Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Vundo Trojan Virus. Have Hjt Log, Please Help


  • Please log in to reply
9 replies to this topic

#1 Wheatus

Wheatus

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:12:30 PM

Posted 09 December 2007 - 01:55 AM

hi,
I've got infected with a trojan vundo virus. I've used spybot SD, vundofix, and symantec, but none of them can fully remove the virus. Symantec occationaly catches it and "deletes" it but it always comes back. VundoFix works temporarilly but again, it always keeps coming back. I am using Spybot's TeaTimer application to monitor my registry and it continually catches vundo trying to add Broser helper objects. Also I have used TrojanHunter which found it originally but it is still there and now it sees nothing. I still have the resident protection installed just incase. Also i have used trend micro's housecall virus scan, but it finds nothing.

I have HJT but I am worried about deleting things that I don't know what they do. So I would really apreciate some help. Here is a copy of my HJT log:



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:54:21 PM, on 12/8/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\WINDOWS\system32\nvraidservice.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
E:\Program Files\TrojanHunter 5.0\THGuard.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
E:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
E:\Program Files\Cisco Systems\Clean Access Agent\CCAAgent.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
E:\Program Files\Opera\Opera.exe
C:\Program Files\Internet Explorer\iexplore.exe
E:\HJT\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O4 - HKLM\..\Run: [NVRaidService] C:\WINDOWS\system32\nvraidservice.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [THGuard] "E:\Program Files\TrojanHunter 5.0\THGuard.exe"
O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] E:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Clean Access Agent.lnk = E:\Program Files\Cisco Systems\Clean Access Agent\CCAAgent.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NBService - Nero AG - E:\Program Files\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

--
End of file - 5564 bytes




I also have a startup list if it is helpful. Let me know and I'll post it.

Anyway, I would really apreciate anyone's help on this. I can always format my hard drive and reinstall windows, but thats always a pain. So any help is great.

Thanks,
Noah

BC AdBot (Login to Remove)

 


#2 Baabiouz

Baabiouz

    Finnish Malware Fighter


  • Members
  • 3,355 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:08:30 PM

Posted 09 December 2007 - 09:15 AM

Hi Noah!

I will be handling your log to help you get cleaned up. Please give me some time to look it over and I will get back to you as soon as possible. I'm in Hijackthis school and Teachers will check my posts.
Posted Image

#3 Wheatus

Wheatus
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:12:30 PM

Posted 09 December 2007 - 01:08 PM

hey,
thanks for the quick response! I apreciate the help. I look forward to geting feedback on my log.

Thanks,
Noah

#4 Baabiouz

Baabiouz

    Finnish Malware Fighter


  • Members
  • 3,355 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:08:30 PM

Posted 09 December 2007 - 02:01 PM

Hi!

#1
While Spybot's TeaTimer is normally a wonderful tool to protect against hijackers, it can also interfere with HijackThis fixes. So please disable TeaTimer by doing the following:
1) Run Spybot-S&D
2) Go to the Mode menu, and make sure "Advanced Mode" is selected
3) On the left hand side, choose Tools -> Resident
4) Uncheck "Resident TeaTimer" and OK any prompts
You can reenable TeaTimer once your system is clean.

#2
Please download Combofix to your desktop.
Doubleclick comboFix.exe to launch the application.
Follow the prompts that will be displayed on the screen.
Don't click on the window while the fix is running, because that will cause your system to hang.
When finished, it should produce a log, combofix.txt.
Post this log in your next reply together with a new hijackthislog.

#3
Rename HijackThis.exe

1. Right click on the HijackThis icon.

Posted Image

2. Select Rename.

Posted Image

3. Now type the following scanner.exe <<< NOTE: make sure to put period before exe when typing.
Hit the enter key on keyboard.

Posted Image

Double click on Scanner.exe.
Click on Do a system scan and save a logfile. Post that HijackThis log and Combofix log back here :thumbsup:
Posted Image

#5 Wheatus

Wheatus
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:12:30 PM

Posted 09 December 2007 - 04:12 PM

ok here goes:

combofix log:
ComboFix 07-12-09.1 - Wheatus 2007-12-09 12:57:39.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1426 [GMT -8:00]
Running from: C:\Documents and Settings\Wheatus\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Start Menu\Live Safety Center.lnk
C:\Documents and Settings\All Users\Start Menu\Online Security Guide.lnk
C:\Documents and Settings\Wheatus\Favorites\Online Security Guide.lnk
C:\WINDOWS\system32\afioujhe.dll
C:\WINDOWS\system32\amvbtcgl.dll
C:\WINDOWS\system32\aycdd.ini
C:\WINDOWS\system32\aycdd.ini2
C:\WINDOWS\system32\ddcya.dll
C:\WINDOWS\system32\josmimsn.dll
C:\WINDOWS\system32\mevvdptb.dll
C:\WINDOWS\system32\negfvexm.dll
C:\WINDOWS\system32\nnnopmn.dll
C:\WINDOWS\system32\olsvcbqp.dll
C:\WINDOWS\system32\rvffkinn.dll
C:\WINDOWS\system32\sdjdsees.dll
C:\WINDOWS\system32\spgpldok.dll
C:\WINDOWS\system32\ssqpp.dll
C:\WINDOWS\system32\ufaymomn.dll
C:\WINDOWS\system32\urqolii.dll
C:\WINDOWS\system32\wvutroo.dll
C:\WINDOWS\system32\wyhrnxca.dll

.
((((((((((((((((((((((((( Files Created from 2007-11-09 to 2007-12-09 )))))))))))))))))))))))))))))))
.

