Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Adware Infected


  • Please log in to reply
12 replies to this topic

#1 serious-gal

serious-gal

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:03:08 AM

Posted 12 September 2007 - 09:18 AM

hi...i have windows xp and norton antivirus 2007 installed...thr r adwares tht are sending spam mails from my connection...until sumtime ago...i was not being allowed to use my connection...whenevr i tried to do so thr was the blue screen of physical dump n my system restarted...i deleted the scheduled tasks n this stopped the dumping process...



hijackthis log...



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:04:54 PM, on 9/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\LogMeIn\x86\RaMaint.exe
C:\Program Files\LogMeIn\x86\LogMeIn.exe
c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\LogMeIn\x86\LogMeInSystray.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\DAP\DAP.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [AAWTray] C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 5.0\THGuard.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: Internet TV by Endicosoft.com - {1D958E09-3112-7f0e-9723-5C1321C57B27} - C:\Program Files\Internet TV 2050\InternetTV.exe (file missing)
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O13 - WWW Prefix:
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/RACtrl.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LogMeIn.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

--
End of file - 7572 bytes




cmbofix log...




ComboFix 07-09-10.6 - "kurchi" 2007-09-12 17:14:30.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.107 [GMT 5.5:30]
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\DOCUME~1\kurchi\Desktop\internet.lnk
C:\WINDOWS\system32\8_exception.nls
C:\WINDOWS\system32\AutoRun.inf
C:\WINDOWS\system32\jkkkjih.dll
C:\WINDOWS\system32\wvuvwuv.dll


((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


-------\LEGACY_FWDRV.SYS
-------\LEGACY_RUNTIME
-------\fwdrv.sys
-------\nm


((((((((((((((((((((((((( Files Created from 2007-08-12 to 2007-09-12 )))))))))))))))))))))))))))))))
.

2007-09-12 13:01 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Simply Super Software
2007-09-12 00:46 <DIR> d-------- C:\DOCUME~1\kurchi\APPLIC~1\TrojanHunter
2007-09-12 00:42 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-09-12 00:37 <DIR> d-------- C:\Program Files\TrojanHunter 5.0
2007-09-12 00:35 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-09-12 00:17 77,312 --a------ C:\WINDOWS\system32\ztvunace26.dll
2007-09-12 00:17 75,264 --a------ C:\WINDOWS\system32\unacev2.dll
2007-09-12 00:17 69,632 --a------ C:\WINDOWS\system32\ztvcabinet.dll
2007-09-12 00:17 162,304 --a------ C:\WINDOWS\system32\ztvunrar36.dll
2007-09-12 00:17 153,088 --a------ C:\WINDOWS\system32\UNRAR3.dll
2007-09-12 00:17 <DIR> d-------- C:\Program Files\Trojan Remover
2007-09-12 00:17 <DIR> d-------- C:\DOCUME~1\kurchi\APPLIC~1\Simply Super Software
2007-09-12 00:17 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Simply Super Software
2007-09-11 23:26 <DIR> d-------- C:\WINDOWS\ERUNT
2007-09-11 23:25 <DIR> d-------- C:\Program Files\NoAdware5.0
2007-09-11 21:55 555 --ahs---- C:\WINDOWS\system32\egjlm.ini.ren
2007-09-11 21:53 244,832 --a------ C:\WINDOWS\system32\mljge.dll
2007-09-11 21:46 <DIR> d-------- C:\Program Files\Lavasoft
2007-09-11 21:46 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-09-11 15:09 0 --a------ C:\WINDOWS\system32\ntkrpamp.exe
2007-09-11 15:09 0 --a------ C:\WINDOWS\system32\ntkrnlmp.exe
2007-09-11 15:06 15,860 --a------ C:\WINDOWS\system32\jkkli.dll
2007-09-07 16:17 <DIR> d--h----- C:\WINDOWS\system32\GroupPolicy
2007-09-04 10:36 <DIR> d-------- C:\Program Files\Minilyrics
2007-09-02 15:36 <DIR> d-------- C:\Program Files\Skype
2007-09-02 15:36 <DIR> d-------- C:\Program Files\Common Files\Skype
2007-09-02 15:36 <DIR> d-------- C:\DOCUME~1\kurchi\APPLIC~1\Skype
2007-09-02 15:35 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
2007-09-01 13:07 <DIR> d-------- C:\Program Files\SQLyog Enterprise Trial
2007-09-01 13:07 <DIR> d-------- C:\DOCUME~1\kurchi\APPLIC~1\SQLyog
2007-08-31 16:06 <DIR> d-------- C:\Program Files\MySQL
2007-08-27 19:04 83,552 --a------ C:\WINDOWS\system32\LMIRfsClientNP.dll
2007-08-27 19:04 63,040 --a------ C:\WINDOWS\system32\LMIinit.dll
2007-08-27 19:04 46,112 --a------ C:\WINDOWS\system32\drivers\LMIRfsDriver.sys
2007-08-27 19:04 26,176 --a------ C:\WINDOWS\system32\LMIport.dll
2007-08-27 19:03 <DIR> d-------- C:\Program Files\LogMeIn
2007-08-20 16:51 <DIR> d-------- C:\Program Files\Common Files\xing shared
2007-08-20 16:17 129,024 --a------ C:\WINDOWS\system32\AVERM.dll
2007-08-20 16:17 <DIR> d-------- C:\Program Files\Common Files\Download Manager
2007-08-17 03:59 22,112 -ra------ C:\WINDOWS\system32\drivers\COH_Mon.sys
2007-08-16 05:08 3,350 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys
2007-08-15 17:00 56 -r-hs---- C:\WINDOWS\system32\3CF77F5431.sys
2007-08-15 17:00 <DIR> d-------- C:\Program Files\DivX
2007-08-14 17:34 <DIR> d-------- C:\My Music
2007-08-13 17:29 <DIR> d-------- C:\Program Files\BitLord
2007-08-13 16:47 <DIR> d-------- C:\DOCUME~1\kurchi\APPLIC~1\.BitTornado
2007-08-13 13:16 <DIR> d-------- C:\Program Files\NetAnts
2007-08-13 12:06 <DIR> d-a------ C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
2007-08-13 12:06 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
2007-08-13 09:57 <DIR> d-------- C:\Program Files\UseNeXT
2007-08-13 09:57 <DIR> d-------- C:\DOCUME~1\kurchi\APPLIC~1\UseNeXT
2007-08-13 07:09 <DIR> d-------- C:\Program Files\eMule
2007-08-13 06:53 50,688 --a------ C:\WINDOWS\system32\wbhelp2.dll
2007-08-13 06:53 <DIR> d-------- C:\Program Files\DAP
2007-08-12 17:48 <DIR> d-------- C:\Program Files\CAM Development
2007-08-12 16:47 <DIR> d-------- C:\Program Files\Total PDF Converter
2007-08-12 16:47 <DIR> d-------- C:\DOCUME~1\kurchi\APPLIC~1\Softplicity
2007-08-12 16:37 <DIR> d-------- C:\Program Files\ABC Amber CHM Converter

