Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Bkdr_ciadoor.ea , Virtumonde And Others


  • This topic is locked This topic is locked
21 replies to this topic

#1 **LYN**

**LYN**

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:03:35 AM

Posted 10 November 2007 - 03:46 AM

I hope you can help me.

My computer is running very sluggishly. It crashes frequently,particularly when I try to run scans. A couple of times I have had messages that there is insufficient virtual memory and Windows is allocating more.

After repeated attempts and restarts I have managed to d the following:

* download,install and run Adaware 2007. This removed several nasties and managed to stop the infuriating pop up fake Windows security messages, usually accompanied by an IE window opening with some "vital" download of anti-virus or spyware removal program. I was constantly closing windows.

* download,install and run Spybot S&D which found many infected files and removed them. On subsequent executions of this program VIRTUMONDE is a recurring villain.

* run Panda anti-virus which identified and disinfected over 20,000 problem files. This took several attempts to complete due to memory issues.

* run Housecall which identified the following:
* BKDR_CIADOOR.EA (1608 infections)
* HSTTP cookies - 4 detected
* ASP.NET path validation vulnerability
I can't be sure if any of these issues were resolved by housecall as the computer shut down again.

* download,install and run McAfee Stinger which told me the machine was clean.

* Installed Sygate Personal firewall. Unfortunately I have no idea what I should and shouldn't be giving access to so I am relying on common sense and guesswork.

* Today Symantec auto protect has identified the following problems
* Adware. Ezula (rebootrequired - quarantine) count 7 file name pochki20071106[1]
* downloader (partial) count 2 file name mosx1024[1]
* downloader (deleted) count 2 file name V1G0F+1~1
* downloader (deleted) count 2 file name V1G0F+1~1

* recent error message on start up "error loading c:windows/system32/yfdqgena.dll the specified module could not be found"

* Sygate Personal Firewall detected a hijacking attempt via Realplayer.

Application Hijacking has been detected
The application: C:\Program Files\Common Files\Real\Update_OB\realsched.exe try to launch another application: C:\Program Files\Real\RealPlayer\realplay.exe


I have since deleted the Realplayer program. The system is now running much faster.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:40:19 PM, on 10/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\S24EvMon.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\RegSrvc.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Battery miser\batterymiser.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\WINDOWS\system32\ElkCtrl.exe
C:\Program Files\IP Operator\IPOperator.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\WINDOWS\System32\svchost.exe
C:\Windows\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://mail.google.com/mail/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://pac.schools.nsw.edu.au/schools/ashcroft-p.pac
O3 - Toolbar: (no name) - {11A69AE4-FBED-4832-A2BF-45AF82825583} - (no file)
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [batterymiser] C:\Program Files\Battery miser\batterymiser.exe
O4 - HKLM\..\Run: [KeybdUtility] "C:\Program Files\On Screen Display\Hotkey.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechCameraService(E)] C:\WINDOWS\system32\ElkCtrl.exe /automation
O4 - HKLM\..\Run: [Host Process] C:\WINDOWS\Fonts\svchost.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [0c33614f] rundll32.exe "C:\WINDOWS\system32\yfdqgena.dll",b
O4 - HKLM\..\Run: [IPOperator] "C:\Program Files\IP Operator\IPOperator.exe" -aUtOsTaRtFrOmReG
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\RunOnce: [FFTI] C:\Documents and Settings\Lyn Walkerden\Application Data\Mozilla\Firefox\Profiles\unk0xsjt.default\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\ffti.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /DestPath="C:\Documents and Settings\Lyn Walkerden\Application Data\Mozilla\Firefox\Profiles/unk0xsjt.default\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}"
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://groups.msn.com/controls/PhotoUC/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1126924212568
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} - http://a532.g.akamai.net/f/532/6712/5m/vir...l/installer.exe
O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://www.babysfirstsite.com/members/XUpload.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{36FBFC76-AF04-4A7A-BFB1-BF242B2BB2DC}: NameServer = 203.0.178.191
O20 - AppInit_DLLs: C:\WINDOWS\system32\__c004FF0.dat
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

--
End of file - 9567 bytes

Thanks in advance,

Lyn

ETA Just noticed an additional problem, Internet Explorer will not connect to the internet. Keeps telling me I am offline. Firefox is working fine. I am not sure if I have blocked something I shouldn't have via SPF or maybe deleted something??

Edited by **LYN**, 10 November 2007 - 03:53 AM.


BC AdBot (Login to Remove)

 


m

#2 SifuMike

SifuMike

    malware expert


  • Staff Emeritus
  • 15,385 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Vancouver (not BC) WA (Not DC) USA
  • Local time:09:35 AM

Posted 11 November 2007 - 10:59 PM

Hello LYN,

Lets start by running ComobFix.

If you have used Combofix before, please delete the version you are having and redownload it again, because Combofix is being updated everyday.

Disconnect from the Internet while running ComboFix.

Temporarily disable any anti-virus and anti-malware real-time protection before performing a scan.
They can interfere with ComboFix or remove some of its embedded files which may cause unpredictable results.
Some scanners may see some combofix related components as suspicious and block or delete them while there's nothing wrong with them.



1. Download this file - combofix.exe to your Desktop.
Note:
It is important that it is saved directly to your desktop

2. Double click combofix.exe & follow the prompts.
3. When finished, it shall produce a log for you, C:\ComboFix.txt. Post the ComboFix log and a fresh Hijackthis log in your next reply.
Do NOT post the ComboFix-quarantined-files.txt - unless I ask you to.

Note:
Do not mouseclick combofix's window while it's running. That may cause it to stall
In case you see a sed.cfexe error with the option to send a report or not, choose "don't send".

If you have Norton Antivirus installed then disable script blocking so it will not interfere with the fix.

To disable Norton Script blocking Service:

* Disable the Script Blocking Service:
To open Services, click Start, point to Settings, and then click Control Panel.
Double-click Administrative Tools, and then double-click Services.
Find ScriptBlocking services, Right-click the service, and then click and then click Properties.
On the General tab, under Startup, click Disabled.
Under Service Status, click Stop button. Click Apply button.

* Disable the Script Blocking In Norton Settings:
Start Norton Antivirus.
Click Options. If a menu appears when you click Options, then click Norton Antivirus. The Norton Antivirus Options dialog box appears.
Click Script Blocking.
Uncheck Enable Script Blocking (recommended).
Click OK
You can reenable it afterwards when everything is clean again.


Trojan Hunter has been reported to detect combofix as Worm.Qiv.100.
If I've saved you time & money,
please make a donation so I can keep helping people just like you! You can donate using a credit card and PayPal. Thank you!



Posted Image

Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#3 **LYN**

**LYN**
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:03:35 AM

Posted 12 November 2007 - 04:02 AM

Sorry I deleted the post because I realised I made some errors. Back soon to post the logs you requested.

Edited by **LYN**, 12 November 2007 - 04:04 AM.


#4 **LYN**

**LYN**
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:03:35 AM

Posted 12 November 2007 - 05:47 AM

Thanks so much for helping me out. I am quite a novice so hopefully you can bear with me while I learn.

I hope this is OK. I forgot to disconnect the internet the 1st time I ran combofix so I had to do it all over again. Should I have uninstalled the program and downloaded it again?

Here are the logs.

ComboFix 07-11-08.1 - Lyn Walkerden 2007-11-12 21:17:58.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.84 [GMT 11:00]Running from: C:\Documents and Settings\Lyn Walkerden\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
C:\WINDOWS\system32\efefe.dll
C:\Windows\system32\efefe.ini

.
((((((((((((((((((((((((( Files Created from 2007-10-12 to 2007-11-12 )))))))))))))))))))))))))))))))
.

