Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Sign Of Win32:tratho Trojan Vtsqp.dll Infected Vundo/virtumonde


  • Please log in to reply
36 replies to this topic

#1 Tom S.

Tom S.

  • Members
  • 24 posts
  • OFFLINE
  •  
  • Local time:02:08 AM

Posted 05 January 2008 - 01:48 AM

My computer is almost completely bogged down by this. All programs are very slow and windows boot takes more than 5 minutes. I have tried the vundo remove and virtuegone tools with no luck. I need help! Please can anyone walk me through a fix for this mess. Thank you in advance. Here is the hijackthis log for your review. :thumbsup:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:46, on 2008-01-05
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\ACS.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
c:\TOSHIBA\IVP\swupdate\swupdtmr.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\WINDOWS\system32\TCtrlIOHook.exe
C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk .exe
C:\Program Files\Apoint2K\Apoint .exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\TOSHIBA\Accessibility\FnKeyHook.exe
C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
C:\Program Files\TOSHIBA\Accessibility\FnKeyHook .exe
C:\WINDOWS\system32\ZoomingHook.exe
C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
C:\Program Files\ltmoh\Ltmoh .exe
C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
C:\Program Files\Toshiba\Tvs\TvsTray.exe
C:\toshiba\ivp\ism\pinger.exe
C:\Program Files\TOSHIBA\E-KEY\CeEKey .exe
C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView .exe
C:\Program Files\TOSHIBA\TouchPad\TPTray .exe
C:\Program Files\Apoint2K\Apntex.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2L1.EXE
C:\Program Files\Toshiba\Tvs\TvsTray .exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\toshiba\ivp\ism\pinger .exe
C:\Program Files\TOSHIBA\ConfigFree\CFSServ.exe
C:\Program Files\TOSHIBA\Touch and Launch\PadExe .exe
C:\Program Files\Atheros\ACU.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2L1 .EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray .exe
C:\Program Files\TOSHIBA\ConfigFree\CFXFER.exe
C:\Program Files\Atheros\ACU .exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient .exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd .exe
C:\Program Files\Microsoft SQL Server\MSSQL$PARAGON\Binn\sqlservr.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier .exe
C:\WINDOWS\system32\RAMASST.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\cmd.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\MICROS~2\Office12\OUTLOOK.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\Alwil Software\Avast4\ashLogV.exe
C:\WINDOWS\system32\cmd.exe
C:\ComboFix\nircmd.cfexe
C:\ComboFix\vfind.cfexe
C:\WINDOWS\system32\findstr.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sckmls.fnismls.com/Paragon/Default.asp
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.toshibadirect.com/dpdstart
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer Provided by Cox High Speed Internet
F2 - REG:system.ini: Shell=explorer.exe
F3 - REG:win.ini: load=C:\WINDOWS\system32\vtsqp.exe
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [TCtryIOHook] TCtrlIOHook.exe
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [HWSetup] C:\Program Files\TOSHIBA\TOSHIBA Applet\HWSetup.exe hwSetUP
O4 - HKLM\..\Run: [SVPWUTIL] C:\Program Files\Toshiba\Windows Utilities\SVPWUTIL.exe SVPwUTIL
O4 - HKLM\..\Run: [TOSHIBA Accessibility] C:\Program Files\TOSHIBA\Accessibility\FnKeyHook.exe
O4 - HKLM\..\Run: [CeEKEY] C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
O4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
O4 - HKLM\..\Run: [ZoomingHook] ZoomingHook.exe
O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
O4 - HKLM\..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
O4 - HKLM\..\Run: [Tvs] C:\Program Files\Toshiba\Tvs\TvsTray.exe
O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
O4 - HKLM\..\Run: [EPSON Stylus CX6400] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2L1.EXE /P19 "EPSON Stylus CX6400" /O6 "USB001" /M "Stylus CX6400"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [CFSServ.exe] CFSServ.exe -NoClient
O4 - HKLM\..\Run: [Notebook Maximizer] C:\Program Files\Notebook Maximizer\maximizer_startup.exe
O4 - HKLM\..\Run: [ACU] "C:\Program Files\Atheros\ACU.exe" -nogui
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask .exe" -atboottime
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: MSSQL$PARAGON.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\scm.exe
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Toolbars\Restrictions present
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe
O9 - Extra 'Tools' menuitem: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O13 - DefaultPrefix:
O14 - IERESET.INF: START_PAGE_URL=http://www.toshibadirect.com/dpdstart
O15 - Trusted Zone: *.fnismls.com
O15 - Trusted Zone: *.getmedianow.com
O15 - Trusted Zone: mt5493.ghinconnect.com
O15 - Trusted Zone: *.live.com
O15 - Trusted Zone: *.showingtime.com
O15 - Trusted Zone: *.spellchecker.net
O15 - Trusted Zone: *.virtualearth.net
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://support.cox.com//sdccommon/download/tgctlcm.cab
O16 - DPF: {0854D220-A90A-466D-BC02-6683183802B7} (PrintPreview Class) - http://sckmls.fnismls.com/Paragon/Codebase...rintControl.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4788DE0A-3552-49EA-AC8C-233DA52523B9} (AxLoaderPassword Class) - http://www.blackberry.com/devicesoftware/AxLoader.cab
O16 - DPF: {5879B3B0-566E-4ECB-9B77-9A8A5E62AAB8} (DeviceMon Class) - http://www.blackberry.com/DST2007/patch/de...teLoaderUSB.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1169008234968
O16 - DPF: {B030900C-746A-47BF-8B1D-EA3FB3395563} (CoxFastConnect20 Control) - https://fastconnect.cox.net/cd20/CoxFastConnect20.ocx
O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} (AxisMediaControlEmb Class) - http://216.162.199.11:82/activex/AMC.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1224D68B-39AD-483B-B1C7-A7037C4809B0}: NameServer = 68.105.28.13,68.105.29.13
O17 - HKLM\System\CCS\Services\Tcpip\..\{E2A63CD1-738A-463C-A3EE-01181CAFE000}: NameServer = 68.105.28.13,68.105.29.13
O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\ACS.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: DVD-RAM_Service - Matsubleepa Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Swupdtmr - Unknown owner - c:\TOSHIBA\IVP\swupdate\swupdtmr.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O24 - Desktop Component 0: (no name) - http://us.news1.yimg.com/us.yimg.com/p/ap/...fDwYZ3RZoph.w--

--
End of file - 15623 bytes

BC AdBot (Login to Remove)

 


#2 Tom S.

Tom S.
  • Topic Starter

  • Members
  • 24 posts
  • OFFLINE
  •  
  • Local time:02:08 AM

Posted 05 January 2008 - 05:32 AM

Post combofix log:


ComboFix 08-01-05.1 - Tom Scanlon 2008-01-05 2:46:07.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.118 [GMT -6:00]
Running from: C:\Documents and Settings\Tom Scanlon\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Microsoft Works\WksSb.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\vtsqp.dll
.
---- Previous Run -------
.
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Atheros\ACU.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\Program Files\Microsoft Works\wkfud.exe
C:\Program Files\Notebook Maximizer\maximizer_startup.exe
C:\Program Files\TOSHIBA\Accessibility\FnKeyHook.exe
C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
C:\Program Files\TOSHIBA\TOSHIBA Applet\HWSetup.exe
C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
C:\Program Files\Toshiba\Tvs\TvsTray.exe
C:\Program Files\Toshiba\Windows Utilities\SVPWUTIL.exe
c:\toshiba\ivp\ism\pinger.exe
C:\WINDOWS\Fonts\a.zip
C:\WINDOWS\Fonts\Crack.exe
C:\WINDOWS\system32\ctfmon.exe.tmp
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\pqstv.ini
C:\WINDOWS\system32\pqstv.ini2
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2L1.EXE
C:\WINDOWS\system32\vtsqp.dll
C:\WINDOWS\system32\vtsqp.exe
C:\winlogon.exe
C:\x.dat
C:\z.dat

.
((((((((((((((((((((((((( Files Created from 2007-12-05 to 2008-01-05 )))))))))))))))))))))))))))))))
.