2007-12-07 21:10 . 2007-12-07 21:10 <DIR> d-------- C:\Documents and Settings\Wheatus\Application Data\TrojanHunter
2007-12-07 10:27 . 2007-12-08 20:49 <DIR> d-------- C:\VundoFix Backups
2007-12-04 11:49 . 2007-12-04 11:49 <DIR> d-------- C:\Program Files\Common Files\Blizzard Entertainment
2007-12-03 01:38 . 2007-12-03 01:38 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ATI
2007-11-30 14:19 . 2007-12-03 01:10 <DIR> d-------- C:\temp
2007-11-30 14:19 . 2007-11-30 14:19 108,144 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2007-11-30 14:18 . 2007-11-30 14:18 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Media Center Programs
2007-11-29 22:09 . 2004-08-03 23:10 85,376 --a------ C:\WINDOWS\system32\drivers\NABTSFEC.sys
2007-11-29 22:08 . 2005-07-29 18:55 90,624 --a------ C:\WINDOWS\system32\kswdmcap.ax
2007-11-29 21:50 . 2005-06-08 06:45 86,016 --a------ C:\WINDOWS\system32\vatee.ax
2007-11-29 21:49 . 2007-11-29 21:49 <DIR> d-------- C:\Program Files\Common Files\Logitech
2007-11-29 21:49 . 2005-05-27 01:23 2,180,096 --a------ C:\WINDOWS\system32\drivers\lvsvf2.sys
2007-11-29 21:49 . 2005-05-27 01:32 1,317,152 --a------ C:\WINDOWS\system32\drivers\lvcm.sys
2007-11-29 21:49 . 2005-05-27 01:36 372,736 --a------ C:\WINDOWS\system32\LVUI2RC.dll
2007-11-29 21:49 . 2005-05-27 01:29 204,800 --a------ C:\WINDOWS\system32\LVUI2.dll
2007-11-29 21:49 . 2005-05-27 01:26 204,800 --a------ C:\WINDOWS\system32\lvcodec2.dll
2007-11-29 21:49 . 2005-05-27 01:19 106,496 --a------ C:\WINDOWS\system32\lvcoinst.dll
2007-11-29 21:49 . 2005-07-19 17:31 53,248 -ra------ C:\WINDOWS\system32\InstMed.exe
2007-11-29 21:49 . 2005-05-27 01:31 22,016 --a------ C:\WINDOWS\system32\drivers\LVUSBSta.sys
2007-11-29 21:49 . 2005-05-27 01:10 9,255 --a------ C:\WINDOWS\system32\lvcoinst.ini
2007-11-29 21:46 . 1998-10-29 17:45 306,688 --a------ C:\WINDOWS\IsUninst.exe
2007-11-29 21:44 . 2007-11-29 21:44 268 --a------ C:\WINDOWS\_delis32.ini
2007-11-29 15:39 . 2007-12-03 01:36 <DIR> d-------- C:\Program Files\ATI Technologies
2007-11-29 15:39 . 2007-11-01 21:05 593,920 --a------ C:\WINDOWS\system32\ati2sgag.exe
2007-11-29 00:52 . 2007-11-29 02:26 <DIR> d-------- C:\Documents and Settings\Wheatus\.housecall6.6
2007-11-29 00:51 . 2007-11-29 00:51 <DIR> d-------- C:\WINDOWS\Sun
2007-11-29 00:27 . 2007-11-29 00:46 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-28 12:12 . 2007-11-30 00:00 152 --a------ C:\WINDOWS\WININIT.INI
2007-11-27 22:40 . 2007-12-07 20:54 69 --a------ C:\WINDOWS\NeroDigital.ini
2007-11-27 15:18 . 2007-11-27 15:18 0 --a------ C:\WINDOWS\ativpsrm.bin
2007-11-27 15:16 . 2007-11-27 15:16 451,072 --a------ C:\WINDOWS\Radeon Omega Drivers v3.8.421 Uninstall.exe
2007-11-27 01:05 . 2007-11-28 13:13 <DIR> d-------- C:\Program Files\Common Files\LogiShrd
2007-11-27 00:29 . 2007-11-27 00:29 <DIR> d--h----- C:\WINDOWS\PIF
2007-11-26 23:48 . 2007-11-26 23:48 0 --a------ C:\WINDOWS\vpc32.INI
2007-11-26 23:43 . 2007-11-27 11:36 <DIR> d-------- C:\Program Files\Viewpoint
2007-11-26 23:43 . 2007-11-26 23:43 <DIR> d-------- C:\Program Files\AOD
2007-11-26 23:43 . 2007-11-26 23:43 <DIR> d-------- C:\Documents and Settings\Wheatus\Application Data\Aim
2007-11-26 23:43 . 2007-11-26 23:43 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Viewpoint
2007-11-26 15:58 . 2007-11-27 00:06 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2007-11-26 15:58 . 2007-11-26 15:58 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Logitech
2007-11-26 15:58 . 2007-11-27 00:05 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Logishrd
2007-11-26 15:41 . 2007-11-26 15:48 <DIR> d-------- C:\Documents and Settings\Wheatus\Application Data\Ventrilo
2007-11-26 15:39 . 2007-11-26 15:39 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-11-26 15:33 . 2003-11-17 20:24 208,896 --a------ C:\WINDOWS\system32\SSRemove.exe
2007-11-26 15:33 . 2004-07-05 15:01 61,440 --a------ C:\WINDOWS\system32\ssdevm.dll
2007-11-26 15:33 . 2004-02-04 14:24 49,152 --a------ C:\WINDOWS\system32\ssusbpn.dll
2007-11-26 15:33 . 2004-09-23 16:29 10,077 --a------ C:\WINDOWS\system32\SSGR3MK.DLL
2007-11-26 15:33 . 2003-07-21 20:50 8,478 --a------ C:\WINDOWS\system32\SP119.ICO
2007-11-26 15:32 . 2007-11-26 15:33 <DIR> d-------- C:\WINDOWS\Samsung
2007-11-26 15:32 . 2004-05-17 22:04 41,984 --------- C:\WINDOWS\system32\drivers\DGIVECP.SYS
2007-11-26 15:28 . 2007-11-26 15:28 <DIR> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-11-26 15:27 . 2005-08-25 18:18 118,784 --a------ C:\WINDOWS\system32\MSSTDFMT.DLL
2007-11-26 15:27 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\system32\MSINET.OCX
2007-11-26 15:23 . 2007-11-26 15:23 <DIR> d-------- C:\Program Files\Windows Defender
2007-11-26 15:18 . 2007-12-09 12:58 <DIR> d-------- C:\Program Files\Symantec AntiVirus
2007-11-26 15:18 . 2007-11-26 15:18 <DIR> d-------- C:\Program Files\Symantec
2007-11-26 15:18 . 2007-11-26 15:18 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared
2007-11-26 15:18 . 2007-11-26 15:18 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Symantec
2007-11-26 15:18 . 2006-05-05 16:19 107,696 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2007-11-26 15:18 . 2006-05-05 16:19 87,808 --a------ C:\WINDOWS\system32\S32EVNT1.DLL
2007-11-26 15:13 . 2007-11-26 15:13 <DIR> d-------- C:\Program Files\ResNet
2007-11-26 13:27 . 2006-06-27 05:40 12,800 -----c--- C:\WINDOWS\system32\dllcache\WgaTray.exe
2007-11-26 13:27 . 2006-06-27 05:40 3,584 -----c--- C:\WINDOWS\system32\dllcache\WgaLogon.dll
2007-11-26 13:15 . 2007-02-28 01:55 2,182,144 -----c--- C:\WINDOWS\system32\dllcache\ntoskrnl.exe
2007-11-26 13:15 . 2007-02-28 01:53 2,137,600 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
2007-11-26 13:15 . 2007-02-28 01:15 2,017,280 -----c--- C:\WINDOWS\system32\dllcache\ntkrpamp.exe
2007-11-26 12:24 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys
2007-11-26 10:12 . 2007-11-26 10:12 <DIR> d-------- C:\Documents and Settings\Wheatus\Application Data\Ahead
2007-11-26 10:12 . 2007-11-26 10:12 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Ahead
2007-11-26 10:10 . 2007-11-26 10:12 <DIR> d-------- C:\Program Files\Common Files\Ahead
2007-11-26 10:10 . 2007-11-26 10:10 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Nero
2007-11-26 09:17 . 2007-11-26 09:36 23 --a------ C:\WINDOWS\popcinfot.dat
2007-11-25 20:48 . 2007-11-25 20:48 <DIR> d--hs---- C:\Documents and Settings\Wheatus\UserData
2007-11-25 20:46 . 2007-11-25 20:46 <DIR> d-------- C:\Documents and Settings\Wheatus\Application Data\CiscoCAA
2007-11-25 20:25 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2007-11-25 20:25 . 2004-08-03 23:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2007-11-25 12:58 . 2007-11-25 12:58 <DIR> d-------- C:\Program Files\Common Files\Adobe
2007-11-25 10:40 . 2007-11-25 10:40 <DIR> d-------- C:\Documents and Settings\Wheatus\Application Data\vlc
2007-11-25 10:07 . 2007-12-09 10:15 <DIR> d-------- C:\Documents and Settings\Wheatus\Application Data\foobar2000
2007-11-24 19:58 . 2004-08-04 00:56 21,504 --a------ C:\WINDOWS\system32\hidserv.dll
2007-11-24 19:58 . 2004-08-04 00:56 21,504 --a--c--- C:\WINDOWS\system32\dllcache\hidserv.dll
2007-11-24 15:48 . 2007-11-24 15:48 45 --a------ C:\WINDOWS\system32\initdebug.nfo
2007-11-24 03:08 . 2007-11-24 03:08 <DIR> d-------- C:\WINDOWS\system32\config\systemprofile\Application Data\ATI
2007-11-24 03:01 . 2007-11-24 03:01 <DIR> d-------- C:\Program Files\MSXML 6.0
2007-11-24 03:00 . 2007-11-24 03:00 <DIR> d-------- C:\Program Files\MSXML 4.0
2007-11-24 01:30 . 2007-11-24 01:30 <DIR> d-------- C:\Program Files\Java
2007-11-24 01:30 . 2007-11-24 01:30 <DIR> d-------- C:\Program Files\Common Files\Java
2007-11-24 01:30 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2007-11-23 21:53 . 2007-11-23 21:53 <DIR> d-------- C:\WINDOWS\system32\Futuremark
2007-11-23 21:53 . 2004-10-25 20:02 21,664 --a------ C:\WINDOWS\system32\drivers\Entech.sys
2007-11-23 21:53 . 2001-11-19 18:05 3,972 --------- C:\WINDOWS\system32\drivers\PciBus.sys
2007-11-23 21:42 . 2007-11-23 21:42 0 --a------ C:\WINDOWS\nsreg.dat
2007-11-23 21:40 . 2007-12-09 13:00 74,752 --a------ C:\WINDOWS\system32\nvdb02.adghz
2007-11-23 21:39 . 2007-11-23 21:39 <DIR> d-------- C:\WINDOWS\system32\Lang
2007-11-23 21:39 . 2007-11-27 15:58 <DIR> d-------- C:\Documents and Settings\Wheatus\Application Data\ATI
2007-11-23 21:39 . 2007-11-23 21:39 940,794 --a------ C:\WINDOWS\system32\LoopyMusic.wav
2007-11-23 21:39 . 2007-11-23 21:39 146,650 --a------ C:\WINDOWS\system32\BuzzingBee.wav
2007-11-23 21:33 . 2007-11-23 21:33 <DIR> d-------- C:\Program Files\Realtek
2007-11-23 21:33 . 2007-02-26 15:03 16,125,440 --a------ C:\WINDOWS\RTHDCPL.exe
2007-11-23 21:32 . 2007-11-23 21:33 <DIR> d-------- C:\Program Files\NVIDIA Corporation