2007-11-12 16:54 51,200 --a------ C:\Windows\NirCmd.exe
2007-11-12 07:28 6,836 --a------ C:\Windows\system32\pljouhye.dll
2007-11-11 14:44 81,472 --a------ C:\Windows\system32\lewpxqbw.dll
2007-11-11 11:52 81,472 --a------ C:\Windows\system32\mcudggop.dll
2007-11-11 11:49 85,056 --a------ C:\Windows\system32\xbnejgqb.dll
2007-11-11 10:40 81,472 --a------ C:\Windows\system32\hugyfydx.dll
2007-11-11 09:40 81,472 --a------ C:\Windows\system32\tlpyiuyc.dll
2007-11-11 08:13 81,472 --a------ C:\Windows\system32\dehdgaua.dll
2007-11-10 20:13 81,472 --a------ C:\Windows\system32\ipbadnll.dll
2007-11-10 19:39 <DIR> d-------- C:\Program Files\Trend Micro
2007-11-10 09:30 88,128 --a------ C:\Windows\system32\hyyygwfd.dll
2007-11-10 09:28 77,888 --a------ C:\Windows\system32\thphrrwv.dll
2007-11-10 09:22 6,836 --a------ C:\Windows\system32\oxgsqvfq.dll
2007-11-09 15:40 <DIR> d-------- C:\Documents and Settings\NetworkService\Application Data\Talkback
2007-11-09 15:19 83,096 --a------ C:\Windows\system32\SSSensor.dll
2007-11-09 15:19 60,496 --a------ C:\Windows\system32\drivers\Teefer.sys
2007-11-09 15:19 21,075 --a------ C:\Windows\system32\drivers\wpsdrvnt.sys
2007-11-09 15:19 14,568 --a------ C:\Windows\system32\drivers\wg6n.sys
2007-11-09 15:19 14,568 --a------ C:\Windows\system32\drivers\wg5n.sys
2007-11-09 15:19 14,568 --a------ C:\Windows\system32\drivers\wg4n.sys
2007-11-09 15:19 14,568 --a------ C:\Windows\system32\drivers\wg3n.sys
2007-11-09 15:18 <DIR> d-------- C:\Program Files\Sygate
2007-11-08 19:30 <DIR> d-------- C:\Windows\system32\ActiveScan
2007-11-08 17:59 80,448 --a------ C:\Windows\system32\worwvgqh.dll
2007-11-08 17:57 102,664 --a------ C:\Windows\system32\drivers\tmcomm.sys
2007-11-08 17:56 <DIR> d-------- C:\Documents and Settings\Lyn Walkerden\.housecall6.6
2007-11-08 16:21 80,448 --a------ C:\Windows\system32\wsohikyb.dll
2007-11-08 16:13 35,328 --a------ C:\Windows\system32\opnopop.dll
2007-11-08 16:13 172 --a------ C:\6601.bat
2007-11-08 15:36 79,936 --a------ C:\Windows\system32\gdbmpxda.dll
2007-11-08 14:03 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-07 19:22 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-11-07 19:09 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-11-07 16:13 79,936 --a------ C:\Windows\system32\qemqoect.dll
2007-11-07 16:04 6,836 --a------ C:\Windows\system32\oqlxrner.dll
2007-11-07 16:01 145,984 --a------ C:\Windows\system32\bvnwnvkq.dll
2007-11-06 21:37 3,866 --a------ C:\Windows\system32\tmp.reg
2007-11-06 15:54 83,008 --a------ C:\Windows\system32\ojwbihjg.dll
2007-11-06 15:49 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Adobe Systems
2007-11-06 07:22 83,008 --a------ C:\Windows\system32\bwncmewk.dll
2007-11-06 07:09 35,328 --a------ C:\Windows\system32\mljifed.dll
2007-11-05 17:20 83,008 --a------ C:\Windows\system32\diavxbok.dll
2007-11-05 12:59 78,912 --a------ C:\Windows\system32\trdcagwh.dll
2007-11-05 12:57 <DIR> d-------- C:\Program Files\Enigma Software Group
2007-11-05 08:55 <DIR> d---s---- C:\Documents and Settings\Administrator\UserData
2007-11-05 08:20 35,328 --a------ C:\Windows\system32\khfeeec.dll
2007-11-04 09:11 81,472 --a------ C:\Windows\system32\xikoycmc.dll
2007-11-04 08:59 35,328 --a------ C:\Windows\system32\urqnlml.dll
2007-11-03 20:59 81,472 --a------ C:\Windows\system32\bhxqvysv.dll
2007-11-03 10:08 <DIR> d-------- C:\Windows\pss
2007-11-03 08:42 35,328 --a------ C:\Windows\system32\fcccbyy.dll
2007-11-02 17:49 <DIR> d--hs---- C:\found.000
2007-11-02 15:44 147,456 --a------ C:\Windows\system32\vbzip10.dll
2007-11-02 15:40 <DIR> d-------- C:\Windows\system32\Mz18r
2007-11-02 15:40 <DIR> d-------- C:\Temp\mZOr
2007-10-24 23:28 <DIR> d-------- C:\Program Files\Common Files\Adobe Systems Shared
2007-10-17 22:19 <DIR> d-------- C:\Program Files\Kidwidget
2007-10-17 22:17 286,720 --------- C:\Windows\Setup1.exe
2007-10-17 22:17 73,216 --a------ C:\Windows\ST6UNST.EXE
2007-10-17 22:13 733,696 --a------ C:\Windows\GPInstall.exe
2007-10-17 21:58 <DIR> d-------- C:\LITTLEFI
2007-10-17 21:54 <DIR> d-------- C:\Program Files\Shape Art
2007-10-17 21:52 <DIR> d--hs---- C:\Windows\ftpcache
2007-10-17 21:51 <DIR> d-------- C:\Program Files\AlbyMedia
2007-10-17 21:42 <DIR> d-------- C:\Program Files\ABC-Ware
2007-10-16 16:31 <DIR> d-------- C:\Walkerden Resource Pty Ltd
2007-10-16 16:25 <DIR> d-------- C:\MYOBODBC
2007-10-16 16:21 <DIR> d-------- C:\Program Files\MYOB
2007-10-16 16:21 <DIR> d-------- C:\myob17

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-12 10:12 --------- d-----w C:\Program Files\Symantec AntiVirus
2007-11-10 21:13 --------- d-----w C:\Program Files\Lavasoft
2007-11-10 21:13 --------- d-----w C:\Documents and Settings\Lyn Walkerden\Application Data\Lavasoft
2007-11-10 07:39 --------- d-----w C:\Program Files\Common Files\Real
2007-11-08 10:18 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2007-11-08 10:15 --------- d-----w C:\Program Files\Battery miser
2007-11-08 09:00 --------- d-----w C:\Program Files\On Screen Display
2007-11-08 08:59 --------- d-----w C:\Program Files\IP Operator
2007-11-06 10:20 --------- d-----w C:\Program Files\Logitech
2007-11-03 02:24 --------- d-----w C:\Program Files\Nokia
2007-11-02 04:44 278,538 ----a-w C:\WINDOWS\Fonts\Setup.exe
2007-10-27 05:24 --------- d-----w C:\Program Files\Virtools Web Player 3.5
2007-10-24 12:26 --------- d-----w C:\Program Files\Common Files\Adobe
2007-10-06 07:10 --------- d-----w C:\Program Files\Minisebran
2007-10-05 22:21 --------- d-----w C:\Program Files\Sebran
2007-09-14 08:02 --------- d-----w C:\Program Files\Playground Radio
2007-09-14 07:12 --------- d-----w C:\Program Files\iTunes
2007-09-14 07:11 --------- d-----w C:\Program Files\iPod
2007-09-14 06:45 --------- d-----w C:\Program Files\Apple Software Update
2007-08-21 06:15 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-08-21 06:15 683,520 ----a-w C:\WINDOWS\system32\dllcache\inetcomm.dll
2007-08-20 10:04 824,832 ----a-w C:\WINDOWS\system32\dllcache\wininet.dll
2007-08-20 10:04 671,232 ----a-w C:\WINDOWS\system32\dllcache\mstime.dll
2007-08-20 10:04 63,488 ----a-w C:\WINDOWS\system32\dllcache\icardie.dll
2007-08-20 10:04 6,058,496 ----a-w C:\WINDOWS\system32\dllcache\ieframe.dll
2007-08-20 10:04 52,224 ----a-w C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2007-08-20 10:04 477,696 ----a-w C:\WINDOWS\system32\dllcache\mshtmled.dll
2007-08-20 10:04 459,264 ----a-w C:\WINDOWS\system32\dllcache\msfeeds.dll
2007-08-20 10:04 44,544 ----a-w C:\WINDOWS\system32\dllcache\iernonce.dll
2007-08-20 10:04 384,512 ----a-w C:\WINDOWS\system32\dllcache\iedkcs32.dll
2007-08-20 10:04 383,488 ----a-w C:\WINDOWS\system32\dllcache\ieapfltr.dll
2007-08-20 10:04 3,584,512 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2007-08-20 10:04 27,648 ----a-w C:\WINDOWS\system32\dllcache\jsproxy.dll
2007-08-20 10:04 267,776 ----a-w C:\WINDOWS\system32\dllcache\iertutil.dll
2007-08-20 10:04 232,960 ----a-w C:\WINDOWS\system32\dllcache\webcheck.dll
2007-08-20 10:04 230,400 ----a-w C:\WINDOWS\system32\dllcache\ieaksie.dll
2007-08-20 10:04 214,528 ----a-w C:\WINDOWS\system32\dllcache\dxtrans.dll
2007-08-20 10:04 193,024 ----a-w C:\WINDOWS\system32\dllcache\msrating.dll
2007-08-20 10:04 153,088 ----a-w C:\WINDOWS\system32\dllcache\ieakeng.dll
2007-08-20 10:04 132,608 ----a-w C:\WINDOWS\system32\dllcache\extmgr.dll
2007-08-20 10:04 124,928 ----a-w C:\WINDOWS\system32\dllcache\advpack.dll
2007-08-20 10:04 105,984 ----a-w C:\WINDOWS\system32\dllcache\url.dll
2007-08-20 10:04 102,400 ----a-w C:\WINDOWS\system32\dllcache\occache.dll
2007-08-20 10:04 1,152,000 ----a-w C:\WINDOWS\system32\dllcache\urlmon.dll
2007-08-17 10:21 625,152 ----a-w C:\WINDOWS\system32\dllcache\iexplore.exe
2007-08-17 10:20 63,488 ----a-w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2007-08-17 10:20 13,824 ----a-w C:\WINDOWS\system32\dllcache\ieudinit.exe
2007-08-17 07:34 161,792 ----a-w C:\WINDOWS\system32\dllcache\ieakui.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2A7BA40D-69D2-47A9-A7B6-1DCB4162AEA2}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3ee55232-f65c-4c7d-8e96-a562ff0b9fea}]
2007-11-11 14:44 81472 --a------ C:\WINDOWS\system32\lewpxqbw.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{402DF6A1-5415-4C49-BE7B-EF67A809A3B3}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5154D29B-AEC5-4130-BFA5-37EFD692A254}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{899F466B-BA51-4E10-8CDF-9788137AA72B}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BC9E0063-1D0C-4A46-97AF-8FD2AEA2513F}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BCC73622-F72D-4277-803C-D65565A0947F}]
2007-11-03 08:42 35328 --a------ C:\WINDOWS\system32\fcccbyy.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ca26637c-0723-4e4d-b702-83a843cf25d3}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F014716F-76A6-48D5-82E1-07BD10CE8710}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2003-10-02 16:37]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2003-10-02 16:19]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2003-09-12 17:19]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2003-09-12 17:18]
"AGRSMMSG"="AGRSMMSG.exe" [2003-03-31 15:54 C:\Windows\AGRSMMSG.exe]
"batterymiser"="C:\Program Files\Battery miser\batterymiser.exe" [2004-03-24 05:46]
"KeybdUtility"="C:\Program Files\On Screen Display\Hotkey.exe" [2004-05-25 12:15]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2005-06-03 03:21]
"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2005-06-24 13:27]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="C:\Program Files\Google\Gmail Notifier\gnotify.exe" [2005-07-16 08:48]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-07-20 08:14]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-12-08 17:35]
"InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [2004-03-04 02:47]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2005-12-09 16:32]
"LogitechCameraService(E)"="C:\WINDOWS\system32\ElkCtrl.exe" [2004-11-01 18:22]
"Host Process"="C:\WINDOWS\Fonts\svchost.exe" []
"SmcService"="C:\PROGRA~1\Sygate\SPF\smc.exe" [2004-10-15 19:40]
"0c33614f"="C:\WINDOWS\system32\teddtpmj.dll" []
"IPOperator"="C:\Program Files\IP Operator\IPOperator.exe" [2004-03-03 08:29]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 18:56]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runonce]
"FFTI"=C:\Documents and Settings\Lyn Walkerden\Application Data\Mozilla\Firefox\Profiles\unk0xsjt.default\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\ffti.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /DestPath="C:\Documents and Settings\Lyn Walkerden\Application Data\Mozilla\Firefox\Profiles/unk0xsjt.default\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{BCC73622-F72D-4277-803C-D65565A0947F}"= C:\WINDOWS\system32\fcccbyy.dll [2007-11-03 08:42 35328]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\fcccbyy]
fcccbyy.dll 2007-11-03 08:42 35328 C:\Windows\system32\fcccbyy.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk
backup=C:\WINDOWS\pss\Logitech Desktop Messenger.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LaCie Backup]
C:\Program Files\LaCie\Backup Software\\LaCieBackup.exe /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LDM]
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechCameraAssistant]
C:\Program Files\Logitech\Video\CameraAssistant.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideo[inspector]]
C:\Program Files\Logitech\Video\InstallHelper.exe /inspect

