Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Devmgrn.dll + Search-daily.com


  • This topic is locked This topic is locked
18 replies to this topic

#1 jclfc

jclfc

  • Members
  • 71 posts
  • OFFLINE
  •  
  • Local time:08:04 AM

Posted 18 September 2007 - 08:37 PM

Right, hope this is finally in the right place. Mod's, if it isn't then please feel free to delete but I think it should be okay.

Here's my problem...

Every time I attempt to open a browser window, be it IE or My Computer/Documents etc., my AVG free edition pops up with the following message...

Threat Detected!
While opening file: C:\Windows\SYSTEM32\devmgrn.dll
Trojan horse BHO.AXY

I have tried using heal and move to vault but they prompt me to restart and the problem is still there after rebooting. I've even tried in Safe Mode.

I've used HijackThis, AVG free, Avast free, KillBox, BHODemon, Super Anti Spyware, Stinger, SpyBot S&D and AdAware to remove it but nothing has.

Some reconise the file but has trouble removing it eg - Reboot to remove file but it remains.

I also have that annoying problem of Google search pages redirecting to Search-Daily.com.

Here is my HijackThis log:

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\btbb_wcm\McciTrayApp.exe
C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
C:\PROGRA~1\BTHOME~1\Help\SMARTB~1\BTHelpNotifier.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\LClock\LClock.exe
C:\Program Files\ViStart\ViStart.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\James.JAMES-HL17SMTOP\Local Settings\Temporary Internet Files\Content.IE5\Z34AZDWF\stinger[1].exe
C:\Documents and Settings\James.JAMES-HL17SMTOP\Desktop\Spyware\HiJackThis_v2.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.red.clientapps.yahoo.com/customi...fo/bt_side.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.red.clientapps.yahoo.com/customi...arch.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.red.clientapps.yahoo.com/customi...fo/bt_side.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.red.clientapps.yahoo.com/customi...arch.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: (no name) - {02AAC8ED-0B61-480E-BBF2-6EBF533FF093} - c:\windows\system32\oqnxbltm.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {421B7566-ABB1-437F-AEA2-8291B7F564F1} - c:\windows\system32\devmgrn.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll
O4 - HKLM\..\Run: [btbb_wcm_McciTrayApp] C:\Program Files\btbb_wcm\McciTrayApp.exe
O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\BTHOME~1\Help\SMARTB~1\BTHelpNotifier.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SoundMan] soundman.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe -quiet
O4 - HKCU\..\Run: [eyeBeam SIP Client] "C:\Program Files\BT Broadband Talk Softphone\BTSoftphone.exe"
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LClock] C:\Program Files\LClock\LClock.exe
O4 - HKCU\..\Run: [Vista Sidebar] C:\Program Files\Vista Sidebar\sidebar.exe
O4 - HKCU\..\Run: [ViStart] C:\Program Files\ViStart\ViStart.exe
O4 - HKCU\..\Run: [VisualTooltip] C:\Program Files\VisualTooltip\VisualToolTip.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [wk1133] C:\WINDOWS\system32\wk1133.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: BT Broadband Desktop Help.lnk = C:\Program Files\BT Home Hub\Help\bin\matcli.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: BT Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MIC273~1\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: dreacrya - C:\WINDOWS\SYSTEM32\devmgrn.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

BC AdBot (Login to Remove)

 


#2 rookie147

rookie147

  • Members
  • 5,321 posts
  • OFFLINE
  •  
  • Local time:09:04 AM

Posted 22 September 2007 - 02:51 PM

Hello there and welcome to BleepingComputer. My name is Charles and I will be dealing with your log today.
Please download VundoFix to your Desktop.
Double-click VundoFix.exe to run it.
Click the Scan for Vundo button.
Once it's done scanning, click the Remove Vundo button.
You will receive a prompt asking if you want to remove the files, click YES
Once you click yes, your desktop will go blank as it starts removing Vundo.
When completed, it will prompt that it will reboot your computer, click OK.
Please post the contents of C:\vundofix.txt in your next reply.
Note: It is possible that VundoFix encountered a file it could not remove.
VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button" when VundoFix appears upon rebooting.

Please include VundoFix.txt and a new HijackThis log in your next reply.
Thanks,
Charles

If you are pleased with the service I have offered, you may like to consider making a donation. Posted Image
Posted Image


#3 jclfc

jclfc
  • Topic Starter

  • Members
  • 71 posts
  • OFFLINE
  •  
  • Local time:08:04 AM

Posted 22 September 2007 - 08:53 PM

Hi Charles, thank you for your response. I run VundoFix but it said there were no infected files. Here are the logs you requested -

VundoFix V6.3.23

Checking Java version...

Sun Java not detected
Scan started at 01:40:01 21/05/2007

Listing files found while scanning....

C:\WINDOWS\System32\fccyw.dll
C:\WINDOWS\SYSTEM32\hfwmkxxn.ini
C:\WINDOWS\SYSTEM32\nxxkmwfh.dll
C:\WINDOWS\System32\wyccf.bak1
C:\WINDOWS\System32\wyccf.ini

Beginning removal...

Beginning removal...

Attempting to delete C:\WINDOWS\System32\fccyw.dll
C:\WINDOWS\System32\fccyw.dll Could not be deleted.

Attempting to delete C:\WINDOWS\SYSTEM32\hfwmkxxn.ini
C:\WINDOWS\SYSTEM32\hfwmkxxn.ini Has been deleted!

Attempting to delete C:\WINDOWS\SYSTEM32\nxxkmwfh.dll
C:\WINDOWS\SYSTEM32\nxxkmwfh.dll Has been deleted!

Attempting to delete C:\WINDOWS\System32\wyccf.bak1
C:\WINDOWS\System32\wyccf.bak1 Has been deleted!

Attempting to delete C:\WINDOWS\System32\wyccf.ini
C:\WINDOWS\System32\wyccf.ini Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V6.3.23

Checking Java version...

Sun Java not detected
Scan started at 01:51:26 21/05/2007

Listing files found while scanning....

No infected files were found.


VundoFix V6.3.23

Checking Java version...

Java version is 1.5.0.3
Old versions of java are exploitable and should be removed.

Scan started at 20:45:52 21/05/2007

Listing files found while scanning....

C:\WINDOWS\System32\srqru.bak1
C:\WINDOWS\System32\srqru.ini
C:\WINDOWS\System32\urqrs.dll

Beginning removal...

Attempting to delete C:\WINDOWS\System32\srqru.bak1
C:\WINDOWS\System32\srqru.bak1 Has been deleted!

Attempting to delete C:\WINDOWS\System32\srqru.ini
C:\WINDOWS\System32\srqru.ini Has been deleted!

Attempting to delete C:\WINDOWS\System32\urqrs.dll
C:\WINDOWS\System32\urqrs.dll Could not be deleted.

Performing Repairs to the registry.
Done!

VundoFix V6.3.23

Checking Java version...

Java version is 1.5.0.3
Old versions of java are exploitable and should be removed.

Scan started at 00:35:27 26/05/2003

Listing files found while scanning....

No infected files were found.


VundoFix V6.5.9

Checking Java version...

Java version is 1.5.0.3
Old versions of java are exploitable and should be removed.

Scan started at 02:49:02 23/09/2007

Listing files found while scanning....

No infected files were found.


Beginning removal...


HJT Log -


Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\btbb_wcm\McciTrayApp.exe
C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
C:\PROGRA~1\BTHOME~1\Help\SMARTB~1\BTHelpNotifier.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\LClock\LClock.exe
C:\Program Files\ViStart\ViStart.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\James.JAMES-HL17SMTOP\Desktop\Spyware\HiJackThis_v2.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.red.clientapps.yahoo.com/customi...fo/bt_side.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.red.clientapps.yahoo.com/customi...arch.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.red.clientapps.yahoo.com/customi...fo/bt_side.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.red.clientapps.yahoo.com/customi...arch.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: (no name) - {02AAC8ED-0B61-480E-BBF2-6EBF533FF093} - c:\windows\system32\oqnxbltm.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {421B7566-ABB1-437F-AEA2-8291B7F564F1} - c:\windows\system32\devmgrn.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll
O4 - HKLM\..\Run: [btbb_wcm_McciTrayApp] C:\Program Files\btbb_wcm\McciTrayApp.exe
O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\BTHOME~1\Help\SMARTB~1\BTHelpNotifier.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SoundMan] soundman.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe -quiet
O4 - HKCU\..\Run: [eyeBeam SIP Client] "C:\Program Files\BT Broadband Talk Softphone\BTSoftphone.exe"
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LClock] C:\Program Files\LClock\LClock.exe
O4 - HKCU\..\Run: [Vista Sidebar] C:\Program Files\Vista Sidebar\sidebar.exe
O4 - HKCU\..\Run: [ViStart] C:\Program Files\ViStart\ViStart.exe
O4 - HKCU\..\Run: [VisualTooltip] C:\Program Files\VisualTooltip\VisualToolTip.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [wk1133] C:\WINDOWS\system32\wk1133.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\RunOnce: [gi2004334376] "C:\DOCUME~1\JAMES~1.JAM\LOCALS~1\Temp\gi05QTON.exe" /resume:"C:\DOCUME~1\JAMES~1.JAM\LOCALS~1\Temp\2O05QQ55" /exename:"C:\Documents and Settings\James.JAMES-HL17SMTOP\My Documents\BitTorrent Downloads\Elecard MPEG Player v4.5.70328\Elecard MPEG Player 4.5.70328.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: BT Broadband Desktop Help.lnk = C:\Program Files\BT Home Hub\Help\bin\matcli.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: BT Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MIC273~1\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: dreacrya - C:\WINDOWS\SYSTEM32\devmgrn.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

#4 rookie147

rookie147

  • Members
  • 5,321 posts
  • OFFLINE
  •  
  • Local time:09:04 AM

Posted 23 September 2007 - 03:04 AM

We will run Vundofix another way then:

Double-click VundoFix.exe to run it.
When VundoFix re-opens, click "Scan for Vundo" button.
Once the scan is complete, right click inside the listbox (white box) and click "Add More Files"
Copy and paste the entries below into the top boxes (no arrows):

--> c:\windows\system32\devmgrn.dll

Click "Add Files" and click "Close Window".
Click the Remove Vundo button.
You will receive a prompt asking if you want to remove the files, click YES
Once you click yes, your Desktop will go blank as it starts removing Vundo - this is normal.
When completed, it will prompt that it will shutdown your computer, click OK.
Turn your computer back on.

You're using an outdated version of Java (the latest one is Java Runtime Environment (JRE) 6u2), and these can be exploited by malware, so you need to update it as soon as possible. Please update and remove the older versions from your computer. Do the following:
Go to Start | Control Panel | Add/Remove Programs
Search in the list for all previous installed versions of Java (J2SE Runtime Environment ...)
Select it and click Remove.
Then download and install the newest version from here:
Java Runtime Environment (JRE) 6u2

Please include VundoFix.txt and a new HijackThis log in your next reply.
Thanks,
Charles

Edited by rookie147, 23 September 2007 - 03:04 AM.

If you are pleased with the service I have offered, you may like to consider making a donation. Posted Image
Posted Image


#5 jclfc

jclfc
  • Topic Starter

  • Members
  • 71 posts
  • OFFLINE
  •  
  • Local time:08:04 AM

Posted 23 September 2007 - 11:30 AM

Hi Charles, just updated the Java but I ran the VundoFix scan prior to doing so. Again, VundoFix found no problems. Here are the log files -

VundoFix V6.3.23

Checking Java version...

Sun Java not detected
Scan started at 01:40:01 21/05/2007

Listing files found while scanning....

C:\WINDOWS\System32\fccyw.dll
C:\WINDOWS\SYSTEM32\hfwmkxxn.ini
C:\WINDOWS\SYSTEM32\nxxkmwfh.dll
C:\WINDOWS\System32\wyccf.bak1
C:\WINDOWS\System32\wyccf.ini

Beginning removal...