2008-01-05 02:20 . 2008-01-05 02:20 <DIR> d-------- C:\FlashMedia.temp
2008-01-05 02:18 . 2008-01-05 02:18 <DIR> d-------- C:\sdsecure.temp
2008-01-05 02:16 . 2008-01-05 02:16 <DIR> d-------- C:\NoteBook Maximizer.temp
2008-01-05 02:14 . 2008-01-05 02:14 <DIR> d-------- C:\AcousticSilencer.temp
2008-01-05 02:13 . 2008-01-05 02:13 <DIR> d-------- C:\TouchPad.temp
2008-01-04 23:52 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-04 19:45 . 2008-01-05 02:34 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-01-04 19:45 . 2008-01-04 19:45 1,409 --a------ C:\WINDOWS\QTFont.for
2008-01-02 16:59 . 2005-05-23 14:45 <DIR> d-------- C:\Documents and Settings\Administrator\WINDOWS
2008-01-02 16:52 . 2008-01-04 14:45 15,360 --a------ C:\WINDOWS\system32\ctfmon .exe
2008-01-02 02:07 . 2008-01-02 02:07 0 --a------ C:\WINDOWS\CeEKey .INI
2008-01-01 22:46 . 2008-01-01 22:46 0 --a------ C:\WINDOWS\TPTray .INI
2008-01-01 21:34 . 2008-01-04 14:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-01-01 16:42 . 2008-01-01 16:42 <DIR> d-------- C:\Program Files\Lavasoft
2008-01-01 11:47 . 2008-01-02 15:38 <DIR> d-------- C:\VundoFix Backups
2008-01-01 03:25 . 2005-09-23 08:29 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll
2008-01-01 03:15 . 2008-01-01 03:15 <DIR> d-------- C:\Program Files\Trend Micro
2008-01-01 00:13 . 2008-01-01 00:13 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared
2008-01-01 00:13 . 2008-01-01 00:13 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Symantec
2007-12-31 23:20 . 2002-12-29 01:14 81,920 --a------ C:\WINDOWS\system32\Startup.cpl
2007-12-31 21:26 . 2008-01-01 11:25 155,648 --a------ C:\WINDOWS\system32\igfxtray .exe
2007-12-31 21:26 . 2008-01-01 11:25 126,976 --a------ C:\WINDOWS\system32\hkcmd .exe
2007-12-31 19:46 . 2007-12-31 19:46 134 --a------ C:\n.bat
2007-12-31 19:45 . 2007-12-31 19:45 <DIR> d-------- C:\WINDOWS\system32\ardCo18
2007-12-31 19:45 . 2007-12-31 19:45 <DIR> d-------- C:\Temp\cEeer12
2007-12-31 19:45 . 2007-12-31 19:45 <DIR> d-------- C:\Temp
2007-12-31 18:49 . 2007-12-31 18:49 147,456 --a------ C:\WINDOWS\system32\vbzip10.dll
2007-12-31 18:44 . 2008-01-02 17:55 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2007-12-20 21:12 . 2007-12-20 21:12 <DIR> d-------- C:\Documents and Settings\Shantel\Application Data\Roxio
2007-12-18 20:03 . 2007-12-18 20:04 <DIR> d-------- C:\Documents and Settings\Shantel\Application Data\Blackberry Desktop
2007-12-18 17:38 . 2007-12-18 17:38 <DIR> d-------- C:\Documents and Settings\Shantel\Application Data\Research In Motion
2007-12-18 17:26 . 2007-12-18 17:26 <DIR> d-------- C:\Program Files\ZoneAlarmSB
2007-12-18 16:11 . 2007-12-18 16:11 <DIR> d-------- C:\Documents and Settings\Tom Scanlon\Application Data\Roxio
2007-12-18 16:03 . 2008-01-05 03:43 256 --a------ C:\WINDOWS\system32\pool.bin
2007-12-18 15:43 . 2007-12-18 15:43 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\InstallShield
2007-12-18 15:42 . 2007-12-18 15:42 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Sonic
2007-12-18 15:36 . 2007-12-18 15:37 <DIR> d-------- C:\Program Files\Roxio
2007-12-18 15:36 . 2007-12-18 15:41 <DIR> d-------- C:\Program Files\Common Files\Sonic Shared
2007-12-18 15:36 . 2007-12-18 15:38 <DIR> d-------- C:\Program Files\Common Files\Roxio Shared
2007-12-18 15:36 . 2007-12-18 16:02 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Roxio