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-24 05:33 315,392 ----a-w C:\WINDOWS\HideWin.exe
2007-11-24 03:29 --------- d-----w C:\Documents and Settings\Wheatus\Application Data\InstallShield
2007-11-24 03:18 --------- d-----w C:\Program Files\microsoft frontpage
2007-11-02 05:52 2,644,480 ----a-w C:\WINDOWS\system32\drivers\ati2mtag.sys
2007-11-02 04:57 9,314,304 ----a-w C:\WINDOWS\system32\atioglx2.dll
2007-11-02 04:24 176,128 ----a-w C:\WINDOWS\system32\atiok3x2.dll
2007-11-02 04:10 364,544 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll
2007-11-02 04:09 268,288 ----a-w C:\WINDOWS\system32\ati2dvag.dll
2007-11-02 04:01 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe
2007-11-02 04:01 143,360 ----a-w C:\WINDOWS\system32\atipdlxx.dll
2007-11-02 04:01 122,880 ----a-w C:\WINDOWS\system32\Oemdspif.dll
2007-11-02 04:00 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll
2007-11-02 04:00 122,880 ----a-w C:\WINDOWS\system32\ati2evxx.dll
2007-11-02 03:59 495,616 ----a-w C:\WINDOWS\system32\ati2evxx.exe
2007-11-02 03:58 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL
2007-11-02 03:50 3,133,728 ----a-w C:\WINDOWS\system32\ati3duag.dll
2007-11-02 03:39 1,602,176 ----a-w C:\WINDOWS\system32\ativvaxx.dll
2007-11-02 03:35 307,200 ----a-w C:\WINDOWS\system32\atiiiexx.dll
2007-11-02 03:26 5,435,392 ----a-w C:\WINDOWS\system32\atioglxx.dll
2007-11-02 03:24 376,832 ----a-w C:\WINDOWS\system32\atikvmag.dll
2007-11-02 03:22 49,152 ----a-w C:\WINDOWS\system32\drivers\ati2erec.dll
2007-11-02 03:22 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll
2007-11-02 03:16 499,712 ----a-w C:\WINDOWS\system32\ati2cqag.dll
2007-10-22 02:51 323,624 ----a-w C:\WINDOWS\system32\wiaaut.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NVIDIA nTune"="C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-03-14 15:48]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:56]
"SpybotSD TeaTimer"="E:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NVRaidService"="C:\WINDOWS\system32\nvraidservice.exe" [2006-10-18 17:32]
"RTHDCPL"="RTHDCPL.EXE" [2007-02-26 15:03 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 18:04 C:\WINDOWS\SkyTel.exe]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-03-24 17:14]
"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2006-06-15 01:40]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20]
"AtiPTA"="atiptaxx.exe" []
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 11:35]
"THGuard"="E:\Program Files\TrojanHunter 5.0\THGuard.exe" [2007-09-09 09:31]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wingdm32]
wingdm32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2007-10-10 19:51 39792 --a------ E:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC]
C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2007-03-01 15:57 153136 --a------ C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

S3 SetupNTGLM7X;SetupNTGLM7X;\??\D:\NTGLM7X.sys

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - F:\autorun.exe

.
Contents of the 'Scheduled Tasks' folder
"2007-12-09 20:47:04 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2900.3156]
-> C:\DOCUME~1\Wheatus\LOCALS~1\Temp\mufnqmxqAH.dll
.
**************************************************************************

catchme 0.3.1331 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-09 13:00:05
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-09 13:00:51 - machine was rebooted
.
--- E O F ---







Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:11:52 PM, on 12/9/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\nvraidservice.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
E:\Program Files\TrojanHunter 5.0\THGuard.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
E:\Program Files\Cisco Systems\Clean Access Agent\CCAAgent.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
E:\Program Files\Opera\Opera.exe
E:\HJT\scanner.exe.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [NVRaidService] C:\WINDOWS\system32\nvraidservice.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [THGuard] "E:\Program Files\TrojanHunter 5.0\THGuard.exe"
O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] E:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Clean Access Agent.lnk = E:\Program Files\Cisco Systems\Clean Access Agent\CCAAgent.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O20 - Winlogon Notify: wingdm32 - wingdm32.dll (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NBService - Nero AG - E:\Program Files\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

--
End of file - 5863 bytes



I shut off the TeaTimer resident protection, but when combofix restarted my computer, it came back on. Combofix then was deleting registry items, and teatimer was throwing a fit as usual but I allowed them since it was combofix. I'm not sure if it caused anyproblems with what combofix was doing. let me know if I should run combofix again.

Thanks,
Noah

#6 Wheatus

Wheatus
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:12:30 PM

Posted 11 December 2007 - 01:16 AM

hey,
It's been two days since anything from vundo has showed up. I deleted a couple of BHOs and extra buttons using HJT. I don't know if that did it or if one of my scans with Spybot or Trojan Hunter finally got it. Regardless, I would still like your opinion of my HJT log. Maybe its still there, but it hasn't been showing up lately. Let me know what you think.

Thanks,
Noah

#7 Baabiouz

Baabiouz

    Finnish Malware Fighter


  • Members
  • 3,355 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:08:30 PM

Posted 11 December 2007 - 12:52 PM

Hi!

You don't need to run combofix again, it's fine.

#1
I see that Viewpoint is installed. Viewpoint, Viewpoint Manager, Viewpoint Media Player are Viewpoint components which are installed as a side effect of installing other software, most notably AOL and AOL Instant Messenger (AIM). Viewpoint Manager is responsible for managing and updating Viewpoint Media Player’s components. You can disable this using the Viewpoint Manager Control Panel found in the Windows Control Panel menu. By selecting Disable auto-updating for the Viewpoint Manager -- the player will no longer attempt to check for updates. Anything that is installed without your consent is suspect. Read what Viewpoint says and make your own decision.

To provide a satisfying consumer experience and to operate effectively, the Viewpoint Media Player periodically sends information to servers at Viewpoint. Each installation of the Viewpoint Media Player is identifiable to Viewpoint via a Customer Unique Identifier (CUID), an alphanumeric identifier embedded in the Viewpoint Media Player. The Viewpoint Media Player randomly generates the CUID during installation and uses it to indicate a unique installation of the product. A CUID is never connected to a user's name, email address, or other personal contact information. CUIDs are used for the sole purpose of filtering redundant information. Each of these information exchanges occurs anonymously.


Viewpoint Manager is considered as foistware instead of malware since it is installed without user's approval but doesn't spy or do anything "bad". This may change, read Viewpoint to Plunge Into Adware.
I recommend that you remove the Viewpoint products; however, decide for yourself. To uninstall the the Viewpoint components (Viewpoint, Viewpoint Manager, Viewpoint Media Player):

1. Click Start, point to Settings, and then click Control Panel.
2. In Control Panel, double-click Add or Remove Programs.
3. In Add or Remove Programs, highlight >>Viewpoint component<< , click Remove.
4. Do the same for each Viewpoint component.

#2
Please visit virusscan.jotti.org
* Click the Browse... button
* Navigate to the file C:\WINDOWS\_delis32.ini
* Click the Open button
* Click the Send button
* Copy and paste the results back here

#3
While Spybot's TeaTimer is normally a wonderful tool to protect against hijackers, it can also interfere with HijackThis fixes. So please disable TeaTimer by doing the following:
1) Run Spybot-S&D
2) Go to the Mode menu, and make sure "Advanced Mode" is selected
3) On the left hand side, choose Tools -> Resident
4) Uncheck "Resident TeaTimer" and OK any prompts
You can reenable TeaTimer once your system is clean.