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-12 01:55 --------- d-------- C:\Program Files\Roguescanfix
2007-09-11 21:45 --------- d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-09-11 18:02 --------- d-------- C:\Program Files\Common Files\Ahead
2007-09-11 15:39 --------- d-------- C:\Program Files\Common Files\Symantec Shared
2007-09-09 14:00 --------- d-------- C:\Program Files\XoftSpySE
2007-09-01 16:04 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google Updater
2007-08-29 18:00 --------- d-------- C:\DOCUME~1\kurchi\APPLIC~1\Google
2007-08-21 17:07 --------- d-------- C:\Program Files\Google
2007-08-21 16:13 --------- d-------- C:\Program Files\IrfanView
2007-08-20 16:53 --------- d-------- C:\DOCUME~1\kurchi\APPLIC~1\Real
2007-08-20 16:51 --------- d-------- C:\Program Files\Common Files\Real
2007-08-17 03:59 --------- d-------- C:\Program Files\Norton AntiVirus
2007-08-17 03:59 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
2007-08-15 04:47 --------- d-------- C:\DOCUME~1\kurchi\APPLIC~1\uTorrent
2007-08-13 16:47 --------- d-------- C:\DOCUME~1\kurchi\APPLIC~1\.BitTornado
2007-08-12 04:51 --------- d-------- C:\Program Files\Internet TV 2050
2007-08-10 18:18 --------- d-------- C:\Program Files\Symantec
2007-08-10 18:11 806 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.INF
2007-08-10 18:11 8014 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2007-08-10 18:11 48776 --a------ C:\WINDOWS\system32\S32EVNT1.DLL
2007-08-10 18:11 115000 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2007-08-09 14:35 --------- d-------- C:\Program Files\Common Files\InstallShield
2007-08-09 12:37 --------- d-------- C:\DOCUME~1\kurchi\APPLIC~1\BitTorrent
2007-08-07 13:58 8320 --a------ C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-08-07 13:56 9344 --a------ C:\WINDOWS\system32\drivers\NSDriver.sys
2007-08-05 06:47 --------- d-------- C:\DOCUME~1\kurchi\APPLIC~1\BitTorrent Pro
2007-08-05 06:46 --------- d--h----- C:\Program Files\InstallShield Installation Information
2007-08-05 06:46 --------- d-------- C:\Program Files\Microsoft Reader
2007-08-05 06:38 --------- d-------- C:\Program Files\BitTorrent
2007-08-04 15:28 --------- d-------- C:\Program Files\ApexDC++
2007-08-02 17:51 --------- d-------- C:\Program Files\LanHelper
2007-08-02 17:46 --------- d-------- C:\Program Files\LanSurfer
2007-08-02 13:53 --------- d-------- C:\Program Files\Look@LAN
2007-08-02 07:24 720896 --a------ C:\WINDOWS\iun6002.exe
2007-07-30 14:31 --------- d-------- C:\Program Files\Yahoo!
2007-07-30 14:31 --------- d-------- C:\Program Files\Common Files\Scanner
2007-07-30 14:23 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-07-30 14:20 --------- d-------- C:\Program Files\Real
2007-07-30 05:32 --------- d-------- C:\Program Files\Eusing Free Registry Cleaner
2007-07-30 05:08 --------- d-------- C:\DOCUME~1\kurchi\APPLIC~1\Uniblue
2007-07-29 16:15 --------- d-------- C:\Program Files\Winamp
2007-07-29 15:22 728062 --ahs---- C:\WINDOWS\system32\ehhkj.bak2
2007-07-29 14:59 --------- d-------- C:\Program Files\RegistryPatrol3.0
2007-07-29 12:59 --------- d-------- C:\Program Files\Microsoft Visual Studio 8
2007-07-29 12:59 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft Help
2007-07-29 12:37 --------- d-------- C:\Program Files\Logitech
2007-07-27 14:21 6467 --ahs---- C:\WINDOWS\system32\ehhkj.bak1
2007-07-27 13:17 --------- d-------- C:\Program Files\Common Files\Logitech
2007-07-26 13:05 --------- d-------- C:\DOCUME~1\kurchi\APPLIC~1\Comodo
2007-07-26 13:05 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Comodo
2007-07-19 13:03 --------- d-------- C:\Program Files\Realtek
2007-07-19 13:03 --------- d-------- C:\Program Files\NetWaiting
2007-07-19 12:09 --------- d-------- C:\Program Files\CONEXANT
2007-07-18 13:34 --------- d-------- C:\DOCUME~1\kurchi\APPLIC~1\WordWeb
2007-07-18 13:03 --------- d-------- C:\Program Files\WordWeb
2007-07-17 17:05 --------- d-------- C:\DOCUME~1\kurchi\APPLIC~1\Help
2007-07-14 16:11 --------- d-------- C:\Program Files\MSBuild
2007-07-14 15:59 --------- d-------- C:\Program Files\Microsoft Works
2007-07-13 10:07 --------- d-------- C:\DOCUME~1\kurchi\APPLIC~1\U3
2007-06-15 02:59 241904 --a------ C:\WINDOWS\UNBOC.EXE
2004-12-07 18:33 2636408 --a------ C:\Program Files\aawsepersonal.exe
2004-12-04 11:48 407954 --a------ C:\Program Files\defs.ref
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BBFDE104-B76F-4203-8469-9639DA79E1B0}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CC806EE4-A165-4416-9A6B-B8990400FD82}]
2007-09-11 21:54 244832 --a------ C:\WINDOWS\system32\mljge.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FC507A89-F261-447B-91E8-F1831A98527C}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [2006-06-03 07:32 C:\WINDOWS\system32\CHDAudPropShortcut.exe]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 20:36]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-10 11:29]
"osCheck"="C:\Program Files\Norton AntiVirus\osCheck.exe" [2007-01-14 12:41]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-13 12:00]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-08-20 16:50]
"LogMeIn GUI"="C:\Program Files\LogMeIn\x86\LogMeInSystray.exe" [2007-04-18 07:33]
"AAWTray"="C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe" [2007-08-08 15:53]
"TrojanScanner"="C:\Program Files\Trojan Remover\Trjscan.exe" [2007-09-04 13:26]
"THGuard"="C:\Program Files\TrojanHunter 5.0\THGuard.exe" [2007-09-09 09:31]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 14:55]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:26]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-14 05:39]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ddcccde]
ddcccde.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\jkhhe]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
LMIinit.dll 2007-05-26 08:52 63040 C:\WINDOWS\system32\LMIinit.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winemx32]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\\WINDOWS\\system32\\mljge

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^kurchi^Start Menu^Programs^Startup^WordWeb.lnk]
backup=C:\WINDOWS\pss\WordWeb.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitComet]
"\\Anish\BitLord\BitLord.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DownloadAccelerator]
"C:\Program Files\DAP\DAP.EXE" /STARTUP

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk]
C:\Program Files\Google\Google Talk\googletalk.exe /autostart

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpWirelessAssistant]
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]
C:\TCWIN45\PIPELINE\remind.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
"C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"wuauserv"=2 (0x2)
"wscsvc"=2 (0x2)
"gusvc"=2 (0x2)
"CmdAgent"=2 (0x2)

R2 LMIInfo;LogMeIn Kernel Information Provider;\??\C:\Program Files\LogMeIn\x86\RaInfo.sys
R2 LMIRfsDriver;LogMeIn Remote File System Driver;\??\C:\WINDOWS\system32\drivers\LMIRfsDriver.sys
R2 SMTPSVC;Simple Mail Transfer Protocol (SMTP);C:\WINDOWS\system32\inetsrv\inetinfo.exe
R3 lmimirr;lmimirr;C:\WINDOWS\system32\DRIVERS\lmimirr.sys
S3 SQLWriter;SQL Server VSS Writer;"c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe"


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{595f9d29-3c17-11dc-ba75-0016d49da938}]
Auto\command- H:\MicrosoftPowerPoint.exe
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL MicrosoftPowerPoint.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b81c2536-4fac-11dc-bac2-0016d49da938}]
Auto\command- G:\recycled\SVCH0ST.EXE
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL recycled\SVCH0ST.EXE

.
Contents of the 'Scheduled Tasks' folder
"2007-09-09 18:30:00 C:\WINDOWS\Tasks\At1.job"
- C:\WINDOWS\system32\M2T5lej3.exe
"2007-09-12 03:30:00 C:\WINDOWS\Tasks\At10.job"
- C:\WINDOWS\system32\M2T5lej3.exe
"2007-09-12 04:30:00 C:\WINDOWS\Tasks\At11.job"
"2007-09-12 05:30:00 C:\WINDOWS\Tasks\At12.job"
- C:\WINDOWS\system32\M2T5lej3.exe
"2007-09-12 06:30:00 C:\WINDOWS\Tasks\At13.job"
- C:\WINDOWS\system32\M2T5lej3.exe
"2007-09-09 07:30:00 C:\WINDOWS\Tasks\At14.job"
"2007-09-09 08:30:00 C:\WINDOWS\Tasks\At15.job"
- C:\WINDOWS\system32\M2T5lej3.exe
"2007-09-12 09:30:01 C:\WINDOWS\Tasks\At16.job"
- C:\WINDOWS\system32\M2T5lej3.exe
"2007-09-12 10:30:00 C:\WINDOWS\Tasks\At17.job"
- C:\WINDOWS\system32\M2T5lej3.exe
"2007-09-12 11:30:00 C:\WINDOWS\Tasks\At18.job"
- C:\WINDOWS\system32\M2T5lej3.exe
"2007-09-11 12:30:00 C:\WINDOWS\Tasks\At19.job"
- C:\WINDOWS\system32\M2T5lej3.exe
"2007-09-11 19:30:00 C:\WINDOWS\Tasks\At2.job"
- C:\WINDOWS\system32\M2T5lej3.exe
"2007-09-11 13:30:00 C:\WINDOWS\Tasks\At20.job"
- C:\WINDOWS\system32\M2T5lej3.exe
"2007-09-10 14:30:00 C:\WINDOWS\Tasks\At21.job"
- C:\WINDOWS\system32\M2T5lej3.exe
"2007-09-11 15:30:00 C:\WINDOWS\Tasks\At22.job"
- C:\WINDOWS\system32\M2T5lej3.exe
"2007-09-11 16:30:00 C:\WINDOWS\Tasks\At23.job"
- C:\WINDOWS\system32\M2T5lej3.exe
"2007-09-09 17:30:00 C:\WINDOWS\Tasks\At24.job"
- C:\WINDOWS\system32\M2T5lej3.exe
"2007-09-09 20:30:00 C:\WINDOWS\Tasks\At3.job"
- C:\WINDOWS\system32\M2T5lej3.exe
"2007-09-09 21:30:00 C:\WINDOWS\Tasks\At4.job"
- C:\WINDOWS\system32\M2T5lej3.exe
"2007-09-09 22:30:00 C:\WINDOWS\Tasks\At5.job"
- C:\WINDOWS\system32\M2T5lej3.exe
"2007-09-09 23:30:00 C:\WINDOWS\Tasks\At6.job"
- C:\WINDOWS\system32\M2T5lej3.exe
"2007-09-10 00:30:00 C:\WINDOWS\Tasks\At7.job"
"2007-09-10 01:30:00 C:\WINDOWS\Tasks\At8.job"
- C:\WINDOWS\system32\M2T5lej3.exe
"2007-09-12 02:30:02 C:\WINDOWS\Tasks\At9.job"
- C:\WINDOWS\system32\M2T5lej3.exe
"2007-09-10 14:30:00 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - kurchi.job"
"2007-09-12 11:56:58 C:\WINDOWS\Tasks\XoftSpySE 2.job"
- C:\Program Files\XoftSpySE\XoftSpy.exe
"2007-09-10 14:30:00 C:\WINDOWS\Tasks\XoftSpySE.job"
- C:\Program Files\XoftSpySE\XoftSpy.exe
.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-12 17:28:54
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-09-12 17:33:26 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-09-12 17:33
.
--- E O F ---




i have already tried scanning n removing trojans using norton,trojan remover,spybot search...

