Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Infected With Fake Security Centre, Virtumonde


  • This topic is locked This topic is locked
18 replies to this topic

#1 jaypeedu

jaypeedu

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:11:30 AM

Posted 22 November 2007 - 01:57 AM

hi, have been infected with a number of trojans that i have struggled to clear.
inital problem was fake security centre appearing (red cross in tool bar) bringing up ulimate defender/cleaner (with what is ultimate fixer on the side of the page)
thought i had cleared this following a blog which listed the process of going throughAVG, SS&D, AD aware, Ccleaner, antirootkit, combofix. But it didn't seem to sort the problem. also ran stinger, error killer, smitfraud, fixvundo as well as any others i could get my hands on!
then ended up buying spyware doc (having read a good review about it remoing ultimate fixer) and it found 5 trojans, all of which it claimed to delete apart from one, virtumonde, which it said it was unable to. went into safe mode and it picked up two others (which hadn't been there, but no mention of virtumonde now)
so it looked like i had cleared them, as no more balloon, but when i go to iexplorer spyware doctor brings up a malicious attempt from virtuamonde (pogram files MWSQGVQC/DEHElWXJ.dll this am and pmnnm.dll yesterday i think).
I understand if you feel i should go right back to the beginning again and follow your exact instructions, but i think i have done everything required to superficially clear them and am reluctant to keep going on line to pick up new programmes for fear of unwanted information being shared with a third party!
please find below my hijackthis log
thanks

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:54:17, on 22/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\msdtc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\WINDOWS\Explorer.EXE
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\mqsvc.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\Program Files\Windows Media Player\WMPNetwk.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\RunDll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\System\CmFlywav.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System\CMAS2DS.EXE
C:\WINDOWS\System32\alg.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...n&pf=laptop
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {158A95B4-1F79-3B06-78BF-0424CDB17C2E} - C:\Program Files\Nprtttww\ifywqkfx.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: (no name) - {200D0AAD-71B1-51C9-DDB0-092BA4662A54} - C:\Program Files\Mwsqgvqs\dehhwxyj.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Flash Module - {C87FA4A3-2474-4a3f-B413-67D515905024} - rasmoesa.dll (file missing)
O2 - BHO: gFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: FlashGet - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\Program Files\FlashGet\fgiebar.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [PDF4 Registry Controller] "C:\Program Files\ScanSoft\PDF Professional 4.0\\RegistryController.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Cmaudiow] RunDll32 cmcnfgw.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [mount.exe] C:\Program Files\GiPo@Utilities\GiPo@FileUtilities\mount.exe /z
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Open with ScanSoft PDF Converter 4.0 - res://C:\Program Files\ScanSoft\PDF Professional 4.0\cnvres_eng.dll /100
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_SG&c=64&bd=pavilion&pf=laptop
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC...bin/AvSniff.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by122fd.bay122.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo...otoUploader.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1165715353343
O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - http://drmlicense.one.microsoft.com/crlupdate/en/crlocx.ocx
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

--
End of file - 15032 bytes

as i said, if i should go through all the same process again

BC AdBot (Login to Remove)

 


m

#2 MoNsTeReNeRgY22

MoNsTeReNeRgY22

    1337 Malware Destroyer


  • Members
  • 611 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:30 PM

Posted 26 November 2007 - 01:03 AM

Hello and Welcome to Bleeping Computer.

I am MoNsTeReNeRgY22 and I will be assisting you with your malware problem today.

Please give me some time to analyze your log, and I will post back with instructions ASAP.


Posted Image


#3 MoNsTeReNeRgY22

MoNsTeReNeRgY22

    1337 Malware Destroyer


  • Members
  • 611 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:30 PM

Posted 28 November 2007 - 02:40 AM

Hello jaypeedu,

Download SDFix and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in Safe Mode by doing the following :
  • Restart your computer
  • After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
  • Instead of Windows loading as normal, the Advanced Options Menu should appear;
  • Select the first option, to run Windows in Safe Mode, then press Enter.
  • Choose your usual account.
  • Open the extracted SDFix folder and double click RunThis.bat to start the script.
  • Type Y to begin the cleanup process.
  • It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
  • Press any Key and it will restart the PC.
  • When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
  • Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
    (Report.txt will also be copied to Clipboard ready for posting back on the forum).
  • Finally paste the contents of the Report.txt back on the forum with a new HijackThis log


Posted Image


#4 jaypeedu

jaypeedu
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:11:30 AM

Posted 04 December 2007 - 10:03 PM

My SDfix log is:

SDFix: Version 1.116

Run by Jeremy Pallot on 05/12/2007 at 13:34

Microsoft Windows XP [Version 5.1.2600]

Running From: C:\DOCUME~1\JEREMY~1\Desktop\SDFix

Safe Mode:
Checking Services:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


Normal Mode:
Checking Files:

Trojan Files Found:

C:\WINDOWS\system32\cmds.txt - Deleted
C:\WINDOWS\system32\cookie1.dat - Deleted
C:\WINDOWS\system32\ps1.dat - Deleted
C:\WINDOWS\system32\rc.dat - Deleted




Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.



Final Check:

catchme 0.3.1262.1 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-05 13:45:09
Windows 5.1.2600 Service Pack 2 NTFS

detected NTDLL code modification:
ZwClose

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:00000057

scanning hidden files ...