#4
Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\WINDOWS\SYSTEM32\wingdm32.dll

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wingdm32]


Save this as CFScript.txt

Posted Image

Refering to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply.

#5
Let's run ATF-Cleaner and scan your computer;

Download ATF (Atribune Temp File) Cleaner© by Atribune to your desktop.
This program is for XP and Windows 2000 only!

Double-click ATF Cleaner.exe to open it.

Under Main select the following:
  • Windows Temp
  • Current User Temp
  • All Users Temp
  • Temporary Internet Files
  • Prefetch
  • Java Cache
*The other boxes are optional*
Then click the Empty Selected button.

Click Exit on the Main menu to close the program.

Please download AVG Anti-Spyware to your Desktop or to your usual Download Folder.
AVG Anti-Spyware
  • Install AVG Anti-Spyware by double clicking the installer.
  • Follow the prompts. Make sure that Launch AVG Anti-Spyware is checked.
  • On the main screen under Your Computer's security.
    • Click on Change state next to Resident shield. It should now change to inactive.
    • Click on Change state next to Automatic updates. It should now change to inactive.
    • Next to Last Update, click on Update now. (You will need an active internet connection to perform this)
    • Wait until you see the Update succesfull message.
  • Right-click the AVG Anti-Spyware Tray Icon and uncheck Start with Windows.
  • Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
If you are having problems with the updater, you can use this link to manually update ewido.
AVG Anti-Spyware manual updates.
Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that AVG Anti-Spyware is closed before installing the update.

Reboot your computer in Safe Mode.
  • If the computer is running, shut down Windows, and then turn off the power.
  • Wait 30 seconds, and then turn the computer on.
  • Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
  • Ensure that the Safe Mode option is selected.
  • Press Enter. The computer then begins to start in Safe mode.
  • Login on your usual account.
Once in Safe Mode:

Close ALL open Windows / Programs / Folders. Please start AVG Anti-Spyware and run a full scan.
  • Click on Scanner on the toolbar.
  • Click on the Settings tab.
    • Under How to act?
      • Click on Recommended Action and choose Quarantine from the popup menu.
    • Under How to scan?
      • All checkboxes should be ticked.
    • Under Possibly unwanted software:
      • All checkboxes should be ticked.
    • Under Reports:
      • Select Do not automatically generate reports and uncheck Only if threats were found.
    • Under What to scan?
      • Select Scan every file.
  • Click on the Scan tab.
  • Click on Complete System Scan to start the scan process.
  • Let the program scan the machine.
  • When the scan has finished, follow the instructions below.
    IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.
    • Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
    • At the bottom of the window click on the Apply all Actions button. (3)
      Posted Image
  • When done, click the Save Scan Report button. (4)
    • Click the Save Report as button.
    • Save the report to your Desktop.
  • Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
Reboot back into Normal Mode, and post a new HJT log, along with the AVG Anti-Spyware log.

#6
Please post a fresh HijackThis log, Combofix log, AVG Anti-Spyware results and Virusscan.jotti.org results :thumbsup:

Edited by Baabiouz, 11 December 2007 - 12:53 PM.

Posted Image

#8 Wheatus

Wheatus
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:12:30 PM

Posted 11 December 2007 - 09:21 PM

Alright, here goes:

HJT:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:17:03 PM, on 12/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\nvraidservice.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
E:\Program Files\TrojanHunter 5.0\THGuard.exe
C:\WINDOWS\system32\ctfmon.exe
E:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
E:\Program Files\Steam\Steam.exe
E:\Program Files\foobar2000\foobar2000.exe
E:\Program Files\Opera\Opera.exe
E:\HJT\scanner.exe.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [NVRaidService] C:\WINDOWS\system32\nvraidservice.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [THGuard] "E:\Program Files\TrojanHunter 5.0\THGuard.exe"
O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] E:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - E:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O20 - Winlogon Notify: wingdm32 - C:\WINDOWS\
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NBService - Nero AG - E:\Program Files\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe

--
End of file - 4622 bytes



ComboFix:

ComboFix 07-12-09.1 - Wheatus 2007-12-11 12:46:32.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1514 [GMT -8:00]
Running from: C:\Documents and Settings\Wheatus\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Wheatus\Desktop\CFScript.txt
* Created a new restore point

FILE
C:\WINDOWS\SYSTEM32\wingdm32.dll
.

((((((((((((((((((((((((( Files Created from 2007-11-11 to 2007-12-11 )))))))))))))))))))))))))))))))
.