plz help...my net connection's got extremely slow...

i'll wait for the next response

BC AdBot (Login to Remove)

 


#2 Buckeye_Sam

Buckeye_Sam

    Malware Expert


  • Members
  • 17,382 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Pickerington, Ohio
  • Local time:04:38 PM

Posted 12 September 2007 - 04:17 PM

Hi and welcome to Bleeping Computer! My name is Sam and I will be helping you. :thumbsup:
It looks like you have a few things going on there, so this may take a few steps.

Please download VundoFix.exe to your desktop
  • Double-click VundoFix.exe to run it.
  • Click the Scan for Vundo button.
  • Once it's done scanning, click the Remove Vundo button.
  • You will receive a prompt asking if you want to remove the files, click YES
  • Once you click yes, your desktop will go blank as it starts removing Vundo.
  • When completed, it will prompt that it will reboot your computer, click OK.
  • Please post the contents of C:\vundofix.txt and a new HiJackThis log in a reply to this thread.
Note: It is possible that VundoFix encountered a file it could not remove. In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button" when VundoFix appears upon rebooting.
Posted Image If I have helped you in any way, please consider a donation to help me continue the fight against malware.


Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it!


========================================================

#3 serious-gal

serious-gal
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:03:08 AM

Posted 13 September 2007 - 12:37 AM

hi sam...thanks for all the trouble...


followed ur instructions...

vudofix log...



VundoFix V6.5.8

Checking Java version...

Scan started at 10:33:35 AM 9/13/2007

Listing files found while scanning....

C:\WINDOWS\system32\nhowycvy.ini
C:\WINDOWS\system32\yvcywohn.dll

VundoFix V6.5.8

Checking Java version...

Scan started at 10:47:32 AM 9/13/2007

Listing files found while scanning....

C:\windows\system32\nhowycvy.ini
C:\WINDOWS\system32\yvcywohn.dll

Beginning removal...

Attempting to delete C:\windows\system32\nhowycvy.ini
C:\windows\system32\nhowycvy.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\yvcywohn.dll
C:\WINDOWS\system32\yvcywohn.dll Has been deleted!

Performing Repairs to the registry.
Done!




hijackthis log...



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:59:45 AM, on 9/13/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\savedump.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [AAWTray] C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 5.0\THGuard.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: Internet TV by Endicosoft.com - {1D958E09-3112-7f0e-9723-5C1321C57B27} - C:\Program Files\Internet TV 2050\InternetTV.exe (file missing)
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O13 - WWW Prefix:
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/RACtrl.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LogMeIn.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

--
End of file - 7441 bytes




will wait for your next instructions


:thumbsup:

#4 Buckeye_Sam

Buckeye_Sam

    Malware Expert


  • Members
  • 17,382 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Pickerington, Ohio
  • Local time:04:38 PM

Posted 13 September 2007 - 03:52 PM

Please do an online scan with Kaspersky WebScanner

Click on Kaspersky Online Scanner

You will be promted to install an ActiveX component from Kaspersky, Click Yes.
  • The program will launch and then begin downloading the latest definition files:
  • Once the files have been downloaded click on NEXT
  • Now click on Scan Settings
  • In the scan settings make that the following are selected:
    • Scan using the following Anti-Virus database:
    Extended (if available otherwise Standard)
    • Scan Options:
    Scan Archives
    Scan Mail Bases
  • Click OK
  • Now under select a target to scan:Select My Computer
  • This will program will start and scan your system.
  • The scan will take a while so be patient and let it run.
  • Once the scan is complete it will display if your system has been infected.
    • Now click on the Save as Text button:
  • Save the file to your desktop.
  • Copy and paste that information in your next post.

Also post a new log from Combofix.
Posted Image If I have helped you in any way, please consider a donation to help me continue the fight against malware.


Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it!


========================================================

#5 serious-gal

serious-gal
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:03:08 AM

Posted 14 September 2007 - 09:41 AM

hi...



-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Friday, September 14, 2007 7:51:22 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.93.1
Kaspersky Anti-Virus database last update: 14/09/2007
Kaspersky Anti-Virus database records: 418348
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\
E:\
F:\

Scan Statistics:
Total number of scanned objects: 52386
Number of viruses found: 3
Number of infected objects: 11
Number of suspicious objects: 0
Duration of the scan process: 02:00:09

Infected Object Name / Virus Name / Last Action
C:\check_LSA7.txt Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\2007-09-14_Log.ALUSchedulerSvc.LiveUpdate Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBConfig.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBDebug.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBDetect.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBNotify.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBRefr.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetCfg.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetCfg2.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetDev.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetLoc.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetUsr.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBStHash.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBValid.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPPolicy.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPStart.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPStop.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtErEvt.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtETmp\8F036817.TMP Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtMoEvt.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtNvEvt.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtScEvt.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtTxFEvt.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtViEvt.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SubEng\submissions.idx Object is locked skipped
C:\Documents and Settings\kurchi\Application Data\Mozilla\Firefox\Profiles\rnftgzd0.default\cert8.db Object is locked skipped
C:\Documents and Settings\kurchi\Application Data\Mozilla\Firefox\Profiles\rnftgzd0.default\formhistory.dat Object is locked skipped
C:\Documents and Settings\kurchi\Application Data\Mozilla\Firefox\Profiles\rnftgzd0.default\history.dat Object is locked skipped
C:\Documents and Settings\kurchi\Application Data\Mozilla\Firefox\Profiles\rnftgzd0.default\key3.db Object is locked skipped
C:\Documents and Settings\kurchi\Application Data\Mozilla\Firefox\Profiles\rnftgzd0.default\parent.lock Object is locked skipped
C:\Documents and Settings\kurchi\Application Data\Mozilla\Firefox\Profiles\rnftgzd0.default\search.sqlite Object is locked skipped
C:\Documents and Settings\kurchi\Application Data\Mozilla\Firefox\Profiles\rnftgzd0.default\urlclassifier2.sqlite Object is locked skipped
C:\Documents and Settings\kurchi\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\kurchi\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\kurchi\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\kurchi\Local Settings\Application Data\Mozilla\Firefox\Profiles\rnftgzd0.default\Cache\_CACHE_001_ Object is locked skipped
C:\Documents and Settings\kurchi\Local Settings\Application Data\Mozilla\Firefox\Profiles\rnftgzd0.default\Cache\_CACHE_002_ Object is locked skipped
C:\Documents and Settings\kurchi\Local Settings\Application Data\Mozilla\Firefox\Profiles\rnftgzd0.default\Cache\_CACHE_003_ Object is locked skipped
C:\Documents and Settings\kurchi\Local Settings\Application Data\Mozilla\Firefox\Profiles\rnftgzd0.default\Cache\_CACHE_MAP_ Object is locked skipped
C:\Documents and Settings\kurchi\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\kurchi\Local Settings\Temp\chhofbpf.exe Infected: Trojan.Win32.Agent.bck skipped
C:\Documents and Settings\kurchi\Local Settings\Temp\gxgmxyuv.exe Infected: Trojan.Win32.Agent.bck skipped
C:\Documents and Settings\kurchi\Local Settings\Temp\hiujmwdb.exe Infected: Trojan-Downloader.Win32.Tiny.id skipped
C:\Documents and Settings\kurchi\Local Settings\Temp\mmjouqxw.exe Infected: Trojan.Win32.Agent.bck skipped
C:\Documents and Settings\kurchi\Local Settings\Temp\ovfatsnn.exe Infected: Trojan.Win32.Agent.bck skipped
C:\Documents and Settings\kurchi\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\kurchi\Local Settings\Temporary Internet Files\Content.IE5\RUGJFTG1\valera[1] Infected: Trojan.Win32.Agent.bck skipped
C:\Documents and Settings\kurchi\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\kurchi\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Temp\Perflib_Perfdata_198.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\EENGINE\EPERSIST.DAT Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\NFWEVT.LOG Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDALRT.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDCON.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDDBG.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDFW.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDIDS.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDSYS.log Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\mastlog.ldf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\model.mdf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\modellog.ldf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\msdbdata.mdf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\msdblog.ldf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\tempdb.mdf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\templog.ldf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\LOG\ERRORLOG Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\LOG\log_281.trc Object is locked skipped
C:\Program Files\Norton AntiVirus\AVApp.log Object is locked skipped
C:\Program Files\Norton AntiVirus\AVError.log Object is locked skipped
C:\Program Files\Norton AntiVirus\AVVirus.log Object is locked skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\wvuvwuv.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
C:\qoobox\Quarantine\catchme2007-09-12_172833.50.zip/jkkkjih.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
C:\qoobox\Quarantine\catchme2007-09-12_172833.50.zip ZIP: infected - 1 skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{BCBD8F5A-034F-40D5-9BC8-6FD6A88A18AA}\RP2\A0000026.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
C:\System Volume Information\_restore{BCBD8F5A-034F-40D5-9BC8-6FD6A88A18AA}\RP2\A0000035.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
C:\System Volume Information\_restore{BCBD8F5A-034F-40D5-9BC8-6FD6A88A18AA}\RP5\change.log Object is locked skipped
C:\WINDOWS\CSC\00000001 Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\ODiag.evt Object is locked skipped
C:\WINDOWS\system32\config\OSession.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\ntkrnlmp.exe Object is locked skipped
C:\WINDOWS\system32\ntkrnlpa.exe Object is locked skipped
C:\WINDOWS\system32\ntkrpamp.exe Object is locked skipped
C:\WINDOWS\system32\ntoskrnl.exe Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