C:\Documents and Settings\Jeremy Pallot\Local Settings\Application Data\Microsoft\Messenger\jezpallot@hotmail.com\SharingMetadata\nonniegan@hotmail.com\DFSR\Staging\CS{215D5E17-612B-6C2B-74B3-571BC4A76613}\01\12-{215D5E17-612B-6C2B-74B3-571BC4A76613}-v1-{DD07B39F-0883-41A3-BF83-8C67E17296E9}-v12-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 8 bytes hidden from API
C:\Documents and Settings\Jeremy Pallot\Local Settings\Application Data\Microsoft\Messenger\jezpallot@hotmail.com\SharingMetadata\nonniegan@hotmail.com\DFSR\Staging\CS{215D5E17-612B-6C2B-74B3-571BC4A76613}\11\11-{57B9B1EF-7EE0-4AFA-AC29-E7F5443B86CE}-v11-{57B9B1EF-7EE0-4AFA-AC29-E7F5443B86CE}-v11-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 136 bytes hidden from API
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Aortic dissection involving ostium of right coronary artery as the reason of myocardial infarction -- Horszczaruk et al_ 27 (5) 518 -- European Heart Journal_files\arrowTtrim.gif 51 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Aortic dissection involving ostium of right coronary artery as the reason of myocardial infarction -- Horszczaruk et al_ 27 (5) 518 -- European Heart Journal_files\callback.js 1792 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Aortic dissection involving ostium of right coronary artery as the reason of myocardial infarction -- Horszczaruk et al_ 27 (5) 518 -- European Heart Journal_files\ehi52501.gif 146658 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Aortic dissection involving ostium of right coronary artery as the reason of myocardial infarction -- Horszczaruk et al_ 27 (5) 518 -- European Heart Journal_files\eurheartj.css 437 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Aortic dissection involving ostium of right coronary artery as the reason of myocardial infarction -- Horszczaruk et al_ 27 (5) 518 -- European Heart Journal_files\go.gif 279 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Aortic dissection involving ostium of right coronary artery as the reason of myocardial infarction -- Horszczaruk et al_ 27 (5) 518 -- European Heart Journal_files\hw.css 18970 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Aortic dissection involving ostium of right coronary artery as the reason of myocardial infarction -- Horszczaruk et al_ 27 (5) 518 -- European Heart Journal_files\lstrok.gif 77 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Aortic dissection involving ostium of right coronary artery as the reason of myocardial infarction -- Horszczaruk et al_ 27 (5) 518 -- European Heart Journal_files\main.js 4084 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Aortic dissection involving ostium of right coronary artery as the reason of myocardial infarction -- Horszczaruk et al_ 27 (5) 518 -- European Heart Journal_files\nacute.gif 89 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Aortic dissection involving ostium of right coronary artery as the reason of myocardial infarction -- Horszczaruk et al_ 27 (5) 518 -- European Heart Journal_files\print.css 133 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Aortic dissection involving ostium of right coronary artery as the reason of myocardial infarction -- Horszczaruk et al_ 27 (5) 518 -- European Heart Journal_files\sim.gif 155 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Aortic dissection involving ostium of right coronary artery as the reason of myocardial infarction -- Horszczaruk et al_ 27 (5) 518 -- European Heart Journal_files\spacer.gif 43 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Aortic dissection involving ostium of right coronary artery as the reason of myocardial infarction -- Horszczaruk et al_ 27 (5) 518 -- European Heart Journal_files\Thumbs.db 7680 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Aortic dissection involving ostium of right coronary artery as the reason of myocardial infarction -- Horszczaruk et al_ 27 (5) 518 -- European Heart Journal_files\Thumbs.db:encryptable 0 bytes hidden from API
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Aortic dissection involving ostium of right coronary artery as the reason of myocardial infarction -- Horszczaruk et al_ 27 (5) 518 -- European Heart Journal_files\utility.js 14971 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Aortic dissection involving ostium of right coronary artery as the reason of myocardial infarction -- Horszczaruk et al_ 27 (5) 518 -- European Heart Journal_files\xmlhttprequest.js 8394 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Pitfalls in diagnosis of aortic dissection by angi___[Comput Med Imaging Graph_ 1991 Nov-Dec] - PubMed Result_files\2873.css 6670 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Pitfalls in diagnosis of aortic dissection by angi___[Comput Med Imaging Graph_ 1991 Nov-Dec] - PubMed Result_files\7008 44403 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Pitfalls in diagnosis of aortic dissection by angi___[Comput Med Imaging Graph_ 1991 Nov-Dec] - PubMed Result_files\bkgd.gif 1140 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Pitfalls in diagnosis of aortic dissection by angi___[Comput Med Imaging Graph_ 1991 Nov-Dec] - PubMed Result_files\conf_icon.gif 636 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Pitfalls in diagnosis of aortic dissection by angi___[Comput Med Imaging Graph_ 1991 Nov-Dec] - PubMed Result_files\http_--linkinghub.elsevier.com-ihub-images-PubMedLink.gif 1631 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Pitfalls in diagnosis of aortic dissection by angi___[Comput Med Imaging Graph_ 1991 Nov-Dec] - PubMed Result_files\myncbihelpicon.gif 1671 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Pitfalls in diagnosis of aortic dissection by angi___[Comput Med Imaging Graph_ 1991 Nov-Dec] - PubMed Result_files\ncbi_logo.gif 895 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Pitfalls in diagnosis of aortic dissection by angi___[Comput Med Imaging Graph_ 1991 Nov-Dec] - PubMed Result_files\ncbi_test.css 4885 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Pitfalls in diagnosis of aortic dissection by angi___[Comput Med Imaging Graph_ 1991 Nov-Dec] - PubMed Result_files\pixel.gif 49 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Pitfalls in diagnosis of aortic dissection by angi___[Comput Med Imaging Graph_ 1991 Nov-Dec] - PubMed Result_files\popupmenu2_7loader.js 31894 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Pitfalls in diagnosis of aortic dissection by angi___[Comput Med Imaging Graph_ 1991 Nov-Dec] - PubMed Result_files\portal.js 40090 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Pitfalls in diagnosis of aortic dissection by angi___[Comput Med Imaging Graph_ 1991 Nov-Dec] - PubMed Result_files\pubmed-www-nlm.gif 4070 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Pitfalls in diagnosis of aortic dissection by angi___[Comput Med Imaging Graph_ 1991 Nov-Dec] - PubMed Result_files\rss.gif 395 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Pitfalls in diagnosis of aortic dissection by angi___[Comput Med Imaging Graph_ 1991 Nov-Dec] - PubMed Result_files\tab_1st_left_bg.gif 245 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Pitfalls in diagnosis of aortic dissection by angi___[Comput Med Imaging Graph_ 1991 Nov-Dec] - PubMed Result_files\tab_1st_left_top.gif 111 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Pitfalls in diagnosis of aortic dissection by angi___[Comput Med Imaging Graph_ 1991 Nov-Dec] - PubMed Result_files\tab_active_left_bg.gif 204 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Pitfalls in diagnosis of aortic dissection by angi___[Comput Med Imaging Graph_ 1991 Nov-Dec] - PubMed Result_files\tab_active_left_top.gif 124 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Pitfalls