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
"C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\QTTask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
"C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1

R3 EraserUtilDrv10733;EraserUtilDrv10733;\??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv10733.sys
R3 lgsnd_filter;lgsnd_filter;C:\WINDOWS\system32\drivers\lgsnd_filter.sys
R3 LVPrcMon;Logitech LVPrcMon Driver;\??\C:\WINDOWS\system32\drivers\LVPrcMon.sys
R3 tifm;tifm;C:\WINDOWS\system32\drivers\tifm.sys
S3 SF-620;Kingsun SF-620 USB Infrared Adapter;C:\WINDOWS\system32\DRIVERS\SF-620.sys

.
Contents of the 'Scheduled Tasks' folder
"2007-09-29 13:11:12 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2004-03-26 20:01:46 C:\WINDOWS\Tasks\Critical Battery Alarm Program.job"
"2004-03-26 20:01:46 C:\WINDOWS\Tasks\Low Battery Alarm Program.job"
.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-12 21:24:25
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-12 21:27:15
C:\ComboFix2.txt ... 2007-11-12 19:23
.
--- E O F ---

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:33:28 PM, on 12/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\S24EvMon.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\RegSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Battery miser\batterymiser.exe
C:\Program Files\On Screen Display\Hotkey.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\WINDOWS\system32\ElkCtrl.exe
C:\Program Files\IP Operator\IPOperator.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://mail.google.com/mail/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://pac.schools.nsw.edu.au/schools/ashcroft-p.pac
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {2A7BA40D-69D2-47A9-A7B6-1DCB4162AEA2} - (no file)
O2 - BHO: {aef9b0ff-265a-69e8-d7c4-c56f23255ee3} - {3ee55232-f65c-4c7d-8e96-a562ff0b9fea} - C:\WINDOWS\system32\lewpxqbw.dll
O2 - BHO: (no name) - {402DF6A1-5415-4C49-BE7B-EF67A809A3B3} - (no file)
O2 - BHO: (no name) - {5154D29B-AEC5-4130-BFA5-37EFD692A254} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {899F466B-BA51-4E10-8CDF-9788137AA72B} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {BC9E0063-1D0C-4A46-97AF-8FD2AEA2513F} - (no file)
O2 - BHO: (no name) - {BCC73622-F72D-4277-803C-D65565A0947F} - C:\WINDOWS\system32\fcccbyy.dll
O2 - BHO: (no name) - {ca26637c-0723-4e4d-b702-83a843cf25d3} - (no file)
O2 - BHO: (no name) - {F014716F-76A6-48D5-82E1-07BD10CE8710} - (no file)
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [batterymiser] C:\Program Files\Battery miser\batterymiser.exe
O4 - HKLM\..\Run: [KeybdUtility] "C:\Program Files\On Screen Display\Hotkey.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechCameraService(E)] C:\WINDOWS\system32\ElkCtrl.exe /automation
O4 - HKLM\..\Run: [Host Process] C:\WINDOWS\Fonts\svchost.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [0c33614f] rundll32.exe "C:\WINDOWS\system32\teddtpmj.dll",b
O4 - HKLM\..\Run: [IPOperator] "C:\Program Files\IP Operator\IPOperator.exe" -aUtOsTaRtFrOmReG
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\RunOnce: [FFTI] C:\Documents and Settings\Lyn Walkerden\Application Data\Mozilla\Firefox\Profiles\unk0xsjt.default\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\ffti.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /DestPath="C:\Documents and Settings\Lyn Walkerden\Application Data\Mozilla\Firefox\Profiles/unk0xsjt.default\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}"
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://groups.msn.com/controls/PhotoUC/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1126924212568
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} - http://a532.g.akamai.net/f/532/6712/5m/vir...l/installer.exe
O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://www.babysfirstsite.com/members/XUpload.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{36FBFC76-AF04-4A7A-BFB1-BF242B2BB2DC}: NameServer = 203.0.178.191
O20 - Winlogon Notify: fcccbyy - C:\WINDOWS\SYSTEM32\fcccbyy.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

--
End of file - 10756 bytes

Edited by **LYN**, 12 November 2007 - 05:50 AM.


#5 SifuMike

SifuMike

    malware expert


  • Staff Emeritus
  • 15,385 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Vancouver (not BC) WA (Not DC) USA
  • Local time:09:35 AM

Posted 12 November 2007 - 02:43 PM

Hi LYN,

Do you know what this is? IPOperator.exe
Did you install it?

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

Updating Java:
  • Download the latest version of Java Runtime Environment (JRE) 6 Update 3.
  • Scroll down to where it says "Java Runtime Environment (JRE) 6 Update 3".
  • Click the "Download" button to the right.
  • Check the box that says: "Accept License Agreement".
  • The page will refresh.
  • Click on the link to download Windows Offline Installation, Multi-language jre-6-windows-i586.exe and save to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
    Examples of older versions in Add or Remove Programs:
    Java 2 Runtime Environment, SE v1.4.2
    J2SE Runtime Environment 5.0
    J2SE Runtime Environment 5.0 Update 6
  • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u3-windows-i586-p.exe to install the newest version.
*******************************************
I see you are running Teatimer.
I suggest you to disable it because it can interfere with the changes you'll make on your system.
If teatimer gives you a warning afterwards that some changes were made, allow this instead of blocking it.

How to disable TeaTimer during HijackThis Cleanup
When everything is done and your log is clean again, you can enable it again.

Download CCleaner and install it. (default location is best). Do not run it yet!

CCleaner Tutorial

*******************************************

Select the following with HijackThis.
With all windows (including this one!) closed (close browser/explorer windows), please select "fix checked"

O2 - BHO: (no name) - {2A7BA40D-69D2-47A9-A7B6-1DCB4162AEA2} - (no file)
O2 - BHO: {aef9b0ff-265a-69e8-d7c4-c56f23255ee3} - {3ee55232-f65c-4c7d-8e96-a562ff0b9fea} - C:\WINDOWS\system32\lewpxqbw.dll
O2 - BHO: (no name) - {402DF6A1-5415-4C49-BE7B-EF67A809A3B3} - (no file)
O2 - BHO: (no name) - {5154D29B-AEC5-4130-BFA5-37EFD692A254} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {899F466B-BA51-4E10-8CDF-9788137AA72B} - (no file)
O2 - BHO: (no name) - {BC9E0063-1D0C-4A46-97AF-8FD2AEA2513F} - (no file)
O2 - BHO: (no name) - {BCC73622-F72D-4277-803C-D65565A0947F} - C:\WINDOWS\system32\fcccbyy.dll
O2 - BHO: (no name) - {ca26637c-0723-4e4d-b702-83a843cf25d3} - (no file)
O2 - BHO: (no name) - {F014716F-76A6-48D5-82E1-07BD10CE8710} - (no file)
O4 - HKLM\..\Run: [Host Process] C:\WINDOWS\Fonts\svchost.exe
O4 - HKLM\..\Run: [0c33614f] rundll32.exe "C:\WINDOWS\system32\teddtpmj.dll",b
O20 - Winlogon Notify: fcccbyy - C:\WINDOWS\SYSTEM32\fcccbyy.dll


*******************************************

*NOTE* CCleaner deletes EVERYTHING out of temp/temporary folders and does not make backups.

Let's empty the temp files:

Run CCleaner.

CAUTION: Please do NOT use the Issues or Registry button. This is a built-in registry cleaner. If you don't know how to use it, you may cause irreparable damage to your system.

1. Starting with v1.27.260, CCleaner installs the Yahoo Toolbar as an option which IS checkmarked by default during the installation.
IF you do NOT want it, REMOVE the checkmark when provided with the option OR download the toolbarfree Basic version instead of the Standard Build.


2. Before first use, select Options > Advanced and UNCHECK "Only delete files in Windows Temp folder older than 48 hours"

3. Then select the items you wish to clean up.

In the Windows Tab:
• Clean all entries in the "Internet Explorer" section except Autocomplete Forum History.
• Clean all the entries in the "Windows Explorer" section.
• Clean all entries in the "System" section except for Start Menu Shortcuts and Desktop Shortcuts.
• Clean any others that you choose.

In the Applications Tab:
• Clean all including cookies in the Firefox/Mozilla section if you use it.
• Clean all in the Opera section if you use it.
• Clean Sun Java in the Internet Section.
• Clean any others that you choose.

4. Click the "Run Cleaner" button.
5. A pop up box will appear advising this process will permanently delete files from your system.
6. Click "OK" and it will scan and clean your system.
7. Click "exit" when done.

If it asks you to reboot at the end, click NO.

CCleaner should be run with the above settings for each User Account!

*******************************************

Click Start, then Run and type Notepad and click OK.
Open notepad - don't use any other text editor than notepad or the script will fail.
Copy/paste the text in the code box below into notepad:

File:: 
C:\WINDOWS\Fonts\svchost.exe
C:\WINDOWS\system32\teddtpmj.dll
C:\WINDOWS\system32\lewpxqbw.dll

Registry:: 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"0c33614f"=- 
"Host Process"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{BCC73622-F72D-4277-803C-D65565A0947F}"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\fcccbyy]


Name the Notepad file CFScript.txt and Save it to your desktop.

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.


Posted Image

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.

Edited by SifuMike, 12 November 2007 - 03:17 PM.

If I've saved you time & money,
please make a donation so I can keep helping people just like you! You can donate using a credit card and PayPal. Thank you!



Posted Image

Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#6 **LYN**

**LYN**
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:03:35 AM

Posted 13 November 2007 - 03:33 AM

Hi SifuMike,

I have no idea what IPOperator.exe is and I don't believe I installed it. At least not deliberately.

When I got to the fix checked part of your instructions, only 2 of the files on the list were there, the ones beginning with 04.

Here are the logs.

ComboFix 07-11-08.1 - Lyn Walkerden 2007-11-13 18:21:24.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.116 [GMT 11:00]
Running from: C:\Documents and Settings\Lyn Walkerden\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Lyn Walkerden\Desktop\CFScript.txt
* Created a new restore point

FILE
C:\WINDOWS\Fonts\svchost.exe
C:\WINDOWS\system32\lewpxqbw.dll
C:\WINDOWS\system32\teddtpmj.dll
.