Beginning removal...

Attempting to delete C:\WINDOWS\System32\fccyw.dll
C:\WINDOWS\System32\fccyw.dll Could not be deleted.

Attempting to delete C:\WINDOWS\SYSTEM32\hfwmkxxn.ini
C:\WINDOWS\SYSTEM32\hfwmkxxn.ini Has been deleted!

Attempting to delete C:\WINDOWS\SYSTEM32\nxxkmwfh.dll
C:\WINDOWS\SYSTEM32\nxxkmwfh.dll Has been deleted!

Attempting to delete C:\WINDOWS\System32\wyccf.bak1
C:\WINDOWS\System32\wyccf.bak1 Has been deleted!

Attempting to delete C:\WINDOWS\System32\wyccf.ini
C:\WINDOWS\System32\wyccf.ini Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V6.3.23

Checking Java version...

Sun Java not detected
Scan started at 01:51:26 21/05/2007

Listing files found while scanning....

No infected files were found.


VundoFix V6.3.23

Checking Java version...

Java version is 1.5.0.3
Old versions of java are exploitable and should be removed.

Scan started at 20:45:52 21/05/2007

Listing files found while scanning....

C:\WINDOWS\System32\srqru.bak1
C:\WINDOWS\System32\srqru.ini
C:\WINDOWS\System32\urqrs.dll

Beginning removal...

Attempting to delete C:\WINDOWS\System32\srqru.bak1
C:\WINDOWS\System32\srqru.bak1 Has been deleted!

Attempting to delete C:\WINDOWS\System32\srqru.ini
C:\WINDOWS\System32\srqru.ini Has been deleted!

Attempting to delete C:\WINDOWS\System32\urqrs.dll
C:\WINDOWS\System32\urqrs.dll Could not be deleted.

Performing Repairs to the registry.
Done!

VundoFix V6.3.23

Checking Java version...

Java version is 1.5.0.3
Old versions of java are exploitable and should be removed.

Scan started at 00:35:27 26/05/2003

Listing files found while scanning....

No infected files were found.


VundoFix V6.5.9

Checking Java version...

Java version is 1.5.0.3
Old versions of java are exploitable and should be removed.

Scan started at 02:49:02 23/09/2007

Listing files found while scanning....

No infected files were found.


Beginning removal...

VundoFix V6.5.9

Checking Java version...

Java version is 1.5.0.3
Old versions of java are exploitable and should be removed.

Scan started at 15:23:57 23/09/2007

Listing files found while scanning....

No infected files were found.


HJT log -


Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\btbb_wcm\McciTrayApp.exe
C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
C:\PROGRA~1\BTHOME~1\Help\SMARTB~1\BTHelpNotifier.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\LClock\LClock.exe
C:\Program Files\ViStart\ViStart.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\James.JAMES-HL17SMTOP\Desktop\Spyware\HiJackThis_v2.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.red.clientapps.yahoo.com/customi...fo/bt_side.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.red.clientapps.yahoo.com/customi...arch.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.red.clientapps.yahoo.com/customi...fo/bt_side.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.red.clientapps.yahoo.com/customi...arch.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: (no name) - {02AAC8ED-0B61-480E-BBF2-6EBF533FF093} - c:\windows\system32\oqnxbltm.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {421B7566-ABB1-437F-AEA2-8291B7F564F1} - c:\windows\system32\devmgrn.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll
O4 - HKLM\..\Run: [btbb_wcm_McciTrayApp] C:\Program Files\btbb_wcm\McciTrayApp.exe
O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\BTHOME~1\Help\SMARTB~1\BTHelpNotifier.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SoundMan] soundman.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe -quiet
O4 - HKCU\..\Run: [eyeBeam SIP Client] "C:\Program Files\BT Broadband Talk Softphone\BTSoftphone.exe"
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LClock] C:\Program Files\LClock\LClock.exe
O4 - HKCU\..\Run: [Vista Sidebar] C:\Program Files\Vista Sidebar\sidebar.exe
O4 - HKCU\..\Run: [ViStart] C:\Program Files\ViStart\ViStart.exe
O4 - HKCU\..\Run: [VisualTooltip] C:\Program Files\VisualTooltip\VisualToolTip.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [wk1133] C:\WINDOWS\system32\wk1133.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\RunOnce: [gi2004334376] "C:\DOCUME~1\JAMES~1.JAM\LOCALS~1\Temp\gi05QTON.exe" /resume:"C:\DOCUME~1\JAMES~1.JAM\LOCALS~1\Temp\2O05QQ55" /exename:"C:\Documents and Settings\James.JAMES-HL17SMTOP\My Documents\BitTorrent Downloads\Elecard MPEG Player v4.5.70328\Elecard MPEG Player 4.5.70328.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: BT Broadband Desktop Help.lnk = C:\Program Files\BT Home Hub\Help\bin\matcli.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: BT Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MIC273~1\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: dreacrya - C:\WINDOWS\SYSTEM32\devmgrn.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

#6 rookie147

rookie147

  • Members
  • 5,321 posts
  • OFFLINE
  •  
  • Local time:09:04 AM

Posted 23 September 2007 - 01:00 PM

The top part is missing off your HJT log, please can you post the full log in your reply?

If you are pleased with the service I have offered, you may like to consider making a donation. Posted Image
Posted Image


#7 jclfc

jclfc
  • Topic Starter

  • Members
  • 71 posts
  • OFFLINE
  •  
  • Local time:08:04 AM

Posted 23 September 2007 - 01:18 PM

Apologies -

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:19:14, on 23/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\btbb_wcm\McciTrayApp.exe
C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
C:\PROGRA~1\BTHOME~1\Help\SMARTB~1\BTHelpNotifier.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\LClock\LClock.exe
C:\Program Files\ViStart\ViStart.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\James.JAMES-HL17SMTOP\Desktop\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.red.clientapps.yahoo.com/customi...fo/bt_side.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.red.clientapps.yahoo.com/customi...arch.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.red.clientapps.yahoo.com/customi...fo/bt_side.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.red.clientapps.yahoo.com/customi...arch.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: (no name) - {02AAC8ED-0B61-480E-BBF2-6EBF533FF093} - c:\windows\system32\oqnxbltm.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {421B7566-ABB1-437F-AEA2-8291B7F564F1} - c:\windows\system32\devmgrn.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll
O4 - HKLM\..\Run: [btbb_wcm_McciTrayApp] C:\Program Files\btbb_wcm\McciTrayApp.exe
O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\BTHOME~1\Help\SMARTB~1\BTHelpNotifier.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SoundMan] soundman.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe -quiet
O4 - HKCU\..\Run: [eyeBeam SIP Client] "C:\Program Files\BT Broadband Talk Softphone\BTSoftphone.exe"
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LClock] C:\Program Files\LClock\LClock.exe
O4 - HKCU\..\Run: [Vista Sidebar] C:\Program Files\Vista Sidebar\sidebar.exe
O4 - HKCU\..\Run: [ViStart] C:\Program Files\ViStart\ViStart.exe
O4 - HKCU\..\Run: [VisualTooltip] C:\Program Files\VisualTooltip\VisualToolTip.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [wk1133] C:\WINDOWS\system32\wk1133.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\RunOnce: [gi2004334376] "C:\DOCUME~1\JAMES~1.JAM\LOCALS~1\Temp\gi05QTON.exe" /resume:"C:\DOCUME~1\JAMES~1.JAM\LOCALS~1\Temp\2O05QQ55" /exename:"C:\Documents and Settings\James.JAMES-HL17SMTOP\My Documents\BitTorrent Downloads\Elecard MPEG Player v4.5.70328\Elecard MPEG Player 4.5.70328.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: BT Broadband Desktop Help.lnk = C:\Program Files\BT Home Hub\Help\bin\matcli.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: BT Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MIC273~1\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: dreacrya - C:\WINDOWS\SYSTEM32\devmgrn.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

--
End of file - 10466 bytes

#8 rookie147

rookie147

  • Members
  • 5,321 posts
  • OFFLINE
  •  
  • Local time:09:04 AM

Posted 23 September 2007 - 02:49 PM

Hello again,
Please print off a copy of these instructions, and also save them to a Notepad file on your desktop, so they are easily accessible.
We are going to boot into Safe Mode later in the fix, and there is no internet access.

Scan again with HijackThis and put a checkmark next to each of the following entries (if present):

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.red.clientapps.yahoo.com/customi...fo/bt_side.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.red.clientapps.yahoo.com/customi...arch.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.red.clientapps.yahoo.com/customi...fo/bt_side.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.red.clientapps.yahoo.com/customi...arch.yahoo.com/
O2 - BHO: (no name) - {02AAC8ED-0B61-480E-BBF2-6EBF533FF093} - c:\windows\system32\oqnxbltm.dll
O2 - BHO: (no name) - {421B7566-ABB1-437F-AEA2-8291B7F564F1} - c:\windows\system32\devmgrn.dll
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - HKCU\..\Run: [wk1133] C:\WINDOWS\system32\wk1133.exe
O4 - HKCU\..\RunOnce: [gi2004334376] "C:\DOCUME~1\JAMES~1.JAM\LOCALS~1\Temp\gi05QTON.exe" /resume:"C:\DOCUME~1\JAMES~1.JAM\LOCALS~1\Temp\2O05QQ55" /exename:"C:\Documents and Settings\James.JAMES-HL17SMTOP\My Documents\BitTorrent Downloads\Elecard MPEG Player v4.5.70328\Elecard MPEG Player 4.5.70328.exe"
O20 - Winlogon Notify: dreacrya - C:\WINDOWS\SYSTEM32\devmgrn.dll


Then close all other windows--you should only see HijackThis on your Desktop--and click the Fix checked button.

Please reboot your computer into Safe Mode.
This is done by rebooting Windows and pressing F8 at boot/Windows startup, usually right after the beep.
Then select Safe Mode from the list.
Make sure you choose the option without Networking Support.

Set your system to show all files.
Navigate to Start | My Computer | Tools | Folder Options.
Select the View tab. Under the "Hidden Files and Folders" heading, select "Show hidden files and folders".
Uncheck: Hide file extensions for known file types
Uncheck the Hide protected operating system files (recommended) option.
Click Yes to confirm.

Next, please find and delete the following files (if present):

C:\WINDOWS\SYSTEM32\wk1133.exe
C:\WINDOWS\SYSTEM32\devmgrn.dll
C:\WINDOWS\SYSTEM32\oqnxbltm.dll
C:\WINDOWS\SYSTEM32\urqrs.dll
C:\WINDOWS\SYSTEM32\fccyw.dll

Reboot into Normal Mode again.

Download Combofix to your Desktop.
Double click combofix.exe
Follow the prompts that are displayed.
Don't click on the window while the fix is running, because that will cause your system to hang.
When finished, it should produce a log, combofix.txt. Post that in your next reply.