in diagnosis of aortic dissection by angi___[Comput Med Imaging Graph_ 1991 Nov-Dec] - PubMed Result_files\tab_active_main_bg.gif 104 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Pitfalls in diagnosis of aortic dissection by angi___[Comput Med Imaging Graph_ 1991 Nov-Dec] - PubMed Result_files\tab_active_right_bg.gif 203 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Pitfalls in diagnosis of aortic dissection by angi___[Comput Med Imaging Graph_ 1991 Nov-Dec] - PubMed Result_files\tab_active_right_top.gif 179 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Pitfalls in diagnosis of aortic dissection by angi___[Comput Med Imaging Graph_ 1991 Nov-Dec] - PubMed Result_files\tab_active_top_bg.gif 101 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Pitfalls in diagnosis of aortic dissection by angi___[Comput Med Imaging Graph_ 1991 Nov-Dec] - PubMed Result_files\tab_last_right_top.gif 109 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Pitfalls in diagnosis of aortic dissection by angi___[Comput Med Imaging Graph_ 1991 Nov-Dec] - PubMed Result_files\tab_main_bg.gif 105 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Pitfalls in diagnosis of aortic dissection by angi___[Comput Med Imaging Graph_ 1991 Nov-Dec] - PubMed Result_files\tab_middle_bg.gif 372 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Pitfalls in diagnosis of aortic dissection by angi___[Comput Med Imaging Graph_ 1991 Nov-Dec] - PubMed Result_files\tab_middle_top.gif 126 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Pitfalls in diagnosis of aortic dissection by angi___[Comput Med Imaging Graph_ 1991 Nov-Dec] - PubMed Result_files\tab_top_bg.gif 66 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Pitfalls in diagnosis of aortic dissection by angi___[Comput Med Imaging Graph_ 1991 Nov-Dec] - PubMed Result_files\Thumbs.db 7168 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Pitfalls in diagnosis of aortic dissection by angi___[Comput Med Imaging Graph_ 1991 Nov-Dec] - PubMed Result_files\Thumbs.db:encryptable 0 bytes hidden from API
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Pitfalls in diagnosis of aortic dissection by angi___[Comput Med Imaging Graph_ 1991 Nov-Dec] - PubMed Result_files\transparent.gif 807 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Spontaneous coronary artery dissection -- Naughton et al_ 22 (12) 910 -- Emergency Medicine Journal_files\63623239386639333436386166363730.jpg 6607 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Spontaneous coronary artery dissection -- Naughton et al_ 22 (12) 910 -- Emergency Medicine Journal_files\arrowTtrim.gif 51 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Spontaneous coronary artery dissection -- Naughton et al_ 22 (12) 910 -- Emergency Medicine Journal_files\callback.js 1792 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Spontaneous coronary artery dissection -- Naughton et al_ 22 (12) 910 -- Emergency Medicine Journal_files\em21196.f1.gif 23903 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Spontaneous coronary artery dissection -- Naughton et al_ 22 (12) 910 -- Emergency Medicine Journal_files\fig-down.gif 820 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Spontaneous coronary artery dissection -- Naughton et al_ 22 (12) 910 -- Emergency Medicine Journal_files\free.gif 76 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Spontaneous coronary artery dissection -- Naughton et al_ 22 (12) 910 -- Emergency Medicine Journal_files\quicksearch.css 1399 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Spontaneous coronary artery dissection -- Naughton et al_ 22 (12) 910 -- Emergency Medicine Journal_files\spacer.gif 43 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Spontaneous coronary artery dissection -- Naughton et al_ 22 (12) 910 -- Emergency Medicine Journal_files\Thumbs.db 7168 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Spontaneous coronary artery dissection -- Naughton et al_ 22 (12) 910 -- Emergency Medicine Journal_files\Thumbs.db:encryptable 0 bytes hidden from API
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Spontaneous coronary artery dissection -- Naughton et al_ 22 (12) 910 -- Emergency Medicine Journal_files\title.gif 1640 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Spontaneous coronary artery dissection -- Naughton et al_ 22 (12) 910 -- Emergency Medicine Journal_files\urchin.js 21089 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Spontaneous coronary artery dissection -- Naughton et al_ 22 (12) 910 -- Emergency Medicine Journal_files\utility.js 14971 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Spontaneous coronary artery dissection -- Naughton et al_ 22 (12) 910 -- Emergency Medicine Journal_files\xmlhttprequest.js 8394 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Spontaneous dissection of native coronary arteries -- Butler et al_ 91 (2) 223 -- Heart_files\63623239386639333436386166363330.jpg 6607 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Spontaneous dissection of native coronary arteries -- Butler et al_ 91 (2) 223 -- Heart_files\arrowTtrim.gif 51 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Spontaneous dissection of native coronary arteries -- Butler et al_ 91 (2) 223 -- Heart_files\callback.js 1792 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Spontaneous dissection of native coronary arteries -- Butler et al_ 91 (2) 223 -- Heart_files\fig-down.gif 820 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Spontaneous dissection of native coronary arteries -- Butler et al_ 91 (2) 223 -- Heart_files\free.gif 76 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Spontaneous dissection of native coronary arteries -- Butler et al_ 91 (2) 223 -- Heart_files\homelink.gif 127 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Spontaneous dissection of native coronary arteries -- Butler et al_ 91 (2) 223 -- Heart_files\ht14423.f1.gif 28025 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Spontaneous dissection of native coronary arteries -- Butler et al_ 91 (2) 223 -- Heart_files\postgradmedj.gif 1080 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Spontaneous dissection of native coronary arteries -- Butler et al_ 91 (2) 223 -- Heart_files\quicksearch.css 1399 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Spontaneous dissection of native coronary arteries -- Butler et al_ 91 (2) 223 -- Heart_files\search_result.gif 3492 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Spontaneous dissection of native coronary arteries -- Butler et al_ 91 (2) 223 -- Heart_files\spacer.gif 43 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Spontaneous dissection of native coronary arteries -- Butler et al_ 91 (2) 223 -- Heart_files\Thumbs.db 7168 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Spontaneous dissection of native coronary arteries -- Butler et al_ 91 (2) 223 -- Heart_files\Thumbs.db:encryptable 0 bytes hidden from API
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Spontaneous dissection of native coronary arteries -- Butler et al_ 91 (2) 223 -- Heart_files\title.gif 1769 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Spontaneous dissection of native coronary arteries -- Butler et al_ 91 (2) 223 -- Heart_files\urchin.js 21089 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Spontaneous dissection of native coronary arteries -- Butler et al_ 91 (2) 223 -- Heart_files\utility.js 14971 bytes
C:\Documents and Settings\Jeremy Pallot\My Documents\Work\Portfolio Documents\4. Teaching and training, appraising and assessing\coronary dissection case study files\Spontaneous dissection of native coronary arteries -- Butler et al_ 91 (2) 223 -- Heart_files\xmlhttprequest.js 8394 bytes