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-05 09:41 5,242,912 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-01-05 09:35 62,420 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-01-05 09:23 --------- d-----w C:\Program Files\Microsoft Works
2008-01-05 09:23 --------- d-----w C:\Program Files\iTunes
2008-01-05 08:17 --------- d-----w C:\Program Files\Notebook Maximizer
2008-01-05 08:16 720,896 ----a-w C:\WINDOWS\iun6002.exe
2008-01-05 06:53 --------- d-----w C:\Program Files\ltmoh
2008-01-05 06:53 --------- d-----w C:\Program Files\Atheros
2008-01-05 06:53 --------- d-----w C:\Program Files\Apoint2K
2008-01-05 04:40 --------- d-----w C:\Program Files\QuickTime
2008-01-03 16:32 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-03 16:32 --------- d-----w C:\Program Files\Toshiba
2008-01-03 04:17 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-01-03 02:27 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-01-01 19:50 --------- d-----w C:\Documents and Settings\Tom Scanlon\Application Data\FrostWire
2008-01-01 00:56 --------- d-----w C:\Program Files\LimeWire
2007-12-29 06:39 186 ----a-w C:\Documents and Settings\Tom Scanlon\Application Data\wklnhst.dat
2007-12-18 21:36 --------- d-----w C:\Program Files\Common Files\InstallShield
2007-12-14 05:40 --------- d-----w C:\Program Files\UltimateBet
2007-11-23 23:22 --------- d-----w C:\Program Files\iPod
2007-11-14 22:05 75,248 ----a-w C:\WINDOWS\zllsputility.exe
2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-11 07:15 --------- d-----w C:\Documents and Settings\All Users\Application Data\MailFrontier
2007-02-17 02:40 35,632 ----a-w C:\Documents and Settings\Shantel\Application Data\GDIPFONTCACHEV1.DAT
2007-02-04 22:53 142 ----a-w C:\Documents and Settings\Shantel\Application Data\wklnhst.dat
.
<pre>
----a-w		   483,328 2008-01-05 05:39:22  C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray .exe
----a-w			79,224 2008-01-05 04:40:39  C:\Program Files\Alwil Software\Avast4\ashDisp .exe
----a-w		   196,608 2008-01-05 05:38:31  C:\Program Files\Apoint2K\Apoint .exe
----a-w		   290,816 2008-01-05 05:39:26  C:\Program Files\Atheros\ACU .exe
----a-w		   437,160 2008-01-03 08:50:53  C:\Program Files\Common Files\Microsoft Shared\DW\dwtrig20 .exe
----a-w			28,738 2008-01-05 08:33:09  C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind .exe
----a-w		   228,088 2008-01-05 05:39:40  C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9 .exe
----a-w			68,856 2008-01-05 05:41:28  C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier .exe
----a-w		   385,024 2008-01-05 05:38:31  C:\Program Files\Intel\Wireless\Bin\ifrmewrk .exe
----a-w		   267,048 2008-01-05 08:32:54  C:\Program Files\iTunes\iTunesHelper .exe
----a-w		   184,320 2008-01-05 05:38:52  C:\Program Files\ltmoh\Ltmoh .exe
----a-w		 1,694,208 2008-01-05 08:33:30  C:\Program Files\Messenger\msmsgs .exe
----a-w			24,576 2008-01-05 05:39:34  C:\Program Files\Microsoft Works\wkfud .exe
----a-w		   729,088 2008-01-05 08:33:01  C:\Program Files\Microsoft Works\WksSb .exe
----a-w			28,672 2008-01-05 05:39:21  C:\Program Files\Notebook Maximizer\maximizer_startup .exe
----a-w		   286,720 2008-01-05 04:40:38  C:\Program Files\QuickTime\qttask					  .exe
----a-w		   662,016 2008-01-05 04:31:53  C:\Program Files\QuickTime\qttask					 .exe
----a-w		   662,016 2008-01-05 01:37:15  C:\Program Files\QuickTime\qttask					.exe
----a-w		   662,016 2008-01-04 21:11:06  C:\Program Files\QuickTime\qttask				   .exe
----a-w		   317,440 2008-01-04 18:46:48  C:\Program Files\QuickTime\qttask				  .exe
----a-w		   662,016 2008-01-04 05:55:12  C:\Program Files\QuickTime\qttask				 .exe
----a-w		   662,016 2008-01-04 03:21:19  C:\Program Files\QuickTime\qttask				.exe
----a-w		   662,016 2008-01-03 16:42:33  C:\Program Files\QuickTime\qttask			   .exe
----a-w		   662,016 2008-01-03 13:57:26  C:\Program Files\QuickTime\qttask			  .exe
----a-w		   662,016 2008-01-03 08:39:43  C:\Program Files\QuickTime\qttask			 .exe
----a-w		   662,016 2008-01-03 05:30:55  C:\Program Files\QuickTime\qttask			.exe
----a-w		   662,016 2008-01-03 03:19:53  C:\Program Files\QuickTime\qttask		   .exe
----a-w		   662,016 2008-01-03 02:19:56  C:\Program Files\QuickTime\qttask		  .exe
----a-w		   662,016 2008-01-03 01:35:54  C:\Program Files\QuickTime\qttask		 .exe
----a-w		   662,016 2008-01-02 23:43:37  C:\Program Files\QuickTime\qttask		.exe
----a-w		   662,016 2008-01-02 21:36:48  C:\Program Files\QuickTime\qttask	   .exe
----a-w		   662,016 2008-01-02 18:28:01  C:\Program Files\QuickTime\qttask	  .exe
----a-w		   662,016 2008-01-02 08:37:58  C:\Program Files\QuickTime\qttask	 .exe
----a-w		   662,016 2008-01-02 06:11:26  C:\Program Files\QuickTime\qttask	.exe
----a-w		   662,016 2008-01-02 05:42:26  C:\Program Files\QuickTime\qttask   .exe
----a-w		   662,016 2008-01-01 06:48:14  C:\Program Files\QuickTime\qttask  .exe
----a-w		   662,016 2008-01-01 04:54:26  C:\Program Files\QuickTime\qttask .exe
----a-w		 1,460,560 2008-01-02 06:19:35  C:\Program Files\Spybot - Search & Destroy\TeaTimer .exe
----a-w			24,576 2008-01-05 05:38:49  C:\Program Files\Toshiba\Accessibility\FnKeyHook .exe
----a-w		   675,840 2008-01-05 05:39:00  C:\Program Files\Toshiba\E-KEY\CeEKey .exe
----a-w			65,536 2008-01-05 05:39:57  C:\Program Files\Toshiba\TOSCDSPD\toscdspd .exe
----a-w			28,672 2008-01-05 05:38:40  C:\Program Files\Toshiba\TOSHIBA Applet\HWSetup .exe
----a-w		   122,880 2008-01-05 05:39:02  C:\Program Files\Toshiba\TOSHIBA Zooming Utility\SmoothView .exe
----a-w		 1,077,301 2008-01-05 05:39:11  C:\Program Files\Toshiba\Touch and Launch\PadExe .exe
----a-w			53,248 2008-01-05 05:39:03  C:\Program Files\Toshiba\TouchPad\TPTray .exe
----a-w			73,728 2008-01-05 05:39:07  C:\Program Files\Toshiba\Tvs\TvsTray .exe
----a-w			65,536 2008-01-05 05:38:47  C:\Program Files\Toshiba\Windows Utilities\SVPWUTIL .exe
----a-w		   919,016 2008-01-05 05:39:54  C:\Program Files\Zone Labs\ZoneAlarm\zlclient .exe
----a-w		   151,552 2008-01-05 05:39:10  C:\TOSHIBA\IVP\ISM\pinger .exe
----a-w		   839,697 2008-01-01 21:51:16  C:\WINDOWS\Fonts\svchost .exe
----a-w			15,360 2008-01-04 20:45:17  C:\WINDOWS\system32\ctfmon .exe
----a-w		   126,976 2008-01-01 17:25:53  C:\WINDOWS\system32\hkcmd .exe
----a-w		   155,648 2008-01-01 17:25:51  C:\WINDOWS\system32\igfxtray .exe
----a-w		   122,941 2008-01-01 03:26:31  C:\WINDOWS\system32\dla\tfswctrl .exe
----a-w			99,840 2008-01-05 05:39:17  C:\WINDOWS\system32\spool\drivers\w32x86\3\E_S4I2L1 .EXE
</pre>


-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA}]
2007-12-18 17:26 262144 --a------ C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{47833539-D0C5-4125-9FA8-0819E2EAAC93}
{2318C2B1-4965-11D4-9B18-009027A5CD4F}
{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}

[HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}"= C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL [2007-12-18 17:26 262144]

[HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:00 15360]
"TOSCDSPD"="C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe" [ ]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [ ]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [ ]
"TCtryIOHook"="TCtrlIOHook.exe" [2004-05-01 16:03 28672 C:\WINDOWS\system32\TCtrlIOHook.exe]
"TFncKy"="TFncKy.exe" []
"Apoint"="C:\Program Files\Apoint2K\Apoint.exe" [ ]
"LtMoh"="C:\Program Files\ltmoh\Ltmoh.exe" [ ]
"AGRSMMSG"="AGRSMMSG.exe" [2005-04-12 17:17 88358 C:\WINDOWS\agrsmmsg.exe]
"NDSTray.exe"="NDSTray.exe" []
"HWSetup"="C:\Program Files\TOSHIBA\TOSHIBA Applet\HWSetup.exe" [ ]
"SVPWUTIL"="C:\Program Files\Toshiba\Windows Utilities\SVPWUTIL.exe" [ ]
"TOSHIBA Accessibility"="C:\Program Files\TOSHIBA\Accessibility\FnKeyHook.exe" [ ]
"CeEKEY"="C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe" [ ]
"PadTouch"="C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe" [ ]
"ZoomingHook"="ZoomingHook.exe" [2004-05-01 00:03 24576 C:\WINDOWS\system32\ZoomingHook.exe]
"SmoothView"="C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe" [ ]
"TPNF"="C:\Program Files\TOSHIBA\TouchPad\TPTray.exe" [ ]
"Tvs"="C:\Program Files\Toshiba\Tvs\TvsTray.exe" [ ]
"Pinger"="c:\toshiba\ivp\ism\pinger.exe" [ ]
"EPSON Stylus CX6400"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2L1.exe" [ ]
"Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2006-01-12 20:52 483328]
"CFSServ.exe"="CFSServ.exe" []
"Notebook Maximizer"="C:\Program Files\Notebook Maximizer\maximizer_startup.exe" [2004-05-25 16:35 28672]
"ACU"="C:\Program Files\Atheros\ACU.exe" [ ]
"WorksFUD"="C:\Program Files\Microsoft Works\wkfud.exe" [ ]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 05:06 79224]
"QuickTime Task"="C:\Program Files\QuickTime\qttask .exe" [2008-01-04 22:40 286720]
"RoxWatchTray"="C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [ ]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [ ]
"RegistryMechanic"="" []
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [ ]
"Microsoft Works Portfolio"="C:\Program Files\Microsoft Works\WksSb.exe" [ ]
"Microsoft Works Update Detection"="C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [ ]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2007-01-17 02:09:30]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [2006-10-19 14:53 293888]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
C:\Program Files\Intel\Wireless\Bin\LgNotify.dll 2004-10-15 13:27 110592 C:\Program Files\Intel\Wireless\Bin\LgNotify.dll