Scan process completed.





combofix log:


ComboFix 07-09-10.6 - "kurchi" 2007-09-14 19:57:06.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.206 [GMT 5.5:30]
.

((((((((((((((((((((((((( Files Created from 2007-08-14 to 2007-09-14 )))))))))))))))))))))))))))))))
.

2007-09-14 17:38 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2007-09-14 17:38 <DIR> d-------- C:\WINDOWS\LastGood
2007-09-14 17:38 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab
2007-09-13 10:33 <DIR> d-------- C:\VundoFix Backups
2007-09-13 00:24 663,839 ---hs---- C:\WINDOWS\system32\egjlm.bak2
2007-09-12 19:27 668,093 --a------ C:\WINDOWS\system32\egjlm.bak2.ren
2007-09-12 19:03 <DIR> d-------- C:\Program Files\Trend Micro
2007-09-12 17:52 <DIR> d-------- C:\WINDOWS\system32\NtmsData
2007-09-12 13:01 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Simply Super Software
2007-09-12 00:46 <DIR> d-------- C:\DOCUME~1\kurchi\APPLIC~1\TrojanHunter
2007-09-12 00:37 <DIR> d-------- C:\Program Files\TrojanHunter 5.0
2007-09-12 00:35 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-09-12 00:17 77,312 --a------ C:\WINDOWS\system32\ztvunace26.dll
2007-09-12 00:17 75,264 --a------ C:\WINDOWS\system32\unacev2.dll
2007-09-12 00:17 69,632 --a------ C:\WINDOWS\system32\ztvcabinet.dll
2007-09-12 00:17 162,304 --a------ C:\WINDOWS\system32\ztvunrar36.dll
2007-09-12 00:17 153,088 --a------ C:\WINDOWS\system32\UNRAR3.dll
2007-09-12 00:17 <DIR> d-------- C:\DOCUME~1\kurchi\APPLIC~1\Simply Super Software
2007-09-11 23:26 <DIR> d-------- C:\WINDOWS\ERUNT
2007-09-11 23:25 <DIR> d-------- C:\Program Files\NoAdware5.0
2007-09-11 21:55 647,356 --ahs---- C:\WINDOWS\system32\egjlm.ini.ren
2007-09-11 21:53 244,832 --a------ C:\WINDOWS\system32\mljge.dll
2007-09-11 15:09 0 --a------ C:\WINDOWS\system32\ntkrpamp.exe
2007-09-11 15:09 0 --a------ C:\WINDOWS\system32\ntkrnlmp.exe
2007-09-07 16:17 <DIR> d--h----- C:\WINDOWS\system32\GroupPolicy
2007-09-04 10:36 <DIR> d-------- C:\Program Files\Minilyrics
2007-09-02 15:36 <DIR> d-------- C:\Program Files\Skype
2007-09-02 15:36 <DIR> d-------- C:\Program Files\Common Files\Skype
2007-09-02 15:36 <DIR> d-------- C:\DOCUME~1\kurchi\APPLIC~1\Skype
2007-09-02 15:35 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
2007-09-01 13:07 <DIR> d-------- C:\Program Files\SQLyog Enterprise Trial
2007-09-01 13:07 <DIR> d-------- C:\DOCUME~1\kurchi\APPLIC~1\SQLyog
2007-08-31 16:06 <DIR> d-------- C:\Program Files\MySQL
2007-08-27 19:04 83,552 --a------ C:\WINDOWS\system32\LMIRfsClientNP.dll
2007-08-27 19:04 63,040 --a------ C:\WINDOWS\system32\LMIinit.dll
2007-08-27 19:04 46,112 --a------ C:\WINDOWS\system32\drivers\LMIRfsDriver.sys
2007-08-27 19:04 26,176 --a------ C:\WINDOWS\system32\LMIport.dll
2007-08-27 19:03 <DIR> d-------- C:\Program Files\LogMeIn
2007-08-20 16:51 <DIR> d-------- C:\Program Files\Common Files\xing shared
2007-08-20 16:17 129,024 --a------ C:\WINDOWS\system32\AVERM.dll
2007-08-20 16:17 <DIR> d-------- C:\Program Files\Common Files\Download Manager
2007-08-17 03:59 22,112 -ra------ C:\WINDOWS\system32\drivers\COH_Mon.sys
2007-08-16 05:08 3,350 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys
2007-08-15 17:00 56 -r-hs---- C:\WINDOWS\system32\3CF77F5431.sys
2007-08-15 17:00 <DIR> d-------- C:\Program Files\DivX
2007-08-14 17:34 <DIR> d-------- C:\My Music

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-13 17:43 --------- d-------- C:\Program Files\Common Files\Ahead
2007-09-13 17:38 --------- d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-09-13 10:33 --------- d-a------ C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
2007-09-12 01:55 --------- d-------- C:\Program Files\Roguescanfix
2007-09-11 15:39 --------- d-------- C:\Program Files\Common Files\Symantec Shared
2007-09-09 14:00 --------- d-------- C:\Program Files\XoftSpySE
2007-09-06 14:57 --------- d-------- C:\Program Files\CAM Development
2007-09-01 16:04 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google Updater
2007-08-29 18:00 --------- d-------- C:\DOCUME~1\kurchi\APPLIC~1\Google
2007-08-26 11:59 --------- d-------- C:\DOCUME~1\kurchi\APPLIC~1\UseNeXT
2007-08-24 16:41 --------- d-------- C:\Program Files\ABC Amber CHM Converter
2007-08-21 17:07 --------- d-------- C:\Program Files\Google
2007-08-21 16:13 --------- d-------- C:\Program Files\IrfanView
2007-08-21 15:53 --------- d-------- C:\Program Files\BitLord
2007-08-21 14:13 --------- d-------- C:\Program Files\UseNeXT
2007-08-20 16:53 --------- d-------- C:\DOCUME~1\kurchi\APPLIC~1\Real
2007-08-20 16:51 --------- d-------- C:\Program Files\Common Files\Real
2007-08-17 03:59 --------- d-------- C:\Program Files\Norton AntiVirus
2007-08-17 03:59 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
2007-08-15 04:47 --------- d-------- C:\DOCUME~1\kurchi\APPLIC~1\uTorrent
2007-08-14 11:49 --------- d-------- C:\Program Files\NetAnts
2007-08-14 11:47 --------- d-------- C:\Program Files\eMule
2007-08-14 11:28 --------- d-------- C:\Program Files\DAP
2007-08-13 16:47 --------- d-------- C:\DOCUME~1\kurchi\APPLIC~1\.BitTornado
2007-08-13 12:06 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
2007-08-13 06:53 50688 --a------ C:\WINDOWS\system32\wbhelp2.dll
2007-08-12 18:41 --------- d-------- C:\Program Files\Total PDF Converter
2007-08-12 16:47 --------- d-------- C:\DOCUME~1\kurchi\APPLIC~1\Softplicity
2007-08-12 04:51 --------- d-------- C:\Program Files\Internet TV 2050
2007-08-10 18:18 --------- d-------- C:\Program Files\Symantec
2007-08-10 18:11 806 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.INF
2007-08-10 18:11 8014 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2007-08-10 18:11 48776 --a------ C:\WINDOWS\system32\S32EVNT1.DLL
2007-08-10 18:11 115000 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2007-08-09 14:35 --------- d-------- C:\Program Files\Common Files\InstallShield
2007-08-09 12:37 --------- d-------- C:\DOCUME~1\kurchi\APPLIC~1\BitTorrent
2007-08-05 06:47 --------- d-------- C:\DOCUME~1\kurchi\APPLIC~1\BitTorrent Pro
2007-08-05 06:46 --------- d--h----- C:\Program Files\InstallShield Installation Information
2007-08-05 06:46 --------- d-------- C:\Program Files\Microsoft Reader
2007-08-05 06:38 --------- d-------- C:\Program Files\BitTorrent
2007-08-04 15:28 --------- d-------- C:\Program Files\ApexDC++
2007-08-02 17:51 --------- d-------- C:\Program Files\LanHelper
2007-08-02 17:46 --------- d-------- C:\Program Files\LanSurfer
2007-08-02 13:53 --------- d-------- C:\Program Files\Look@LAN
2007-08-02 07:24 720896 --a------ C:\WINDOWS\iun6002.exe
2007-07-30 14:31 --------- d-------- C:\Program Files\Yahoo!
2007-07-30 14:31 --------- d-------- C:\Program Files\Common Files\Scanner
2007-07-30 14:23 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-07-30 14:20 --------- d-------- C:\Program Files\Real
2007-07-30 05:32 --------- d-------- C:\Program Files\Eusing Free Registry Cleaner
2007-07-30 05:08 --------- d-------- C:\DOCUME~1\kurchi\APPLIC~1\Uniblue
2007-07-29 16:15 --------- d-------- C:\Program Files\Winamp
2007-07-29 15:22 728062 --ahs---- C:\WINDOWS\system32\ehhkj.bak2
2007-07-29 14:59 --------- d-------- C:\Program Files\RegistryPatrol3.0
2007-07-29 12:59 --------- d-------- C:\Program Files\Microsoft Visual Studio 8
2007-07-29 12:59 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft Help
2007-07-29 12:37 --------- d-------- C:\Program Files\Logitech
2007-07-27 14:21 6467 --ahs---- C:\WINDOWS\system32\ehhkj.bak1
2007-07-27 13:17 --------- d-------- C:\Program Files\Common Files\Logitech
2007-07-26 13:05 --------- d-------- C:\DOCUME~1\kurchi\APPLIC~1\Comodo
2007-07-26 13:05 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Comodo
2007-07-19 13:03 --------- d-------- C:\Program Files\Realtek
2007-07-19 13:03 --------- d-------- C:\Program Files\NetWaiting
2007-07-19 12:09 --------- d-------- C:\Program Files\CONEXANT
2007-07-18 13:34 --------- d-------- C:\DOCUME~1\kurchi\APPLIC~1\WordWeb
2007-07-18 13:03 --------- d-------- C:\Program Files\WordWeb
2007-07-17 17:05 --------- d-------- C:\DOCUME~1\kurchi\APPLIC~1\Help
2007-07-14 16:11 --------- d-------- C:\Program Files\MSBuild
2007-07-14 15:59 --------- d-------- C:\Program Files\Microsoft Works
2007-06-15 02:59 241904 --a------ C:\WINDOWS\UNBOC.EXE
2004-12-07 18:33 2636408 --a------ C:\Program Files\aawsepersonal.exe
2004-12-04 11:48 407954 --a------ C:\Program Files\defs.ref
.