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 78


Remaining Services:
------------------



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

Remaining Files:
---------------

File Backups: - C:\DOCUME~1\JEREMY~1\Desktop\SDFix\backups\backups.zip

Files with Hidden Attributes:

Sat 9 Dec 2006 22 A.SH. --- "C:\WINDOWS\SMINST\HPCD.sys"
Wed 31 Oct 2007 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"

Finished!


and my new hijack this log is:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:55:56, on 05/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\msdtc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\WINDOWS\system32\mqsvc.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Windows Media Player\WMPNetwk.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Softwin\BitDefender10\vsserv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Softwin\BitDefender10\bdagent.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\System\CmFlywav.exe
C:\WINDOWS\System\CMAS2DS.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...n&pf=laptop
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: gFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: FlashGet - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\Program Files\FlashGet\fgiebar.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [PDF4 Registry Controller] "C:\Program Files\ScanSoft\PDF Professional 4.0\\RegistryController.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Cmaudiow] RunDll32 cmcnfgw.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Open with ScanSoft PDF Converter 4.0 - res://C:\Program Files\ScanSoft\PDF Professional 4.0\cnvres_eng.dll /100
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_SG&c=64&bd=pavilion&pf=laptop
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC...bin/AvSniff.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by122fd.bay122.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo...otoUploader.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1165715353343
O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - http://drmlicense.one.microsoft.com/crlupdate/en/crlocx.ocx
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender10\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe

--
End of file - 14187 bytes

hope this can help sort. thanks again

#5 MoNsTeReNeRgY22

MoNsTeReNeRgY22

    1337 Malware Destroyer


  • Members
  • 611 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:30 PM

Posted 06 December 2007 - 12:30 AM

Hello again,

Step 1
Download Deckard's System Scanner (DSS) to your Desktop.
  • Close all applications and windows.
  • Double-click on DSS.exe to run it, and follow the prompts.
  • When it has finished, dss will open two Notepads main.txt and extra.txt -- please copy (CTRL+A and then CTRL+C) and paste (CTRL+V) the contents of main.txt and extra.txt in your next reply.
Extra Note: When running DSS, some firewalls may warn that sigcheck.exe is trying to access the internet - please ensure that you allow sigcheck.exe permission to do so. Also, it may happen that your Antivirus flags DSS as suspicious. Please allow the Deckard's System Scanner to run and don't let your Antivirus delete it. (In this case, it may be better to temporary disable your Antivirus)

Step 2
Please download F-Secure Blacklight (fsbl.exe) and save to your C:\ drive.
  • Open a command window by going to Start > Run and typing: cmd
  • Copy/paste or type the following in the command window: C:\fsbl.exe /expert
  • Hit "Enter" to start the program and then close the cmd box.
  • Accept the user agreement and click "Next".
  • Click "Scan".
  • After the scan is complete, click "Next", then "Exit".
  • BlackLight will create a log in C:\ drive named "fsbl-xxxxxxx.log" (the xxxxxxx will be the date and time of the scan).
  • The log will have a list of all items found. Do not choose to rename any yet!
    I want to see the log first because legitimate items can also be present...like "wbemtest.exe" and "tcptest.exe.
  • Exit Blacklight and post the contents of the log in your next reply.


Posted Image


#6 jaypeedu

jaypeedu
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:11:30 AM

Posted 06 December 2007 - 03:00 AM

only got main.txt, no extra.txt appeared.


Deckard's System Scanner v20071014.68
Run by Jeremy Pallot on 2007-12-06 18:40:04
Computer is in Normal Mode.
--------------------------------------------------------------------------------



-- HijackThis (run as Jeremy Pallot.exe) ---------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:40:17, on 06/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\msdtc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\WINDOWS\system32\mqsvc.exe
C:\Program Files\Windows Media Player\WMPNetwk.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\RunDll32.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\System\CmFlywav.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\System\CMAS2DS.EXE
C:\WINDOWS\System\CMAS2DS.EXE
C:\Documents and Settings\Jeremy Pallot\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\JEREMY~1.EXE
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...n&pf=laptop
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: gFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: FlashGet - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\Program Files\FlashGet\fgiebar.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [PDF4 Registry Controller] "C:\Program Files\ScanSoft\PDF Professional 4.0\\RegistryController.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Cmaudiow] RunDll32 cmcnfgw.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Open with ScanSoft PDF Converter 4.0 - res://C:\Program Files\ScanSoft\PDF Professional 4.0\cnvres_eng.dll /100
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_SG&c=64&bd=pavilion&pf=laptop
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC...bin/AvSniff.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by122fd.bay122.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo...otoUploader.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1165715353343
O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - http://drmlicense.one.microsoft.com/crlupdate/en/crlocx.ocx
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