R1 SerTVOutCtlr;TOSHIBA Controls Driver -EPIOMngr;C:\WINDOWS\system32\drivers\EPIOMngr.sys [2004-07-30 17:05]
R1 TPwSav;Common Driver;C:\WINDOWS\system32\Drivers\TPwSav.sys [2005-02-25 20:22]
R2 MSSQL$MSSMLBIZ;SQL Server (MSSMLBIZ);"c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" [2007-02-10 05:29]
R2 MSSQL$PARAGON;MSSQL$PARAGON;C:\Program Files\Microsoft SQL Server\MSSQL$PARAGON\Binn\sqlservr.exe [2002-12-17 17:26]
R2 SQLWriter;SQL Server VSS Writer;"c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe" [2007-02-10 05:29]
S1 StickyMesger;StickyMesger;C:\Program Files\TOSHIBA\Accessibility\StickyMesger.sys []
S3 EKECioCtl;EKECioCtl;C:\Program Files\TOSHIBA\E-KEY\CeEKey .exe [2008-01-04 23:39]
S3 SQLAgent$PARAGON;SQLAgent$PARAGON;C:\Program Files\Microsoft SQL Server\MSSQL$PARAGON\Binn\sqlagent.EXE [2002-12-17 17:23]
S3 umpusbxp;ActiveKEY VCP Serial Port Driver;C:\WINDOWS\system32\DRIVERS\umpusbxp.sys [2007-01-29 20:05]
S3 WCG200V2XP;Linksys WCG200 ver. 2 Wireless-G Cable Gateway;C:\WINDOWS\system32\DRIVERS\WCG200V2XP.sys [2004-07-06 02:06]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fdff6e5f-ec2a-11db-a65d-0012f0ba208f}]
\Shell\AutoRun\command - E:\InstallTomTomHOME.exe

.
Contents of the 'Scheduled Tasks' folder
"2008-01-04 18:52:50 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-05 03:42:25
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-05 4:14:54 - machine was rebooted [Tom Scanlon]
ComboFix-quarantined-files.txt 2008-01-05 10:14:44
.
2007-12-21 09:02:13 --- E O F ---

#3 Tom S.

Tom S.
  • Topic Starter

  • Members
  • 24 posts
  • OFFLINE
  •  
  • Local time:02:08 AM

Posted 05 January 2008 - 05:39 AM

New hijackthis log:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:37:08 AM, on 1/5/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\ACS.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Microsoft SQL Server\MSSQL$PARAGON\Binn\sqlservr.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
c:\TOSHIBA\IVP\swupdate\swupdtmr.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\TCtrlIOHook.exe
C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\WINDOWS\system32\ZoomingHook.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSServ.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TOSHIBA\ConfigFree\CFXFER.exe
C:\Program Files\Research In Motion\BlackBerry\DesktopMgr.exe
C:\WINDOWS\system32\RAMASST.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Research In Motion\BlackBerry\DesktopMgr.exe
C:\Program Files\Common Files\Research In Motion\RIMDeviceManager\RIMDeviceManager.exe
C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\NOTEPAD.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sckmls.fnismls.com/Paragon/Default.asp
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.toshibadirect.com/dpdstart
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [TCtryIOHook] TCtrlIOHook.exe
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [HWSetup] C:\Program Files\TOSHIBA\TOSHIBA Applet\HWSetup.exe hwSetUP
O4 - HKLM\..\Run: [SVPWUTIL] C:\Program Files\Toshiba\Windows Utilities\SVPWUTIL.exe SVPwUTIL
O4 - HKLM\..\Run: [TOSHIBA Accessibility] C:\Program Files\TOSHIBA\Accessibility\FnKeyHook.exe
O4 - HKLM\..\Run: [CeEKEY] C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
O4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
O4 - HKLM\..\Run: [ZoomingHook] ZoomingHook.exe
O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
O4 - HKLM\..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
O4 - HKLM\..\Run: [Tvs] C:\Program Files\Toshiba\Tvs\TvsTray.exe
O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
O4 - HKLM\..\Run: [EPSON Stylus CX6400] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2L1.EXE /P19 "EPSON Stylus CX6400" /O6 "USB001" /M "Stylus CX6400"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [CFSServ.exe] CFSServ.exe -NoClient
O4 - HKLM\..\Run: [Notebook Maximizer] C:\Program Files\Notebook Maximizer\maximizer_startup.exe
O4 - HKLM\..\Run: [ACU] "C:\Program Files\Atheros\ACU.exe" -nogui
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask .exe" -atboottime
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Desktop Manager.lnk = C:\Program Files\Research In Motion\BlackBerry\DesktopMgr.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Desktop Manager.lnk = C:\Program Files\Research In Motion\BlackBerry\DesktopMgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: MSSQL$PARAGON.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\scm.exe
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Toolbars\Restrictions present
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe
O9 - Extra 'Tools' menuitem: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O13 - DefaultPrefix:
O14 - IERESET.INF: START_PAGE_URL=http://www.toshibadirect.com/dpdstart
O15 - Trusted Zone: *.fnismls.com
O15 - Trusted Zone: *.getmedianow.com
O15 - Trusted Zone: mt5493.ghinconnect.com
O15 - Trusted Zone: *.live.com
O15 - Trusted Zone: *.showingtime.com
O15 - Trusted Zone: *.spellchecker.net
O15 - Trusted Zone: *.virtualearth.net
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://support.cox.com//sdccommon/download/tgctlcm.cab
O16 - DPF: {0854D220-A90A-466D-BC02-6683183802B7} (PrintPreview Class) - http://sckmls.fnismls.com/Paragon/Codebase...rintControl.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4788DE0A-3552-49EA-AC8C-233DA52523B9} (AxLoaderPassword Class) - http://www.blackberry.com/devicesoftware/AxLoader.cab
O16 - DPF: {5879B3B0-566E-4ECB-9B77-9A8A5E62AAB8} (DeviceMon Class) - http://www.blackberry.com/DST2007/patch/de...teLoaderUSB.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1169008234968
O16 - DPF: {B030900C-746A-47BF-8B1D-EA3FB3395563} (CoxFastConnect20 Control) - https://fastconnect.cox.net/cd20/CoxFastConnect20.ocx
O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} (AxisMediaControlEmb Class) - http://216.162.199.11:82/activex/AMC.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1224D68B-39AD-483B-B1C7-A7037C4809B0}: NameServer = 68.105.28.13,68.105.29.13
O17 - HKLM\System\CCS\Services\Tcpip\..\{E2A63CD1-738A-463C-A3EE-01181CAFE000}: NameServer = 68.105.28.13,68.105.29.13
O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\ACS.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: DVD-RAM_Service - Matsubleepa Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Swupdtmr - Unknown owner - c:\TOSHIBA\IVP\swupdate\swupdtmr.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O24 - Desktop Component 0: (no name) - http://us.news1.yimg.com/us.yimg.com/p/ap/...fDwYZ3RZoph.w--

--
End of file - 14486 bytes

#4 RichieUK

RichieUK

    Malware Assassin


  • Malware Response Team
  • 13,614 posts
  • OFFLINE
  •  
  • Local time:09:08 AM

Posted 05 January 2008 - 05:47 AM

Welcome to the BleepingComputer HijackThis Logs and Analysis forum Tom S.
My name is Richie and i'll be helping you to fix your problems.