2007-12-07 21:10 . 2007-12-07 21:10 <DIR> d-------- C:\Documents and Settings\Wheatus\Application Data\TrojanHunter
2007-12-07 10:27 . 2007-12-08 20:49 <DIR> d-------- C:\VundoFix Backups
2007-12-04 11:49 . 2007-12-04 11:49 <DIR> d-------- C:\Program Files\Common Files\Blizzard Entertainment
2007-12-03 01:38 . 2007-12-03 01:38 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ATI
2007-11-30 14:19 . 2007-12-03 01:10 <DIR> d-------- C:\temp
2007-11-30 14:19 . 2007-11-30 14:19 108,144 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2007-11-30 14:18 . 2007-11-30 14:18 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Media Center Programs
2007-11-29 22:09 . 2004-08-03 23:10 85,376 --a------ C:\WINDOWS\system32\drivers\NABTSFEC.sys
2007-11-29 22:08 . 2005-07-29 18:55 90,624 --a------ C:\WINDOWS\system32\kswdmcap.ax
2007-11-29 21:50 . 2005-06-08 06:45 86,016 --a------ C:\WINDOWS\system32\vatee.ax
2007-11-29 21:49 . 2007-11-29 21:49 <DIR> d-------- C:\Program Files\Common Files\Logitech
2007-11-29 21:49 . 2005-05-27 01:23 2,180,096 --a------ C:\WINDOWS\system32\drivers\lvsvf2.sys
2007-11-29 21:49 . 2005-05-27 01:32 1,317,152 --a------ C:\WINDOWS\system32\drivers\lvcm.sys
2007-11-29 21:49 . 2005-05-27 01:36 372,736 --a------ C:\WINDOWS\system32\LVUI2RC.dll
2007-11-29 21:49 . 2005-05-27 01:29 204,800 --a------ C:\WINDOWS\system32\LVUI2.dll
2007-11-29 21:49 . 2005-05-27 01:26 204,800 --a------ C:\WINDOWS\system32\lvcodec2.dll
2007-11-29 21:49 . 2005-05-27 01:19 106,496 --a------ C:\WINDOWS\system32\lvcoinst.dll
2007-11-29 21:49 . 2005-07-19 17:31 53,248 -ra------ C:\WINDOWS\system32\InstMed.exe
2007-11-29 21:49 . 2005-05-27 01:31 22,016 --a------ C:\WINDOWS\system32\drivers\LVUSBSta.sys
2007-11-29 21:49 . 2005-05-27 01:10 9,255 --a------ C:\WINDOWS\system32\lvcoinst.ini
2007-11-29 21:46 . 1998-10-29 17:45 306,688 --a------ C:\WINDOWS\IsUninst.exe
2007-11-29 21:44 . 2007-11-29 21:44 268 --a------ C:\WINDOWS\_delis32.ini
2007-11-29 15:39 . 2007-12-03 01:36 <DIR> d-------- C:\Program Files\ATI Technologies
2007-11-29 15:39 . 2007-11-01 21:05 593,920 --a------ C:\WINDOWS\system32\ati2sgag.exe
2007-11-29 00:52 . 2007-11-29 02:26 <DIR> d-------- C:\Documents and Settings\Wheatus\.housecall6.6
2007-11-29 00:51 . 2007-11-29 00:51 <DIR> d-------- C:\WINDOWS\Sun
2007-11-29 00:27 . 2007-11-29 00:46 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-28 12:12 . 2007-11-30 00:00 152 --a------ C:\WINDOWS\WININIT.INI
2007-11-27 22:40 . 2007-12-07 20:54 69 --a------ C:\WINDOWS\NeroDigital.ini
2007-11-27 15:18 . 2007-11-27 15:18 0 --a------ C:\WINDOWS\ativpsrm.bin
2007-11-27 15:16 . 2007-11-27 15:16 451,072 --a------ C:\WINDOWS\Radeon Omega Drivers v3.8.421 Uninstall.exe
2007-11-27 01:05 . 2007-11-28 13:13 <DIR> d-------- C:\Program Files\Common Files\LogiShrd
2007-11-27 00:29 . 2007-11-27 00:29 <DIR> d--h----- C:\WINDOWS\PIF
2007-11-26 23:48 . 2007-11-26 23:48 0 --a------ C:\WINDOWS\vpc32.INI
2007-11-26 23:43 . 2007-11-27 11:36 <DIR> d-------- C:\Program Files\Viewpoint
2007-11-26 23:43 . 2007-11-26 23:43 <DIR> d-------- C:\Program Files\AOD
2007-11-26 23:43 . 2007-11-26 23:43 <DIR> d-------- C:\Documents and Settings\Wheatus\Application Data\Aim
2007-11-26 15:58 . 2007-11-27 00:06 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2007-11-26 15:58 . 2007-11-26 15:58 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Logitech
2007-11-26 15:58 . 2007-11-27 00:05 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Logishrd
2007-11-26 15:41 . 2007-11-26 15:48 <DIR> d-------- C:\Documents and Settings\Wheatus\Application Data\Ventrilo
2007-11-26 15:39 . 2007-11-26 15:39 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-11-26 15:33 . 2003-11-17 20:24 208,896 --a------ C:\WINDOWS\system32\SSRemove.exe
2007-11-26 15:33 . 2004-07-05 15:01 61,440 --a------ C:\WINDOWS\system32\ssdevm.dll
2007-11-26 15:33 . 2004-02-04 14:24 49,152 --a------ C:\WINDOWS\system32\ssusbpn.dll
2007-11-26 15:33 . 2004-09-23 16:29 10,077 --a------ C:\WINDOWS\system32\SSGR3MK.DLL
2007-11-26 15:33 . 2003-07-21 20:50 8,478 --a------ C:\WINDOWS\system32\SP119.ICO
2007-11-26 15:32 . 2007-11-26 15:33 <DIR> d-------- C:\WINDOWS\Samsung
2007-11-26 15:32 . 2004-05-17 22:04 41,984 --------- C:\WINDOWS\system32\drivers\DGIVECP.SYS
2007-11-26 15:28 . 2007-11-26 15:28 <DIR> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-11-26 15:27 . 2005-08-25 18:18 118,784 --a------ C:\WINDOWS\system32\MSSTDFMT.DLL
2007-11-26 15:27 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\system32\MSINET.OCX
2007-11-26 15:18 . 2007-12-09 22:47 <DIR> d-------- C:\Program Files\Symantec
2007-11-26 15:18 . 2007-12-09 22:47 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared
2007-11-26 15:18 . 2007-12-09 22:47 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Symantec
2007-11-26 15:13 . 2007-11-26 15:13 <DIR> d-------- C:\Program Files\ResNet
2007-11-26 13:27 . 2006-06-27 05:40 12,800 -----c--- C:\WINDOWS\system32\dllcache\WgaTray.exe
2007-11-26 13:27 . 2006-06-27 05:40 3,584 -----c--- C:\WINDOWS\system32\dllcache\WgaLogon.dll
2007-11-26 13:15 . 2007-02-28 01:55 2,182,144 -----c--- C:\WINDOWS\system32\dllcache\ntoskrnl.exe
2007-11-26 13:15 . 2007-02-28 01:53 2,137,600 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
2007-11-26 13:15 . 2007-02-28 01:15 2,017,280 -----c--- C:\WINDOWS\system32\dllcache\ntkrpamp.exe
2007-11-26 12:24 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys
2007-11-26 10:12 . 2007-11-26 10:12 <DIR> d-------- C:\Documents and Settings\Wheatus\Application Data\Ahead
2007-11-26 10:12 . 2007-11-26 10:12 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Ahead
2007-11-26 10:10 . 2007-11-26 10:12 <DIR> d-------- C:\Program Files\Common Files\Ahead
2007-11-26 10:10 . 2007-11-26 10:10 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Nero
2007-11-26 09:17 . 2007-11-26 09:36 23 --a------ C:\WINDOWS\popcinfot.dat
2007-11-25 20:48 . 2007-11-25 20:48 <DIR> d--hs---- C:\Documents and Settings\Wheatus\UserData
2007-11-25 20:46 . 2007-11-25 20:46 <DIR> d-------- C:\Documents and Settings\Wheatus\Application Data\CiscoCAA
2007-11-25 20:25 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2007-11-25 20:25 . 2004-08-03 23:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2007-11-25 12:58 . 2007-11-25 12:58 <DIR> d-------- C:\Program Files\Common Files\Adobe
2007-11-25 10:40 . 2007-11-25 10:40 <DIR> d-------- C:\Documents and Settings\Wheatus\Application Data\vlc
2007-11-25 10:07 . 2007-12-11 00:36 <DIR> d-------- C:\Documents and Settings\Wheatus\Application Data\foobar2000
2007-11-24 19:58 . 2004-08-04 00:56 21,504 --a------ C:\WINDOWS\system32\hidserv.dll
2007-11-24 19:58 . 2004-08-04 00:56 21,504 --a--c--- C:\WINDOWS\system32\dllcache\hidserv.dll
2007-11-24 15:48 . 2007-11-24 15:48 45 --a------ C:\WINDOWS\system32\initdebug.nfo
2007-11-24 03:01 . 2007-11-24 03:01 <DIR> d-------- C:\Program Files\MSXML 6.0
2007-11-24 03:00 . 2007-11-24 03:00 <DIR> d-------- C:\Program Files\MSXML 4.0
2007-11-24 01:30 . 2007-11-24 01:30 <DIR> d-------- C:\Program Files\Java
2007-11-24 01:30 . 2007-11-24 01:30 <DIR> d-------- C:\Program Files\Common Files\Java
2007-11-24 01:30 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2007-11-23 21:53 . 2007-11-23 21:53 <DIR> d-------- C:\WINDOWS\system32\Futuremark
2007-11-23 21:53 . 2004-10-25 20:02 21,664 --a------ C:\WINDOWS\system32\drivers\Entech.sys
2007-11-23 21:53 . 2001-11-19 18:05 3,972 --------- C:\WINDOWS\system32\drivers\PciBus.sys
2007-11-23 21:42 . 2007-11-23 21:42 0 --a------ C:\WINDOWS\nsreg.dat
2007-11-23 21:40 . 2007-12-11 11:58 83,632 --a------ C:\WINDOWS\system32\nvdb02.adghz
2007-11-23 21:39 . 2007-11-23 21:39 <DIR> d-------- C:\WINDOWS\system32\Lang
2007-11-23 21:39 . 2007-11-27 15:58 <DIR> d-------- C:\Documents and Settings\Wheatus\Application Data\ATI
2007-11-23 21:39 . 2007-11-23 21:39 940,794 --a------ C:\WINDOWS\system32\LoopyMusic.wav
2007-11-23 21:39 . 2007-11-23 21:39 146,650 --a------ C:\WINDOWS\system32\BuzzingBee.wav
2007-11-23 21:33 . 2007-11-23 21:33 <DIR> d-------- C:\Program Files\Realtek
2007-11-23 21:33 . 2007-02-26 15:03 16,125,440 --a------ C:\WINDOWS\RTHDCPL.exe
2007-11-23 21:32 . 2007-11-23 21:33 <DIR> d-------- C:\Program Files\NVIDIA Corporation
2007-11-23 21:32 . 2007-11-30 14:12 <DIR> d--h----- C:\Program Files\InstallShield Installation Information
2007-11-23 21:31 . 2007-11-23 21:35 <DIR> d-------- C:\Program Files\Common Files\InstallShield
2007-11-23 12:58 . 2007-03-14 16:57 363,008 -ra------ C:\WINDOWS\system32\idecoiins.dll
2007-11-23 12:58 . 2007-03-14 08:57 363,008 --a------ C:\WINDOWS\system32\idecoi.dll
2007-11-23 12:58 . 2007-03-14 16:57 105,472 -ra------ C:\WINDOWS\system32\drivers\nvatabus.sys
2007-11-23 12:58 . 2007-03-14 08:57 89,216 --a------ C:\WINDOWS\system32\drivers\nvraid.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-24 05:33 315,392 ----a-w C:\WINDOWS\HideWin.exe
2007-11-24 03:29 --------- d-----w C:\Documents and Settings\Wheatus\Application Data\InstallShield
2007-11-24 03:18 --------- d-----w C:\Program Files\microsoft frontpage
2007-11-02 05:52 2,644,480 ----a-w C:\WINDOWS\system32\drivers\ati2mtag.sys
2007-11-02 04:57 9,314,304 ----a-w C:\WINDOWS\system32\atioglx2.dll
2007-11-02 04:24 176,128 ----a-w C:\WINDOWS\system32\atiok3x2.dll
2007-11-02 04:10 364,544 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll
2007-11-02 04:09 268,288 ----a-w C:\WINDOWS\system32\ati2dvag.dll
2007-11-02 04:01 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe
2007-11-02 04:01 143,360 ----a-w C:\WINDOWS\system32\atipdlxx.dll
2007-11-02 04:01 122,880 ----a-w C:\WINDOWS\system32\Oemdspif.dll
2007-11-02 04:00 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll
2007-11-02 04:00 122,880 ----a-w C:\WINDOWS\system32\ati2evxx.dll
2007-11-02 03:59 495,616 ----a-w C:\WINDOWS\system32\ati2evxx.exe
2007-11-02 03:58 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL
2007-11-02 03:50 3,133,728 ----a-w C:\WINDOWS\system32\ati3duag.dll
2007-11-02 03:39 1,602,176 ----a-w C:\WINDOWS\system32\ativvaxx.dll
2007-11-02 03:35 307,200 ----a-w C:\WINDOWS\system32\atiiiexx.dll
2007-11-02 03:26 5,435,392 ----a-w C:\WINDOWS\system32\atioglxx.dll
2007-11-02 03:24 376,832 ----a-w C:\WINDOWS\system32\atikvmag.dll
2007-11-02 03:22 49,152 ----a-w C:\WINDOWS\system32\drivers\ati2erec.dll
2007-11-02 03:22 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll
2007-11-02 03:16 499,712 ----a-w C:\WINDOWS\system32\ati2cqag.dll
2007-10-22 02:51 323,624 ----a-w C:\WINDOWS\system32\wiaaut.dll
.