--
End of file - 13112 bytes

-- Files created between 2007-11-06 and 2007-12-06 -----------------------------

2007-12-05 13:34:03 0 d-------- C:\WINDOWS\ERUNT
2007-12-04 11:54:03 0 d-------- C:\Program Files\Microsoft Office Outlook Connector
2007-11-28 12:37:42 0 d-------- C:\Program Files\Mixxx
2007-11-25 18:08:55 0 d-------- C:\Documents and Settings\Jeremy Pallot\Phone Browser
2007-11-25 17:42:09 0 d-------- C:\Documents and Settings\All Users\Application Data\PC Suite
2007-11-25 17:41:53 0 d-------- C:\Documents and Settings\Jeremy Pallot\Application Data\Nokia
2007-11-25 17:40:37 0 d-------- C:\Program Files\DIFX
2007-11-25 17:40:34 0 d-------- C:\Documents and Settings\Jeremy Pallot\Application Data\PC Suite
2007-11-25 17:40:17 0 d-------- C:\Program Files\PC Connectivity Solution
2007-11-25 17:39:55 0 d-------- C:\Program Files\Nokia
2007-11-25 17:39:29 0 d-------- C:\Documents and Settings\All Users\Application Data\Installations
2007-11-23 16:33:07 0 d-------- C:\Program Files\Alwil Software
2007-11-23 06:32:14 0 d-------- C:\Documents and Settings\LocalService\Desktop
2007-11-22 21:44:08 81984 --a------ C:\WINDOWS\system32\bdod.bin
2007-11-22 19:41:01 0 d--hs---- C:\Documents and Settings\LocalService\Temporary Internet Files
2007-11-22 19:41:01 0 d--hs---- C:\Documents and Settings\LocalService\History
2007-11-22 18:09:29 0 d-------- C:\Documents and Settings\Jeremy Pallot\Application Data\HouseCall 6.6
2007-11-22 16:49:45 0 d-------- C:\Program Files\Common Files\Gibinsoft Shared
2007-11-22 16:49:44 0 d-------- C:\Program Files\GiPo@Utilities
2007-11-22 02:38:46 0 d-------- C:\Program Files\Spyware Doctor
2007-11-21 20:04:51 0 d-------- C:\WINDOWS\system32\bits
2007-11-21 19:37:54 0 d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2007-11-21 19:37:32 0 d-------- C:\Program Files\SUPERAntiSpyware
2007-11-21 19:37:31 0 d-------- C:\Documents and Settings\Jeremy Pallot\Application Data\SUPERAntiSpyware.com
2007-11-21 19:23:08 0 d-------- C:\WINDOWS\VundoFix Backups
2007-11-21 19:19:30 0 d-------- C:\WUTemp
2007-11-21 04:53:36 5998 --a------ C:\WINDOWS\system32\tmp.reg
2007-11-21 04:43:56 0 dr-h----- C:\Documents and Settings\Jeremy Pallot\Recent
2007-11-21 04:31:29 0 d-------- C:\Program Files\CCleaner
2007-11-21 03:58:06 0 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-21 03:42:11 0 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2007-11-21 03:39:23 0 d-------- C:\Program Files\Trend Micro
2007-11-20 21:26:46 0 d-------- C:\Documents and Settings\Jeremy Pallot\Application Data\WholeSecurity
2007-11-20 03:52:53 0 d-------- C:\Documents and Settings\Jeremy Pallot\Application Data\Sunbelt Software
2007-11-19 17:32:04 0 d-------- C:\Documents and Settings\Jeremy Pallot\Application Data\True Sword
2007-11-19 17:23:22 0 d-------- C:\WINDOWS\system32\backuped
2007-11-19 17:18:21 0 d-------- C:\Documents and Settings\Jeremy Pallot\Application Data\PC Tools
2007-11-19 15:06:18 84231 --ahs---- C:\WINDOWS\system32\mnnmp.ini2
2007-11-19 15:03:52 0 d-------- C:\Program Files\E404DHelper
2007-11-19 15:03:51 104448 --a------ C:\WINDOWS\system32\drvrud.dll
2007-11-19 15:00:35 0 d-------- C:\Program Files\ghyjcrwz
2007-11-19 12:10:37 0 d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2007-11-18 21:53:11 0 d-------- C:\Program Files\MSXML 6.0
2007-11-18 21:51:54 0 d-------- C:\Program Files\Microsoft SQL Server
2007-11-18 20:19:31 0 d-------- C:\Program Files\Windows Live Favorites
2007-11-18 20:16:48 0 d-------- C:\Program Files\Microsoft SQL Server Compact Edition
2007-11-18 20:06:42 0 d--hs--c- C:\Program Files\Common Files\WindowsLiveInstaller
2007-11-18 20:06:12 0 d-------- C:\Program Files\Windows Live
2007-11-18 20:05:18 0 d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
2007-11-12 15:10:00 402 --a------ C:\WINDOWS\system\Flywave.dll
2007-11-12 15:01:54 65536 --a------ C:\WINDOWS\CmiWIFIUninstall.exe <Not Verified; C-Media Corporation; CmiUSBUninstall Application>
2007-11-12 15:01:53 2322432 --a------ C:\WINDOWS\WiWizard.exe <Not Verified; ; NewWizard Application>
2007-11-12 15:01:52 159819 --a------ C:\WINDOWS\system32\w32n55.dll <Not Verified; Printing Communications Assoc., Inc. (PCAUSA); PCAUSA Rawether for Windows>
2007-11-12 15:01:52 274490 --a------ C:\WINDOWS\system32\flac.dll
2007-11-12 15:01:52 17664 --a------ C:\WINDOWS\system32\drivers\pcasp50.sys <Not Verified; Printing Communications Assoc., Inc. (PCAUSA); PCAUSA Rawether for Windows>
2007-11-12 15:01:51 1410240 --a------ C:\WINDOWS\system32\drivers\cmudaxv.sys <Not Verified; C-Media Electronics Inc; C-Media UDAX Audio WDM Driver>
2007-11-12 15:01:51 69632 --a------ C:\WINDOWS\system32\cmudaxv.dll <Not Verified; C-Media; C-Media cmuda.dll>
2007-11-12 15:01:51 249856 --a------ C:\WINDOWS\system32\cmrmdrvw.exe <Not Verified; C-Media; CmiRemoveDriver Application>
2007-11-12 15:01:51 45056 --a------ C:\WINDOWS\system32\cmrmdrvw.dll
2007-11-12 15:01:51 32768 --a------ C:\WINDOWS\system32\cmpropv.dll <Not Verified; C-Media Inc.; C-Media Audio Device Property Page>
2007-11-12 15:01:51 315392 --a------ C:\WINDOWS\system\cmifltr.dll <Not Verified; C-Media Electronics Inc.; C-Media CmiFltr>
2007-11-12 15:01:50 917504 --a------ C:\WINDOWS\system\cmids3d.dll <Not Verified; C-Media Electronics Inc.; C-Media Cmids3d>
2007-11-12 15:01:50 276030 --a------ C:\WINDOWS\system\cmflywav.exe <Not Verified; C-Media; CmFlywave Application>
2007-11-12 15:01:49 491520 --a------ C:\WINDOWS\system32\cmaudiow.dll <Not Verified; ; CmSuppX Dynamic Link Library>
2007-11-12 15:01:49 266321 --a------ C:\WINDOWS\system32\cmasio.dll <Not Verified; C-Media Electronics Inc.; C-Media VAD ASIO>
2007-11-12 15:01:48 98381 --a------ C:\WINDOWS\system32\casp.dll <Not Verified; Wipro Technologies; C-Media Wi-sonic Wireless Audio Center>
2007-11-12 15:01:48 712704 --a------ C:\WINDOWS\system32\audio3d.dll <Not Verified; Sensaura Ltd; Sensaura>
2007-11-12 15:01:48 61516 --a------ C:\WINDOWS\system\cmas2ds.exe <Not Verified; C-Media Electronics Inc.; CMAS2DS>
2007-11-11 21:30:44 0 d-------- C:\Program Files\iPod
2007-11-11 21:30:39 0 d-------- C:\Program Files\iTunes
2007-11-11 20:58:53 0 d-------- C:\Program Files\Sondigo Sirocco Wireless Audio
2007-11-07 18:11:37 0 d-------- C:\Program Files\PanoPerfectLite


