d0845263bc3884e\WapRes.2052.dll Object is locked skipped

I:\1aee358d0845263bc3884e\WapRes.2070.dll Object is locked skipped

I:\1aee358d0845263bc3884e\WapRes.3082.dll Object is locked skipped

I:\1aee358d0845263bc3884e\WapRes.dll Object is locked skipped

I:\1aee358d0845263bc3884e\WapUI.dll Object is locked skipped

I:\1aee358d0845263bc3884e\wcu\dotNetFramework\dotNetFX20\ASPNET.msp Object is locked skipped

I:\1aee358d0845263bc3884e\wcu\dotNetFramework\dotNetFX20\clr.msp Object is locked skipped

I:\1aee358d0845263bc3884e\wcu\dotNetFramework\dotNetFX20\crt.msp Object is locked skipped

I:\1aee358d0845263bc3884e\wcu\dotNetFramework\dotNetFX20\dw.msp Object is locked skipped

I:\1aee358d0845263bc3884e\wcu\dotNetFramework\dotNetFX20\Netfx20a_x86.msi Object is locked skipped

I:\1aee358d0845263bc3884e\wcu\dotNetFramework\dotNetFX20\NetFX_CA.msp Object is locked skipped

I:\1aee358d0845263bc3884e\wcu\dotNetFramework\dotNetFX20\NetFX_Core.msp Object is locked skipped

I:\1aee358d0845263bc3884e\wcu\dotNetFramework\dotNetFX20\NetFX_Other.msp Object is locked skipped

I:\1aee358d0845263bc3884e\wcu\dotNetFramework\dotNetFX20\prexp.msp Object is locked skipped

I:\1aee358d0845263bc3884e\wcu\dotNetFramework\dotNetFX20\winforms.msp Object is locked skipped

I:\5f901aa52ab5c08c6a74b2a289191987\%temp%dd_msxml_retMSI.txt Object is locked skipped

I:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

I:\System Volume Information\_restore{5C065A26-82FF-41C6-B878-B0DE000C2881}\RP182\change.log Object is locked skipped

J:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

J:\System Volume Information\_restore{5C065A26-82FF-41C6-B878-B0DE000C2881}\RP182\change.log Object is locked skipped

Scan process completed.