Then scan once more with HijackThis and post the log in your reply along with the Combofix log you just created.
Thanks,
Charles

If you are pleased with the service I have offered, you may like to consider making a donation. Posted Image
Posted Image


#9 jclfc

jclfc
  • Topic Starter

  • Members
  • 71 posts
  • OFFLINE
  •  
  • Local time:08:04 AM

Posted 23 September 2007 - 05:27 PM

The computer would not allow me to manually delete devmgrn.dll and oqnxbltm.dll as it said the files are in use. Here are the logs -

ComboFix 07-09-21.2 - "James" 2007-09-23 23:15:43.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.389 [GMT 1:00]
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Avenger
C:\DOCUME~1\James\APPLIC~1\.rdr.ini
C:\DOCUME~1\James\STARTM~1\Programs\Startup\ta_start.lnk
C:\DOCUME~1\JAMES~1.JAM\APPLIC~1\inst.exe
C:\DOCUME~1\JAMES~1.JAM\APPLIC~1\macromedia\Flash Player\#SharedObjects\YG9B4TR4\www.broadcaster.com
C:\DOCUME~1\JAMES~1.JAM\APPLIC~1\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com
C:\DOCUME~1\JAMES~1.JAM\APPLIC~1\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol
C:\DOCUME~1\LOCALS~1\APPLIC~1\.rdr.ini
C:\DOCUME~1\NETWOR~1\APPLIC~1\.rdr.ini
C:\temp\0b9
C:\temp\0b9\tmpTF.log
C:\WINDOWS\system32\devmgrn.dll
C:\WINDOWS\system32\drivers\ukafejkh.sys
C:\WINDOWS\system32\pskill.exe
C:\WINDOWS\system32\T2
C:\WINDOWS\system32\T3
C:\WINDOWS\system32\T5
C:\WINDOWS\system32\T7

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


-------\LEGACY_OBYSWJUN
-------\LEGACY_OOBSMXGH
-------\obyswjun
-------\oobsmxgh


((((((((((((((((((((((((( Files Created from 2007-08-23 to 2007-09-23 )))))))))))))))))))))))))))))))
.

2007-09-23 23:14 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-09-21 18:27 <DIR> d-------- C:\Program Files\3ivx
2007-09-18 19:17 <DIR> d-------- C:\Program Files\AC3Filter
2007-09-18 02:23 <DIR> d-------- C:\WINDOWS\BDOSCAN8
2007-09-18 01:39 <DIR> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\SUPERAntiSpyware.com
2007-09-18 01:38 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2007-09-18 01:38 <DIR> d-------- C:\DOCUME~1\JAMES~1.JAM\APPLIC~1\SUPERAntiSpyware.com
2007-09-12 01:00 <DIR> d-a------ C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\TEMP
2007-09-12 00:57 77,312 --a------ C:\WINDOWS\SYSTEM32\ztvunace26.dll
2007-09-12 00:57 75,264 --a------ C:\WINDOWS\SYSTEM32\unacev2.dll
2007-09-12 00:57 69,632 --a------ C:\WINDOWS\SYSTEM32\ztvcabinet.dll
2007-09-12 00:57 162,304 --a------ C:\WINDOWS\SYSTEM32\ztvunrar36.dll
2007-09-12 00:57 153,088 --a------ C:\WINDOWS\SYSTEM32\UNRAR3.dll
2007-09-12 00:57 <DIR> d-------- C:\Program Files\Trojan Remover
2007-09-12 00:57 <DIR> d-------- C:\DOCUME~1\JAMES~1.JAM\APPLIC~1\Simply Super Software
2007-09-12 00:57 <DIR> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Simply Super Software
2007-09-11 15:53 <DIR> d-------- C:\Program Files\BHODemon 2
2007-09-10 19:41 95,608 --a------ C:\WINDOWS\SYSTEM32\AvastSS.scr
2007-09-10 19:41 94,416 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\aswmon2.sys
2007-09-10 19:41 92,848 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\aswmon.sys
2007-09-10 19:41 42,912 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\aswTdi.sys
2007-09-10 19:41 26,624 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\aavmker4.sys
2007-09-10 19:41 23,152 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\aswRdr.sys
2007-09-10 19:40 801,144 --a------ C:\WINDOWS\SYSTEM32\aswBoot.exe
2007-09-10 19:40 1,060,864 --a------ C:\WINDOWS\SYSTEM32\MFC71.dll
2007-09-10 18:02 <DIR> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Lavasoft
2007-09-10 14:01 30,697,041 --------- C:\avg7qt.dat
2007-09-08 16:47 2,800 --a------ C:\WINDOWS\SYSTEM32\tmp.reg
2007-09-08 16:46 53,248 --a------ C:\WINDOWS\SYSTEM32\Process.exe
2007-09-08 16:46 51,200 --a------ C:\WINDOWS\SYSTEM32\dumphive.exe
2007-09-08 16:46 289,144 --a------ C:\WINDOWS\SYSTEM32\VCCLSID.exe
2007-09-08 16:46 288,417 --a------ C:\WINDOWS\SYSTEM32\SrchSTS.exe
2007-09-05 01:41 102,114 --a------ C:\WINDOWS\SYSTEM32\oqnxbltm.dll
2007-09-05 00:23 756,224 --a------ C:\WINDOWS\SYSTEM32\etlwonjw.dll
2007-09-05 00:23 48,640 --a------ C:\WINDOWS\SYSTEM32\rzpsottz.dll
2007-09-05 00:23 147,729 --a------ C:\WINDOWS\SYSTEM32\libssl32.dll
2007-09-05 00:23 128,512 --a------ C:\WINDOWS\SYSTEM32\kszqxorg.dll
2007-09-04 00:21 46,592 --a------ C:\WINDOWS\SYSTEM32\tvdjnrye.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2020-05-20 18:40 --------- d-------- C:\Program Files\DirectX
2020-05-20 18:39 266 ---hs---- C:\Program Files\desktop.ini
2020-05-20 18:39 11079 --ah----- C:\Program Files\folder.htt
2007-09-23 23:23 --------- d-------- C:\Program Files\ViStart
2007-09-21 18:14 --------- d-------- C:\Program Files\Yahoo!
2007-09-20 17:08 --------- d-------- C:\Program Files\Common Files\Elecard
2007-09-20 01:28 --------- d-------- C:\Program Files\AnMing
2007-09-18 01:37 --------- d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-09-13 12:06 --------- d-------- C:\DOCUME~1\JAMES~1.JAM\APPLIC~1\BitTorrent
2007-09-10 18:02 --------- d-------- C:\Program Files\Lavasoft
2007-09-04 13:46 359808 --a------ C:\WINDOWS\system32\drivers\tcpip.sys
2007-08-18 00:18 --------- d-------- C:\DOCUME~1\JAMES~1.JAM\APPLIC~1\DNA
2007-08-17 13:24 --------- d-------- C:\Program Files\MSXML 6.0
2007-08-16 19:05 --------- d-------- C:\Program Files\Windows Sidebar
2007-08-16 00:34 --------- d-------- C:\Program Files\VAIOXP
2007-08-15 14:33 --------- d-------- C:\Program Files\Vista Sidebar
2007-08-15 14:19 --------- d-------- C:\Program Files\SystemRequirementsLab
2007-08-15 01:35 --------- d-------- C:\DOCUME~1\JAMES~1.JAM\APPLIC~1\ViStart
2007-08-15 01:28 --------- d-------- C:\Program Files\VisualTooltip
2007-08-15 01:28 --------- d-------- C:\Program Files\ViOrb
2007-08-15 01:28 --------- d-------- C:\Program Files\Styler
2007-08-15 01:28 --------- d-------- C:\Program Files\MSN Messenger
2007-08-15 01:27 --------- d-------- C:\Program Files\LClock
2007-08-14 23:23 --------- d-------- C:\Program Files\PeerGuardian2
2007-08-14 02:12 --------- d-------- C:\Program Files\PowerISO
2007-08-14 02:04 --------- d-------- C:\Program Files\Microsoft Visual Studio 8
2007-08-14 02:04 --------- d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Microsoft Help
2007-08-14 02:03 --------- d-------- C:\Program Files\Microsoft Expression
2007-08-14 01:01 --------- d-------- C:\Program Files\vso
2007-08-14 01:01 --------- d-------- C:\DOCUME~1\JAMES~1.JAM\APPLIC~1\Vso
2007-08-14 00:56 94208 --a------ C:\WINDOWS\system32\drivers\ezplay.sys
2007-08-14 00:56 94208 --a------ C:\DOCUME~1\JAMES~1.JAM\APPLIC~1\ezplay.sys
2007-08-14 00:55 47360 --a------ C:\WINDOWS\system32\drivers\pcouffin.sys
2007-08-14 00:55 47360 --a------ C:\DOCUME~1\JAMES~1.JAM\APPLIC~1\pcouffin.sys
2007-08-13 03:48 --------- d-------- C:\Program Files\Microsoft Works
2007-08-13 03:47 --------- d-------- C:\Program Files\MSBuild
2007-08-12 23:13 --------- d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Google
2007-08-09 00:56 --------- d-------- C:\Program Files\Elecard
2007-08-08 23:09 --------- d-------- C:\Program Files\Evil Msn
2007-08-08 23:06 --------- d-------- C:\DOCUME~1\JAMES~1.JAM\APPLIC~1\Google
2007-08-08 22:52 --------- d-------- C:\Program Files\Google
2007-08-08 21:19 --------- d-------- C:\Program Files\Windows Media Connect 2
2007-08-08 19:43 --------- d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\WinZip
2007-08-07 15:26 --------- d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\AVS4YOU
2007-08-07 15:25 --------- d-------- C:\Program Files\Common Files\AVSMedia
2007-08-07 15:25 --------- d-------- C:\Program Files\AVSMedia
2007-08-07 15:07 --------- d-------- C:\Program Files\Common Files\Download Manager
2007-08-07 14:47 --------- d-------- C:\DOCUME~1\JAMES~1.JAM\APPLIC~1\CopyToDvd
2007-08-07 14:21 --------- d-------- C:\DOCUME~1\JAMES~1.JAM\APPLIC~1\Ahead
2007-08-07 02:52 66272 --a------ C:\WINDOWS\SYSTEM32\libfaac.dll
2007-08-07 02:52 443104 --a------ C:\WINDOWS\SYSTEM32\OpenQuicktimeLib.dll
2007-08-07 02:52 25312 --a------ C:\WINDOWS\SYSTEM32\SamsungVfWCodec.dll
2007-08-07 02:52 25312 --a------ C:\WINDOWS\SYSTEM32\DivXVfWCodec.dll
2007-08-07 02:51 324320 --a------ C:\WINDOWS\SYSTEM32\3ivxVfWCodec.dll
2007-08-07 02:51 1139488 --a------ C:\WINDOWS\SYSTEM32\3ivx.dll
2007-08-07 01:15 33052 --a------ C:\WINDOWS\system32\drivers\scdemu.sys
2007-08-07 00:11 --------- d-------- C:\Program Files\ffdshow
2007-08-04 20:24 7680 --a------ C:\WINDOWS\SYSTEM32\ff_vfw.dll
2007-08-02 23:48 --------- d-------- C:\Program Files\AvRack
2007-08-02 00:40 --------- d-------- C:\DOCUME~1\JAMES~1.JAM\APPLIC~1\Real
2007-08-01 23:14 --------- d-------- C:\Program Files\Real Alternative
2007-08-01 23:14 --------- d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Real
2007-07-31 18:33 60273 --a------ C:\WINDOWS\SYSTEM32\pthreadGC2.dll
2007-07-31 15:02 --------- d-------- C:\DOCUME~1\JAMES~1.JAM\APPLIC~1\Help
2007-07-30 19:19 92504 --a------ C:\WINDOWS\SYSTEM32\cdm.dll
2007-07-30 19:19 549720 --a------ C:\WINDOWS\SYSTEM32\wuapi.dll
2007-07-30 19:19 53080 --a------ C:\WINDOWS\SYSTEM32\wuauclt.exe
2007-07-30 19:19 43352 --a------ C:\WINDOWS\SYSTEM32\wups2.dll
2007-07-30 19:19 325976 --a------ C:\WINDOWS\SYSTEM32\wucltui.dll
2007-07-30 19:19 203096 --a------ C:\WINDOWS\SYSTEM32\wuweb.dll
2007-07-30 19:19 1712984 --a------ C:\WINDOWS\SYSTEM32\wuaueng.dll
2007-07-30 19:18 33624 --a------ C:\WINDOWS\SYSTEM32\wups.dll
2007-07-30 00:37 --------- d-------- C:\Program Files\7-Zip
2007-07-27 18:41 --------- d-------- C:\Program Files\MP3 Wav Editor
2007-07-25 01:31 --------- d-------- C:\DOCUME~1\JAMES~1.JAM\APPLIC~1\Samsung
2007-07-25 01:28 --------- d--h----- C:\Program Files\InstallShield Installation Information
2007-07-19 21:03 166 --a------ C:\Program Files\quqwc^ql.txt
2007-07-19 21:03 16 --a------ C:\chdir.bat
2007-06-26 07:08 1104896 --a------ C:\WINDOWS\SYSTEM32\msxml3.dll
2007-06-26 05:13 305447 --a------ C:\WINDOWS\SYSTEM32\viwc.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"btbb_wcm_McciTrayApp"="C:\Program Files\btbb_wcm\McciTrayApp.exe" [2005-12-29 12:22]
"YBrowser"="C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe" [2006-07-21 17:19]
"Motive SmartBridge"="C:\PROGRA~1\BTHOME~1\Help\SMARTB~1\BTHelpNotifier.exe" [2006-02-06 18:52]
"NWEReboot"="" []
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40]
"SoundMan"="soundman.exe" [2001-05-30 04:02 C:\WINDOWS\soundman.exe]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-09-14 12:59]
"PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2007-08-07 01:05]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-06-01 16:51]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 11:06]
"TrojanScanner"="C:\Program Files\Trojan Remover\Trjscan.exe" [2007-09-12 00:58]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe" [2005-08-31 17:11]
"eyeBeam SIP Client"="C:\Program Files\BT Broadband Talk Softphone\BTSoftphone.exe" [2006-07-31 20:00]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-06-01 14:32]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56]
"LClock"="C:\Program Files\LClock\LClock.exe" [2004-09-20 01:27]
"Vista Sidebar"="C:\Program Files\Vista Sidebar\sidebar.exe" [2007-06-21 17:04]
"ViStart"="C:\Program Files\ViStart\ViStart.exe" [2007-06-21 23:41]
"VisualTooltip"="C:\Program Files\VisualTooltip\VisualToolTip.exe" [2006-12-27 10:07]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2007-01-30 06:21]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-06-21 14:06]