((((((((((((((((((((((((((((( snapshot_2007-09-12_173140.56 )))))))))))))))))))))))))))))))))))))))))
.
----a-w 233,472 2005-09-12 09:43:46 C:\WINDOWS\UNNeroBackItUp.exe
----a-w 233,472 2005-09-12 09:43:46 C:\WINDOWS\UNNeroVision.exe
----a-r 29,926 2007-09-13 12:14:28 C:\WINDOWS\Installer\{C93369CB-B4E9-E095-9289-E6B5AE941033}\ARPPRODUCTICON.exe
----a-w 245,482 2007-09-12 12:26:24 C:\WINDOWS\pchealth\helpctr\Config\Cache\Professional_32_1033.dat
----a-w 1,568,768 2004-07-26 10:46:10 C:\WINDOWS\system32\imagX7.dll
----a-w 476,320 2004-07-26 10:46:10 C:\WINDOWS\system32\imagXpr7.dll
----a-w 262,144 2004-07-26 10:46:10 C:\WINDOWS\system32\imagXR7.dll
----a-w 471,040 2004-07-26 10:46:10 C:\WINDOWS\system32\imagXRA7.dll
----a-w 155,648 2001-07-09 05:20:42 C:\WINDOWS\system32\NeroCheck.exe
----a-w 90,184 2005-02-16 08:48:04 C:\WINDOWS\system32\NeroCo.dll
----a-w 94,310 2007-09-14 11:32:21 C:\WINDOWS\system32\perfc009.dat
----a-w 491,192 2007-09-14 11:32:21 C:\WINDOWS\system32\perfh009.dat
----a-w 364,544 2004-07-09 03:13:56 C:\WINDOWS\system32\TwnLib4.dll
----a-w 5,888 2005-08-15 05:38:26 C:\WINDOWS\system32\drivers\imagedrv.sys
----a-w 127,488 2005-08-15 05:38:26 C:\WINDOWS\system32\drivers\imagesrv.sys
----a-w 224,653 2007-09-14 11:31:59 C:\WINDOWS\system32\inetsrv\MetaBase.bin
----a-w 213,048 2005-05-24 05:57:16 C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll
----a-w 94,208 2007-09-07 05:59:00 C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
----a-w 946,176 2007-09-07 05:59:00 C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll
----a-w 74,404 2007-09-12 13:07:55 C:\WINDOWS\system32\Restore\rstrlog.dat
----atw 16,384 2007-09-12 14:38:42 C:\WINDOWS\temp\Perflib_Perfdata_538.dat
.
----a-w 94,310 2007-09-12 08:48:44 C:\WINDOWS\system32\perfc009.dat
----a-w 491,192 2007-09-12 08:48:44 C:\WINDOWS\system32\perfh009.dat
----a-w 224,660 2007-09-12 12:01:17 C:\WINDOWS\system32\inetsrv\MetaBase.bin
----a-w 8,844 2007-09-11 13:28:32 C:\WINDOWS\system32\Restore\rstrlog.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{94081DA3-6C74-46D4-AD17-8B12F24A9F28}]
2007-09-11 21:54 244832 --a------ C:\WINDOWS\system32\mljge.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BBFDE104-B76F-4203-8469-9639DA79E1B0}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FC507A89-F261-447B-91E8-F1831A98527C}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [2006-06-03 07:32 C:\WINDOWS\system32\CHDAudPropShortcut.exe]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 20:36]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-10 11:29]
"osCheck"="C:\Program Files\Norton AntiVirus\osCheck.exe" [2007-01-14 12:41]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-13 12:00]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-08-20 16:50]
"LogMeIn GUI"="C:\Program Files\LogMeIn\x86\LogMeInSystray.exe" [2007-04-18 07:33]
"AAWTray"="C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe" []
"THGuard"="C:\Program Files\TrojanHunter 5.0\THGuard.exe" [2007-09-09 09:31]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:26]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-14 05:39]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-06-08 07:38]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ddcccde]
ddcccde.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\jkhhe]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
LMIinit.dll 2007-05-26 08:52 63040 C:\WINDOWS\system32\LMIinit.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winemx32]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\\WINDOWS\\system32\\mljge

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^kurchi^Start Menu^Programs^Startup^WordWeb.lnk]
backup=C:\WINDOWS\pss\WordWeb.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitComet]
"\\Anish\BitLord\BitLord.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DownloadAccelerator]
"C:\Program Files\DAP\DAP.EXE" /STARTUP

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk]
C:\Program Files\Google\Google Talk\googletalk.exe /autostart

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpWirelessAssistant]
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]
C:\TCWIN45\PIPELINE\remind.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
"C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"wuauserv"=2 (0x2)
"wscsvc"=2 (0x2)
"gusvc"=2 (0x2)
"CmdAgent"=2 (0x2)

R2 LMIRfsDriver;LogMeIn Remote File System Driver;\??\C:\WINDOWS\system32\drivers\LMIRfsDriver.sys
R2 SMTPSVC;Simple Mail Transfer Protocol (SMTP);C:\WINDOWS\system32\inetsrv\inetinfo.exe
R3 lmimirr;lmimirr;C:\WINDOWS\system32\DRIVERS\lmimirr.sys
S2 LMIInfo;LogMeIn Kernel Information Provider;\??\C:\Program Files\LogMeIn\x86\RaInfo.sys
S3 SQLWriter;SQL Server VSS Writer;"c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe"


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{595f9d29-3c17-11dc-ba75-0016d49da938}]
Auto\command- H:\MicrosoftPowerPoint.exe
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL MicrosoftPowerPoint.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b81c2536-4fac-11dc-bac2-0016d49da938}]
Auto\command- G:\recycled\SVCH0ST.EXE
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL recycled\SVCH0ST.EXE

.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-14 20:01:16
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-09-14 20:03:20
C:\ComboFix-quarantined-files.txt ... 2007-09-14 20:03
C:\ComboFix2.txt ... 2007-09-12 18:35
.
--- E O F ---

#6 serious-gal

serious-gal
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:03:08 AM

Posted 14 September 2007 - 09:43 AM

oh...do u need this too...?