Download RenV.exe to your desktop,double click to run it:
http://download.bleepingcomputer.com/sUBs/Beta/RenV.exe
When its finished it will produce a Log.
Please post the contents of that Log into your next reply.

Close any open browsers.
Double click on combofix.exe again and follow the prompts.
When it's finished it will produce a log.
Post the entire contents of C:\ComboFix.txt into your next reply.

Also post a new Hijackthis log please.

Note:
You should NOT use Combofix unless you have been instructed to do so by a Malware Removal Expert.
It is intended by its creator to be used under the guidance and supervision of an expert,not for private use.
Using this tool incorrectly could render your system/pc inoperable.
Posted Image
Posted Image

#5 Tom S.

Tom S.
  • Topic Starter

  • Members
  • 24 posts
  • OFFLINE
  •  
  • Local time:02:08 AM

Posted 05 January 2008 - 06:27 AM

This isnt much of a log but this is what ren v created:


[code=auto:0]
Ran on Sat 01/05/2008 - 5:26:22.34

#6 Tom S.

Tom S.
  • Topic Starter

  • Members
  • 24 posts
  • OFFLINE
  •  
  • Local time:02:08 AM

Posted 05 January 2008 - 07:15 AM

Combo fix is not completing. It says find 3m Prepiring Log Report Do not run any programs until it finishes

#7 Tom S.

Tom S.
  • Topic Starter

  • Members
  • 24 posts
  • OFFLINE
  •  
  • Local time:02:08 AM

Posted 05 January 2008 - 07:22 AM

ComboFix 08-01-05.1 - Tom Scanlon 2008-01-05 5:30:58.3 - NTFSx86
Running from: C:\Documents and Settings\Tom Scanlon\Desktop\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2007-12-05 to 2008-01-05 )))))))))))))))))))))))))))))))
.

2008-01-05 05:11 . 2008-01-05 05:11 <DIR> d-------- C:\Touched.temp
2008-01-05 05:07 . 2008-01-05 05:07 <DIR> d-------- C:\TouchandLaunch.temp
2008-01-05 02:20 . 2008-01-05 02:20 <DIR> d-------- C:\FlashMedia.temp
2008-01-05 02:18 . 2008-01-05 02:18 <DIR> d-------- C:\sdsecure.temp
2008-01-05 02:16 . 2008-01-05 02:16 <DIR> d-------- C:\NoteBook Maximizer.temp
2008-01-05 02:14 . 2008-01-05 02:14 <DIR> d-------- C:\AcousticSilencer.temp
2008-01-05 02:13 . 2008-01-05 02:13 <DIR> d-------- C:\TouchPad.temp
2008-01-04 23:52 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-04 19:45 . 2008-01-05 02:34 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-01-04 19:45 . 2008-01-04 19:45 1,409 --a------ C:\WINDOWS\QTFont.for
2008-01-02 16:59 . 2005-05-23 14:45 <DIR> d-------- C:\Documents and Settings\Administrator\WINDOWS
2008-01-02 16:52 . 2008-01-04 14:45 15,360 --a------ C:\WINDOWS\system32\ctfmon .exe
2008-01-02 02:07 . 2008-01-02 02:07 0 --a------ C:\WINDOWS\CeEKey .INI
2008-01-01 22:46 . 2008-01-01 22:46 0 --a------ C:\WINDOWS\TPTray .INI
2008-01-01 21:34 . 2008-01-04 14:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-01-01 16:42 . 2008-01-01 16:42 <DIR> d-------- C:\Program Files\Lavasoft
2008-01-01 11:47 . 2008-01-02 15:38 <DIR> d-------- C:\VundoFix Backups
2008-01-01 03:25 . 2005-09-23 08:29 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll
2008-01-01 03:15 . 2008-01-01 03:15 <DIR> d-------- C:\Program Files\Trend Micro
2008-01-01 00:13 . 2008-01-01 00:13 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared
2008-01-01 00:13 . 2008-01-01 00:13 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Symantec
2007-12-31 23:20 . 2002-12-29 01:14 81,920 --a------ C:\WINDOWS\system32\Startup.cpl
2007-12-31 21:26 . 2008-01-01 11:25 155,648 --a------ C:\WINDOWS\system32\igfxtray .exe
2007-12-31 21:26 . 2008-01-01 11:25 126,976 --a------ C:\WINDOWS\system32\hkcmd .exe
2007-12-31 19:46 . 2007-12-31 19:46 134 --a------ C:\n.bat
2007-12-31 19:45 . 2007-12-31 19:45 <DIR> d-------- C:\WINDOWS\system32\ardCo18
2007-12-31 19:45 . 2007-12-31 19:45 <DIR> d-------- C:\Temp\cEeer12
2007-12-31 19:45 . 2007-12-31 19:45 <DIR> d-------- C:\Temp
2007-12-31 18:49 . 2007-12-31 18:49 147,456 --a------ C:\WINDOWS\system32\vbzip10.dll
2007-12-31 18:44 . 2008-01-02 17:55 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2007-12-20 21:12 . 2007-12-20 21:12 <DIR> d-------- C:\Documents and Settings\Shantel\Application Data\Roxio
2007-12-18 20:03 . 2007-12-18 20:04 <DIR> d-------- C:\Documents and Settings\Shantel\Application Data\Blackberry Desktop
2007-12-18 17:38 . 2007-12-18 17:38 <DIR> d-------- C:\Documents and Settings\Shantel\Application Data\Research In Motion
2007-12-18 17:26 . 2007-12-18 17:26 <DIR> d-------- C:\Program Files\ZoneAlarmSB
2007-12-18 16:11 . 2007-12-18 16:11 <DIR> d-------- C:\Documents and Settings\Tom Scanlon\Application Data\Roxio
2007-12-18 16:03 . 2008-01-05 05:24 256 --a------ C:\WINDOWS\system32\pool.bin
2007-12-18 15:43 . 2007-12-18 15:43 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\InstallShield
2007-12-18 15:42 . 2007-12-18 15:42 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Sonic
2007-12-18 15:36 . 2007-12-18 15:37 <DIR> d-------- C:\Program Files\Roxio
2007-12-18 15:36 . 2007-12-18 15:41 <DIR> d-------- C:\Program Files\Common Files\Sonic Shared
2007-12-18 15:36 . 2007-12-18 15:38 <DIR> d-------- C:\Program Files\Common Files\Roxio Shared
2007-12-18 15:36 . 2007-12-18 16:02 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Roxio