-- Find3M Report ---------------------------------------------------------------

2007-12-02 10:27:52 0 d-------- C:\Program Files\Java
2007-11-30 10:58:48 0 d-------- C:\Program Files\Common Files
2007-11-29 13:37:25 0 d-------- C:\Documents and Settings\Jeremy Pallot\Application Data\Skype
2007-11-28 12:58:43 2119 --a------ C:\WINDOWS\mozver.dat
2007-11-23 15:42:08 0 d-------- C:\Program Files\Common Files\Symantec Shared
2007-11-22 19:46:18 0 d-------- C:\Program Files\Apple Software Update
2007-11-19 21:49:45 0 d--h----- C:\Program Files\InstallShield Installation Information
2007-11-19 14:36:26 0 d-------- C:\Program Files\Microsoft Works
2007-11-19 13:20:02 0 d-------- C:\Program Files\FlashGet
2007-11-18 21:53:55 0 d-------- C:\Program Files\Microsoft.NET
2007-11-18 20:56:37 0 d-------- C:\Program Files\Windows Live Toolbar
2007-11-14 09:54:36 0 d-------- C:\Program Files\Google
2007-11-11 21:29:27 0 d-------- C:\Program Files\QuickTime
2007-11-05 17:11:12 0 d-------- C:\Documents and Settings\Jeremy Pallot\Application Data\Real
2007-11-05 17:09:43 0 d-------- C:\Program Files\Common Files\xing shared
2007-11-05 17:09:41 0 d-------- C:\Program Files\Common Files\Real
2007-10-29 12:12:36 0 d-------- C:\Documents and Settings\Jeremy Pallot\Application Data\System Tweaker
2007-10-29 12:12:21 0 d-------- C:\Program Files\Uniblue
2007-10-29 11:37:42 0 d-------- C:\Documents and Settings\Jeremy Pallot\Application Data\Uniblue
2007-10-23 17:06:08 585728 --a------ C:\WINDOWS\WLXPGSS.SCR <Not Verified; Microsoft Corporation; Windows Live Photo Gallery>


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [17/06/2006 16:22]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [25/09/2007 01:11]
"SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [30/09/2003 00:14]
"RecGuard"="C:\Windows\SMINST\RecGuard.exe" [11/10/2005 13:23]
"QPService"="C:\Program Files\HP\QuickPlay\QPService.exe" [19/07/2006 18:14]
"QlbCtrl"="C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [19/06/2006 14:33]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [16/03/2006 07:00]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [16/03/2006 07:00]
"PDF4 Registry Controller"="C:\Program Files\ScanSoft\PDF Professional 4.0\\RegistryController.exe" [22/08/2006 19:09]
"nwiz"="nwiz.exe" [27/09/2006 18:10 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [27/09/2006 18:10]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [27/09/2006 18:10]
"MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [16/03/2006 07:00]
"MsmqIntCert"="regsvr32 /s mqrt.dll" []
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [16/03/2006 07:00]
"IMEKRMIG6.1"="C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE" [16/03/2006 07:00]
"hpWirelessAssistant"="C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [12/08/2006 07:25]
"HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [17/02/2005 00:11]
"High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [26/07/2006 23:44 C:\WINDOWS\system32\CHDAudPropShortcut.exe]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [06/08/2005 15:56]
"Cpqset"="C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe" [13/07/2006 14:02]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [10/10/2007 20:51]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [19/10/2007 20:16]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [02/11/2007 18:36]
"Cmaudiow"="cmcnfgw.cpl" []
"SpyHunter"="" []
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [06/09/2007 20:06]
"SDTray"="C:\Program Files\Spyware Doctor\SDTrayApp.exe" [02/11/2007 17:24]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [16/03/2006 15:00]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [11/07/2007 23:22]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" []

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice"




-- End of Deckard's System Scanner: finished at 2007-12-06 18:40:53 ------------

12/06/07 18:44:48 [Info]: BlackLight Engine 1.0.67 initialized
12/06/07 18:44:48 [Info]: OS: 5.1 build 2600 (Service Pack 2)
12/06/07 18:44:48 [Note]: 7019 4
12/06/07 18:44:48 [Note]: 7005 0
12/06/07 18:44:58 [Note]: 7006 0
12/06/07 18:44:58 [Note]: 7022 0
12/06/07 18:44:58 [Note]: 7011 2872
12/06/07 18:44:58 [Note]: 7026 0
12/06/07 18:44:58 [Note]: 7026 0
12/06/07 18:45:02 [Note]: FSRAW library version 1.7.1024
12/06/07 18:58:01 [Note]: 7007 0


this is all i got from running blacklight... nothing was found

#7 MoNsTeReNeRgY22

MoNsTeReNeRgY22

    1337 Malware Destroyer


  • Members
  • 611 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:30 PM

Posted 07 December 2007 - 08:52 AM

Hello,

Step 1
Please download the OTMoveIt by OldTimer.
  • Save it to your desktop.
  • Please double-click OTMoveIt.exe to run it.
  • Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

    C:\WINDOWS\system32\mnnmp.ini2
    C:\WINDOWS\system32\drvrud.dll
    C:\Program Files\ghyjcrwz


  • Return to OTMoveIt, right click on the "Paste List of Files/Folders to be moved" window and choose Paste.
  • Click the red Moveit! button.
  • Copy everything on the Results window to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it on your next reply.
  • Close OTMoveIt
*If a file or folder cannot be moved immediately, you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine, choose Yes.
**If a reboot was necessary or you needed to Exit before posting the log, you will find a copy of the log at the root of the drive where OTMoveIt is installed, usually at :
C:\_OTMoveIt\MovedFiles\********_******.log
(where "********_******" is the "date_time")

Click "Exit" to close OTMoveIt.

Step 2
Lets run an F-Secure online scan for Viruses, Spyware and RootKits:
  • Go to http://support.f-secure.com/enu/home/ols.shtml
  • Scroll to the bottom of the page and click the Start scanning button. A window will pop up.
  • Allow the Active X control to be installed on your computer, then click the Accept button
  • Click Full System Scan and allow the components to download and the scan to complete.
  • If malware is found, check Submit samples to F-Secure then select Automatic cleaning
  • When cleaning has finitished, click Show report (this will open an Internet Explorer window containing the report)
  • Highlight and Copy (CTRL + C) the complete report, and Paste (CTRL + V) in a new reply to this post
If Automatic cleaning with Submit samples hangs, click Cancel, then New Scan
  • When the cleaning option is presented, Uncheck Submit samples to F-Secure
  • Click Automatic cleaning
  • When cleaning has finitished, click Show report (this will open an Internet Explorer window containing the report)
  • Highlight and Copy (CTRL + C) the complete report, and Paste (CTRL + V) in a new reply to this post
Notes:
  • This scan will only work with Internet Explorer
  • You must have administrator rights to run this scan
  • This scan can take several hours, so please be patient


Posted Image


#8 jaypeedu

jaypeedu
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:11:30 AM

Posted 10 December 2007 - 01:34 AM

this is the OTmoveit log. will post the other once i have run it.

C:\WINDOWS\system32\mnnmp.ini2 moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\drvrud.dll
C:\WINDOWS\system32\drvrud.dll NOT unregistered.
C:\WINDOWS\system32\drvrud.dll moved successfully.
C:\Program Files\ghyjcrwz moved successfully.