Unable to gain System Privileges

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Windows\system32\jllnn.ini
C:\Windows\system32\jllnn.ini2
C:\WINDOWS\system32\lewpxqbw.dll
C:\WINDOWS\system32\nnllj.dll

.
((((((((((((((((((((((((( Files Created from 2007-10-13 to 2007-11-13 )))))))))))))))))))))))))))))))
.

2007-11-13 17:08 <DIR> d-------- C:\Program Files\CCleaner
2007-11-12 16:54 51,200 --a------ C:\Windows\NirCmd.exe
2007-11-12 07:28 6,836 --a------ C:\Windows\system32\pljouhye.dll
2007-11-11 11:52 81,472 --a------ C:\Windows\system32\mcudggop.dll
2007-11-11 11:49 85,056 --a------ C:\Windows\system32\xbnejgqb.dll
2007-11-11 10:40 81,472 --a------ C:\Windows\system32\hugyfydx.dll
2007-11-11 09:40 81,472 --a------ C:\Windows\system32\tlpyiuyc.dll
2007-11-11 08:13 81,472 --a------ C:\Windows\system32\dehdgaua.dll
2007-11-10 20:13 81,472 --a------ C:\Windows\system32\ipbadnll.dll
2007-11-10 19:39 <DIR> d-------- C:\Program Files\Trend Micro
2007-11-10 09:30 88,128 --a------ C:\Windows\system32\hyyygwfd.dll
2007-11-10 09:28 77,888 --a------ C:\Windows\system32\thphrrwv.dll
2007-11-10 09:22 6,836 --a------ C:\Windows\system32\oxgsqvfq.dll
2007-11-09 15:40 <DIR> d-------- C:\Documents and Settings\NetworkService\Application Data\Talkback
2007-11-09 15:19 83,096 --a------ C:\Windows\system32\SSSensor.dll
2007-11-09 15:19 60,496 --a------ C:\Windows\system32\drivers\Teefer.sys
2007-11-09 15:19 21,075 --a------ C:\Windows\system32\drivers\wpsdrvnt.sys
2007-11-09 15:19 14,568 --a------ C:\Windows\system32\drivers\wg6n.sys
2007-11-09 15:19 14,568 --a------ C:\Windows\system32\drivers\wg5n.sys
2007-11-09 15:19 14,568 --a------ C:\Windows\system32\drivers\wg4n.sys
2007-11-09 15:19 14,568 --a------ C:\Windows\system32\drivers\wg3n.sys
2007-11-09 15:18 <DIR> d-------- C:\Program Files\Sygate
2007-11-08 19:30 <DIR> d-------- C:\Windows\system32\ActiveScan
2007-11-08 17:59 80,448 --a------ C:\Windows\system32\worwvgqh.dll
2007-11-08 17:57 102,664 --a------ C:\Windows\system32\drivers\tmcomm.sys
2007-11-08 17:56 <DIR> d-------- C:\Documents and Settings\Lyn Walkerden\.housecall6.6
2007-11-08 16:21 80,448 --a------ C:\Windows\system32\wsohikyb.dll
2007-11-08 16:13 35,328 --a------ C:\Windows\system32\opnopop.dll
2007-11-08 16:13 172 --a------ C:\6601.bat
2007-11-08 15:36 79,936 --a------ C:\Windows\system32\gdbmpxda.dll
2007-11-08 14:03 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-07 19:22 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-11-07 19:09 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-11-07 16:13 79,936 --a------ C:\Windows\system32\qemqoect.dll
2007-11-07 16:04 6,836 --a------ C:\Windows\system32\oqlxrner.dll
2007-11-07 16:01 145,984 --a------ C:\Windows\system32\bvnwnvkq.dll
2007-11-06 21:37 3,866 --a------ C:\Windows\system32\tmp.reg
2007-11-06 15:54 83,008 --a------ C:\Windows\system32\ojwbihjg.dll
2007-11-06 15:49 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Adobe Systems
2007-11-06 07:22 83,008 --a------ C:\Windows\system32\bwncmewk.dll
2007-11-06 07:09 35,328 --a------ C:\Windows\system32\mljifed.dll
2007-11-05 17:20 83,008 --a------ C:\Windows\system32\diavxbok.dll
2007-11-05 12:59 78,912 --a------ C:\Windows\system32\trdcagwh.dll
2007-11-05 12:57 <DIR> d-------- C:\Program Files\Enigma Software Group
2007-11-05 08:55 <DIR> d---s---- C:\Documents and Settings\Administrator\UserData
2007-11-05 08:20 35,328 --a------ C:\Windows\system32\khfeeec.dll
2007-11-04 09:11 81,472 --a------ C:\Windows\system32\xikoycmc.dll
2007-11-04 08:59 35,328 --a------ C:\Windows\system32\urqnlml.dll
2007-11-03 20:59 81,472 --a------ C:\Windows\system32\bhxqvysv.dll
2007-11-03 10:08 <DIR> d-------- C:\Windows\pss
2007-11-03 08:42 35,328 --a------ C:\Windows\system32\fcccbyy.dll
2007-11-02 17:49 <DIR> d--hs---- C:\found.000
2007-11-02 15:44 147,456 --a------ C:\Windows\system32\vbzip10.dll
2007-11-02 15:40 <DIR> d-------- C:\Windows\system32\Mz18r
2007-11-02 15:40 <DIR> d-------- C:\Temp\mZOr
2007-10-24 23:28 <DIR> d-------- C:\Program Files\Common Files\Adobe Systems Shared
2007-10-17 22:19 <DIR> d-------- C:\Program Files\Kidwidget
2007-10-17 22:17 286,720 --------- C:\Windows\Setup1.exe
2007-10-17 22:17 73,216 --a------ C:\Windows\ST6UNST.EXE
2007-10-17 22:13 733,696 --a------ C:\Windows\GPInstall.exe
2007-10-17 21:58 <DIR> d-------- C:\LITTLEFI
2007-10-17 21:54 <DIR> d-------- C:\Program Files\Shape Art
2007-10-17 21:52 <DIR> d--hs---- C:\Windows\ftpcache
2007-10-17 21:51 <DIR> d-------- C:\Program Files\AlbyMedia
2007-10-17 21:42 <DIR> d-------- C:\Program Files\ABC-Ware
2007-10-16 16:31 <DIR> d-------- C:\Walkerden Resource Pty Ltd
2007-10-16 16:25 <DIR> d-------- C:\MYOBODBC
2007-10-16 16:21 <DIR> d-------- C:\Program Files\MYOB
2007-10-16 16:21 <DIR> d-------- C:\myob17

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-13 07:34 --------- d-----w C:\Program Files\Symantec AntiVirus
2007-11-13 05:55 --------- d-----w C:\Program Files\Java
2007-11-10 21:13 --------- d-----w C:\Program Files\Lavasoft
2007-11-10 21:13 --------- d-----w C:\Documents and Settings\Lyn Walkerden\Application Data\Lavasoft
2007-11-10 07:39 --------- d-----w C:\Program Files\Common Files\Real
2007-11-08 10:18 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2007-11-08 10:15 --------- d-----w C:\Program Files\Battery miser
2007-11-08 09:00 --------- d-----w C:\Program Files\On Screen Display
2007-11-08 08:59 --------- d-----w C:\Program Files\IP Operator
2007-11-06 10:20 --------- d-----w C:\Program Files\Logitech
2007-11-03 02:24 --------- d-----w C:\Program Files\Nokia
2007-11-02 04:44 278,538 ----a-w C:\WINDOWS\Fonts\Setup.exe
2007-10-27 05:24 --------- d-----w C:\Program Files\Virtools Web Player 3.5
2007-10-24 12:26 --------- d-----w C:\Program Files\Common Files\Adobe
2007-10-06 07:10 --------- d-----w C:\Program Files\Minisebran
2007-10-05 22:21 --------- d-----w C:\Program Files\Sebran
2007-09-14 08:02 --------- d-----w C:\Program Files\Playground Radio
2007-09-14 07:12 --------- d-----w C:\Program Files\iTunes
2007-09-14 07:11 --------- d-----w C:\Program Files\iPod
2007-09-14 06:45 --------- d-----w C:\Program Files\Apple Software Update
.

((((((((((((((((((((((((((((( snapshot@2007-11-12_19.21.53.48 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-03-13 14:31:24 135,168 ----a-w C:\WINDOWS\system32\java.exe
+ 2007-09-24 11:30:28 135,168 ----a-w C:\WINDOWS\system32\java.exe
- 2007-03-13 14:31:28 135,168 ----a-w C:\WINDOWS\system32\javaw.exe
+ 2007-09-24 11:30:30 135,168 ----a-w C:\WINDOWS\system32\javaw.exe
- 2007-03-13 16:04:46 139,264 ----a-w C:\WINDOWS\system32\javaws.exe
+ 2007-09-24 12:31:42 139,264 ----a-w C:\WINDOWS\system32\javaws.exe
+ 2007-11-13 08:02:36 313,440 ----a-w C:\WINDOWS\system32\urqpq.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2A7BA40D-69D2-47A9-A7B6-1DCB4162AEA2}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{402DF6A1-5415-4C49-BE7B-EF67A809A3B3}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5154D29B-AEC5-4130-BFA5-37EFD692A254}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5F4AF498-42CE-4A53-BF97-4E8CF36BE9E7}]
2007-11-13 19:02 313440 --a------ C:\WINDOWS\system32\urqpq.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{899F466B-BA51-4E10-8CDF-9788137AA72B}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BC9E0063-1D0C-4A46-97AF-8FD2AEA2513F}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BCC73622-F72D-4277-803C-D65565A0947F}]
2007-11-03 08:42 35328 --a------ C:\WINDOWS\system32\fcccbyy.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ca26637c-0723-4e4d-b702-83a843cf25d3}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F014716F-76A6-48D5-82E1-07BD10CE8710}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2003-10-02 16:37]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2003-10-02 16:19]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2003-09-12 17:19]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2003-09-12 17:18]
"AGRSMMSG"="AGRSMMSG.exe" [2003-03-31 15:54 C:\Windows\AGRSMMSG.exe]
"batterymiser"="C:\Program Files\Battery miser\batterymiser.exe" [2004-03-24 05:46]
"KeybdUtility"="C:\Program Files\On Screen Display\Hotkey.exe" [2004-05-25 12:15]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2005-06-03 03:21]
"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2005-06-24 13:27]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="C:\Program Files\Google\Gmail Notifier\gnotify.exe" [2005-07-16 08:48]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-07-20 08:14]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-12-08 17:35]
"InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [2004-03-04 02:47]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2005-12-09 16:32]
"LogitechCameraService(E)"="C:\WINDOWS\system32\ElkCtrl.exe" [2004-11-01 18:22]
"SmcService"="C:\PROGRA~1\Sygate\SPF\smc.exe" [2004-10-15 19:40]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]
"IPOperator"="C:\Program Files\IP Operator\IPOperator.exe" [2004-03-03 08:29]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 18:56]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runonce]
"FFTI"=C:\Documents and Settings\Lyn Walkerden\Application Data\Mozilla\Firefox\Profiles\unk0xsjt.default\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\ffti.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /DestPath="C:\Documents and Settings\Lyn Walkerden\Application Data\Mozilla\Firefox\Profiles/unk0xsjt.default\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{BCC73622-F72D-4277-803C-D65565A0947F}"= C:\WINDOWS\system32\fcccbyy.dll [2007-11-03 08:42 35328]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\fcccbyy]
fcccbyy.dll 2007-11-03 08:42 35328 C:\Windows\system32\fcccbyy.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\urqpq.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk
backup=C:\WINDOWS\pss\Logitech Desktop Messenger.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LaCie Backup]
C:\Program Files\LaCie\Backup Software\\LaCieBackup.exe /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LDM]
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechCameraAssistant]
C:\Program Files\Logitech\Video\CameraAssistant.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideo[inspector]]
C:\Program Files\Logitech\Video\InstallHelper.exe /inspect