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-05 11:52 5,314,592 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-01-05 09:35 62,420 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-01-05 09:23 --------- d-----w C:\Program Files\Microsoft Works
2008-01-05 09:23 --------- d-----w C:\Program Files\iTunes
2008-01-05 08:17 --------- d-----w C:\Program Files\Notebook Maximizer
2008-01-05 08:16 720,896 ----a-w C:\WINDOWS\iun6002.exe
2008-01-05 06:53 --------- d-----w C:\Program Files\ltmoh
2008-01-05 06:53 --------- d-----w C:\Program Files\Atheros
2008-01-05 06:53 --------- d-----w C:\Program Files\Apoint2K
2008-01-05 04:40 --------- d-----w C:\Program Files\QuickTime
2008-01-03 16:32 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-03 16:32 --------- d-----w C:\Program Files\Toshiba
2008-01-03 04:17 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-01-03 02:27 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-01-01 21:51 839,697 ----a-w C:\WINDOWS\Fonts\svchost .exe
2008-01-01 19:50 --------- d-----w C:\Documents and Settings\Tom Scanlon\Application Data\FrostWire
2008-01-01 00:56 --------- d-----w C:\Program Files\LimeWire
2007-12-31 01:17 12,860,001 ----a-w C:\WINDOWS\Internet Logs\tvDebug.zip
2007-12-29 06:39 186 ----a-w C:\Documents and Settings\Tom Scanlon\Application Data\wklnhst.dat
2007-12-18 22:00 169,131 ----a-w C:\WINDOWS\Internet Logs\vsmon_on_demand_2007_12_18_15_58_41_full.dmp.zip
2007-12-18 21:36 --------- d-----w C:\Program Files\Common Files\InstallShield
2007-12-14 05:40 --------- d-----w C:\Program Files\UltimateBet
2007-11-24 02:53 295,430 ----a-w C:\WINDOWS\Internet Logs\vsmon_on_demand_2007_11_23_20_52_51_full.dmp.zip
2007-11-23 23:22 --------- d-----w C:\Program Files\iPod
2007-11-14 22:05 75,248 ----a-w C:\WINDOWS\zllsputility.exe
2007-11-14 22:05 1,086,952 ----a-w C:\WINDOWS\system32\zpeng24.dll
2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-11 07:15 --------- d-----w C:\Documents and Settings\All Users\Application Data\MailFrontier
2007-10-29 22:43 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
2007-10-27 23:40 222,720 ----a-w C:\WINDOWS\system32\wmasf.dll
2007-06-21 21:02 20,704,899 ----a-w C:\WINDOWS\Internet Logs\vsmon_on_demand_2007_06_21_16_00_38_full.dmp.zip
2007-02-17 02:40 35,632 ----a-w C:\Documents and Settings\Shantel\Application Data\GDIPFONTCACHEV1.DAT
2007-02-04 22:53 142 ----a-w C:\Documents and Settings\Shantel\Application Data\wklnhst.dat
.
<pre>
----a-w		   483,328 2008-01-05 05:39:22  C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray .exe
----a-w			79,224 2008-01-05 04:40:39  C:\Program Files\Alwil Software\Avast4\ashDisp .exe
----a-w		   196,608 2008-01-05 05:38:31  C:\Program Files\Apoint2K\Apoint .exe
----a-w		   290,816 2008-01-05 05:39:26  C:\Program Files\Atheros\ACU .exe
----a-w		   437,160 2008-01-03 08:50:53  C:\Program Files\Common Files\Microsoft Shared\DW\dwtrig20 .exe
----a-w			28,738 2008-01-05 08:33:09  C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind .exe
----a-w		   228,088 2008-01-05 05:39:40  C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9 .exe
----a-w			68,856 2008-01-05 05:41:28  C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier .exe
----a-w		   385,024 2008-01-05 05:38:31  C:\Program Files\Intel\Wireless\Bin\ifrmewrk .exe
----a-w		   267,048 2008-01-05 08:32:54  C:\Program Files\iTunes\iTunesHelper .exe
----a-w		   184,320 2008-01-05 05:38:52  C:\Program Files\ltmoh\Ltmoh .exe
----a-w		 1,694,208 2008-01-05 08:33:30  C:\Program Files\Messenger\msmsgs .exe
----a-w			24,576 2008-01-05 05:39:34  C:\Program Files\Microsoft Works\wkfud .exe
----a-w		   729,088 2008-01-05 08:33:01  C:\Program Files\Microsoft Works\WksSb .exe
----a-w			28,672 2008-01-05 05:39:21  C:\Program Files\Notebook Maximizer\maximizer_startup .exe
----a-w		   286,720 2008-01-05 04:40:38  C:\Program Files\QuickTime\qttask					  .exe
----a-w		   662,016 2008-01-05 04:31:53  C:\Program Files\QuickTime\qttask					 .exe
----a-w		   662,016 2008-01-05 01:37:15  C:\Program Files\QuickTime\qttask					.exe
----a-w		   662,016 2008-01-04 21:11:06  C:\Program Files\QuickTime\qttask				   .exe
----a-w		   317,440 2008-01-04 18:46:48  C:\Program Files\QuickTime\qttask				  .exe
----a-w		   662,016 2008-01-04 05:55:12  C:\Program Files\QuickTime\qttask				 .exe
----a-w		   662,016 2008-01-04 03:21:19  C:\Program Files\QuickTime\qttask				.exe
----a-w		   662,016 2008-01-03 16:42:33  C:\Program Files\QuickTime\qttask			   .exe
----a-w		   662,016 2008-01-03 13:57:26  C:\Program Files\QuickTime\qttask			  .exe
----a-w		   662,016 2008-01-03 08:39:43  C:\Program Files\QuickTime\qttask			 .exe
----a-w		   662,016 2008-01-03 05:30:55  C:\Program Files\QuickTime\qttask			.exe
----a-w		   662,016 2008-01-03 03:19:53  C:\Program Files\QuickTime\qttask		   .exe
----a-w		   662,016 2008-01-03 02:19:56  C:\Program Files\QuickTime\qttask		  .exe
----a-w		   662,016 2008-01-03 01:35:54  C:\Program Files\QuickTime\qttask		 .exe
----a-w		   662,016 2008-01-02 23:43:37  C:\Program Files\QuickTime\qttask		.exe
----a-w		   662,016 2008-01-02 21:36:48  C:\Program Files\QuickTime\qttask	   .exe
----a-w		   662,016 2008-01-02 18:28:01  C:\Program Files\QuickTime\qttask	  .exe
----a-w		   662,016 2008-01-02 08:37:58  C:\Program Files\QuickTime\qttask	 .exe
----a-w		   662,016 2008-01-02 06:11:26  C:\Program Files\QuickTime\qttask	.exe
----a-w		   662,016 2008-01-02 05:42:26  C:\Program Files\QuickTime\qttask   .exe
----a-w		   662,016 2008-01-01 06:48:14  C:\Program Files\QuickTime\qttask  .exe
----a-w		   662,016 2008-01-01 04:54:26  C:\Program Files\QuickTime\qttask .exe
----a-w		 1,460,560 2008-01-02 06:19:35  C:\Program Files\Spybot - Search & Destroy\TeaTimer .exe
----a-w			24,576 2008-01-05 05:38:49  C:\Program Files\Toshiba\Accessibility\FnKeyHook .exe
----a-w		   675,840 2008-01-05 05:39:00  C:\Program Files\Toshiba\E-KEY\CeEKey .exe
----a-w			65,536 2008-01-05 05:39:57  C:\Program Files\Toshiba\TOSCDSPD\toscdspd .exe
----a-w			28,672 2008-01-05 05:38:40  C:\Program Files\Toshiba\TOSHIBA Applet\HWSetup .exe
----a-w		   122,880 2008-01-05 05:39:02  C:\Program Files\Toshiba\TOSHIBA Zooming Utility\SmoothView .exe
----a-w		 1,077,301 2008-01-05 05:39:11  C:\Program Files\Toshiba\Touch and Launch\PadExe .exe
----a-w			53,248 2008-01-05 05:39:03  C:\Program Files\Toshiba\TouchPad\TPTray .exe
----a-w			73,728 2008-01-05 05:39:07  C:\Program Files\Toshiba\Tvs\TvsTray .exe
----a-w			65,536 2008-01-05 05:38:47  C:\Program Files\Toshiba\Windows Utilities\SVPWUTIL .exe
----a-w		   919,016 2008-01-05 05:39:54  C:\Program Files\Zone Labs\ZoneAlarm\zlclient .exe
----a-w		   151,552 2008-01-05 05:39:10  C:\TOSHIBA\IVP\ISM\pinger .exe
----a-w		   839,697 2008-01-01 21:51:16  C:\WINDOWS\Fonts\svchost .exe
----a-w			15,360 2008-01-04 20:45:17  C:\WINDOWS\system32\ctfmon .exe
----a-w		   126,976 2008-01-01 17:25:53  C:\WINDOWS\system32\hkcmd .exe
----a-w		   155,648 2008-01-01 17:25:51  C:\WINDOWS\system32\igfxtray .exe
----a-w		   122,941 2008-01-01 03:26:31  C:\WINDOWS\system32\dla\tfswctrl .exe
----a-w			99,840 2008-01-05 05:39:17  C:\WINDOWS\system32\spool\drivers\w32x86\3\E_S4I2L1 .EXE
</pre>