combofix quarantined files


2004-08-05 01:56	  114	--a------	C:\Qoobox\Quarantine\C\WINDOWS\system32\autorun.inf.vir
2007-07-07 17:35	  104	--a------	C:\Qoobox\Quarantine\C\DOCUME~1\kurchi\Desktop\Internet.lnk.vir
2007-07-08 21:23	  15399	--a------	C:\Qoobox\Quarantine\C\ComboFix\FProps.vbs.vir
2007-09-11 15:01	  44054	--a------	C:\Qoobox\Quarantine\C\WINDOWS\system32\jkkkjih.dll.vir
2007-09-11 15:05	  44054	--a------	C:\Qoobox\Quarantine\C\WINDOWS\system32\wvuvwuv.dll.vir
2007-09-11 15:06	  0	--a------	C:\Qoobox\Quarantine\C\WINDOWS\system32\8_exception.nls.vir
2007-09-12 17:21	  1034	--a------	C:\Qoobox\Quarantine\Registry_backups\LEGACY_RUNTIME.reg.cf
2007-09-12 17:21	  1054	--a------	C:\Qoobox\Quarantine\Registry_backups\LEGACY_FWDRV.SYS.reg.cf
2007-09-12 17:21	  196	--a------	C:\Qoobox\Quarantine\Registry_backups\services_nm.reg.cf
2007-09-12 17:21	  868	--a------	C:\Qoobox\Quarantine\Registry_backups\services_fwdrv.reg.cf
2007-09-12 17:22	  157	--a------	C:\Qoobox\Quarantine\catchme.log
2007-09-12 17:22	  23949	--a------	C:\Qoobox\Quarantine\catchme2007-09-12_172833.50.zip


Folder PATH listing
Volume serial number is D883-6CFD
C:\QOOBOX\QUARANTINE
|   catchme.log
|   catchme2007-09-12_172833.50.zip
|   
+---C
|   +---ComboFix
|   |	   FProps.vbs.vir
|   |	   
|   +---DOCUME~1
|   |   \---kurchi
|   |	   \---Desktop
|   |			   Internet.lnk.vir
|   |			   
|   \---WINDOWS
|	   \---system32
|			   8_exception.nls.vir
|			   autorun.inf.vir
|			   jkkkjih.dll.vir
|			   wvuvwuv.dll.vir
|			   
\---Registry_backups
		LEGACY_FWDRV.SYS.reg.cf
		LEGACY_RUNTIME.reg.cf
		services_fwdrv.reg.cf
		services_nm.reg.cf


#7 Buckeye_Sam

Buckeye_Sam

    Malware Expert


  • Members
  • 17,382 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Pickerington, Ohio
  • Local time:04:38 PM

Posted 15 September 2007 - 09:07 AM

All we need to see is the first log, the second one that you posted isn't necessary to see.


Please download ATF Cleaner by Atribune.
This program is for XP and Windows 2000 onlyDouble-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.


===============


Copy and paste ALL the following text in the Quote box below into Notepad.
Click on File(in the menu at the top)>Save as../Save as Type: 'All Files' /File name: CFScript to your desktop.


Folder::
C:\VundoFix Backups

File::
C:\WINDOWS\system32\egjlm.bak2
C:\WINDOWS\system32\egjlm.bak2.ren
C:\WINDOWS\system32\egjlm.ini.ren
C:\WINDOWS\system32\mljge.dll
C:\WINDOWS\system32\ehhkj.bak2
C:\WINDOWS\system32\ehhkj.bak1

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{94081DA3-6C74-46D4-AD17-8B12F24A9F28}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BBFDE104-B76F-4203-8469-9639DA79E1B0}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FC507A89-F261-447B-91E8-F1831A98527C}]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ddcccde]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\jkhhe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winemx32]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"=hex(7):6d,73,76,31,5f,30,00,00

Now drag then drop the CFScript file onto ComboFix.exe as seen in the image below.

Posted Image

This will start ComboFix again.
After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply along with a new HijackThis log.
Posted Image If I have helped you in any way, please consider a donation to help me continue the fight against malware.


Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it!


========================================================

#8 serious-gal

serious-gal
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:03:08 AM

Posted 15 September 2007 - 12:29 PM

ok...



ComboFix 07-09-10.6 - "kurchi" 2007-09-15 22:46:58.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.124 [GMT 5.5:30]
* Created a new restore point

FILE::
C:\WINDOWS\system32\egjlm.bak2
C:\WINDOWS\system32\egjlm.bak2.ren
C:\WINDOWS\system32\egjlm.ini.ren
C:\WINDOWS\system32\mljge.dll
C:\WINDOWS\system32\ehhkj.bak2
C:\WINDOWS\system32\ehhkj.bak1
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\VundoFix Backups
C:\VundoFix Backups\nhowycvy.ini.bad
C:\VundoFix Backups\yvcywohn.dll.bad
C:\WINDOWS\system32\egjlm.bak2
C:\WINDOWS\system32\egjlm.bak2.ren
C:\WINDOWS\system32\egjlm.ini.ren
C:\WINDOWS\system32\ehhkj.bak2


((((((((((((((((((((((((( Files Created from 2007-08-15 to 2007-09-15 )))))))))))))))))))))))))))))))
.

2007-09-15 21:18 <DIR> d-------- C:\Program Files\Comodo
2007-09-15 18:55 138,624 --a------ C:\WINDOWS\system32\drivers\sp_rsdrv2.sys
2007-09-15 18:54 <DIR> d-------- C:\Program Files\Spyware Terminator
2007-09-15 18:54 <DIR> d-------- C:\DOCUME~1\kurchi\APPLIC~1\Spyware Terminator
2007-09-15 18:54 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spyware Terminator
2007-09-15 15:56 0 --a------ C:\WINDOWS\system32\SBRC.dat
2007-09-15 15:56 0 --a------ C:\WINDOWS\system32\SBFC.dat
2007-09-15 13:41 15,544 --a------ C:\WINDOWS\system32\drivers\sbhr.sys
2007-09-15 13:40 <DIR> d-------- C:\DOCUME~1\kurchi\APPLIC~1\Sunbelt Software
2007-09-15 13:40 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sunbelt Software
2007-09-15 13:39 <DIR> d-------- C:\Program Files\Sunbelt Software
2007-09-15 11:11 <DIR> d-------- C:\kav
2007-09-14 17:38 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2007-09-14 17:38 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab
2007-09-12 19:03 <DIR> d-------- C:\Program Files\Trend Micro
2007-09-12 17:52 <DIR> d-------- C:\WINDOWS\system32\NtmsData
2007-09-12 13:01 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Simply Super Software
2007-09-12 00:46 <DIR> d-------- C:\DOCUME~1\kurchi\APPLIC~1\TrojanHunter
2007-09-12 00:37 <DIR> d-------- C:\Program Files\TrojanHunter 5.0
2007-09-12 00:35 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-09-12 00:17 77,312 --a------ C:\WINDOWS\system32\ztvunace26.dll
2007-09-12 00:17 75,264 --a------ C:\WINDOWS\system32\unacev2.dll
2007-09-12 00:17 69,632 --a------ C:\WINDOWS\system32\ztvcabinet.dll
2007-09-12 00:17 162,304 --a------ C:\WINDOWS\system32\ztvunrar36.dll
2007-09-12 00:17 153,088 --a------ C:\WINDOWS\system32\UNRAR3.dll
2007-09-12 00:17 <DIR> d-------- C:\DOCUME~1\kurchi\APPLIC~1\Simply Super Software
2007-09-11 23:26 <DIR> d-------- C:\WINDOWS\ERUNT
2007-09-11 23:25 <DIR> d-------- C:\Program Files\NoAdware5.0
2007-09-11 15:09 0 --a------ C:\WINDOWS\system32\ntkrpamp.exe
2007-09-11 15:09 0 --a------ C:\WINDOWS\system32\ntkrnlmp.exe
2007-09-07 16:17 <DIR> d--h----- C:\WINDOWS\system32\GroupPolicy
2007-09-04 10:36 <DIR> d-------- C:\Program Files\Minilyrics
2007-09-02 15:36 <DIR> d-------- C:\Program Files\Skype
2007-09-02 15:36 <DIR> d-------- C:\Program Files\Common Files\Skype
2007-09-02 15:36 <DIR> d-------- C:\DOCUME~1\kurchi\APPLIC~1\Skype
2007-09-02 15:35 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
2007-09-01 13:07 <DIR> d-------- C:\Program Files\SQLyog Enterprise Trial
2007-09-01 13:07 <DIR> d-------- C:\DOCUME~1\kurchi\APPLIC~1\SQLyog
2007-08-31 16:06 <DIR> d-------- C:\Program Files\MySQL
2007-08-27 19:04 83,552 --a------ C:\WINDOWS\system32\LMIRfsClientNP.dll
2007-08-27 19:04 63,040 --a------ C:\WINDOWS\system32\LMIinit.dll
2007-08-27 19:04 46,112 --a------ C:\WINDOWS\system32\drivers\LMIRfsDriver.sys
2007-08-27 19:04 26,176 --a------ C:\WINDOWS\system32\LMIport.dll
2007-08-27 19:03 <DIR> d-------- C:\Program Files\LogMeIn
2007-08-27 11:26 27,120 --a------ C:\WINDOWS\system32\SBBD.exe
2007-08-20 16:51 <DIR> d-------- C:\Program Files\Common Files\xing shared
2007-08-20 16:17 129,024 --a------ C:\WINDOWS\system32\AVERM.dll
2007-08-20 16:17 <DIR> d-------- C:\Program Files\Common Files\Download Manager
2007-08-17 03:59 22,112 -ra------ C:\WINDOWS\system32\drivers\COH_Mon.sys
2007-08-16 05:08 3,350 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys
2007-08-15 17:00 56 -r-hs---- C:\WINDOWS\system32\3CF77F5431.sys
2007-08-15 17:00 <DIR> d-------- C:\Program Files\DivX