C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\Programs\Startup\
BT Broadband Desktop Help.lnk - C:\Program Files\BT Home Hub\Help\bin\matcli.exe [2007-05-28 16:20:35]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

S3 rtport;rtport;\??\C:\WINDOWS\system32\drivers\rtport.sys
S3 ss_bus;Samsung Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\system32\DRIVERS\ss_bus.sys
S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys
S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\system32\DRIVERS\ss_mdm.sys
S3 sscdbus;SAMSUNG USB Composite Device driver (WDM);C:\WINDOWS\system32\DRIVERS\sscdbus.sys
S3 sscdmdfl;SAMSUNG CDMA Modem Filter;C:\WINDOWS\system32\DRIVERS\sscdmdfl.sys
S3 sscdmdm;SAMSUNG CDMA Modem Drivers;C:\WINDOWS\system32\DRIVERS\sscdmdm.sys

*Newly Created Service* - OOBSMXGH

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{34A19196-274E-4D75-9D30-D7A45A0A4178}]
"C:\Program Files\Windows Sidebar\.\regsvr32.exe" /s wlsrvc.dll

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6B9228DA-9C15-419e-856C-19E768A13BDC}]
"C:\Program Files\Windows Sidebar\.\regsvr32.exe" /s sbdrop.dll

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D58F39FF-953E-4F45-898F-59F243B9A523}]
C:\WINDOWS\system32\hidec /W "C:\Program Files\VAIOXP\Tools\regtlib.exe" "C:\Program Files\Windows Sidebar\sidebar.exe"
.
Contents of the 'Scheduled Tasks' folder
"2007-09-20 12:59:07 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-09-22 23:00:00 C:\WINDOWS\Tasks\At1.job"
- C:\WINDOWS\system32\qaJ2pdww.exe
"2007-06-08 23:46:27 C:\WINDOWS\Tasks\At10.job"
- C:\WINDOWS\system32\qaJ2pdww.exe
"2007-06-08 23:46:27 C:\WINDOWS\Tasks\At11.job"
- C:\WINDOWS\system32\qaJ2pdww.exe
"2007-09-12 10:00:00 C:\WINDOWS\Tasks\At12.job"
- C:\WINDOWS\system32\qaJ2pdww.exe
"2007-09-15 11:00:00 C:\WINDOWS\Tasks\At13.job"
- C:\WINDOWS\system32\qaJ2pdww.exe
"2007-09-22 12:00:00 C:\WINDOWS\Tasks\At14.job"
- C:\WINDOWS\system32\qaJ2pdww.exe
"2007-09-21 13:00:00 C:\WINDOWS\Tasks\At15.job"
- C:\WINDOWS\system32\qaJ2pdww.exe
"2007-09-21 14:00:00 C:\WINDOWS\Tasks\At16.job"
- C:\WINDOWS\system32\qaJ2pdww.exe
"2007-09-23 15:00:00 C:\WINDOWS\Tasks\At17.job"
"2007-09-23 16:00:00 C:\WINDOWS\Tasks\At18.job"
- C:\WINDOWS\system32\qaJ2pdww.exe
"2007-09-23 17:00:00 C:\WINDOWS\Tasks\At19.job"
- C:\WINDOWS\system32\qaJ2pdww.exe
"2007-09-23 00:00:00 C:\WINDOWS\Tasks\At2.job"
- C:\WINDOWS\system32\qaJ2pdww.exe
"2007-09-23 18:00:00 C:\WINDOWS\Tasks\At20.job"
- C:\WINDOWS\system32\qaJ2pdww.exe
"2007-09-22 19:00:00 C:\WINDOWS\Tasks\At21.job"
- C:\WINDOWS\system32\qaJ2pdww.exe
"2007-09-22 20:00:00 C:\WINDOWS\Tasks\At22.job"
- C:\WINDOWS\system32\qaJ2pdww.exe
"2007-09-22 21:00:00 C:\WINDOWS\Tasks\At23.job"
"2007-09-22 22:00:00 C:\WINDOWS\Tasks\At24.job"
"2007-09-23 01:00:00 C:\WINDOWS\Tasks\At3.job"
- C:\WINDOWS\system32\qaJ2pdww.exe
"2007-09-23 02:00:00 C:\WINDOWS\Tasks\At4.job"
- C:\WINDOWS\system32\qaJ2pdww.exe
"2007-09-03 03:00:00 C:\WINDOWS\Tasks\At5.job"
- C:\WINDOWS\system32\qaJ2pdww.exe
"2007-06-08 23:46:27 C:\WINDOWS\Tasks\At6.job"
- C:\WINDOWS\system32\qaJ2pdww.exe
"2007-06-08 23:46:27 C:\WINDOWS\Tasks\At7.job"
- C:\WINDOWS\system32\qaJ2pdww.exe
"2007-06-08 23:46:27 C:\WINDOWS\Tasks\At8.job"
- C:\WINDOWS\system32\qaJ2pdww.exe
"2007-06-08 23:46:27 C:\WINDOWS\Tasks\At9.job"
- C:\WINDOWS\system32\qaJ2pdww.exe
"2007-09-23 21:28:23 C:\WINDOWS\Tasks\User_Feed_Synchronization-{B4F66692-B8BE-47E4-BD45-3D1BAFDBA7DB}.job"
- C:\WINDOWS\system32\msfeedssync.exe
.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-23 23:22:48
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-09-23 23:25:23 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-09-23 23:25
C:\ComboFix2.txt ... 2007-05-25 18:42
.
--- E O F ---


----

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:28:31, on 23/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\btbb_wcm\McciTrayApp.exe
C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
C:\PROGRA~1\BTHOME~1\Help\SMARTB~1\BTHelpNotifier.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\LClock\LClock.exe
C:\Program Files\ViStart\ViStart.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\James.JAMES-HL17SMTOP\Desktop\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll
O4 - HKLM\..\Run: [btbb_wcm_McciTrayApp] C:\Program Files\btbb_wcm\McciTrayApp.exe
O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\BTHOME~1\Help\SMARTB~1\BTHelpNotifier.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SoundMan] soundman.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe -quiet
O4 - HKCU\..\Run: [eyeBeam SIP Client] "C:\Program Files\BT Broadband Talk Softphone\BTSoftphone.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LClock] C:\Program Files\LClock\LClock.exe
O4 - HKCU\..\Run: [Vista Sidebar] C:\Program Files\Vista Sidebar\sidebar.exe
O4 - HKCU\..\Run: [ViStart] C:\Program Files\ViStart\ViStart.exe
O4 - HKCU\..\Run: [VisualTooltip] C:\Program Files\VisualTooltip\VisualToolTip.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: BT Broadband Desktop Help.lnk = C:\Program Files\BT Home Hub\Help\bin\matcli.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: BT Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MIC273~1\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

--
End of file - 9026 bytes

#10 rookie147

rookie147

  • Members
  • 5,321 posts
  • OFFLINE
  •  
  • Local time:09:04 AM

Posted 24 September 2007 - 04:12 PM

Download KillBox from the following link :
http://www.bleepingcomputer.com/files/killbox.php
Unzip the folder to your desktop.

Start Killbox.exe
Select the "Delete on Reboot" option.
Click on the "All Files" button (!important!),which will then flash green.
Copy the complete text in bold below to the clipboard by highlighting the filepaths and pressing Control + C:

C:\WINDOWS\SYSTEM32\devmgrn.dll
C:\WINDOWS\SYSTEM32\oqnxbltm.dll


Open 'file' in the killbox menu on top and choose Paste from clipboard
You must use the file menu--pasting by right-clicking the mouse will only enter one file.
Then press the button that looks like a red circle with a white X in it.
Killbox will tell you that all listed files will be removed on next reboot and asks if you would like to reboot now, click "yes".
Click OK at any Pending File Rename Operations prompts, let me know if there appear.
If you don't get that message, reboot manually.
Your computer should reboot now.

Then I would like to see a new Combofix log.
Thanks,
Charles

If you are pleased with the service I have offered, you may like to consider making a donation. Posted Image
Posted Image


#11 jclfc

jclfc
  • Topic Starter

  • Members
  • 71 posts
  • OFFLINE
  •  
  • Local time:08:04 AM

Posted 25 September 2007 - 06:20 PM

Hi Charles, sorry for short the delay in getting back to you. ComboFix appears to have resolved the devmgrn.dll issue so I followed your instructions for oqnxbltm.dll.

Here is the new CF log -

ComboFix 07-09-21.2 - "James" 2007-09-26 0:14:58.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.367 [GMT 1:00]
.

((((((((((((((((((((((((( Files Created from 2007-08-25 to 2007-09-25 )))))))))))))))))))))))))))))))
.