-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA}]
2007-12-18 17:26 262144 --a------ C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{47833539-D0C5-4125-9FA8-0819E2EAAC93}
{2318C2B1-4965-11D4-9B18-009027A5CD4F}
{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}

[HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}"= C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL [2007-12-18 17:26 262144]

[HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:00 15360]
"TOSCDSPD"="C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe" [ ]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [ ]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [ ]
"TCtryIOHook"="TCtrlIOHook.exe" [2004-05-01 16:03 28672 C:\WINDOWS\system32\TCtrlIOHook.exe]
"TFncKy"="TFncKy.exe" []
"Apoint"="C:\Program Files\Apoint2K\Apoint.exe" [ ]
"LtMoh"="C:\Program Files\ltmoh\Ltmoh.exe" [ ]
"AGRSMMSG"="AGRSMMSG.exe" [2005-04-12 17:17 88358 C:\WINDOWS\agrsmmsg.exe]
"NDSTray.exe"="NDSTray.exe" []
"HWSetup"="C:\Program Files\TOSHIBA\TOSHIBA Applet\HWSetup.exe" [ ]
"SVPWUTIL"="C:\Program Files\Toshiba\Windows Utilities\SVPWUTIL.exe" [ ]
"TOSHIBA Accessibility"="C:\Program Files\TOSHIBA\Accessibility\FnKeyHook.exe" [ ]
"CeEKEY"="C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe" [ ]
"PadTouch"="C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe" [ ]
"ZoomingHook"="ZoomingHook.exe" [2004-05-01 00:03 24576 C:\WINDOWS\system32\ZoomingHook.exe]
"SmoothView"="C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe" [ ]
"TPNF"="C:\Program Files\TOSHIBA\TouchPad\TPTray.exe" [ ]
"Tvs"="C:\Program Files\Toshiba\Tvs\TvsTray.exe" [ ]
"Pinger"="c:\toshiba\ivp\ism\pinger.exe" [ ]
"EPSON Stylus CX6400"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2L1.exe" [ ]
"Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2006-01-12 20:52 483328]
"CFSServ.exe"="CFSServ.exe" []
"Notebook Maximizer"="C:\Program Files\Notebook Maximizer\maximizer_startup.exe" [2004-05-25 16:35 28672]
"ACU"="C:\Program Files\Atheros\ACU.exe" [ ]
"WorksFUD"="C:\Program Files\Microsoft Works\wkfud.exe" [ ]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 05:06 79224]
"QuickTime Task"="C:\Program Files\QuickTime\qttask .exe" [2008-01-04 22:40 286720]
"RoxWatchTray"="C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [ ]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [ ]
"RegistryMechanic"="" []
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [ ]
"Microsoft Works Portfolio"="C:\Program Files\Microsoft Works\WksSb.exe" [ ]
"Microsoft Works Update Detection"="C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [ ]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2007-01-17 02:09:30]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [2006-10-19 14:53 293888]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
C:\Program Files\Intel\Wireless\Bin\LgNotify.dll 2004-10-15 13:27 110592 C:\Program Files\Intel\Wireless\Bin\LgNotify.dll

R1 SerTVOutCtlr;TOSHIBA Controls Driver -EPIOMngr;C:\WINDOWS\system32\drivers\EPIOMngr.sys [2004-07-30 17:05]
R1 TPwSav;Common Driver;C:\WINDOWS\system32\Drivers\TPwSav.sys [2005-02-25 20:22]
R2 MSSQL$MSSMLBIZ;SQL Server (MSSMLBIZ);"c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" [2007-02-10 05:29]
R2 MSSQL$PARAGON;MSSQL$PARAGON;C:\Program Files\Microsoft SQL Server\MSSQL$PARAGON\Binn\sqlservr.exe [2002-12-17 17:26]
R2 SQLWriter;SQL Server VSS Writer;"c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe" [2007-02-10 05:29]
S1 StickyMesger;StickyMesger;C:\Program Files\TOSHIBA\Accessibility\StickyMesger.sys []
S3 EKECioCtl;EKECioCtl;C:\Program Files\TOSHIBA\E-KEY\CeEKey .exe [2008-01-04 23:39]
S3 SQLAgent$PARAGON;SQLAgent$PARAGON;C:\Program Files\Microsoft SQL Server\MSSQL$PARAGON\Binn\sqlagent.EXE [2002-12-17 17:23]
S3 umpusbxp;ActiveKEY VCP Serial Port Driver;C:\WINDOWS\system32\DRIVERS\umpusbxp.sys [2007-01-29 20:05]
S3 WCG200V2XP;Linksys WCG200 ver. 2 Wireless-G Cable Gateway;C:\WINDOWS\system32\DRIVERS\WCG200V2XP.sys [2004-07-06 02:06]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fdff6e5f-ec2a-11db-a65d-0012f0ba208f}]
\Shell\AutoRun\command - E:\InstallTomTomHOME.exe

.
Contents of the 'Scheduled Tasks' folder
"2008-01-04 18:52:50 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-05 05:54:46
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\explorer.exe [6.00.2900.3156]
-> C:\Program Files\ArcSoft\Software Suite\PhotoImpression 5\share\pihook.dll
.
Completion time: 2008-01-05 6:20:39
ComboFix-quarantined-files.txt 2008-01-05 12:20:30
ComboFix2.txt 2008-01-05 10:14:54
.
2007-12-21 09:02:13 --- E O F ---

#8 Tom S.