((((((((((((((((((((((((((((( snapshot@2007-12-09_13.00.28.56 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-12-11 19:58:12 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_46c.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NVIDIA nTune"="C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-03-14 15:48]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:56]
"SpybotSD TeaTimer"="E:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NVRaidService"="C:\WINDOWS\system32\nvraidservice.exe" [2006-10-18 17:32]
"RTHDCPL"="RTHDCPL.EXE" [2007-02-26 15:03 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 18:04 C:\WINDOWS\SkyTel.exe]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]
"AtiPTA"="atiptaxx.exe" []
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 11:35]
"THGuard"="E:\Program Files\TrojanHunter 5.0\THGuard.exe" [2007-09-09 09:31]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2007-10-10 19:51 39792 --a------ E:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC]
C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2007-03-01 15:57 153136 --a------ C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

S3 SetupNTGLM7X;SetupNTGLM7X;\??\D:\NTGLM7X.sys

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - F:\autorun.exe

.
**************************************************************************

catchme 0.3.1331 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-11 12:47:05
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-11 12:47:20
C:\ComboFix2.txt ... 2007-12-09 13:00
.
--- E O F ---





AVG:

---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 2:39:02 PM 12/11/2007

+ Scan result:



Nothing found.



::Report end






jotti.org log:

File: _delis32.ini
Status: OK
MD5: 29cad1cc87b5d4f5e9b842fdf4c42dd3
Packers detected: -
Bit9 reports: File not found

Scanner results
Scan taken on 11 Dec 2007 20:39:21 (GMT)
A-Squared Found nothing
AntiVir Found nothing
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found nothing
CPsecure Found nothing
Dr.Web Found nothing
F-Prot Antivirus Found nothing
F-Secure Anti-Virus Found nothing
Fortinet Found nothing
Ikarus Found nothing
Kaspersky Anti-Virus Found nothing
NOD32 Found nothing
Norman Virus Control Found nothing
Panda Antivirus Found nothing
Rising Antivirus Found nothing
Sophos Antivirus Found nothing
VirusBuster Found nothing
VBA32 Found nothing






I think thats all you asked for. Thanks again for the help

#9 Wheatus

Wheatus
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:12:30 PM

Posted 11 December 2007 - 09:21 PM

Alright, here goes:

HJT:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:17:03 PM, on 12/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\nvraidservice.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
E:\Program Files\TrojanHunter 5.0\THGuard.exe
C:\WINDOWS\system32\ctfmon.exe
E:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
E:\Program Files\Steam\Steam.exe
E:\Program Files\foobar2000\foobar2000.exe
E:\Program Files\Opera\Opera.exe
E:\HJT\scanner.exe.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [NVRaidService] C:\WINDOWS\system32\nvraidservice.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [THGuard] "E:\Program Files\TrojanHunter 5.0\THGuard.exe"
O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] E:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - E:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O20 - Winlogon Notify: wingdm32 - C:\WINDOWS\
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NBService - Nero AG - E:\Program Files\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe

--
End of file - 4622 bytes



ComboFix:

ComboFix 07-12-09.1 - Wheatus 2007-12-11 12:46:32.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1514 [GMT -8:00]
Running from: C:\Documents and Settings\Wheatus\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Wheatus\Desktop\CFScript.txt
* Created a new restore point

FILE
C:\WINDOWS\SYSTEM32\wingdm32.dll
.

((((((((((((((((((((((((( Files Created from 2007-11-11 to 2007-12-11 )))))))))))))))))))))))))))))))
.