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-15 22:41 --------- d-a------ C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
2007-09-14 22:15 --------- d-------- C:\Program Files\XoftSpySE
2007-09-13 17:43 --------- d-------- C:\Program Files\Common Files\Ahead
2007-09-13 17:38 --------- d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-09-12 01:55 --------- d-------- C:\Program Files\Roguescanfix
2007-09-11 15:39 --------- d-------- C:\Program Files\Common Files\Symantec Shared
2007-09-06 14:57 --------- d-------- C:\Program Files\CAM Development
2007-09-01 16:04 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google Updater
2007-08-29 18:00 --------- d-------- C:\DOCUME~1\kurchi\APPLIC~1\Google
2007-08-26 11:59 --------- d-------- C:\DOCUME~1\kurchi\APPLIC~1\UseNeXT
2007-08-24 16:41 --------- d-------- C:\Program Files\ABC Amber CHM Converter
2007-08-21 17:07 --------- d-------- C:\Program Files\Google
2007-08-21 16:13 --------- d-------- C:\Program Files\IrfanView
2007-08-21 15:53 --------- d-------- C:\Program Files\BitLord
2007-08-21 14:13 --------- d-------- C:\Program Files\UseNeXT
2007-08-20 16:53 --------- d-------- C:\DOCUME~1\kurchi\APPLIC~1\Real
2007-08-20 16:51 --------- d-------- C:\Program Files\Common Files\Real
2007-08-17 03:59 --------- d-------- C:\Program Files\Norton AntiVirus
2007-08-17 03:59 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
2007-08-15 04:47 --------- d-------- C:\DOCUME~1\kurchi\APPLIC~1\uTorrent
2007-08-14 11:49 --------- d-------- C:\Program Files\NetAnts
2007-08-14 11:47 --------- d-------- C:\Program Files\eMule
2007-08-14 11:28 --------- d-------- C:\Program Files\DAP
2007-08-13 16:47 --------- d-------- C:\DOCUME~1\kurchi\APPLIC~1\.BitTornado
2007-08-13 12:06 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
2007-08-13 06:53 50688 --a------ C:\WINDOWS\system32\wbhelp2.dll
2007-08-12 18:41 --------- d-------- C:\Program Files\Total PDF Converter
2007-08-12 16:47 --------- d-------- C:\DOCUME~1\kurchi\APPLIC~1\Softplicity
2007-08-12 04:51 --------- d-------- C:\Program Files\Internet TV 2050
2007-08-10 18:18 --------- d-------- C:\Program Files\Symantec
2007-08-10 18:11 806 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.INF
2007-08-10 18:11 8014 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2007-08-10 18:11 48776 --a------ C:\WINDOWS\system32\S32EVNT1.DLL
2007-08-10 18:11 115000 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2007-08-09 14:35 --------- d-------- C:\Program Files\Common Files\InstallShield
2007-08-09 12:37 --------- d-------- C:\DOCUME~1\kurchi\APPLIC~1\BitTorrent
2007-08-05 06:47 --------- d-------- C:\DOCUME~1\kurchi\APPLIC~1\BitTorrent Pro
2007-08-05 06:46 --------- d--h----- C:\Program Files\InstallShield Installation Information
2007-08-05 06:46 --------- d-------- C:\Program Files\Microsoft Reader
2007-08-05 06:38 --------- d-------- C:\Program Files\BitTorrent
2007-08-04 15:28 --------- d-------- C:\Program Files\ApexDC++
2007-08-02 17:51 --------- d-------- C:\Program Files\LanHelper
2007-08-02 17:46 --------- d-------- C:\Program Files\LanSurfer
2007-08-02 13:53 --------- d-------- C:\Program Files\Look@LAN
2007-08-02 07:24 720896 --a------ C:\WINDOWS\iun6002.exe
2007-07-30 14:31 --------- d-------- C:\Program Files\Yahoo!
2007-07-30 14:31 --------- d-------- C:\Program Files\Common Files\Scanner
2007-07-30 14:23 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-07-30 14:20 --------- d-------- C:\Program Files\Real
2007-07-30 05:32 --------- d-------- C:\Program Files\Eusing Free Registry Cleaner
2007-07-30 05:08 --------- d-------- C:\DOCUME~1\kurchi\APPLIC~1\Uniblue
2007-07-29 16:15 --------- d-------- C:\Program Files\Winamp
2007-07-29 14:59 --------- d-------- C:\Program Files\RegistryPatrol3.0
2007-07-29 12:59 --------- d-------- C:\Program Files\Microsoft Visual Studio 8
2007-07-29 12:59 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft Help
2007-07-29 12:37 --------- d-------- C:\Program Files\Logitech
2007-07-27 13:17 --------- d-------- C:\Program Files\Common Files\Logitech
2007-07-26 13:05 --------- d-------- C:\DOCUME~1\kurchi\APPLIC~1\Comodo
2007-07-26 13:05 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Comodo
2007-07-19 13:03 --------- d-------- C:\Program Files\Realtek
2007-07-19 13:03 --------- d-------- C:\Program Files\NetWaiting
2007-07-19 12:09 --------- d-------- C:\Program Files\CONEXANT
2007-07-18 13:34 --------- d-------- C:\DOCUME~1\kurchi\APPLIC~1\WordWeb
2007-07-18 13:03 --------- d-------- C:\Program Files\WordWeb
2007-07-17 17:05 --------- d-------- C:\DOCUME~1\kurchi\APPLIC~1\Help
2004-12-07 18:33 2636408 --a------ C:\Program Files\aawsepersonal.exe
2004-12-04 11:48 407954 --a------ C:\Program Files\defs.ref
.