2007-09-23 23:14 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-09-21 18:27 <DIR> d-------- C:\Program Files\3ivx
2007-09-18 19:17 <DIR> d-------- C:\Program Files\AC3Filter
2007-09-18 02:23 <DIR> d-------- C:\WINDOWS\BDOSCAN8
2007-09-18 01:39 <DIR> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\SUPERAntiSpyware.com
2007-09-18 01:38 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2007-09-18 01:38 <DIR> d-------- C:\DOCUME~1\JAMES~1.JAM\APPLIC~1\SUPERAntiSpyware.com
2007-09-12 01:00 <DIR> d-a------ C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\TEMP
2007-09-12 00:57 77,312 --a------ C:\WINDOWS\SYSTEM32\ztvunace26.dll
2007-09-12 00:57 75,264 --a------ C:\WINDOWS\SYSTEM32\unacev2.dll
2007-09-12 00:57 69,632 --a------ C:\WINDOWS\SYSTEM32\ztvcabinet.dll
2007-09-12 00:57 162,304 --a------ C:\WINDOWS\SYSTEM32\ztvunrar36.dll
2007-09-12 00:57 153,088 --a------ C:\WINDOWS\SYSTEM32\UNRAR3.dll
2007-09-12 00:57 <DIR> d-------- C:\Program Files\Trojan Remover
2007-09-12 00:57 <DIR> d-------- C:\DOCUME~1\JAMES~1.JAM\APPLIC~1\Simply Super Software
2007-09-12 00:57 <DIR> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Simply Super Software
2007-09-11 15:53 <DIR> d-------- C:\Program Files\BHODemon 2
2007-09-10 19:41 95,608 --a------ C:\WINDOWS\SYSTEM32\AvastSS.scr
2007-09-10 19:41 94,416 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\aswmon2.sys
2007-09-10 19:41 92,848 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\aswmon.sys
2007-09-10 19:41 42,912 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\aswTdi.sys
2007-09-10 19:41 26,624 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\aavmker4.sys
2007-09-10 19:41 23,152 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\aswRdr.sys
2007-09-10 19:40 801,144 --a------ C:\WINDOWS\SYSTEM32\aswBoot.exe
2007-09-10 19:40 1,060,864 --a------ C:\WINDOWS\SYSTEM32\MFC71.dll
2007-09-10 18:02 <DIR> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Lavasoft
2007-09-10 14:01 30,697,041 --------- C:\avg7qt.dat
2007-09-08 16:47 2,800 --a------ C:\WINDOWS\SYSTEM32\tmp.reg
2007-09-08 16:46 53,248 --a------ C:\WINDOWS\SYSTEM32\Process.exe
2007-09-08 16:46 51,200 --a------ C:\WINDOWS\SYSTEM32\dumphive.exe
2007-09-08 16:46 289,144 --a------ C:\WINDOWS\SYSTEM32\VCCLSID.exe
2007-09-08 16:46 288,417 --a------ C:\WINDOWS\SYSTEM32\SrchSTS.exe
2007-09-05 00:23 756,224 --a------ C:\WINDOWS\SYSTEM32\etlwonjw.dll
2007-09-05 00:23 48,640 --a------ C:\WINDOWS\SYSTEM32\rzpsottz.dll
2007-09-05 00:23 147,729 --a------ C:\WINDOWS\SYSTEM32\libssl32.dll
2007-09-05 00:23 128,512 --a------ C:\WINDOWS\SYSTEM32\kszqxorg.dll
2007-09-04 00:21 46,592 --a------ C:\WINDOWS\SYSTEM32\tvdjnrye.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2020-05-20 18:40 --------- d-------- C:\Program Files\DirectX
2020-05-20 18:39 266 ---hs---- C:\Program Files\desktop.ini
2020-05-20 18:39 11079 --ah----- C:\Program Files\folder.htt
2007-09-26 00:12 --------- d-------- C:\Program Files\ViStart
2007-09-25 17:52 --------- d-------- C:\Program Files\Yahoo!
2007-09-20 17:08 --------- d-------- C:\Program Files\Common Files\Elecard
2007-09-20 01:28 --------- d-------- C:\Program Files\AnMing
2007-09-18 01:37 --------- d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-09-13 12:06 --------- d-------- C:\DOCUME~1\JAMES~1.JAM\APPLIC~1\BitTorrent
2007-09-10 18:02 --------- d-------- C:\Program Files\Lavasoft
2007-09-04 13:46 359808 --a------ C:\WINDOWS\system32\drivers\tcpip.sys
2007-08-18 00:18 --------- d-------- C:\DOCUME~1\JAMES~1.JAM\APPLIC~1\DNA
2007-08-17 13:24 --------- d-------- C:\Program Files\MSXML 6.0
2007-08-16 19:05 --------- d-------- C:\Program Files\Windows Sidebar
2007-08-16 00:34 --------- d-------- C:\Program Files\VAIOXP
2007-08-15 14:33 --------- d-------- C:\Program Files\Vista Sidebar
2007-08-15 14:19 --------- d-------- C:\Program Files\SystemRequirementsLab
2007-08-15 01:35 --------- d-------- C:\DOCUME~1\JAMES~1.JAM\APPLIC~1\ViStart
2007-08-15 01:28 --------- d-------- C:\Program Files\VisualTooltip
2007-08-15 01:28 --------- d-------- C:\Program Files\ViOrb
2007-08-15 01:28 --------- d-------- C:\Program Files\Styler
2007-08-15 01:28 --------- d-------- C:\Program Files\MSN Messenger
2007-08-15 01:27 --------- d-------- C:\Program Files\LClock
2007-08-14 23:23 --------- d-------- C:\Program Files\PeerGuardian2
2007-08-14 02:12 --------- d-------- C:\Program Files\PowerISO
2007-08-14 02:04 --------- d-------- C:\Program Files\Microsoft Visual Studio 8
2007-08-14 02:04 --------- d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Microsoft Help
2007-08-14 02:03 --------- d-------- C:\Program Files\Microsoft Expression
2007-08-14 01:01 --------- d-------- C:\Program Files\vso
2007-08-14 01:01 --------- d-------- C:\DOCUME~1\JAMES~1.JAM\APPLIC~1\Vso
2007-08-14 00:56 94208 --a------ C:\WINDOWS\system32\drivers\ezplay.sys
2007-08-14 00:56 94208 --a------ C:\DOCUME~1\JAMES~1.JAM\APPLIC~1\ezplay.sys
2007-08-14 00:55 47360 --a------ C:\WINDOWS\system32\drivers\pcouffin.sys
2007-08-14 00:55 47360 --a------ C:\DOCUME~1\JAMES~1.JAM\APPLIC~1\pcouffin.sys
2007-08-13 03:48 --------- d-------- C:\Program Files\Microsoft Works
2007-08-13 03:47 --------- d-------- C:\Program Files\MSBuild
2007-08-12 23:13 --------- d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Google
2007-08-09 00:56 --------- d-------- C:\Program Files\Elecard
2007-08-08 23:09 --------- d-------- C:\Program Files\Evil Msn
2007-08-08 23:06 --------- d-------- C:\DOCUME~1\JAMES~1.JAM\APPLIC~1\Google
2007-08-08 22:52 --------- d-------- C:\Program Files\Google
2007-08-08 21:19 --------- d-------- C:\Program Files\Windows Media Connect 2
2007-08-08 19:43 --------- d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\WinZip
2007-08-07 15:26 --------- d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\AVS4YOU
2007-08-07 15:25 --------- d-------- C:\Program Files\Common Files\AVSMedia
2007-08-07 15:25 --------- d-------- C:\Program Files\AVSMedia
2007-08-07 15:07 --------- d-------- C:\Program Files\Common Files\Download Manager
2007-08-07 14:47 --------- d-------- C:\DOCUME~1\JAMES~1.JAM\APPLIC~1\CopyToDvd
2007-08-07 14:21 --------- d-------- C:\DOCUME~1\JAMES~1.JAM\APPLIC~1\Ahead
2007-08-07 02:52 66272 --a------ C:\WINDOWS\SYSTEM32\libfaac.dll
2007-08-07 02:52 443104 --a------ C:\WINDOWS\SYSTEM32\OpenQuicktimeLib.dll
2007-08-07 02:52 25312 --a------ C:\WINDOWS\SYSTEM32\SamsungVfWCodec.dll
2007-08-07 02:52 25312 --a------ C:\WINDOWS\SYSTEM32\DivXVfWCodec.dll
2007-08-07 02:51 324320 --a------ C:\WINDOWS\SYSTEM32\3ivxVfWCodec.dll
2007-08-07 02:51 1139488 --a------ C:\WINDOWS\SYSTEM32\3ivx.dll
2007-08-07 01:15 33052 --a------ C:\WINDOWS\system32\drivers\scdemu.sys
2007-08-07 00:11 --------- d-------- C:\Program Files\ffdshow
2007-08-04 20:24 7680 --a------ C:\WINDOWS\SYSTEM32\ff_vfw.dll
2007-08-02 23:48 --------- d-------- C:\Program Files\AvRack
2007-08-02 00:40 --------- d-------- C:\DOCUME~1\JAMES~1.JAM\APPLIC~1\Real
2007-08-01 23:14 --------- d-------- C:\Program Files\Real Alternative
2007-08-01 23:14 --------- d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Real
2007-07-31 18:33 60273 --a------ C:\WINDOWS\SYSTEM32\pthreadGC2.dll
2007-07-31 15:02 --------- d-------- C:\DOCUME~1\JAMES~1.JAM\APPLIC~1\Help
2007-07-30 19:19 92504 --a------ C:\WINDOWS\SYSTEM32\cdm.dll
2007-07-30 19:19 549720 --a------ C:\WINDOWS\SYSTEM32\wuapi.dll
2007-07-30 19:19 53080 --a------ C:\WINDOWS\SYSTEM32\wuauclt.exe
2007-07-30 19:19 43352 --a------ C:\WINDOWS\SYSTEM32\wups2.dll
2007-07-30 19:19 325976 --a------ C:\WINDOWS\SYSTEM32\wucltui.dll
2007-07-30 19:19 203096 --a------ C:\WINDOWS\SYSTEM32\wuweb.dll
2007-07-30 19:19 1712984 --a------ C:\WINDOWS\SYSTEM32\wuaueng.dll
2007-07-30 19:18 33624 --a------ C:\WINDOWS\SYSTEM32\wups.dll
2007-07-30 00:37 --------- d-------- C:\Program Files\7-Zip
2007-07-27 18:41 --------- d-------- C:\Program Files\MP3 Wav Editor
2007-07-25 01:31 --------- d-------- C:\DOCUME~1\JAMES~1.JAM\APPLIC~1\Samsung
2007-07-25 01:28 --------- d--h----- C:\Program Files\InstallShield Installation Information
2007-07-19 21:03 166 --a------ C:\Program Files\quqwc^ql.txt
2007-07-19 21:03 16 --a------ C:\chdir.bat
2007-06-26 07:08 1104896 --a------ C:\WINDOWS\SYSTEM32\msxml3.dll
2007-06-26 05:13 305447 --a------ C:\WINDOWS\SYSTEM32\viwc.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"btbb_wcm_McciTrayApp"="C:\Program Files\btbb_wcm\McciTrayApp.exe" [2005-12-29 12:22]
"YBrowser"="C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe" [2006-07-21 17:19]
"Motive SmartBridge"="C:\PROGRA~1\BTHOME~1\Help\SMARTB~1\BTHelpNotifier.exe" [2006-02-06 18:52]
"NWEReboot"="" []
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40]
"SoundMan"="soundman.exe" [2001-05-30 04:02 C:\WINDOWS\soundman.exe]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-09-14 12:59]
"PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2007-08-07 01:05]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-06-01 16:51]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 11:06]
"TrojanScanner"="C:\Program Files\Trojan Remover\Trjscan.exe" [2007-09-12 00:58]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe" [2005-08-31 17:11]
"eyeBeam SIP Client"="C:\Program Files\BT Broadband Talk Softphone\BTSoftphone.exe" [2006-07-31 20:00]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-06-01 14:32]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56]
"LClock"="C:\Program Files\LClock\LClock.exe" [2004-09-20 01:27]
"Vista Sidebar"="C:\Program Files\Vista Sidebar\sidebar.exe" [2007-06-21 17:04]
"ViStart"="C:\Program Files\ViStart\ViStart.exe" [2007-06-21 23:41]
"VisualTooltip"="C:\Program Files\VisualTooltip\VisualToolTip.exe" [2006-12-27 10:07]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2007-01-30 06:21]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-06-21 14:06]
"BitTorrent"="C:\Program Files\BitTorrent\bittorrent.exe" [2007-03-02 00:11]

C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\Programs\Startup\
BT Broadband Desktop Help.lnk - C:\Program Files\BT Home Hub\Help\bin\matcli.exe [2007-05-28 16:20:35]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