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
"C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\QTTask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
"C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1

R3 lgsnd_filter;lgsnd_filter;C:\WINDOWS\system32\drivers\lgsnd_filter.sys
R3 LVPrcMon;Logitech LVPrcMon Driver;\??\C:\WINDOWS\system32\drivers\LVPrcMon.sys
R3 tifm;tifm;C:\WINDOWS\system32\drivers\tifm.sys
S3 SF-620;Kingsun SF-620 USB Infrared Adapter;C:\WINDOWS\system32\DRIVERS\SF-620.sys

.
Contents of the 'Scheduled Tasks' folder
"2007-09-29 13:11:12 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2004-03-26 20:01:46 C:\WINDOWS\Tasks\Critical Battery Alarm Program.job"
"2004-03-26 20:01:46 C:\WINDOWS\Tasks\Low Battery Alarm Program.job"
.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-13 18:57:39
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-13 19:05:59 - machine was rebooted
C:\ComboFix2.txt ... 2007-11-12 21:27
C:\ComboFix3.txt ... 2007-11-12 19:23
.
--- E O F ---

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:15:58 PM, on 13/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\S24EvMon.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\RegSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Battery miser\batterymiser.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\WINDOWS\system32\ElkCtrl.exe
C:\Program Files\IP Operator\IPOperator.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://mail.google.com/mail/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://pac.schools.nsw.edu.au/schools/ashcroft-p.pac
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [batterymiser] C:\Program Files\Battery miser\batterymiser.exe
O4 - HKLM\..\Run: [KeybdUtility] "C:\Program Files\On Screen Display\Hotkey.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechCameraService(E)] C:\WINDOWS\system32\ElkCtrl.exe /automation
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [IPOperator] "C:\Program Files\IP Operator\IPOperator.exe" -aUtOsTaRtFrOmReG
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\RunOnce: [FFTI] C:\Documents and Settings\Lyn Walkerden\Application Data\Mozilla\Firefox\Profiles\unk0xsjt.default\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\ffti.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /DestPath="C:\Documents and Settings\Lyn Walkerden\Application Data\Mozilla\Firefox\Profiles/unk0xsjt.default\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}"
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://groups.msn.com/controls/PhotoUC/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1126924212568
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} - http://a532.g.akamai.net/f/532/6712/5m/vir...l/installer.exe
O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://www.babysfirstsite.com/members/XUpload.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{36FBFC76-AF04-4A7A-BFB1-BF242B2BB2DC}: NameServer = 203.0.178.191
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

--
End of file - 8889 bytes


Thanks again for your help,

Lyn

#7 SifuMike

SifuMike

    malware expert


  • Staff Emeritus
  • 15,385 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Vancouver (not BC) WA (Not DC) USA
  • Local time:09:35 AM

Posted 13 November 2007 - 02:10 PM

Hi LYN,

You have a suspicious file we need to check.

Go to My Computer and double-click C.
Go to the Tools menu and select 'Folder Options'.
On the 'View' tab select 'show hidden files and folders',
deselect (uncheck) 'hide protected operating system files (recommended)', and
deselect (uncheck) "Hide extensions for known file types.'


Go to next site: http://www.virustotal.com/en/indexf.html
On top you'll find 'Browse'
Click the browse button and browse to next file:

C:\Program Files\IP Operator\IPOperator.exe

Click open.
Then click the 'Send' button next to it.
This will scan the file. Please be patient.
Save the results in notepad.
Once scanned, copy and paste the results also in your next reply.

NOTE: I usually enter my email address at virus total so they can send me the scan results. They usually only take a couple minutes to reply.
You can copy/paste the results of scan results here.

*******************

Click Start, then Run and type Notepad and click OK.
Open notepad - don't use any other text editor than notepad or the script will fail.
Copy/paste the text in the code box below into notepad:

File:: 
C:\Windows\system32\pljouhye.dll
C:\Windows\system32\mcudggop.dll
C:\Windows\system32\xbnejgqb.dll
C:\Windows\system32\hugyfydx.dll
C:\Windows\system32\tlpyiuyc.dll
C:\Windows\system32\dehdgaua.dll
C:\Windows\system32\ipbadnll.dll
C:\Windows\system32\hyyygwfd.dll
C:\Windows\system32\thphrrwv.dll
C:\Windows\system32\oxgsqvfq.dll
C:\Windows\system32\worwvgqh.dll
C:\Windows\system32\wsohikyb.dll
C:\Windows\system32\opnopop.dll
C:\6601.bat
C:\Windows\system32\gdbmpxda.dll
C:\Windows\system32\qemqoect.dll
C:\Windows\system32\oqlxrner.dll
C:\Windows\system32\bvnwnvkq.dll
C:\Windows\system32\tmp.reg
C:\Windows\system32\ojwbihjg.dll
C:\Windows\system32\bwncmewk.dll
C:\Windows\system32\mljifed.dll
C:\Windows\system32\diavxbok.dll
C:\Windows\system32\trdcagwh.dll
C:\Windows\system32\khfeeec.dll
C:\Windows\system32\xikoycmc.dll
C:\Windows\system32\urqnlml.dll
C:\Windows\system32\bhxqvysv.dll
C:\Windows\system32\fcccbyy.dll

Registry:: 
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2A7BA40D-69D2-47A9-A7B6-1DCB4162AEA2}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{402DF6A1-5415-4C49-BE7B-EF67A809A3B3}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5154D29B-AEC5-4130-BFA5-37EFD692A254}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5F4AF498-42CE-4A53-BF97-4E8CF36BE9E7}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{899F466B-BA51-4E10-8CDF-9788137AA72B}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BC9E0063-1D0C-4A46-97AF-8FD2AEA2513F}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BCC73622-F72D-4277-803C-D65565A0947F}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ca26637c-0723-4e4d-b702-83a843cf25d3}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F014716F-76A6-48D5-82E1-07BD10CE8710}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{BCC73622-F72D-4277-803C-D65565A0947F}"=- 
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\fcccbyy] 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa] 
"Authentication Packages"=hex(7):6d,73,76,31,5f,30,00,00
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]


Name the Notepad file CFScript.txt and Save it to your desktop.

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.


Posted Image

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together a new HijackThis log and the Virus Total scan results.
If I've saved you time & money,
please make a donation so I can keep helping people just like you! You can donate using a credit card and PayPal. Thank you!



Posted Image

Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#8 **LYN**

**LYN**
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:03:35 AM

Posted 13 November 2007 - 05:00 PM

Virus total scan results

Antivirus Version Last Update Result
AhnLab-V3 2007.11.14.0 2007.11.13 -
AntiVir 7.6.0.34 2007.11.13 -
Authentium 4.93.8 2007.11.13 -
Avast 4.7.1074.0 2007.11.13 -
AVG 7.5.0.503 2007.11.13 -
BitDefender 7.2 2007.11.13 -
CAT-QuickHeal 9.00 2007.11.13 -
ClamAV 0.91.2 2007.11.13 -
DrWeb 4.44.0.09170 2007.11.13 -
eSafe 7.0.15.0 2007.11.13 -
eTrust-Vet 31.2.5291 2007.11.13 -
Ewido 4.0 2007.11.13 -
FileAdvisor 1 2007.11.13 -
Fortinet 3.11.0.0 2007.10.19 -
F-Prot 4.4.2.54 2007.11.13 -
F-Secure 6.70.13030.0 2007.11.13 -
Ikarus T3.1.1.12 2007.11.13 -
Kaspersky 7.0.0.125 2007.11.13 -
McAfee 5162 2007.11.13 -
Microsoft 1.3007 2007.11.12 -
NOD32v2 2655 2007.11.13 -
Norman 5.80.02 2007.11.13 -
Panda 9.0.0.4 2007.11.13 -
Prevx1 V2 2007.11.13 -
Rising 20.18.11.00 2007.11.13 -
Sophos 4.23.0 2007.11.13 -
Sunbelt 2.2.907.0 2007.11.13 -
Symantec 10 2007.11.13 -
TheHacker 6.2.9.124 2007.11.13 W32/Sluter.worm.gen
VBA32 3.12.2.4 2007.11.11 -
VirusBuster 4.3.26:9 2007.11.13 -
Webwasher-Gateway 6.0.1 2007.11.13 -
Additional information
File size: 32768 bytes
MD5: 983ec44ae7c0813e1540a9720f6b1933
SHA1: c6ccdca92691dbdab518a729a6cbf40556d09b3f

As soon as I activated IE to run the scan the annoying pop-up fake security messages started again. Symantec is telling me I have adware ezula and downloader.