((((((((((((((((((((((((((((( snapshot_2007-09-12_173140.56 )))))))))))))))))))))))))))))))))))))))))
.
----a-w 233,472 2005-09-12 09:43:46 C:\WINDOWS\UNNeroBackItUp.exe
----a-w 233,472 2005-09-12 09:43:46 C:\WINDOWS\UNNeroVision.exe
----a-r 19,230 2007-09-15 08:09:46 C:\WINDOWS\Installer\{A5CC3E6E-CAC7-4D47-A5C8-743E549890D5}\ARPPRODUCTICON.exe
----a-r 29,926 2007-09-13 12:14:28 C:\WINDOWS\Installer\{C93369CB-B4E9-E095-9289-E6B5AE941033}\ARPPRODUCTICON.exe
----a-w 516,832 2006-12-28 11:43:52 C:\WINDOWS\system32\capicom.dll
----a-w 1,568,768 2004-07-26 10:46:10 C:\WINDOWS\system32\imagX7.dll
----a-w 476,320 2004-07-26 10:46:10 C:\WINDOWS\system32\imagXpr7.dll
----a-w 262,144 2004-07-26 10:46:10 C:\WINDOWS\system32\imagXR7.dll
----a-w 471,040 2004-07-26 10:46:10 C:\WINDOWS\system32\imagXRA7.dll
----a-w 131,072 2005-11-02 06:09:14 C:\WINDOWS\system32\MD5.dll
----a-w 155,648 2001-07-09 05:20:42 C:\WINDOWS\system32\NeroCheck.exe
----a-w 90,184 2005-02-16 08:48:04 C:\WINDOWS\system32\NeroCo.dll
----a-w 24,924 2005-11-02 06:09:16 C:\WINDOWS\system32\openports.dll
----a-w 94,310 2007-09-15 15:56:29 C:\WINDOWS\system32\perfc009.dat
----a-w 491,192 2007-09-15 15:56:29 C:\WINDOWS\system32\perfh009.dat
----a-w 49,152 2003-02-21 01:46:08 C:\WINDOWS\system32\REGTLIB.EXE
----a-w 40,960 2005-11-02 06:09:16 C:\WINDOWS\system32\SDelete.dll
----a-w 364,544 2004-07-09 03:13:56 C:\WINDOWS\system32\TwnLib4.dll
----a-w 493,400 2006-06-22 10:10:28 C:\WINDOWS\system32\XceedZip.dll
----a-w 75,520 2007-09-15 15:48:23 C:\WINDOWS\system32\drivers\cmdmon.sys
----a-w 5,888 2005-08-15 05:38:26 C:\WINDOWS\system32\drivers\imagedrv.sys
----a-w 127,488 2005-08-15 05:38:26 C:\WINDOWS\system32\drivers\imagesrv.sys
----a-w 51,328 2007-09-15 15:48:23 C:\WINDOWS\system32\drivers\inspect.sys
----a-w 10,032 2006-10-30 06:00:30 C:\WINDOWS\system32\drivers\SBTEDrv.sys
----a-w 224,664 2007-09-15 17:21:35 C:\WINDOWS\system32\inetsrv\MetaBase.bin
----a-w 213,048 2005-05-24 05:57:16 C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll
----a-w 94,208 2007-09-07 05:59:00 C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
----a-w 946,176 2007-09-07 05:59:00 C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll
----a-w 74,404 2007-09-12 13:07:55 C:\WINDOWS\system32\Restore\rstrlog.dat
----atw 16,384 2007-09-15 17:22:15 C:\WINDOWS\temp\Perflib_Perfdata_aac.dat
.
----a-w 466,944 2003-05-03 02:14:44 C:\WINDOWS\system32\capicom.dll
----a-w 94,310 2007-09-12 08:48:44 C:\WINDOWS\system32\perfc009.dat
----a-w 491,192 2007-09-12 08:48:44 C:\WINDOWS\system32\perfh009.dat
----a-w 224,660 2007-09-12 12:01:17 C:\WINDOWS\system32\inetsrv\MetaBase.bin
----a-w 8,844 2007-09-11 13:28:32 C:\WINDOWS\system32\Restore\rstrlog.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [2006-06-03 07:32 C:\WINDOWS\system32\CHDAudPropShortcut.exe]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 20:36]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-10 11:29]
"osCheck"="C:\Program Files\Norton AntiVirus\osCheck.exe" [2007-01-14 12:41]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-13 12:00]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-08-20 16:50]
"LogMeIn GUI"="C:\Program Files\LogMeIn\x86\LogMeInSystray.exe" [2007-04-18 07:33]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50]
"SBCSTray"="C:\Program Files\Sunbelt Software\CounterSpy\SBCSTray.exe" [2007-08-27 12:09]
"SpywareTerminator"="C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe" [2007-09-15 18:54]
"COMODO Firewall Pro"="C:\Program Files\Comodo\Firewall\CPF.exe" [2007-09-15 21:18]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:26]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-14 05:39]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-06-08 07:38]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoFolderOptions"=0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
LMIinit.dll 2007-05-26 08:52 63040 C:\WINDOWS\system32\LMIinit.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^kurchi^Start Menu^Programs^Startup^WordWeb.lnk]
backup=C:\WINDOWS\pss\WordWeb.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitComet]
"\\Anish\BitLord\BitLord.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DownloadAccelerator]
"C:\Program Files\DAP\DAP.EXE" /STARTUP

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk]
C:\Program Files\Google\Google Talk\googletalk.exe /autostart

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpWirelessAssistant]
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]
C:\TCWIN45\PIPELINE\remind.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
"C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"wuauserv"=2 (0x2)
"wscsvc"=2 (0x2)
"gusvc"=2 (0x2)
"CmdAgent"=2 (0x2)

R0 SBHR;SBHR;C:\WINDOWS\system32\drivers\sbhr.sys
R1 sp_rsdrv2;Spyware Terminator Driver 2;\??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys
R2 LMIInfo;LogMeIn Kernel Information Provider;\??\C:\Program Files\LogMeIn\x86\RaInfo.sys
R2 LMIRfsDriver;LogMeIn Remote File System Driver;\??\C:\WINDOWS\system32\drivers\LMIRfsDriver.sys
R2 SMTPSVC;Simple Mail Transfer Protocol (SMTP);C:\WINDOWS\system32\inetsrv\inetinfo.exe
R3 lmimirr;lmimirr;C:\WINDOWS\system32\DRIVERS\lmimirr.sys
R3 SBAPIFS;SBAPIFS;\??\C:\WINDOWS\system32\drivers\sbapifs.sys
S3 SQLWriter;SQL Server VSS Writer;"c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe"


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{595f9d29-3c17-11dc-ba75-0016d49da938}]
Auto\command- H:\MicrosoftPowerPoint.exe
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL MicrosoftPowerPoint.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b81c2536-4fac-11dc-bac2-0016d49da938}]
Auto\command- G:\recycled\SVCH0ST.EXE
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL recycled\SVCH0ST.EXE

*Newly Created Service* - SBAPIFS
.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-15 22:52:31
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-09-15 22:54:48 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-09-15 22:54
C:\ComboFix2.txt ... 2007-09-14 20:03
C:\ComboFix3.txt ... 2007-09-12 18:35
.
--- E O F ---





and...



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:56:52 PM, on 9/15/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\LogMeIn\x86\RaMaint.exe
C:\Program Files\LogMeIn\x86\LogMeIn.exe
C:\Program Files\Sunbelt Software\CounterSpy\SBCSSvc.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\LogMeIn\x86\LogMeInSystray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Sunbelt Software\CounterSpy\SBCSTray.exe
C:\Program Files\Comodo\Firewall\CPF.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\notepad.exe
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Symantec\LiveUpdate\AUPDATE.EXE
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SBCSTray] C:\Program Files\Sunbelt Software\CounterSpy\SBCSTray.exe
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: Internet TV by Endicosoft.com - {1D958E09-3112-7f0e-9723-5C1321C57B27} - C:\Program Files\Internet TV 2050\InternetTV.exe (file missing)
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d...can_unicode.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/RACtrl.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LogMeIn.exe
O23 - Service: Sunbelt CounterSpy Antispyware (SBCSSvc) - Sunbelt Software - C:\Program Files\Sunbelt Software\CounterSpy\SBCSSvc.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

--
End of file - 8606 bytes

#9 Buckeye_Sam

Buckeye_Sam

    Malware Expert


  • Members
  • 17,382 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Pickerington, Ohio
  • Local time:04:38 PM

Posted 16 September 2007 - 09:15 AM

Your log looks good to me, although I would not recommend using Spyware Terminator. It's had a shaky past and there are far better programs to use as alternatives.

How are things working on your end? Any problems?
Posted Image If I have helped you in any way, please consider a donation to help me continue the fight against malware.


Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it!


========================================================

#10 serious-gal

serious-gal
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:03:08 AM

Posted 16 September 2007 - 10:00 AM

ok...i was just tryin cleaning up things with these antispywares...i have already uninstalled it..
its fine after installing this comodo firewall...else there were spam mails being sent...the firewall's blocking the process i guess..

thr's winantivirus cropping up now and then...though i try n clean them up everytime with xoftspy...

do i need to use a registry cleaner or sumthin?...suggest a good one...

#11 Buckeye_Sam

Buckeye_Sam

    Malware Expert


  • Members
  • 17,382 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Pickerington, Ohio
  • Local time:04:38 PM

Posted 17 September 2007 - 08:15 AM

thr's winantivirus cropping up now and then

Do you mean that you are still getting popups, or that xoftspy is showing it in it's scan?
Posted Image If I have helped you in any way, please consider a donation to help me continue the fight against malware.


Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it!


========================================================

#12 serious-gal

serious-gal
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:03:08 AM

Posted 18 September 2007 - 10:23 AM

not getting pop ups anymore..as of now...


but there is definitely something in my system...if i uninstall the firewall...there r spam mails being sent to other ip addresses from my lap...some RAT or sumthing?..i have no idea..

#13 Buckeye_Sam

Buckeye_Sam

    Malware Expert


  • Members
  • 17,382 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Pickerington, Ohio
  • Local time:04:38 PM

Posted 19 September 2007 - 09:08 AM

Ok, let's run a malware scan and take another look around.

Download and scan with SUPERAntiSpyware Free for Home Users
  • Double-click SUPERAntiSpyware.exe and use the default settings for installation.
  • An icon will be created on your desktop. Double-click that icon to launch the program.
  • If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download and unzip them from here.)
  • Under "Configuration and Preferences", click the Preferences button.
  • Click the Scanning Control tab.
  • Under Scanner Options make sure the following are checked (leave all others unchecked):
    • Close browsers before scanning.
    • Scan for tracking cookies.
    • Terminate memory threats before quarantining.
  • Click the "Close" button to leave the control center screen.
  • Back on the main screen, under "Scan for Harmful Software" click Scan your computer.
  • On the left, make sure you check C:\Fixed Drive.
  • On the right, under "Complete Scan", choose Perform Complete Scan.
  • Click "Next" to start the scan. Please be patient while it scans your computer.
  • After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
  • Make sure everything has a checkmark next to it and click "Next".
  • A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
  • If asked if you want to reboot, click "Yes".
  • To retrieve the removal information after reboot, launch SUPERAntispyware again.
    • Click Preferences, then click the Statistics/Logs tab.
    • Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
    • If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
    • Please copy and paste the Scan Log results in your next reply.
  • Click Close to exit the program.

Also post a new Combofix log.
Posted Image If I have helped you in any way, please consider a donation to help me continue the fight against malware.


Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it!


========================================================




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users