S3 rtport;rtport;\??\C:\WINDOWS\system32\drivers\rtport.sys
S3 ss_bus;Samsung Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\system32\DRIVERS\ss_bus.sys
S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys
S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\system32\DRIVERS\ss_mdm.sys
S3 sscdbus;SAMSUNG USB Composite Device driver (WDM);C:\WINDOWS\system32\DRIVERS\sscdbus.sys
S3 sscdmdfl;SAMSUNG CDMA Modem Filter;C:\WINDOWS\system32\DRIVERS\sscdmdfl.sys
S3 sscdmdm;SAMSUNG CDMA Modem Drivers;C:\WINDOWS\system32\DRIVERS\sscdmdm.sys


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{34A19196-274E-4D75-9D30-D7A45A0A4178}]
"C:\Program Files\Windows Sidebar\.\regsvr32.exe" /s wlsrvc.dll

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6B9228DA-9C15-419e-856C-19E768A13BDC}]
"C:\Program Files\Windows Sidebar\.\regsvr32.exe" /s sbdrop.dll

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D58F39FF-953E-4F45-898F-59F243B9A523}]
C:\WINDOWS\system32\hidec /W "C:\Program Files\VAIOXP\Tools\regtlib.exe" "C:\Program Files\Windows Sidebar\sidebar.exe"
.
Contents of the 'Scheduled Tasks' folder
"2007-09-20 12:59:07 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-09-25 23:00:00 C:\WINDOWS\Tasks\At1.job"
- C:\WINDOWS\system32\qaJ2pdww.exe
"2007-06-08 23:46:27 C:\WINDOWS\Tasks\At10.job"
- C:\WINDOWS\system32\qaJ2pdww.exe
"2007-06-08 23:46:27 C:\WINDOWS\Tasks\At11.job"
- C:\WINDOWS\system32\qaJ2pdww.exe
"2007-09-12 10:00:00 C:\WINDOWS\Tasks\At12.job"
- C:\WINDOWS\system32\qaJ2pdww.exe
"2007-09-15 11:00:00 C:\WINDOWS\Tasks\At13.job"
- C:\WINDOWS\system32\qaJ2pdww.exe
"2007-09-24 12:00:00 C:\WINDOWS\Tasks\At14.job"
- C:\WINDOWS\system32\qaJ2pdww.exe
"2007-09-25 13:00:00 C:\WINDOWS\Tasks\At15.job"
- C:\WINDOWS\system32\qaJ2pdww.exe
"2007-09-25 14:00:00 C:\WINDOWS\Tasks\At16.job"
- C:\WINDOWS\system32\qaJ2pdww.exe
"2007-09-25 15:00:00 C:\WINDOWS\Tasks\At17.job"
"2007-09-25 16:00:00 C:\WINDOWS\Tasks\At18.job"
- C:\WINDOWS\system32\qaJ2pdww.exe
"2007-09-25 17:00:00 C:\WINDOWS\Tasks\At19.job"
- C:\WINDOWS\system32\qaJ2pdww.exe
"2007-09-25 00:00:00 C:\WINDOWS\Tasks\At2.job"
- C:\WINDOWS\system32\qaJ2pdww.exe
"2007-09-25 18:00:00 C:\WINDOWS\Tasks\At20.job"
- C:\WINDOWS\system32\qaJ2pdww.exe
"2007-09-25 18:59:59 C:\WINDOWS\Tasks\At21.job"
- C:\WINDOWS\system32\qaJ2pdww.exe
"2007-09-25 20:00:00 C:\WINDOWS\Tasks\At22.job"
- C:\WINDOWS\system32\qaJ2pdww.exe
"2007-09-25 21:00:00 C:\WINDOWS\Tasks\At23.job"
"2007-09-25 22:00:00 C:\WINDOWS\Tasks\At24.job"
"2007-09-24 01:00:00 C:\WINDOWS\Tasks\At3.job"
- C:\WINDOWS\system32\qaJ2pdww.exe
"2007-09-24 02:00:00 C:\WINDOWS\Tasks\At4.job"
- C:\WINDOWS\system32\qaJ2pdww.exe
"2007-09-03 03:00:00 C:\WINDOWS\Tasks\At5.job"
- C:\WINDOWS\system32\qaJ2pdww.exe
"2007-06-08 23:46:27 C:\WINDOWS\Tasks\At6.job"
- C:\WINDOWS\system32\qaJ2pdww.exe
"2007-06-08 23:46:27 C:\WINDOWS\Tasks\At7.job"
- C:\WINDOWS\system32\qaJ2pdww.exe
"2007-06-08 23:46:27 C:\WINDOWS\Tasks\At8.job"
- C:\WINDOWS\system32\qaJ2pdww.exe
"2007-06-08 23:46:27 C:\WINDOWS\Tasks\At9.job"
- C:\WINDOWS\system32\qaJ2pdww.exe
"2007-09-25 00:04:06 C:\WINDOWS\Tasks\User_Feed_Synchronization-{B4F66692-B8BE-47E4-BD45-3D1BAFDBA7DB}.job"
- C:\WINDOWS\system32\msfeedssync.exe
.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-26 00:17:52
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-09-26 0:19:42
C:\ComboFix-quarantined-files.txt ... 2007-09-26 00:19
C:\ComboFix2.txt ... 2007-09-23 23:25
C:\ComboFix3.txt ... 2007-05-25 18:42
.
--- E O F ---

#12 rookie147

rookie147

  • Members
  • 5,321 posts
  • OFFLINE
  •  
  • Local time:09:04 AM

Posted 26 September 2007 - 10:54 AM

Hi there,
I'd like you to run Killbox one more time for me, this time deleting the following files instead:

C:\WINDOWS\SYSTEM32\etlwonjw.dll
C:\WINDOWS\SYSTEM32\rzpsottz.dll
C:\WINDOWS\SYSTEM32\libssl32.dll
C:\WINDOWS\SYSTEM32\kszqxorg.dll
C:\WINDOWS\SYSTEM32\tvdjnrye.dll
C:\WINDOWS\system32\qaJ2pdww.exe


Please follow my last set of instructions if you are not confident doing this.

Copy and paste the following text into Notepad:
@echo off
del C:\WINDOWS\Tasks\At*.job
exit
Save this as "jobs.bat". Choose to save as *all files and place it on your Desktop.
Double-click jobs.bat.

Then, after another reboot, I'd like one final Combofix log, along with some information about how things seem to be running now.
Thanks,
Charles

EDIT: Typos

Edited by rookie147, 26 September 2007 - 10:55 AM.

If you are pleased with the service I have offered, you may like to consider making a donation. Posted Image
Posted Image


#13 jclfc

jclfc
  • Topic Starter

  • Members
  • 71 posts
  • OFFLINE
  •  
  • Local time:08:04 AM

Posted 26 September 2007 - 05:13 PM

Hi Charles, having followed your instructions the problems with devmgrn.dll and Search-Daily appear to have gone and, on the surface of it, the system is running well without any apparent problems however I await your verdict on that.

Here is the log -

ComboFix 07-09-21.2 - "James" 2007-09-26 23:07:50.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.377 [GMT 1:00]
.

((((((((((((((((((((((((( Files Created from 2007-08-26 to 2007-09-26 )))))))))))))))))))))))))))))))
.