#9 jaypeedu

jaypeedu
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:11:30 AM

Posted 10 December 2007 - 03:32 AM

Scanning Report
Monday, December 10, 2007 18:14:52 - 19:31:24

Computer name: YOUR-0CDC4F5844
Scanning type: Scan system for viruses, rootkits, spyware
Target: C:\ D:\
Result: 11 malware found
Tracking Cookie (spyware)

* System (Disinfected)
* System
* System
* System
* System
* System
* System
* System
* System

Trojan.Win32.Dialer.qn (virus)

* C:\_OTMOVEIT\MOVEDFILES\WINDOWS\SYSTEM32\DRVRUD.DLL (Renamed & Submitted)

Zlob.gen94 (virus)

* C:\_OTMOVEIT\MOVEDFILES\PROGRAM FILES\GHYJCRWZ\ODUPURCH.DLL (Submitted)

Statistics
Scanned:

* Files: 54225
* System: 5093
* Not scanned: 4

Actions:

* Disinfected: 1
* Renamed: 1
* Deleted: 0
* None: 9
* Submitted: 2

Files not scanned:

* C:\HIBERFIL.SYS
* C:\PAGEFILE.SYS
* C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT
* C:\WINDOWS\SOFTWAREDISTRIBUTION\EVENTCACHE\{3B2A55FA-6B3B-41D4-B78E-15A32EEFD130}.BIN

Options
Scanning engines:

* F-Secure Libra: 2.4.2, 2007-11-28
* F-Secure AVP: 7.0.171, 2007-12-10
* F-Secure Orion: 1.2.37, 2007-12-10
* F-Secure Blacklight: 1.0.64
* F-Secure Draco: 1.0.35, 0638-150-72
* F-Secure Pegasus: 1.19.0, 2007-11-03

Scanning options:

* Scan defined files: COM EXE SYS OV? BIN SCR DLL SHS HTM HTML HTT VBS JS INF VXD DO? XL? RTF CPL WIZ HTA PP? PWZ P?T MSO PIF . ACM ASP AX CNV CSC DRV INI MDB MPD MPP MPT OBD OBT OCX PCI TLB TSP WBK WBT WPC WSH VWP WML BOO HLP TD0 TT6 MSG ASD JSE VBE WSC CHM EML PRC SHB BAT LNK ANI AVB CEO CMD LSP MAP MHT MIF PDF PHP POT WMF NWS TAR TGZ WSF ZL? {* ZIP JAR ARJ LZH TAR TGZ GZ CAB RAR BZ2 HQX
* Use Advanced heuristics

Copyright 1998-2006 Product support |Send virus sample to F-Secure
F-Secure assumes no responsibility for material created or published by third parties that F-Secure World Wide Web pages have a link to. Unless you have clearly stated otherwise, by submitting material to any of our servers, for example by E-mail or via our F-Secure's CGI E-mail, you agree that the material you make available may be published in the F-Secure World Wide Pages or hard-copy publications. You will reach F-Secure public web site by clicking on underlined links. While doing this, your access will be logged to our private access statistics with your domain name.This information will not be given to any third party. You agree not to take action against us in relation to material that you submit. Unless you have clearly stated otherwise, by submitting material you warrant that F-Secure may incorporate any concepts described in it in the F-Secure products/publications without liability.

#10 MoNsTeReNeRgY22

MoNsTeReNeRgY22

    1337 Malware Destroyer


  • Members
  • 611 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:30 PM

Posted 10 December 2007 - 02:30 PM

Can I plesae see one more HJT log.


Posted Image


#11 jaypeedu

jaypeedu
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:11:30 AM

Posted 10 December 2007 - 07:09 PM

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:08:11, on 11/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\msdtc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\WINDOWS\system32\mqsvc.exe
C:\Program Files\Windows Media Player\WMPNetwk.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\RunDll32.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\System\CmFlywav.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...n&pf=laptop
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: gFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: FlashGet - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\Program Files\FlashGet\fgiebar.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [PDF4 Registry Controller] "C:\Program Files\ScanSoft\PDF Professional 4.0\\RegistryController.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Cmaudiow] RunDll32 cmcnfgw.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Open with ScanSoft PDF Converter 4.0 - res://C:\Program Files\ScanSoft\PDF Professional 4.0\cnvres_eng.dll /100
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_SG&c=64&bd=pavilion&pf=laptop
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC...bin/AvSniff.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by122fd.bay122.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo...otoUploader.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1165715353343
O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - http://drmlicense.one.microsoft.com/crlupdate/en/crlocx.ocx
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

--
End of file - 13100 bytes

thanks...

#12 MoNsTeReNeRgY22

MoNsTeReNeRgY22

    1337 Malware Destroyer


  • Members
  • 611 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:30 PM

Posted 15 December 2007 - 12:52 PM

Hey,

Open notepad and copy and paste the following code box in it starting with @echo off

set lfile=C:\look.txt
if exist %lfile% del %lfile%

cd\
echo ----- Foldercontents ----------------- >> %lfile%
dir /s /a /-p /o:gen "C:\WINDOWS\system32\bits" >> %lfile%
echo. >> %lfile%
echo ----- Foldercontents ----------------- >> %lfile%
dir /s /a /-p /o:gen "C:\Program Files\E404DHelper" >> %lfile%
echo. >> %lfile%
start notepad %lfile%

Save this as look.bat , choose to save as *all files and place it on your desktop.
It should look like this:Posted Image
Doubleclick look.bat you created previously.
The data will then be processed.
Then please post C:\look.txt


Posted Image


#13 jaypeedu

jaypeedu
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:11:30 AM

Posted 16 December 2007 - 07:11 PM

----- Foldercontents -----------------
Volume in drive C has no label.
Volume Serial Number is 5BFB-38C0

Directory of C:\WINDOWS\system32\bits

21/11/2007 20:04 <DIR> .
21/11/2007 20:04 <DIR> ..
29/03/2007 23:56 409,600 qmgr.dll
1 File(s) 409,600 bytes

Total Files Listed:
1 File(s) 409,600 bytes
2 Dir(s) 29,376,819,200 bytes free

----- Foldercontents -----------------
Volume in drive C has no label.
Volume Serial Number is 5BFB-38C0

Directory of C:\Program Files\E404DHelper

19/11/2007 15:03 <DIR> .
19/11/2007 15:03 <DIR> ..
19/11/2007 15:03 19,456 e404d.v1.dll
1 File(s) 19,456 bytes

Total Files Listed:
1 File(s) 19,456 bytes
2 Dir(s) 29,376,815,104 bytes free

hope this helps!