2007-12-07 21:10 . 2007-12-07 21:10 <DIR> d-------- C:\Documents and Settings\Wheatus\Application Data\TrojanHunter
2007-12-07 10:27 . 2007-12-08 20:49 <DIR> d-------- C:\VundoFix Backups
2007-12-04 11:49 . 2007-12-04 11:49 <DIR> d-------- C:\Program Files\Common Files\Blizzard Entertainment
2007-12-03 01:38 . 2007-12-03 01:38 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ATI
2007-11-30 14:19 . 2007-12-03 01:10 <DIR> d-------- C:\temp
2007-11-30 14:19 . 2007-11-30 14:19 108,144 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2007-11-30 14:18 . 2007-11-30 14:18 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Media Center Programs
2007-11-29 22:09 . 2004-08-03 23:10 85,376 --a------ C:\WINDOWS\system32\drivers\NABTSFEC.sys
2007-11-29 22:08 . 2005-07-29 18:55 90,624 --a------ C:\WINDOWS\system32\kswdmcap.ax
2007-11-29 21:50 . 2005-06-08 06:45 86,016 --a------ C:\WINDOWS\system32\vatee.ax
2007-11-29 21:49 . 2007-11-29 21:49 <DIR> d-------- C:\Program Files\Common Files\Logitech
2007-11-29 21:49 . 2005-05-27 01:23 2,180,096 --a------ C:\WINDOWS\system32\drivers\lvsvf2.sys
2007-11-29 21:49 . 2005-05-27 01:32 1,317,152 --a------ C:\WINDOWS\system32\drivers\lvcm.sys
2007-11-29 21:49 . 2005-05-27 01:36 372,736 --a------ C:\WINDOWS\system32\LVUI2RC.dll
2007-11-29 21:49 . 2005-05-27 01:29 204,800 --a------ C:\WINDOWS\system32\LVUI2.dll
2007-11-29 21:49 . 2005-05-27 01:26 204,800 --a------ C:\WINDOWS\system32\lvcodec2.dll
2007-11-29 21:49 . 2005-05-27 01:19 106,496 --a------ C:\WINDOWS\system32\lvcoinst.dll
2007-11-29 21:49 . 2005-07-19 17:31 53,248 -ra------ C:\WINDOWS\system32\InstMed.exe
2007-11-29 21:49 . 2005-05-27 01:31 22,016 --a------ C:\WINDOWS\system32\drivers\LVUSBSta.sys
2007-11-29 21:49 . 2005-05-27 01:10 9,255 --a------ C:\WINDOWS\system32\lvcoinst.ini
2007-11-29 21:46 . 1998-10-29 17:45 306,688 --a------ C:\WINDOWS\IsUninst.exe
2007-11-29 21:44 . 2007-11-29 21:44 268 --a------ C:\WINDOWS\_delis32.ini
2007-11-29 15:39 . 2007-12-03 01:36 <DIR> d-------- C:\Program Files\ATI Technologies
2007-11-29 15:39 . 2007-11-01 21:05 593,920 --a------ C:\WINDOWS\system32\ati2sgag.exe
2007-11-29 00:52 . 2007-11-29 02:26 <DIR> d-------- C:\Documents and Settings\Wheatus\.housecall6.6
2007-11-29 00:51 . 2007-11-29 00:51 <DIR> d-------- C:\WINDOWS\Sun
2007-11-29 00:27 . 2007-11-29 00:46 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-28 12:12 . 2007-11-30 00:00 152 --a------ C:\WINDOWS\WININIT.INI
2007-11-27 22:40 . 2007-12-07 20:54 69 --a------ C:\WINDOWS\NeroDigital.ini
2007-11-27 15:18 . 2007-11-27 15:18 0 --a------ C:\WINDOWS\ativpsrm.bin
2007-11-27 15:16 . 2007-11-27 15:16 451,072 --a------ C:\WINDOWS\Radeon Omega Drivers v3.8.421 Uninstall.exe
2007-11-27 01:05 . 2007-11-28 13:13 <DIR> d-------- C:\Program Files\Common Files\LogiShrd
2007-11-27 00:29 . 2007-11-27 00:29 <DIR> d--h----- C:\WINDOWS\PIF
2007-11-26 23:48 . 2007-11-26 23:48 0 --a------ C:\WINDOWS\vpc32.INI
2007-11-26 23:43 . 2007-11-27 11:36 <DIR> d-------- C:\Program Files\Viewpoint
2007-11-26 23:43 . 2007-11-26 23:43 <DIR> d-------- C:\Program Files\AOD
2007-11-26 23:43 . 2007-11-26 23:43 <DIR> d-------- C:\Documents and Settings\Wheatus\Application Data\Aim
2007-11-26 15:58 . 2007-11-27 00:06 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2007-11-26 15:58 . 2007-11-26 15:58 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Logitech
2007-11-26 15:58 . 2007-11-27 00:05 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Logishrd
2007-11-26 15:41 . 2007-11-26 15:48 <DIR> d-------- C:\Documents and Settings\Wheatus\Application Data\Ventrilo
2007-11-26 15:39 . 2007-11-26 15:39 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-11-26 15:33 . 2003-11-17 20:24 208,896 --a------ C:\WINDOWS\system32\SSRemove.exe
2007-11-26 15:33 . 2004-07-05 15:01 61,440 --a------ C:\WINDOWS\system32\ssdevm.dll
2007-11-26 15:33 . 2004-02-04 14:24 49,152 --a------ C:\WINDOWS\system32\ssusbpn.dll
2007-11-26 15:33 . 2004-09-23 16:29 10,077 --a------ C:\WINDOWS\system32\SSGR3MK.DLL
2007-11-26 15:33 . 2003-07-21 20:50 8,478 --a------ C:\WINDOWS\system32\SP119.ICO
2007-11-26 15:32 . 2007-11-26 15:33 <DIR> d-------- C:\WINDOWS\Samsung
2007-11-26 15:32 . 2004-05-17 22:04 41,984 --------- C:\WINDOWS\system32\drivers\DGIVECP.SYS
2007-11-26 15:28 . 2007-11-26 15:28 <DIR> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-11-26 15:27 . 2005-08-25 18:18 118,784 --a------ C:\WINDOWS\system32\MSSTDFMT.DLL
2007-11-26 15:27 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\system32\MSINET.OCX
2007-11-26 15:18 . 2007-12-09 22:47 <DIR> d-------- C:\Program Files\Symantec
2007-11-26 15:18 . 2007-12-09 22:47 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared
2007-11-26 15:18 . 2007-12-09 22:47 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Symantec
2007-11-26 15:13 . 2007-11-26 15:13 <DIR> d-------- C:\Program Files\ResNet
2007-11-26 13:27 . 2006-06-27 05:40 12,800 -----c--- C:\WINDOWS\system32\dllcache\WgaTray.exe
2007-11-26 13:27 . 2006-06-27 05:40 3,584 -----c--- C:\WINDOWS\system32\dllcache\WgaLogon.dll
2007-11-26 13:15 . 2007-02-28 01:55 2,182,144 -----c--- C:\WINDOWS\system32\dllcache\ntoskrnl.exe
2007-11-26 13:15 . 2007-02-28 01:53 2,137,600 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
2007-11-26 13:15 . 2007-02-28 01:15 2,017,280 -----c--- C:\WINDOWS\system32\dllcache\ntkrpamp.exe
2007-11-26 12:24 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys
2007-11-26 10:12 . 2007-11-26 10:12 <DIR> d-------- C:\Documents and Settings\Wheatus\Application Data\Ahead
2007-11-26 10:12 . 2007-11-26 10:12 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Ahead
2007-11-26 10:10 . 2007-11-26 10:12 <DIR> d-------- C:\Program Files\Common Files\Ahead
2007-11-26 10:10 . 2007-11-26 10:10 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Nero
2007-11-26 09:17 . 2007-11-26 09:36 23 --a------ C:\WINDOWS\popcinfot.dat
2007-11-25 20:48 . 2007-11-25 20:48 <DIR> d--hs---- C:\Documents and Settings\Wheatus\UserData
2007-11-25 20:46 . 2007-11-25 20:46 <DIR> d-------- C:\Documents and Settings\Wheatus\Application Data\CiscoCAA
2007-11-25 20:25 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2007-11-25 20:25 . 2004-08-03 23:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2007-11-25 12:58 . 2007-11-25 12:58 <DIR> d-------- C:\Program Files\Common Files\Adobe
2007-11-25 10:40 . 2007-11-25 10:40 <DIR> d-------- C:\Documents and Settings\Wheatus\Application Data\vlc
2007-11-25 10:07 . 2007-12-11 00:36 <DIR> d-------- C:\Documents and Settings\Wheatus\Application Data\foobar2000
2007-11-24 19:58 . 2004-08-04 00:56 21,504 --a------ C:\WINDOWS\system32\hidserv.dll
2007-11-24 19:58 . 2004-08-04 00:56 21,504 --a--c--- C:\WINDOWS\system32\dllcache\hidserv.dll
2007-11-24 15:48 . 2007-11-24 15:48 45 --a------ C:\WINDOWS\system32\initdebug.nfo
2007-11-24 03:01 . 2007-11-24 03:01 <DIR> d-------- C:\Program Files\MSXML 6.0
2007-11-24 03:00 . 2007-11-24 03:00 <DIR> d-------- C:\Program Files\MSXML 4.0
2007-11-24 01:30 . 2007-11-24 01:30 <DIR> d-------- C:\Program Files\Java
2007-11-24 01:30 . 2007-11-24 01:30 <DIR> d-------- C:\Program Files\Common Files\Java
2007-11-24 01:30 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2007-11-23 21:53 . 2007-11-23 21:53 <DIR> d-------- C:\WINDOWS\system32\Futuremark
2007-11-23 21:53 . 2004-10-25 20:02 21,664 --a------ C:\WINDOWS\system32\drivers\Entech.sys
2007-11-23 21:53 . 2001-11-19 18:05 3,972 --------- C:\WINDOWS\system32\drivers\PciBus.sys
2007-11-23 21:42 . 2007-11-23 21:42 0 --a------ C:\WINDOWS\nsreg.dat
2007-11-23 21:40 . 2007-12-11 11:58 83,632 --a------ C:\WINDOWS\system32\nvdb02.adghz
2007-11-23 21:39 . 2007-11-23 21:39 <DIR> d-------- C:\WINDOWS\system32\Lang
2007-11-23 21:39 . 2007-11-27 15:58 <DIR> d-------- C:\Documents and Settings\Wheatus\Application Data\ATI
2007-11-23 21:39 . 2007-11-23 21:39 940,794 --a------ C:\WINDOWS\system32\LoopyMusic.wav
2007-11-23 21:39 . 2007-11-23 21:39 146,650 --a------ C:\WINDOWS\system32\BuzzingBee.wav
2007-11-23 21:33 . 2007-11-23 21:33 <DIR> d-------- C:\Program Files\Realtek
2007-11-23 21:33 . 2007-02-26 15:03 16,125,440 --a------ C:\WINDOWS\RTHDCPL.exe
2007-11-23 21:32 . 2007-11-23 21:33 <DIR> d-------- C:\Program Files\NVIDIA Corporation
2007-11-23 21:32 . 2007-11-30 14:12 <DIR> d--h----- C:\Program Files\InstallShield Installation Information
2007-11-23 21:31 . 2007-11-23 21:35 <DIR> d-------- C:\Program Files\Common Files\InstallShield
2007-11-23 12:58 . 2007-03-14 16:57 363,008 -ra------ C:\WINDOWS\system32\idecoiins.dll
2007-11-23 12:58 . 2007-03-14 08:57 363,008 --a------ C:\WINDOWS\system32\idecoi.dll
2007-11-23 12:58 . 2007-03-14 16:57 105,472 -ra------ C:\WINDOWS\system32\drivers\nvatabus.sys
2007-11-23 12:58 . 2007-03-14 08:57 89,216 --a------ C:\WINDOWS\system32\drivers\nvraid.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-24 05:33 315,392 ----a-w C:\WINDOWS\HideWin.exe
2007-11-24 03:29 --------- d-----w C:\Documents and Settings\Wheatus\Application Data\InstallShield
2007-11-24 03:18 --------- d-----w C:\Program Files\microsoft frontpage
2007-11-02 05:52 2,644,480 ----a-w C:\WINDOWS\system32\drivers\ati2mtag.sys
2007-11-02 04:57 9,314,304 ----a-w C:\WINDOWS\system32\atioglx2.dll
2007-11-02 04:24 176,128 ----a-w C:\WINDOWS\system32\atiok3x2.dll
2007-11-02 04:10 364,544 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll
2007-11-02 04:09 268,288 ----a-w C:\WINDOWS\system32\ati2dvag.dll
2007-11-02 04:01 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe
2007-11-02 04:01 143,360 ----a-w C:\WINDOWS\system32\atipdlxx.dll
2007-11-02 04:01 122,880 ----a-w C:\WINDOWS\system32\Oemdspif.dll
2007-11-02 04:00 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll
2007-11-02 04:00 122,880 ----a-w C:\WINDOWS\system32\ati2evxx.dll
2007-11-02 03:59 495,616 ----a-w C:\WINDOWS\system32\ati2evxx.exe
2007-11-02 03:58 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL
2007-11-02 03:50 3,133,728 ----a-w C:\WINDOWS\system32\ati3duag.dll
2007-11-02 03:39 1,602,176 ----a-w C:\WINDOWS\system32\ativvaxx.dll
2007-11-02 03:35 307,200 ----a-w C:\WINDOWS\system32\atiiiexx.dll
2007-11-02 03:26 5,435,392 ----a-w C:\WINDOWS\system32\atioglxx.dll
2007-11-02 03:24 376,832 ----a-w C:\WINDOWS\system32\atikvmag.dll
2007-11-02 03:22 49,152 ----a-w C:\WINDOWS\system32\drivers\ati2erec.dll
2007-11-02 03:22 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll
2007-11-02 03:16 499,712 ----a-w C:\WINDOWS\system32\ati2cqag.dll
2007-10-22 02:51 323,624 ----a-w C:\WINDOWS\system32\wiaaut.dll
.