Back with combofix and hijack this logs in a few minutes

Lyn

#9 **LYN**

**LYN**
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:03:35 AM

Posted 13 November 2007 - 05:59 PM

ComboFix 07-11-08.1 - Lyn Walkerden 2007-11-14 9:26:57.5 - NTFSx86
Running from: C:\Documents and Settings\Lyn Walkerden\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Lyn Walkerden\Desktop\CFScript.txt
* Created a new restore point

FILE
C:\6601.bat
C:\Windows\system32\bhxqvysv.dll
C:\Windows\system32\bvnwnvkq.dll
C:\Windows\system32\bwncmewk.dll
C:\Windows\system32\dehdgaua.dll
C:\Windows\system32\diavxbok.dll
C:\Windows\system32\fcccbyy.dll
C:\Windows\system32\gdbmpxda.dll
C:\Windows\system32\hugyfydx.dll
C:\Windows\system32\hyyygwfd.dll
C:\Windows\system32\ipbadnll.dll
C:\Windows\system32\khfeeec.dll
C:\Windows\system32\mcudggop.dll
C:\Windows\system32\mljifed.dll
C:\Windows\system32\ojwbihjg.dll
C:\Windows\system32\opnopop.dll
C:\Windows\system32\oqlxrner.dll
C:\Windows\system32\oxgsqvfq.dll
C:\Windows\system32\pljouhye.dll
C:\Windows\system32\qemqoect.dll
C:\Windows\system32\thphrrwv.dll
C:\Windows\system32\tlpyiuyc.dll
C:\Windows\system32\tmp.reg
C:\Windows\system32\trdcagwh.dll
C:\Windows\system32\urqnlml.dll
C:\Windows\system32\worwvgqh.dll
C:\Windows\system32\wsohikyb.dll
C:\Windows\system32\xbnejgqb.dll
C:\Windows\system32\xikoycmc.dll
.

Unable to gain System Privileges

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\6601.bat
C:\Documents and Settings\All Users\Start Menu\Live Safety Center.lnk
C:\Documents and Settings\All Users\Start Menu\Online Security Guide.lnk
C:\Documents and Settings\Lyn Walkerden\Favorites\Online Security Guide.lnk
C:\Windows\system32\bhxqvysv.dll
C:\Windows\system32\bvnwnvkq.dll
C:\Windows\system32\bwncmewk.dll
C:\Windows\system32\dehdgaua.dll
C:\Windows\system32\diavxbok.dll
C:\Windows\system32\fcccbyy.dll
C:\Windows\system32\gdbmpxda.dll
C:\Windows\system32\hugyfydx.dll
C:\Windows\system32\hyyygwfd.dll
C:\Windows\system32\ipbadnll.dll
C:\Windows\system32\khfeeec.dll
C:\Windows\system32\mcudggop.dll
C:\Windows\system32\mljifed.dll
C:\Windows\system32\ojwbihjg.dll
C:\Windows\system32\opnopop.dll
C:\Windows\system32\oqlxrner.dll
C:\Windows\system32\oxgsqvfq.dll
C:\Windows\system32\pljouhye.dll
C:\Windows\system32\qemqoect.dll
C:\Windows\system32\qpqru.ini
C:\Windows\system32\qpqru.ini2
C:\Windows\system32\thphrrwv.dll
C:\Windows\system32\tlpyiuyc.dll
C:\Windows\system32\tmp.reg
C:\Windows\system32\trdcagwh.dll
C:\Windows\system32\urqnlml.dll
C:\WINDOWS\system32\urqpq.dll
C:\WINDOWS\system32\weoohjch.dllbox
C:\Windows\system32\worwvgqh.dll
C:\Windows\system32\wsohikyb.dll
C:\Windows\system32\xbnejgqb.dll
C:\Windows\system32\xikoycmc.dll
C:\WINDOWS\system32\xtiogqqr.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_DOMAINSERVICE
-------\DomainService


((((((((((((((((((((((((( Files Created from 2007-10-13 to 2007-11-13 )))))))))))))))))))))))))))))))
.

2007-11-14 08:42 85,056 --a------ C:\Windows\system32\ayuqgtgl.dll
2007-11-14 08:36 80,448 --a------ C:\Windows\system32\jsoduvcn.dll
2007-11-14 08:34 145,984 --a------ C:\Windows\system32\weoohjch.dll
2007-11-14 08:33 145,984 --a------ C:\Windows\system32\mbfjdhtb.dll
2007-11-14 08:33 71,232 --a------ C:\Windows\system32\mnasfclp.exe
2007-11-13 17:08 <DIR> d-------- C:\Program Files\CCleaner
2007-11-12 16:54 51,200 --a------ C:\Windows\NirCmd.exe
2007-11-10 19:39 <DIR> d-------- C:\Program Files\Trend Micro
2007-11-09 15:40 <DIR> d-------- C:\Documents and Settings\NetworkService\Application Data\Talkback
2007-11-09 15:19 83,096 --a------ C:\Windows\system32\SSSensor.dll
2007-11-09 15:19 60,496 --a------ C:\Windows\system32\drivers\Teefer.sys
2007-11-09 15:19 21,075 --a------ C:\Windows\system32\drivers\wpsdrvnt.sys
2007-11-09 15:19 14,568 --a------ C:\Windows\system32\drivers\wg6n.sys
2007-11-09 15:19 14,568 --a------ C:\Windows\system32\drivers\wg5n.sys
2007-11-09 15:19 14,568 --a------ C:\Windows\system32\drivers\wg4n.sys
2007-11-09 15:19 14,568 --a------ C:\Windows\system32\drivers\wg3n.sys
2007-11-09 15:18 <DIR> d-------- C:\Program Files\Sygate
2007-11-08 19:30 <DIR> d-------- C:\Windows\system32\ActiveScan
2007-11-08 17:57 102,664 --a------ C:\Windows\system32\drivers\tmcomm.sys
2007-11-08 17:56 <DIR> d-------- C:\Documents and Settings\Lyn Walkerden\.housecall6.6
2007-11-08 14:03 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-07 19:22 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-11-07 19:09 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-11-06 15:49 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Adobe Systems
2007-11-05 12:57 <DIR> d-------- C:\Program Files\Enigma Software Group
2007-11-05 08:55 <DIR> d---s---- C:\Documents and Settings\Administrator\UserData
2007-11-03 10:08 <DIR> d-------- C:\Windows\pss
2007-11-02 17:49 <DIR> d--hs---- C:\found.000
2007-11-02 15:44 147,456 --a------ C:\Windows\system32\vbzip10.dll
2007-11-02 15:40 <DIR> d-------- C:\Windows\system32\Mz18r
2007-11-02 15:40 <DIR> d-------- C:\Temp\mZOr
2007-10-24 23:28 <DIR> d-------- C:\Program Files\Common Files\Adobe Systems Shared
2007-10-17 22:19 <DIR> d-------- C:\Program Files\Kidwidget
2007-10-17 22:17 286,720 --------- C:\Windows\Setup1.exe
2007-10-17 22:17 73,216 --a------ C:\Windows\ST6UNST.EXE
2007-10-17 22:13 733,696 --a------ C:\Windows\GPInstall.exe
2007-10-17 21:58 <DIR> d-------- C:\LITTLEFI
2007-10-17 21:54 <DIR> d-------- C:\Program Files\Shape Art
2007-10-17 21:52 <DIR> d--hs---- C:\Windows\ftpcache
2007-10-17 21:51 <DIR> d-------- C:\Program Files\AlbyMedia
2007-10-17 21:42 <DIR> d-------- C:\Program Files\ABC-Ware
2007-10-16 16:31 <DIR> d-------- C:\Walkerden Resource Pty Ltd
2007-10-16 16:25 <DIR> d-------- C:\MYOBODBC
2007-10-16 16:21 <DIR> d-------- C:\Program Files\MYOB
2007-10-16 16:21 <DIR> d-------- C:\myob17

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-13 22:47 --------- d-----w C:\Program Files\Symantec AntiVirus
2007-11-13 05:55 --------- d-----w C:\Program Files\Java
2007-11-10 21:13 --------- d-----w C:\Program Files\Lavasoft
2007-11-10 21:13 --------- d-----w C:\Documents and Settings\Lyn Walkerden\Application Data\Lavasoft
2007-11-10 07:39 --------- d-----w C:\Program Files\Common Files\Real
2007-11-08 10:18 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2007-11-08 10:15 --------- d-----w C:\Program Files\Battery miser
2007-11-08 09:00 --------- d-----w C:\Program Files\On Screen Display
2007-11-08 08:59 --------- d-----w C:\Program Files\IP Operator
2007-11-06 10:20 --------- d-----w C:\Program Files\Logitech
2007-11-03 02:24 --------- d-----w C:\Program Files\Nokia
2007-11-02 04:44 278,538 ----a-w C:\WINDOWS\Fonts\Setup.exe
2007-10-27 05:24 --------- d-----w C:\Program Files\Virtools Web Player 3.5
2007-10-24 12:26 --------- d-----w C:\Program Files\Common Files\Adobe
2007-10-06 07:10 --------- d-----w C:\Program Files\Minisebran
2007-10-05 22:21 --------- d-----w C:\Program Files\Sebran
2007-09-14 08:02 --------- d-----w C:\Program Files\Playground Radio
2007-09-14 07:12 --------- d-----w C:\Program Files\iTunes
2007-09-14 07:11 --------- d-----w C:\Program Files\iPod
2007-09-14 06:45 --------- d-----w C:\Program Files\Apple Software Update
.

((((((((((((((((((((((((((((( snapshot@2007-11-12_19.21.53.48 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-03-13 14:31:24 135,168 ----a-w C:\WINDOWS\system32\java.exe
+ 2007-09-24 11:30:28 135,168 ----a-w C:\WINDOWS\system32\java.exe
- 2007-03-13 14:31:28 135,168 ----a-w C:\WINDOWS\system32\javaw.exe
+ 2007-09-24 11:30:30 135,168 ----a-w C:\WINDOWS\system32\javaw.exe
- 2007-03-13 16:04:46 139,264 ----a-w C:\WINDOWS\system32\javaws.exe
+ 2007-09-24 12:31:42 139,264 ----a-w C:\WINDOWS\system32\javaws.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{83552a75-4b15-4c46-9978-d77fac05f045}]
2007-11-14 08:36 80448 --a------ C:\WINDOWS\system32\jsoduvcn.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A95B2816-1D7E-4561-A202-68C0DE02353A}]
2007-11-14 08:34 145984 --a------ C:\WINDOWS\system32\weoohjch.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{11A69AE4-FBED-4832-A2BF-45AF82825583}"= C:\WINDOWS\system32\weoohjch.dll [2007-11-14 08:34 145984]