#14 MoNsTeReNeRgY22

MoNsTeReNeRgY22

    1337 Malware Destroyer


  • Members
  • 611 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:30 PM

Posted 21 December 2007 - 08:56 PM

Hello again,

Using Windows Explorer (to get there right-click your Start button and go to "Explore"), please delete these folders (if present):

C:\Program Files\E404DHelper
C:\WINDOWS\VundoFix Backups





Please do an online scan with Kaspersky WebScanner

Click on Kaspersky Online Scanner

You will be promted to install an ActiveX component from Kaspersky, Click Yes.
  • The program will launch and then begin downloading the latest definition files:
  • Once the files have been downloaded click on NEXT
  • Now click on Scan Settings
  • In the scan settings make that the following are selected:
    • Scan using the following Anti-Virus database:
    Extended (if available otherwise Standard)
    • Scan Options:
    Scan Archives
    Scan Mail Bases
  • Click OK
  • Now under select a target to scan:Select My Computer
  • This will program will start and scan your system.
  • The scan will take a while so be patient and let it run.
  • Once the scan is complete it will display if your system has been infected.
    • Now click on the Save as Text button:
  • Save the file to your desktop.
  • Copy and paste that information in your next post.


Posted Image


#15 jaypeedu

jaypeedu
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:11:30 AM

Posted 22 December 2007 - 08:45 PM

Sunday, December 23, 2007 4:55:11 AM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 22/12/2007
Kaspersky Anti-Virus database records: 491482
Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true
Scan Target My Computer
C:\
D:\
E:\
Scan Statistics
Total number of scanned objects 114434
Number of viruses found 4
Number of infected objects 9
Number of suspicious objects 0
Duration of the scan process 02:33:15

Infected Object Name Virus Name Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\eHome\logs\ehRecvr.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\Jeremy Pallot\Application Data\Microsoft\MSNLiveFav\LiveFavorites.xml Object is locked skipped
C:\Documents and Settings\Jeremy Pallot\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Jeremy Pallot\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Jeremy Pallot\Local Settings\Application Data\Microsoft\Messenger\jezpallot@hotmail.com\SharingMetadata\Logs\Dfsr00005.log Object is locked skipped
C:\Documents and Settings\Jeremy Pallot\Local Settings\Application Data\Microsoft\Messenger\jezpallot@hotmail.com\SharingMetadata\pending.dat Object is locked skipped
C:\Documents and Settings\Jeremy Pallot\Local Settings\Application Data\Microsoft\Messenger\jezpallot@hotmail.com\SharingMetadata\Working\database_3B60_DFD7_5BFB_38C0\dfsr.db Object is locked skipped
C:\Documents and Settings\Jeremy Pallot\Local Settings\Application Data\Microsoft\Messenger\jezpallot@hotmail.com\SharingMetadata\Working\database_3B60_DFD7_5BFB_38C0\fsr.log Object is locked skipped
C:\Documents and Settings\Jeremy Pallot\Local Settings\Application Data\Microsoft\Messenger\jezpallot@hotmail.com\SharingMetadata\Working\database_3B60_DFD7_5BFB_38C0\fsrtmp.log Object is locked skipped
C:\Documents and Settings\Jeremy Pallot\Local Settings\Application Data\Microsoft\Messenger\jezpallot@hotmail.com\SharingMetadata\Working\database_3B60_DFD7_5BFB_38C0\tmp.edb Object is locked skipped
C:\Documents and Settings\Jeremy Pallot\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Jeremy Pallot\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Jeremy Pallot\Local Settings\Application Data\Microsoft\Windows Live Contacts\jezpallot@hotmail.com\real\members.stg Object is locked skipped
C:\Documents and Settings\Jeremy Pallot\Local Settings\Temp\~DFEC6.tmp Object is locked skipped
C:\Documents and Settings\Jeremy Pallot\Local Settings\Temp\~DFEDA.tmp Object is locked skipped
C:\Documents and Settings\Jeremy Pallot\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Jeremy Pallot\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Jeremy Pallot\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\Jeremy Pallot\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Temp\Perflib_Perfdata_bc0.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\aswResp.dat Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\Avast4.db Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\integ\avast.int Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\log\AshWebSv.ws Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\log\aswMaiSv.log Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\log\nshield.log Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\report\Resident protection.txt Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\mastlog.ldf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\model.mdf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\modellog.ldf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\msdbdata.mdf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\msdblog.ldf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\tempdb.mdf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\templog.ldf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\LOG\ERRORLOG Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\LOG\log_77.trc Object is locked skipped
C:\qoobox\Quarantine\C\Program Files\SecCenter\scprot4.exe.bak.vir Infected: not-a-virus:FraudTool.Win32.UltimateDefender.z skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\fibagbia\fibagbia3.exe.vir Infected: not-a-virus:Downloader.Win32.UltimateFix.d skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\tnrtmwuk\tnrtmwuk3.exe.vir Infected: not-a-virus:Downloader.Win32.UltimateFix.d skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{3A579F61-82CF-4117-919A-DB7B394CD5BC}\RP15\A0001841.exe/data.rar/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\System Volume Information\_restore{3A579F61-82CF-4117-919A-DB7B394CD5BC}\RP15\A0001841.exe/data.rar Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\System Volume Information\_restore{3A579F61-82CF-4117-919A-DB7B394CD5BC}\RP15\A0001841.exe RarSFX: infected - 2 skipped
C:\System Volume Information\_restore{3A579F61-82CF-4117-919A-DB7B394CD5BC}\RP15\A0001870.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\System Volume Information\_restore{3A579F61-82CF-4117-919A-DB7B394CD5BC}\RP18\A0002115.dll Infected: Trojan.Win32.Dialer.qn skipped
C:\System Volume Information\_restore{3A579F61-82CF-4117-919A-DB7B394CD5BC}\RP25\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\ModemLog_HDAUDIO Soft Data Fax Modem with SmartCP.txt Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\Media Ce.evt Object is locked skipped
C:\WINDOWS\system32\config\ODiag.evt Object is locked skipped
C:\WINDOWS\system32\config\OSession.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\MsDtc\MSDTC.LOG Object is locked skipped
C:\WINDOWS\system32\MsDtc\Trace\dtctrace.log Object is locked skipped
C:\WINDOWS\system32\msmq\storage\QMLog Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\TEMP\Perflib_Perfdata_79c.dat Object is locked skipped
C:\WINDOWS\TEMP\_avast4_\Webshlock.txt Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
C:\_OTMoveIt\MovedFiles\WINDOWS\system32\DRVRUD.0LL Infected: Trojan.Win32.Dialer.qn skipped
Scan process completed.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users