2007-09-23 23:14 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-09-21 18:27 <DIR> d-------- C:\Program Files\3ivx
2007-09-18 19:17 <DIR> d-------- C:\Program Files\AC3Filter
2007-09-18 02:23 <DIR> d-------- C:\WINDOWS\BDOSCAN8
2007-09-18 01:39 <DIR> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\SUPERAntiSpyware.com
2007-09-18 01:38 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2007-09-18 01:38 <DIR> d-------- C:\DOCUME~1\JAMES~1.JAM\APPLIC~1\SUPERAntiSpyware.com
2007-09-12 01:00 <DIR> d-a------ C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\TEMP
2007-09-12 00:57 77,312 --a------ C:\WINDOWS\SYSTEM32\ztvunace26.dll
2007-09-12 00:57 75,264 --a------ C:\WINDOWS\SYSTEM32\unacev2.dll
2007-09-12 00:57 69,632 --a------ C:\WINDOWS\SYSTEM32\ztvcabinet.dll
2007-09-12 00:57 162,304 --a------ C:\WINDOWS\SYSTEM32\ztvunrar36.dll
2007-09-12 00:57 153,088 --a------ C:\WINDOWS\SYSTEM32\UNRAR3.dll
2007-09-12 00:57 <DIR> d-------- C:\Program Files\Trojan Remover
2007-09-12 00:57 <DIR> d-------- C:\DOCUME~1\JAMES~1.JAM\APPLIC~1\Simply Super Software
2007-09-12 00:57 <DIR> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Simply Super Software
2007-09-11 15:53 <DIR> d-------- C:\Program Files\BHODemon 2
2007-09-10 19:41 95,608 --a------ C:\WINDOWS\SYSTEM32\AvastSS.scr
2007-09-10 19:41 94,416 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\aswmon2.sys
2007-09-10 19:41 92,848 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\aswmon.sys
2007-09-10 19:41 42,912 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\aswTdi.sys
2007-09-10 19:41 26,624 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\aavmker4.sys
2007-09-10 19:41 23,152 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\aswRdr.sys
2007-09-10 19:40 801,144 --a------ C:\WINDOWS\SYSTEM32\aswBoot.exe
2007-09-10 19:40 1,060,864 --a------ C:\WINDOWS\SYSTEM32\MFC71.dll
2007-09-10 18:02 <DIR> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Lavasoft
2007-09-10 14:01 30,697,041 --------- C:\avg7qt.dat
2007-09-08 16:47 2,800 --a------ C:\WINDOWS\SYSTEM32\tmp.reg
2007-09-08 16:46 53,248 --a------ C:\WINDOWS\SYSTEM32\Process.exe
2007-09-08 16:46 51,200 --a------ C:\WINDOWS\SYSTEM32\dumphive.exe
2007-09-08 16:46 289,144 --a------ C:\WINDOWS\SYSTEM32\VCCLSID.exe
2007-09-08 16:46 288,417 --a------ C:\WINDOWS\SYSTEM32\SrchSTS.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2020-05-20 18:40 --------- d-------- C:\Program Files\DirectX
2020-05-20 18:39 266 ---hs---- C:\Program Files\desktop.ini
2020-05-20 18:39 11079 --ah----- C:\Program Files\folder.htt
2007-09-26 23:05 --------- d-------- C:\Program Files\ViStart
2007-09-25 17:52 --------- d-------- C:\Program Files\Yahoo!
2007-09-20 17:08 --------- d-------- C:\Program Files\Common Files\Elecard
2007-09-20 01:28 --------- d-------- C:\Program Files\AnMing
2007-09-18 01:37 --------- d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-09-13 12:06 --------- d-------- C:\DOCUME~1\JAMES~1.JAM\APPLIC~1\BitTorrent
2007-09-10 18:02 --------- d-------- C:\Program Files\Lavasoft
2007-09-04 13:46 359808 --a------ C:\WINDOWS\system32\drivers\tcpip.sys
2007-08-18 00:18 --------- d-------- C:\DOCUME~1\JAMES~1.JAM\APPLIC~1\DNA
2007-08-17 13:24 --------- d-------- C:\Program Files\MSXML 6.0
2007-08-16 19:05 --------- d-------- C:\Program Files\Windows Sidebar
2007-08-16 00:34 --------- d-------- C:\Program Files\VAIOXP
2007-08-15 14:33 --------- d-------- C:\Program Files\Vista Sidebar
2007-08-15 14:19 --------- d-------- C:\Program Files\SystemRequirementsLab
2007-08-15 01:35 --------- d-------- C:\DOCUME~1\JAMES~1.JAM\APPLIC~1\ViStart
2007-08-15 01:28 --------- d-------- C:\Program Files\VisualTooltip
2007-08-15 01:28 --------- d-------- C:\Program Files\ViOrb
2007-08-15 01:28 --------- d-------- C:\Program Files\Styler
2007-08-15 01:28 --------- d-------- C:\Program Files\MSN Messenger
2007-08-15 01:27 --------- d-------- C:\Program Files\LClock
2007-08-14 23:23 --------- d-------- C:\Program Files\PeerGuardian2
2007-08-14 02:12 --------- d-------- C:\Program Files\PowerISO
2007-08-14 02:04 --------- d-------- C:\Program Files\Microsoft Visual Studio 8
2007-08-14 02:04 --------- d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Microsoft Help
2007-08-14 02:03 --------- d-------- C:\Program Files\Microsoft Expression
2007-08-14 01:01 --------- d-------- C:\Program Files\vso
2007-08-14 01:01 --------- d-------- C:\DOCUME~1\JAMES~1.JAM\APPLIC~1\Vso
2007-08-14 00:56 94208 --a------ C:\WINDOWS\system32\drivers\ezplay.sys
2007-08-14 00:56 94208 --a------ C:\DOCUME~1\JAMES~1.JAM\APPLIC~1\ezplay.sys
2007-08-14 00:55 47360 --a------ C:\WINDOWS\system32\drivers\pcouffin.sys
2007-08-14 00:55 47360 --a------ C:\DOCUME~1\JAMES~1.JAM\APPLIC~1\pcouffin.sys
2007-08-13 03:48 --------- d-------- C:\Program Files\Microsoft Works
2007-08-13 03:47 --------- d-------- C:\Program Files\MSBuild
2007-08-12 23:13 --------- d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Google
2007-08-09 00:56 --------- d-------- C:\Program Files\Elecard
2007-08-08 23:09 --------- d-------- C:\Program Files\Evil Msn
2007-08-08 23:06 --------- d-------- C:\DOCUME~1\JAMES~1.JAM\APPLIC~1\Google
2007-08-08 22:52 --------- d-------- C:\Program Files\Google
2007-08-08 21:19 --------- d-------- C:\Program Files\Windows Media Connect 2
2007-08-08 19:43 --------- d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\WinZip
2007-08-07 15:26 --------- d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\AVS4YOU
2007-08-07 15:25 --------- d-------- C:\Program Files\Common Files\AVSMedia
2007-08-07 15:25 --------- d-------- C:\Program Files\AVSMedia
2007-08-07 15:07 --------- d-------- C:\Program Files\Common Files\Download Manager
2007-08-07 14:47 --------- d-------- C:\DOCUME~1\JAMES~1.JAM\APPLIC~1\CopyToDvd
2007-08-07 14:21 --------- d-------- C:\DOCUME~1\JAMES~1.JAM\APPLIC~1\Ahead
2007-08-07 02:52 66272 --a------ C:\WINDOWS\SYSTEM32\libfaac.dll
2007-08-07 02:52 443104 --a------ C:\WINDOWS\SYSTEM32\OpenQuicktimeLib.dll
2007-08-07 02:52 25312 --a------ C:\WINDOWS\SYSTEM32\SamsungVfWCodec.dll
2007-08-07 02:52 25312 --a------ C:\WINDOWS\SYSTEM32\DivXVfWCodec.dll
2007-08-07 02:51 324320 --a------ C:\WINDOWS\SYSTEM32\3ivxVfWCodec.dll
2007-08-07 02:51 1139488 --a------ C:\WINDOWS\SYSTEM32\3ivx.dll
2007-08-07 01:15 33052 --a------ C:\WINDOWS\system32\drivers\scdemu.sys
2007-08-07 00:11 --------- d-------- C:\Program Files\ffdshow
2007-08-04 20:24 7680 --a------ C:\WINDOWS\SYSTEM32\ff_vfw.dll
2007-08-02 23:48 --------- d-------- C:\Program Files\AvRack
2007-08-02 00:40 --------- d-------- C:\DOCUME~1\JAMES~1.JAM\APPLIC~1\Real
2007-08-01 23:14 --------- d-------- C:\Program Files\Real Alternative
2007-08-01 23:14 --------- d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Real
2007-07-31 18:33 60273 --a------ C:\WINDOWS\SYSTEM32\pthreadGC2.dll
2007-07-31 15:02 --------- d-------- C:\DOCUME~1\JAMES~1.JAM\APPLIC~1\Help
2007-07-30 19:19 92504 --a------ C:\WINDOWS\SYSTEM32\cdm.dll
2007-07-30 19:19 549720 --a------ C:\WINDOWS\SYSTEM32\wuapi.dll
2007-07-30 19:19 53080 --a------ C:\WINDOWS\SYSTEM32\wuauclt.exe
2007-07-30 19:19 43352 --a------ C:\WINDOWS\SYSTEM32\wups2.dll
2007-07-30 19:19 325976 --a------ C:\WINDOWS\SYSTEM32\wucltui.dll
2007-07-30 19:19 203096 --a------ C:\WINDOWS\SYSTEM32\wuweb.dll
2007-07-30 19:19 1712984 --a------ C:\WINDOWS\SYSTEM32\wuaueng.dll
2007-07-30 19:18 33624 --a------ C:\WINDOWS\SYSTEM32\wups.dll
2007-07-30 00:37 --------- d-------- C:\Program Files\7-Zip
2007-07-27 18:41 --------- d-------- C:\Program Files\MP3 Wav Editor
2007-07-19 21:03 166 --a------ C:\Program Files\quqwc^ql.txt
2007-07-19 21:03 16 --a------ C:\chdir.bat
2007-06-26 07:08 1104896 --a------ C:\WINDOWS\SYSTEM32\msxml3.dll
2007-06-26 05:13 305447 --a------ C:\WINDOWS\SYSTEM32\viwc.exe
.

((((((((((((((((((((((((((((( snapshot_2007-09-23_232448.56 )))))))))))))))))))))))))))))))))))))))))
.
----atw 16,384 2007-09-26 21:59:24 C:\WINDOWS\TEMP\Perflib_Perfdata_58c.dat
.
----atw 16,384 2007-09-23 22:22:19 C:\WINDOWS\TEMP\Perflib_Perfdata_58c.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"btbb_wcm_McciTrayApp"="C:\Program Files\btbb_wcm\McciTrayApp.exe" [2005-12-29 12:22]
"YBrowser"="C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe" [2006-07-21 17:19]
"Motive SmartBridge"="C:\PROGRA~1\BTHOME~1\Help\SMARTB~1\BTHelpNotifier.exe" [2006-02-06 18:52]
"NWEReboot"="" []
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40]
"SoundMan"="soundman.exe" [2001-05-30 04:02 C:\WINDOWS\soundman.exe]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-09-14 12:59]
"PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2007-08-07 01:05]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-06-01 16:51]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 11:06]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe" [2005-08-31 17:11]
"eyeBeam SIP Client"="C:\Program Files\BT Broadband Talk Softphone\BTSoftphone.exe" [2006-07-31 20:00]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-06-01 14:32]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56]
"LClock"="C:\Program Files\LClock\LClock.exe" [2004-09-20 01:27]
"Vista Sidebar"="C:\Program Files\Vista Sidebar\sidebar.exe" [2007-06-21 17:04]
"ViStart"="C:\Program Files\ViStart\ViStart.exe" [2007-06-21 23:41]
"VisualTooltip"="C:\Program Files\VisualTooltip\VisualToolTip.exe" [2006-12-27 10:07]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2007-01-30 06:21]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-06-21 14:06]
"BitTorrent"="C:\Program Files\BitTorrent\bittorrent.exe" [2007-03-02 00:11]

C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\Programs\Startup\
BT Broadband Desktop Help.lnk - C:\Program Files\BT Home Hub\Help\bin\matcli.exe [2007-05-28 16:20:35]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

S3 rtport;rtport;\??\C:\WINDOWS\system32\drivers\rtport.sys
S3 ss_bus;Samsung Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\system32\DRIVERS\ss_bus.sys
S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys
S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\system32\DRIVERS\ss_mdm.sys
S3 sscdbus;SAMSUNG USB Composite Device driver (WDM);C:\WINDOWS\system32\DRIVERS\sscdbus.sys
S3 sscdmdfl;SAMSUNG CDMA Modem Filter;C:\WINDOWS\system32\DRIVERS\sscdmdfl.sys
S3 sscdmdm;SAMSUNG CDMA Modem Drivers;C:\WINDOWS\system32\DRIVERS\sscdmdm.sys


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{34A19196-274E-4D75-9D30-D7A45A0A4178}]
"C:\Program Files\Windows Sidebar\.\regsvr32.exe" /s wlsrvc.dll

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6B9228DA-9C15-419e-856C-19E768A13BDC}]
"C:\Program Files\Windows Sidebar\.\regsvr32.exe" /s sbdrop.dll

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D58F39FF-953E-4F45-898F-59F243B9A523}]
C:\WINDOWS\system32\hidec /W "C:\Program Files\VAIOXP\Tools\regtlib.exe" "C:\Program Files\Windows Sidebar\sidebar.exe"
.
Contents of the 'Scheduled Tasks' folder
"2007-09-20 12:59:07 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-09-26 07:35:18 C:\WINDOWS\Tasks\User_Feed_Synchronization-{B4F66692-B8BE-47E4-BD45-3D1BAFDBA7DB}.job"
.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-26 23:10:37
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-09-26 23:12:10
C:\ComboFix-quarantined-files.txt ... 2007-09-26 23:11
C:\ComboFix2.txt ... 2007-09-26 00:19
C:\ComboFix3.txt ... 2007-09-23 23:25
.
--- E O F ---

#14 rookie147

rookie147

  • Members
  • 5,321 posts
  • OFFLINE
  •  
  • Local time:09:04 AM

Posted 27 September 2007 - 03:44 PM

I'd like one more scan just to make sure that nothing is still hiding from us.
Please do an online scan with Kaspersky WebScanner
You will be promted to install an ActiveX component from Kaspersky, Click Yes.
The program will launch and then begin downloading the latest definition files:
Once the files have been downloaded click on Next
Select a target to scan; click on My Computer
The scan will take a while so be patient and let it run.
Once the scan is complete choose the option to Save as Text
Post these results in your next reply.

If you are pleased with the service I have offered, you may like to consider making a donation. Posted Image
Posted Image


#15 jclfc

jclfc
  • Topic Starter

  • Members
  • 71 posts
  • OFFLINE
  •  
  • Local time:08:04 AM

Posted 30 September 2007 - 06:20 PM

Here you go Charles -

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Monday, October 01, 2007 12:19:41 AM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.93.1
Kaspersky Anti-Virus database last update: 30/09/2007
Kaspersky Anti-Virus database records: 425639
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\

Scan Statistics:
Total number of scanned objects: 94569
Number of viruses found: 19
Number of infected objects: 60
Number of suspicious objects: 0
Duration of the scan process: 05:13:20