[HKEY_CLASSES_ROOT\CLSID\{11A69AE4-FBED-4832-A2BF-45AF82825583}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2003-10-02 16:37]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2003-10-02 16:19]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2003-09-12 17:19]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2003-09-12 17:18]
"AGRSMMSG"="AGRSMMSG.exe" [2003-03-31 15:54 C:\Windows\AGRSMMSG.exe]
"batterymiser"="C:\Program Files\Battery miser\batterymiser.exe" [2004-03-24 05:46]
"KeybdUtility"="C:\Program Files\On Screen Display\Hotkey.exe" [2004-05-25 12:15]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2005-06-03 03:21]
"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2005-06-24 13:27]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="C:\Program Files\Google\Gmail Notifier\gnotify.exe" [2005-07-16 08:48]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-07-20 08:14]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-12-08 17:35]
"InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [2004-03-04 02:47]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2005-12-09 16:32]
"LogitechCameraService(E)"="C:\WINDOWS\system32\ElkCtrl.exe" [2004-11-01 18:22]
"SmcService"="C:\PROGRA~1\Sygate\SPF\smc.exe" [2004-10-15 19:40]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]
"0c33614f"="C:\WINDOWS\system32\ayuqgtgl.dll" [2007-11-14 08:42]
"IPOperator"="C:\Program Files\IP Operator\IPOperator.exe" [2004-03-03 08:29]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 18:56]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runonce]
"FFTI"=C:\Documents and Settings\Lyn Walkerden\Application Data\Mozilla\Firefox\Profiles\unk0xsjt.default\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\ffti.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /DestPath="C:\Documents and Settings\Lyn Walkerden\Application Data\Mozilla\Firefox\Profiles/unk0xsjt.default\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\weoohjch]
weoohjch.dll 2007-11-14 08:34 145984 C:\Windows\system32\weoohjch.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk
backup=C:\WINDOWS\pss\Logitech Desktop Messenger.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LaCie Backup]
C:\Program Files\LaCie\Backup Software\\LaCieBackup.exe /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LDM]
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechCameraAssistant]
C:\Program Files\Logitech\Video\CameraAssistant.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideo[inspector]]
C:\Program Files\Logitech\Video\InstallHelper.exe /inspect

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
"C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\QTTask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
"C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1

R3 EraserUtilDrv10733;EraserUtilDrv10733;\??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv10733.sys
R3 lgsnd_filter;lgsnd_filter;C:\WINDOWS\system32\drivers\lgsnd_filter.sys
R3 LVPrcMon;Logitech LVPrcMon Driver;\??\C:\WINDOWS\system32\drivers\LVPrcMon.sys
R3 tifm;tifm;C:\WINDOWS\system32\drivers\tifm.sys
S3 SF-620;Kingsun SF-620 USB Infrared Adapter;C:\WINDOWS\system32\DRIVERS\SF-620.sys

.
Contents of the 'Scheduled Tasks' folder
"2007-09-29 13:11:12 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2004-03-26 20:01:46 C:\WINDOWS\Tasks\Critical Battery Alarm Program.job"
"2004-03-26 20:01:46 C:\WINDOWS\Tasks\Low Battery Alarm Program.job"
.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-14 09:48:08
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-14 9:55:04 - machine was rebooted
C:\ComboFix2.txt ... 2007-11-13 19:06
C:\ComboFix3.txt ... 2007-11-12 21:27
.
--- E O F ---



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:56:04 AM, on 14/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\S24EvMon.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\RegSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Battery miser\batterymiser.exe
C:\Program Files\On Screen Display\Hotkey.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\WINDOWS\system32\ElkCtrl.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\IP Operator\IPOperator.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://mail.google.com/mail/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://pac.schools.nsw.edu.au/schools/ashcroft-p.pac
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: {540f50ca-f77d-8799-64c4-51b457a25538} - {83552a75-4b15-4c46-9978-d77fac05f045} - C:\WINDOWS\system32\jsoduvcn.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {A95B2816-1D7E-4561-A202-68C0DE02353A} - C:\WINDOWS\system32\weoohjch.dll
O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\system32\weoohjch.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [batterymiser] C:\Program Files\Battery miser\batterymiser.exe
O4 - HKLM\..\Run: [KeybdUtility] "C:\Program Files\On Screen Display\Hotkey.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechCameraService(E)] C:\WINDOWS\system32\ElkCtrl.exe /automation
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [0c33614f] rundll32.exe "C:\WINDOWS\system32\ayuqgtgl.dll",b
O4 - HKLM\..\Run: [IPOperator] "C:\Program Files\IP Operator\IPOperator.exe" -aUtOsTaRtFrOmReG
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\RunOnce: [FFTI] C:\Documents and Settings\Lyn Walkerden\Application Data\Mozilla\Firefox\Profiles\unk0xsjt.default\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\ffti.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /DestPath="C:\Documents and Settings\Lyn Walkerden\Application Data\Mozilla\Firefox\Profiles/unk0xsjt.default\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}"
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://groups.msn.com/controls/PhotoUC/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1126924212568
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} - http://a532.g.akamai.net/f/532/6712/5m/vir...l/installer.exe
O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://www.babysfirstsite.com/members/XUpload.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{36FBFC76-AF04-4A7A-BFB1-BF242B2BB2DC}: NameServer = 203.0.178.191
O20 - Winlogon Notify: weoohjch - C:\WINDOWS\SYSTEM32\weoohjch.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

--
End of file - 9877 bytes

Thanks,

Lyn

#10 SifuMike

SifuMike

    malware expert


  • Staff Emeritus
  • 15,385 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Vancouver (not BC) WA (Not DC) USA
  • Local time:09:35 AM

Posted 13 November 2007 - 06:32 PM

Hi LYN,

This computer has lots of malware on it. :thumbsup:

Click Start, then Run and type Notepad and click OK.
Open notepad - don't use any other text editor than notepad or the script will fail.
Copy/paste the text in the code box below into notepad:

File:: 
C:\Program Files\IP Operator\IPOperator.exe
C:\Windows\system32\ayuqgtgl.dll
C:\Windows\system32\jsoduvcn.dll
C:\Windows\system32\weoohjch.dll
C:\Windows\system32\mbfjdhtb.dll
C:\Windows\system32\mnasfclp.exe
C:\WINDOWS\Fonts\Setup.exe

Registry:: 
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{83552a75-4b15-4c46-9978-d77fac05f045}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A95B2816-1D7E-4561-A202-68C0DE02353A}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{11A69AE4-FBED-4832-A2BF-45AF82825583}"=- 
[-HKEY_CLASSES_ROOT\CLSID\{11A69AE4-FBED-4832-A2BF-45AF82825583}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"0c33614f"=-
"IPOperator"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\weoohjch]


Name the Notepad file CFScript.txt and Save it to your desktop.

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.


Posted Image

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.

Edited by SifuMike, 13 November 2007 - 06:42 PM.

If I've saved you time & money,
please make a donation so I can keep helping people just like you! You can donate using a credit card and PayPal. Thank you!



Posted Image

Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#11 **LYN**

**LYN**
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:03:35 AM

Posted 14 November 2007 - 12:22 AM

Hi again,

That doesn't sound good! :thumbsup:

Here are the logs you requested.

ComboFix 07-11-08.1 - Lyn Walkerden 2007-11-14 15:52:25.6 - NTFSx86
Running from: C:\Documents and Settings\Lyn Walkerden\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Lyn Walkerden\Desktop\CFScript.txt
* Created a new restore point

FILE
C:\Program Files\IP Operator\IPOperator.exe
C:\WINDOWS\Fonts\Setup.exe
C:\Windows\system32\ayuqgtgl.dll
C:\Windows\system32\jsoduvcn.dll
C:\Windows\system32\mbfjdhtb.dll
C:\Windows\system32\mnasfclp.exe
C:\Windows\system32\weoohjch.dll
.

Unable to gain System Privileges

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\IP Operator\IPOperator.exe
C:\WINDOWS\Fonts\Setup.exe
C:\Windows\system32\ayuqgtgl.dll
C:\Windows\system32\jsoduvcn.dll
C:\Windows\system32\mbfjdhtb.dll
C:\Windows\system32\mnasfclp.exe
C:\Windows\system32\weoohjch.dll
C:\WINDOWS\system32\weoohjch.dllbox

.
((((((((((((((((((((((((( Files Created from 2007-10-14 to 2007-11-14 )))))))))))))))))))))))))))))))
.

2007-11-13 17:08 <DIR> d-------- C:\Program Files\CCleaner
2007-11-12 16:54 51,200 --a------ C:\Windows\NirCmd.exe
2007-11-10 19:39 <DIR> d-------- C:\Program Files\Trend Micro
2007-11-09 15:40 <DIR> d-------- C:\Documents and Settings\NetworkService\Application Data\Talkback
2007-11-09 15:19 83,096 --a------ C:\Windows\system32\SSSensor.dll
2007-11-09 15:19 60,496 --a------ C:\Windows\system32\drivers\Teefer.sys
2007-11-09 15:19 21,075 --a------ C:\Windows\system32\drivers\wpsdrvnt.sys
2007-11-09 15:19 14,568 --a------ C:\Windows\system32\drivers\wg6n.sys
2007-11-09 15:19 14,568 --a------ C:\Windows\system32\drivers\wg5n.sys
2007-11-09 15:19 14,568 --a------ C:\Windows\system32\drivers\wg4n.sys
2007-11-09 15:19 14,568 --a------ C:\Windows\system32\drivers\wg3n.sys
2007-11-09 15:18 <DIR> d-------- C:\Program Files\Sygate
2007-11-08 19:30 <DIR> d-------- C:\Windows\system32\ActiveScan
2007-11-08 17:57 102,664 --a------ C:\Windows\system32\drivers\tmcomm.sys
2007-11-08 17:56 <DIR> d-------- C:\Documents and Settings\Lyn Walkerden\.housecall6.6
2007-11-08 14:03 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-07 19:22 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-11-07 19:09 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-11-06 15:49 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Adobe Systems
2007-11-05 12:57 <DIR> d-------- C:\Program Files\Enigma Software Group
2007-11-05 08:55 <DIR> d---s---- C:\Documents and Settings\Administrator\UserData
2007-11-03 10:08 <DIR> d-------- C:\Windows\pss
2007-11-02 17:49 <DIR> d--hs---- C:\found.000
2007-11-02 15:44 147,456 --a------ C:\Windows\system32\vbzip10.dll
2007-11-02 15:40 <DIR> d-------- C:\Windows\system32\Mz18r
2007-11-02 15:40 <DIR> d-------- C:\Temp\mZOr
2007-10-24 23:28 <DIR> d-------- C:\Program Files\Common Files\Adobe Systems Shared
2007-10-17 22:19 <DIR> d-------- C:\Program Files\Kidwidget
2007-10-17 22:17 286,720 --------- C:\Windows\Setup1.exe
2007-10-17 22:17 73,216 --a------ C:\Windows\ST6UNST.EXE
2007-10-17 22:13 733,696 --a------ C:\Windows\GPInstall.exe
2007-10-17 21:58 <DIR> d-------- C:\LITTLEFI
2007-10-17 21:54 <DIR> d-------- C:\Program Files\Shape Art
2007-10-17 21:52 <DIR> d--hs---- C:\Windows\ftpcache
2007-10-17 21:51 <DIR> d-------- C:\Program Files\AlbyMedia
2007-10-17 21:42 <DIR> d-------- C:\Program Files\ABC-Ware
2007-10-16 16:31 <DIR> d-------- C:\Walkerden Resource Pty Ltd
2007-10-16 16:25 <DIR> d-------- C:\MYOBODBC
2007-10-16 16:21 <DIR> d-------- C:\Program Files\MYOB
2007-10-16 16:21 <DIR> d-------- C:\myob17