((((((((((((((((((((((((((((( snapshot@2007-12-09_13.00.28.56 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-12-11 19:58:12 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_46c.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NVIDIA nTune"="C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-03-14 15:48]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:56]
"SpybotSD TeaTimer"="E:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NVRaidService"="C:\WINDOWS\system32\nvraidservice.exe" [2006-10-18 17:32]
"RTHDCPL"="RTHDCPL.EXE" [2007-02-26 15:03 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 18:04 C:\WINDOWS\SkyTel.exe]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]
"AtiPTA"="atiptaxx.exe" []
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 11:35]
"THGuard"="E:\Program Files\TrojanHunter 5.0\THGuard.exe" [2007-09-09 09:31]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2007-10-10 19:51 39792 --a------ E:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC]
C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2007-03-01 15:57 153136 --a------ C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

S3 SetupNTGLM7X;SetupNTGLM7X;\??\D:\NTGLM7X.sys

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - F:\autorun.exe

.
**************************************************************************

catchme 0.3.1331 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-11 12:47:05
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-11 12:47:20
C:\ComboFix2.txt ... 2007-12-09 13:00
.
--- E O F ---





AVG:

---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 2:39:02 PM 12/11/2007

+ Scan result:



Nothing found.



::Report end






jotti.org log:

File: _delis32.ini
Status: OK
MD5: 29cad1cc87b5d4f5e9b842fdf4c42dd3
Packers detected: -
Bit9 reports: File not found

Scanner results
Scan taken on 11 Dec 2007 20:39:21 (GMT)
A-Squared Found nothing
AntiVir Found nothing
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found nothing
CPsecure Found nothing
Dr.Web Found nothing
F-Prot Antivirus Found nothing
F-Secure Anti-Virus Found nothing
Fortinet Found nothing
Ikarus Found nothing
Kaspersky Anti-Virus Found nothing
NOD32 Found nothing
Norman Virus Control Found nothing
Panda Antivirus Found nothing
Rising Antivirus Found nothing
Sophos Antivirus Found nothing
VirusBuster Found nothing
VBA32 Found nothing






I think thats all you asked for. Thanks again for the help

#10 Baabiouz

Baabiouz

    Finnish Malware Fighter


  • Members
  • 3,355 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:08:30 PM

Posted 13 December 2007 - 12:19 AM

Hi!

Well done!

Before we start fixing anything you should print out these instructions or copy them to a NotePad file so they will be accessible.
Some steps will require you to disconnect from the Internet or use Safe Mode and you will not have access to this page.



#1
Please open HiJackThis and choose do a system scan only. Check the boxes next to ONLY the entries listed below:

O20 - Winlogon Notify: wingdm32 - C:\WINDOWS\

Now close all windows other than HiJackThis, including browsers, so that nothing other than HijackThis is open, then click Fix Checked. A box will pop up asking you if you wish to fix the selected items. Please choose YES. Once it has fixed them, please exit/close HijackThis.

#2
There is one service from Symantec's product left.
Let's remove it:

Please click on Start > Control Panel > Add/Remove Programs and uninstall the following programs(if present):

Liveupdate

___________________

Go to Start->Run and type in notepad and hit OK.

Then copy and paste the content of the following codebox into Notepad:
sc stop LiveUpdate
sc delete LiveUpdate
del delete.bat

Save the file as "delete.bat". Make sure to save it with the quotation marks.

Double click delete.bat.

#3
Please set your system to show all files.
Click Start, open My Computer, select the Tools menu and click Folder Options.
Select the View Tab. Under the Hidden files and folders heading, select Show hidden files and folders.
Uncheck: Hide file extensions for known file types
Uncheck the Hide protected operating system files (recommended) option.
Click Yes to confirm.
___________________

Reboot into Safe Mode by continuously tapping the F8 key as soon as the computer begins to boot. A menu should come up where you will be given the option to enter Safe Mode.

#4
In safemode

Using Windows Explorer (to get there right-click your Start button and go to "Explore"), please delete these folders (if present):

C:\Program Files\Symantec
C:\Program Files\Viewpoint
C:\Documents and Settings\All Users\Application Data\Viewpoint
___________________

Please set your system to hide all hidden files.
Click Start, open My Computer, select the Tools menu and click Folder Options.
Select the View Tab. Under the Hidden files and folders heading, uncheck Show hidden files and folders.
Check: Hide file extensions for known file types
Check the Hide protected operating system files (recommended) option.
Click Yes to confirm.

When done, please reboot your computer normally.

#5
In normal mode
Please post a fresh HijackThis log back here and tell me do you have problems :thumbsup:
Posted Image




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users