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users.WINDOWS\Application Data\avg7\Log\emc.log Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\James\.housecall6.6\Quarantine\!update-4395[1].0000.bac_a02892 Infected: Trojan-Downloader.Win32.PurityScan.dx skipped
C:\Documents and Settings\James\.housecall6.6\Quarantine\!update.exe.bac_a02892 Infected: Trojan-Downloader.Win32.PurityScan.dx skipped
C:\Documents and Settings\James\.housecall6.6\Quarantine\A0000334.dll.bac_a02892 Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\James\.housecall6.6\Quarantine\A0000337.exe.bac_a02892 Infected: Trojan-Downloader.Win32.PurityScan.eg skipped
C:\Documents and Settings\James\.housecall6.6\Quarantine\A0000339.exe.bac_a02892 Infected: not-a-virus:AdWare.Win32.PurityScan.fn skipped
C:\Documents and Settings\James\.housecall6.6\Quarantine\A0000350.DLL.bac_a02892 Infected: not-a-virus:AdWare.Win32.PurityScan.ak skipped
C:\Documents and Settings\James\.housecall6.6\Quarantine\A0000419.exe.bac_a02892 Infected: Trojan-Downloader.Win32.Alphabet.gen skipped
C:\Documents and Settings\James\.housecall6.6\Quarantine\antzom[1].exe.bac_a02892 Infected: Trojan.Win32.Agent.qt skipped
C:\Documents and Settings\James\.housecall6.6\Quarantine\drvrew.dll.bac_a02892 Infected: Trojan.Win32.Agent.qt skipped
C:\Documents and Settings\James\.housecall6.6\Quarantine\inlw.exe.bac_a02892 Infected: Trojan-Clicker.Win32.Agent.is skipped
C:\Documents and Settings\James\.housecall6.6\Quarantine\keyfinder.exe.bac_a02892/data.rar/officekey.exe Infected: not-a-virus:PSWTool.Win32.RAS.a skipped
C:\Documents and Settings\James\.housecall6.6\Quarantine\keyfinder.exe.bac_a02892/data.rar Infected: not-a-virus:PSWTool.Win32.RAS.a skipped
C:\Documents and Settings\James\.housecall6.6\Quarantine\keyfinder.exe.bac_a02892 RarSFX: infected - 2 skipped
C:\Documents and Settings\James\.housecall6.6\Quarantine\keyfinder.exe.bac_a02892 CryptFF.b: infected - 2 skipped
C:\Documents and Settings\James\.housecall6.6\Quarantine\ma1x1dd1.game.bac_a02892 Infected: not-a-virus:Porn-Dialer.Win32.GBDialer.i skipped
C:\Documents and Settings\James\.housecall6.6\Quarantine\max1d1641.exe.bac_a02892 Infected: not-a-virus:Porn-Dialer.Win32.GBDialer.i skipped
C:\Documents and Settings\James\.housecall6.6\Quarantine\max1d1641.exe~.bac_a02892 Infected: not-a-virus:Porn-Dialer.Win32.GBDialer.i skipped
C:\Documents and Settings\James\.housecall6.6\Quarantine\mgvrprgl.exe.bac_a02892 Infected: Trojan-Downloader.Win32.Small.cwj skipped
C:\Documents and Settings\James\.housecall6.6\Quarantine\mst1BE.tmp.bac_a02892 Infected: Trojan.Win32.Agent.qt skipped
C:\Documents and Settings\James\.housecall6.6\Quarantine\mst5C.tmp.bac_a02892 Infected: Trojan.Win32.Agent.qt skipped
C:\Documents and Settings\James\.housecall6.6\Quarantine\sfksiesoy[1].htm.bac_a02892 Infected: Trojan-Clicker.Win32.Costrat.at skipped
C:\Documents and Settings\James\.housecall6.6\Quarantine\smanager.7.exe~.bac_a02892 Infected: Trojan-Downloader.Win32.Alphabet.gen skipped
C:\Documents and Settings\James\.housecall6.6\Quarantine\tcpipmon.exe.bac_a02892 Infected: Trojan-Clicker.Win32.Agent.is skipped
C:\Documents and Settings\James\.housecall6.6\Quarantine\VirtualDNS.dll.bac_a02892 Infected: not-a-virus:AdWare.Win32.Webdir.b skipped
C:\Documents and Settings\James\.housecall6.6\Quarantine\vwjrmrmur[1].htm.bac_a02892 Infected: Trojan-Clicker.Win32.Agent.is skipped
C:\Documents and Settings\James\.housecall6.6\Quarantine\vzlodg.dll.bac_a02892 Infected: not-a-virus:AdWare.Win32.PurityScan.ak skipped
C:\Documents and Settings\James\.housecall6.6\Quarantine\win1B3.tmp.exe.bac_a02892 Infected: Trojan.Win32.Agent.qt skipped
C:\Documents and Settings\James\.housecall6.6\Quarantine\win1BF.tmp.exe.bac_a02892 Infected: Trojan-Spy.Win32.Agent.or skipped
C:\Documents and Settings\James\.housecall6.6\Quarantine\win1C3.tmp.exe.bac_a02892/data0002 Infected: Trojan-Downloader.Win32.PurityScan.eg skipped
C:\Documents and Settings\James\.housecall6.6\Quarantine\win1C3.tmp.exe.bac_a02892 NSIS: infected - 1 skipped
C:\Documents and Settings\James\.housecall6.6\Quarantine\win1C3.tmp.exe.bac_a02892 CryptFF.b: infected - 1 skipped
C:\Documents and Settings\James\.housecall6.6\Quarantine\win52.tmp.exe.bac_a02892 Infected: Trojan-Downloader.Win32.Alphabet.gen skipped
C:\Documents and Settings\James\.housecall6.6\Quarantine\win56.tmp.exe.bac_a02892 Infected: Trojan.Win32.Agent.qt skipped
C:\Documents and Settings\James\.housecall6.6\Quarantine\win5D.tmp.exe.bac_a02892 Infected: Trojan-Spy.Win32.Agent.or skipped
C:\Documents and Settings\James\.housecall6.6\Quarantine\win61.tmp.exe.bac_a02892/data0002 Infected: Trojan-Downloader.Win32.PurityScan.eg skipped
C:\Documents and Settings\James\.housecall6.6\Quarantine\win61.tmp.exe.bac_a02892 NSIS: infected - 1 skipped
C:\Documents and Settings\James\.housecall6.6\Quarantine\win61.tmp.exe.bac_a02892 CryptFF.b: infected - 1 skipped
C:\Documents and Settings\James\.housecall6.6\Quarantine\xc23[1].exe.bac_a02892 Infected: Trojan-Downloader.Win32.Alphabet.gen skipped
C:\Documents and Settings\James\.housecall6.6\Quarantine\xc29[1].exe.bac_a02892 Infected: Trojan.Win32.Agent.qt skipped
C:\Documents and Settings\James\.housecall6.6\Quarantine\xc36[1].exe.bac_a02892 Infected: Trojan-Spy.Win32.Agent.or skipped
C:\Documents and Settings\James\.housecall6.6\Quarantine\xc42[1].exe.bac_a02892/data0002 Infected: Trojan-Downloader.Win32.PurityScan.eg skipped
C:\Documents and Settings\James\.housecall6.6\Quarantine\xc42[1].exe.bac_a02892 NSIS: infected - 1 skipped
C:\Documents and Settings\James\.housecall6.6\Quarantine\xc42[1].exe.bac_a02892 CryptFF.b: infected - 1 skipped
C:\Documents and Settings\James\.housecall6.6\Quarantine\xc60[1].exe.bac_a02892 Infected: Trojan.Win32.Agent.qt skipped
C:\Documents and Settings\James\.housecall6.6\Quarantine\xkpgojx[1].htm.bac_a02892 Infected: Trojan-Downloader.Win32.Small.cwj skipped
C:\Documents and Settings\James\Desktop\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\James\Desktop\SmitfraudFix.exe/data.rar/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\James\Desktop\SmitfraudFix.exe/data.rar Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\James\Desktop\SmitfraudFix.exe RarSFX: infected - 2 skipped
C:\Documents and Settings\James.JAMES-HL17SMTOP\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SUPERANTISPYWARE.LOG Object is locked skipped
C:\Documents and Settings\James.JAMES-HL17SMTOP\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\James.JAMES-HL17SMTOP\Desktop\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\James.JAMES-HL17SMTOP\Desktop\Spyware\backups\backup-20070919-010953-183.dll Object is locked skipped
C:\Documents and Settings\James.JAMES-HL17SMTOP\Desktop\Vista Transformation Pack 7.0.exe/WISE0030.BIN Infected: not-a-virus:RiskTool.Win32.PsKill.e skipped
C:\Documents and Settings\James.JAMES-HL17SMTOP\Desktop\Vista Transformation Pack 7.0.exe WiseSFX: infected - 1 skipped
C:\Documents and Settings\James.JAMES-HL17SMTOP\Desktop\vtp7.zip/Vista Transformation Pack 7.0.exe/WISE0030.BIN Infected: not-a-virus:RiskTool.Win32.PsKill.e skipped
C:\Documents and Settings\James.JAMES-HL17SMTOP\Desktop\vtp7.zip/Vista Transformation Pack 7.0.exe Infected: not-a-virus:RiskTool.Win32.PsKill.e skipped
C:\Documents and Settings\James.JAMES-HL17SMTOP\Desktop\vtp7.zip ZIP: infected - 2 skipped
C:\Documents and Settings\James.JAMES-HL17SMTOP\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped
C:\Documents and Settings\James.JAMES-HL17SMTOP\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\James.JAMES-HL17SMTOP\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\James.JAMES-HL17SMTOP\Local Settings\Application Data\Microsoft\Windows Sidebar\Settings.ini Object is locked skipped
C:\Documents and Settings\James.JAMES-HL17SMTOP\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\James.JAMES-HL17SMTOP\Local Settings\History\History.IE5\MSHist012007093020071001\index.dat Object is locked skipped
C:\Documents and Settings\James.JAMES-HL17SMTOP\Local Settings\Temp\bbassistant.log Object is locked skipped
C:\Documents and Settings\James.JAMES-HL17SMTOP\Local Settings\Temp\~DF9782.tmp Object is locked skipped
C:\Documents and Settings\James.JAMES-HL17SMTOP\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\James.JAMES-HL17SMTOP\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\James.JAMES-HL17SMTOP\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Temp\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Temp\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService.NT AUTHORITY\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService.NT AUTHORITY\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService.NT AUTHORITY\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService.NT AUTHORITY\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService.NT AUTHORITY\ntuser.dat.LOG Object is locked skipped
C:\FOUND.001\FILE0000.CHK Infected: Trojan-Downloader.JS.Psyme.hy skipped
C:\FOUND.001\FILE0001.CHK Infected: Trojan-Downloader.JS.Psyme.jf skipped
C:\FOUND.001\FILE0019.CHK Infected: Exploit.HTML.IESlice.l skipped
C:\Program Files\Alwil Software\Avast4\DATA\aswResp.dat Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\Avast4.db Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\log\AshWebSv.ws Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\log\aswMaiSv.log Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\log\nshield.log Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\report\Resident protection.txt Object is locked skipped
C:\Program Files\BT Home Hub\Help\SmartBridge\AlertFilter.log Object is locked skipped
C:\Program Files\BT Home Hub\Help\SmartBridge\log\httpclient.log Object is locked skipped
C:\Program Files\BT Home Hub\Help\SmartBridge\SBExtHost.log Object is locked skipped
C:\Program Files\BT Home Hub\Help\SmartBridge\SmartBridge.log Object is locked skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\pskill.exe.vir Infected: not-a-virus:RiskTool.Win32.PsKill.e skipped
C:\System Volume Information\_restore{601182F9-6305-4DAC-BE44-C78682917CD1}\RP13\A0002861.exe Infected: not-a-virus:RiskTool.Win32.PsKill.e skipped
C:\System Volume Information\_restore{601182F9-6305-4DAC-BE44-C78682917CD1}\RP16\A0003136.dll Object is locked skipped
C:\System Volume Information\_restore{601182F9-6305-4DAC-BE44-C78682917CD1}\RP18\change.log Object is locked skipped
C:\System Volume Information\_restore{601182F9-6305-4DAC-BE44-C78682917CD1}\RP6\A0001374.dll Object is locked skipped
C:\System Volume Information\_restore{601182F9-6305-4DAC-BE44-C78682917CD1}\RP6\A0001387.dll Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\SYSTEM32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\SYSTEM32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\SYSTEM32\config\Antivirus.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\config\default Object is locked skipped
C:\WINDOWS\SYSTEM32\config\default.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\config\Internet.evt Object is locked skipped
C:\WINDOWS\SYSTEM32\config\ODiag.evt Object is locked skipped
C:\WINDOWS\SYSTEM32\config\OSession.evt Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SAM Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SECURITY Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\config\software Object is locked skipped
C:\WINDOWS\SYSTEM32\config\software.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\config\system Object is locked skipped
C:\WINDOWS\SYSTEM32\config\system.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\h323log.txt Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\TEMP\Perflib_Perfdata_584.dat Object is locked skipped
C:\WINDOWS\TEMP\_avast4_\Webshlock.txt Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users