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-14 05:04 --------- d-----w C:\Program Files\Symantec AntiVirus
2007-11-14 05:00 --------- d-----w C:\Program Files\IP Operator
2007-11-13 05:55 --------- d-----w C:\Program Files\Java
2007-11-10 21:13 --------- d-----w C:\Program Files\Lavasoft
2007-11-10 21:13 --------- d-----w C:\Documents and Settings\Lyn Walkerden\Application Data\Lavasoft
2007-11-10 07:39 --------- d-----w C:\Program Files\Common Files\Real
2007-11-08 10:18 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2007-11-08 10:15 --------- d-----w C:\Program Files\Battery miser
2007-11-08 09:00 --------- d-----w C:\Program Files\On Screen Display
2007-11-06 10:20 --------- d-----w C:\Program Files\Logitech
2007-11-03 02:24 --------- d-----w C:\Program Files\Nokia
2007-10-27 05:24 --------- d-----w C:\Program Files\Virtools Web Player 3.5
2007-10-24 12:26 --------- d-----w C:\Program Files\Common Files\Adobe
2007-10-06 07:10 --------- d-----w C:\Program Files\Minisebran
2007-10-05 22:21 --------- d-----w C:\Program Files\Sebran
2007-09-14 08:02 --------- d-----w C:\Program Files\Playground Radio
2007-09-14 07:12 --------- d-----w C:\Program Files\iTunes
2007-09-14 07:11 --------- d-----w C:\Program Files\iPod
2007-09-14 06:45 --------- d-----w C:\Program Files\Apple Software Update
.

((((((((((((((((((((((((((((( snapshot@2007-11-12_19.21.53.48 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-03-13 14:31:24 135,168 ----a-w C:\WINDOWS\system32\java.exe
+ 2007-09-24 11:30:28 135,168 ----a-w C:\WINDOWS\system32\java.exe
- 2007-03-13 14:31:28 135,168 ----a-w C:\WINDOWS\system32\javaw.exe
+ 2007-09-24 11:30:30 135,168 ----a-w C:\WINDOWS\system32\javaw.exe
- 2007-03-13 16:04:46 139,264 ----a-w C:\WINDOWS\system32\javaws.exe
+ 2007-09-24 12:31:42 139,264 ----a-w C:\WINDOWS\system32\javaws.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2003-10-02 16:37]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2003-10-02 16:19]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2003-09-12 17:19]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2003-09-12 17:18]
"AGRSMMSG"="AGRSMMSG.exe" [2003-03-31 15:54 C:\Windows\AGRSMMSG.exe]
"batterymiser"="C:\Program Files\Battery miser\batterymiser.exe" [2004-03-24 05:46]
"KeybdUtility"="C:\Program Files\On Screen Display\Hotkey.exe" [2004-05-25 12:15]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2005-06-03 03:21]
"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2005-06-24 13:27]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="C:\Program Files\Google\Gmail Notifier\gnotify.exe" [2005-07-16 08:48]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-07-20 08:14]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-12-08 17:35]
"InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [2004-03-04 02:47]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2005-12-09 16:32]
"LogitechCameraService(E)"="C:\WINDOWS\system32\ElkCtrl.exe" [2004-11-01 18:22]
"SmcService"="C:\PROGRA~1\Sygate\SPF\smc.exe" [2004-10-15 19:40]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 18:56]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runonce]
"FFTI"=C:\Documents and Settings\Lyn Walkerden\Application Data\Mozilla\Firefox\Profiles\unk0xsjt.default\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\ffti.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /DestPath="C:\Documents and Settings\Lyn Walkerden\Application Data\Mozilla\Firefox\Profiles/unk0xsjt.default\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk
backup=C:\WINDOWS\pss\Logitech Desktop Messenger.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LaCie Backup]
C:\Program Files\LaCie\Backup Software\\LaCieBackup.exe /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LDM]
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechCameraAssistant]
C:\Program Files\Logitech\Video\CameraAssistant.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideo[inspector]]
C:\Program Files\Logitech\Video\InstallHelper.exe /inspect

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
"C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\QTTask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
"C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1

R3 lgsnd_filter;lgsnd_filter;C:\WINDOWS\system32\drivers\lgsnd_filter.sys
R3 LVPrcMon;Logitech LVPrcMon Driver;\??\C:\WINDOWS\system32\drivers\LVPrcMon.sys
R3 tifm;tifm;C:\WINDOWS\system32\drivers\tifm.sys
S3 SF-620;Kingsun SF-620 USB Infrared Adapter;C:\WINDOWS\system32\DRIVERS\SF-620.sys

.
Contents of the 'Scheduled Tasks' folder
"2007-09-29 13:11:12 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2004-03-26 20:01:46 C:\WINDOWS\Tasks\Critical Battery Alarm Program.job"
"2004-03-26 20:01:46 C:\WINDOWS\Tasks\Low Battery Alarm Program.job"
.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-14 16:06:09
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-14 16:11:44 - machine was rebooted
C:\ComboFix2.txt ... 2007-11-14 09:55
C:\ComboFix3.txt ... 2007-11-13 19:06
.
--- E O F ---


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:16:18 PM, on 14/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\S24EvMon.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\RegSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Battery miser\batterymiser.exe
C:\Program Files\On Screen Display\Hotkey.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\WINDOWS\system32\ElkCtrl.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://mail.google.com/mail/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://pac.schools.nsw.edu.au/schools/ashcroft-p.pac
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [batterymiser] C:\Program Files\Battery miser\batterymiser.exe
O4 - HKLM\..\Run: [KeybdUtility] "C:\Program Files\On Screen Display\Hotkey.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechCameraService(E)] C:\WINDOWS\system32\ElkCtrl.exe /automation
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\RunOnce: [FFTI] C:\Documents and Settings\Lyn Walkerden\Application Data\Mozilla\Firefox\Profiles\unk0xsjt.default\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\ffti.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /DestPath="C:\Documents and Settings\Lyn Walkerden\Application Data\Mozilla\Firefox\Profiles/unk0xsjt.default\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}"
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://groups.msn.com/controls/PhotoUC/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1126924212568
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} - http://a532.g.akamai.net/f/532/6712/5m/vir...l/installer.exe
O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://www.babysfirstsite.com/members/XUpload.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{36FBFC76-AF04-4A7A-BFB1-BF242B2BB2DC}: NameServer = 203.0.178.191
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

--
End of file - 9257 bytes


Lyn

#12 SifuMike

SifuMike

    malware expert


  • Staff Emeritus
  • 15,385 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Vancouver (not BC) WA (Not DC) USA
  • Local time:09:35 AM

Posted 14 November 2007 - 12:53 AM

Hi LYN,

Now your log looks much better. :thumbsup:

Select the following with HijackThis.
With all windows (including this one!) closed (close browser/explorer windows), please select "fix checked"

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

Reboot and post a fresh Hijackthis log.
If I've saved you time & money,
please make a donation so I can keep helping people just like you! You can donate using a credit card and PayPal. Thank you!



Posted Image

Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#13 **LYN**

**LYN**
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:03:35 AM

Posted 14 November 2007 - 02:27 AM

Good to know the news isn't all bad :thumbsup:



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:25:07 PM, on 14/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\S24EvMon.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\RegSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Battery miser\batterymiser.exe
C:\Program Files\On Screen Display\Hotkey.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\WINDOWS\system32\ElkCtrl.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://mail.google.com/mail/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://pac.schools.nsw.edu.au/schools/ashcroft-p.pac
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [batterymiser] C:\Program Files\Battery miser\batterymiser.exe
O4 - HKLM\..\Run: [KeybdUtility] "C:\Program Files\On Screen Display\Hotkey.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechCameraService(E)] C:\WINDOWS\system32\ElkCtrl.exe /automation
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\RunOnce: [FFTI] C:\Documents and Settings\Lyn Walkerden\Application Data\Mozilla\Firefox\Profiles\unk0xsjt.default\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\ffti.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /DestPath="C:\Documents and Settings\Lyn Walkerden\Application Data\Mozilla\Firefox\Profiles/unk0xsjt.default\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}"
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://groups.msn.com/controls/PhotoUC/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1126924212568
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} - http://a532.g.akamai.net/f/532/6712/5m/vir...l/installer.exe
O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://www.babysfirstsite.com/members/XUpload.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{36FBFC76-AF04-4A7A-BFB1-BF242B2BB2DC}: NameServer = 203.0.178.191
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

--
End of file - 9273 bytes

Lyn

#14 SifuMike

SifuMike

    malware expert


  • Staff Emeritus
  • 15,385 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Vancouver (not BC) WA (Not DC) USA
  • Local time:09:35 AM

Posted 14 November 2007 - 08:31 AM

Hi Lyn,

Your log looks clean! :thumbsup: Good job on the cleanup!

Uninstall ComboFix, go to to Start > Run & type in ComboFix /u
Make sure there's a space between Combofix and /
Then hit enter.

This will uninstall Combofix, delete its related folders and files, reset your clock settings, hide file extensions, hide the system/hidden files and resets System Restore again.

Please read and follow Groovicus' Guide to Simple PC Security to help keep yourself from becoming infected again, as well as
How did I get infected?, With steps so it does not happen again!
as well as
How to prevent Malware' by miekiemoes


If you want to improve speed/system performance after malware removal, take a look here.

Edited by SifuMike, 14 November 2007 - 08:32 AM.

If I've saved you time & money,
please make a donation so I can keep helping people just like you! You can donate using a credit card and PayPal. Thank you!



Posted Image

Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#15 **LYN**

**LYN**
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:03:35 AM

Posted 15 November 2007 - 05:29 AM

Thank you, thank you, thank you!! :thumbsup:

Everything seems to be working perfectly. :blink:

I will be making a donation over the weekend.

I really appreciate your help.

Lyn




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users