Tom S.
  • Topic Starter

  • Members
  • 24 posts
  • OFFLINE
  •  
  • Local time:02:08 AM

Posted 05 January 2008 - 07:23 AM

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:22:47 AM, on 1/5/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\ACS.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Microsoft SQL Server\MSSQL$PARAGON\Binn\sqlservr.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
c:\TOSHIBA\IVP\swupdate\swupdtmr.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\TCtrlIOHook.exe
C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\WINDOWS\system32\ZoomingHook.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSServ.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TOSHIBA\ConfigFree\CFXFER.exe
C:\WINDOWS\system32\RAMASST.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sckmls.fnismls.com/Paragon/Default.asp
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.toshibadirect.com/dpdstart
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [TCtryIOHook] TCtrlIOHook.exe
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [HWSetup] C:\Program Files\TOSHIBA\TOSHIBA Applet\HWSetup.exe hwSetUP
O4 - HKLM\..\Run: [SVPWUTIL] C:\Program Files\Toshiba\Windows Utilities\SVPWUTIL.exe SVPwUTIL
O4 - HKLM\..\Run: [TOSHIBA Accessibility] C:\Program Files\TOSHIBA\Accessibility\FnKeyHook.exe
O4 - HKLM\..\Run: [CeEKEY] C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
O4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
O4 - HKLM\..\Run: [ZoomingHook] ZoomingHook.exe
O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
O4 - HKLM\..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
O4 - HKLM\..\Run: [Tvs] C:\Program Files\Toshiba\Tvs\TvsTray.exe
O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
O4 - HKLM\..\Run: [EPSON Stylus CX6400] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2L1.EXE /P19 "EPSON Stylus CX6400" /O6 "USB001" /M "Stylus CX6400"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [CFSServ.exe] CFSServ.exe -NoClient
O4 - HKLM\..\Run: [Notebook Maximizer] C:\Program Files\Notebook Maximizer\maximizer_startup.exe
O4 - HKLM\..\Run: [ACU] "C:\Program Files\Atheros\ACU.exe" -nogui
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask .exe" -atboottime
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Desktop Manager.lnk = C:\Program Files\Research In Motion\BlackBerry\DesktopMgr.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Desktop Manager.lnk = C:\Program Files\Research In Motion\BlackBerry\DesktopMgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: MSSQL$PARAGON.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\scm.exe
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Toolbars\Restrictions present
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe
O9 - Extra 'Tools' menuitem: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O13 - DefaultPrefix:
O14 - IERESET.INF: START_PAGE_URL=http://www.toshibadirect.com/dpdstart
O15 - Trusted Zone: *.fnismls.com
O15 - Trusted Zone: *.getmedianow.com
O15 - Trusted Zone: mt5493.ghinconnect.com
O15 - Trusted Zone: *.live.com
O15 - Trusted Zone: *.showingtime.com
O15 - Trusted Zone: *.spellchecker.net
O15 - Trusted Zone: *.virtualearth.net
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://support.cox.com//sdccommon/download/tgctlcm.cab
O16 - DPF: {0854D220-A90A-466D-BC02-6683183802B7} (PrintPreview Class) - http://sckmls.fnismls.com/Paragon/Codebase...rintControl.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4788DE0A-3552-49EA-AC8C-233DA52523B9} (AxLoaderPassword Class) - http://www.blackberry.com/devicesoftware/AxLoader.cab
O16 - DPF: {5879B3B0-566E-4ECB-9B77-9A8A5E62AAB8} (DeviceMon Class) - http://www.blackberry.com/DST2007/patch/de...teLoaderUSB.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1169008234968
O16 - DPF: {B030900C-746A-47BF-8B1D-EA3FB3395563} (CoxFastConnect20 Control) - https://fastconnect.cox.net/cd20/CoxFastConnect20.ocx
O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} (AxisMediaControlEmb Class) - http://216.162.199.11:82/activex/AMC.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1224D68B-39AD-483B-B1C7-A7037C4809B0}: NameServer = 68.105.28.13,68.105.29.13
O17 - HKLM\System\CCS\Services\Tcpip\..\{E2A63CD1-738A-463C-A3EE-01181CAFE000}: NameServer = 68.105.28.13,68.105.29.13
O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\ACS.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: DVD-RAM_Service - Matsubleepa Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Swupdtmr - Unknown owner - c:\TOSHIBA\IVP\swupdate\swupdtmr.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O24 - Desktop Component 0: (no name) - http://us.news1.yimg.com/us.yimg.com/p/ap/...fDwYZ3RZoph.w--

--
End of file - 14124 bytes

#9 RichieUK

RichieUK

    Malware Assassin


  • Malware Response Team
  • 13,614 posts
  • OFFLINE
  •  
  • Local time:09:08 AM

Posted 05 January 2008 - 07:36 AM

Click Start/Control Panel/Add or Remove Programs and remove ZoneAlarm Spy Blocker,then restart your pc.
We can reinstall it later.

Please download OTMoveIt by OldTimer,save it to your desktop:
http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe
Please double-click OTMoveIt.exe to run it.
Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose 'Copy'):

C:\WINDOWS\system32\vbzip10.dll
C:\WINDOWS\Fonts\svchost .exe
C:\WINDOWS\system32\ardCo18
C:\Temp\cEeer12


Return to OTMoveIt, right click on the "Paste List of Files/Folders to be moved" window and choose Paste.
Click the red Moveit! button Posted Image
Copy everything on the 'Results' window to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose 'Copy'), and paste it into your next reply.
Close OTMoveIt.
If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process.
If you are asked to reboot the machine choose Yes.


Run this online virus/spyware scan using Internet Explorer:
Kaspersky WebScanner
Next click Kaspersky Online Scanner
You will be prompted to install an ActiveX component from Kaspersky, Click Yes.
The program will launch and then begin downloading the latest definition files:
Once the files have been downloaded click on NEXT
Now click on Scan Settings
In the scan settings make that the following are selected:
Scan using the following Anti-Virus database:
Standard
Scan Options:
Scan Archives
Scan Mail Bases
Click OK
Now under select a target to scan:
Select My Computer
This will start the program and scan your system.
The scan will take a while so be patient and let it run.
Once the scan is complete it will display if your system has been infected.
Now click on the Save as Text button:
Save the file to your desktop.
Copy and paste the contents of that file into your next reply.
Posted Image
Posted Image

#10 Tom S.

Tom S.
  • Topic Starter

  • Members
  • 24 posts
  • OFFLINE
  •  
  • Local time:02:08 AM

Posted 05 January 2008 - 07:54 AM

DllUnregisterServer procedure not found in C:\WINDOWS\system32\vbzip10.dll
C:\WINDOWS\system32\vbzip10.dll NOT unregistered.
C:\WINDOWS\system32\vbzip10.dll moved successfully.
C:\WINDOWS\Fonts\svchost .exe moved successfully.
C:\WINDOWS\system32\ardCo18 moved successfully.
C:\Temp\cEeer12 moved successfully.

OTMoveIt2 v1.0.5 log created on 01052008_065121

#11 RichieUK

RichieUK

    Malware Assassin


  • Malware Response Team
  • 13,614 posts
  • OFFLINE
  •  
  • Local time:09:08 AM

Posted 05 January 2008 - 07:57 AM

Thanks,follow the Kaspersky Online Scanner instructions now please.
Posted Image
Posted Image

#12 Tom S.

Tom S.
  • Topic Starter

  • Members
  • 24 posts
  • OFFLINE
  •  
  • Local time:02:08 AM

Posted 05 January 2008 - 08:01 AM

An active X prompt is not coming up. do I need to download the antivirus software free version?

#13 RichieUK

RichieUK

    Malware Assassin


  • Malware Response Team
  • 13,614 posts
  • OFFLINE
  •  
  • Local time:09:08 AM

Posted 05 January 2008 - 08:21 AM

Download the free 30 day trial of Kaspersky Anti-Virus 7.0:
http://usa.kaspersky.com/downloads/trial-versions.php

Disconnect from the internet.
Click on Start/Control Panel/Add or Remove Programs and remove/uninstall Avast4,then restart your pc.

Now install Kaspersky Anti-Virus 7.0
Once installed,connect to the net and update Kaspersky's virus definitions.
Disconnect from the internet and do a full system virus scan.
Let me know if Kaspersky detected and removed anything.


Close any open browsers.
Double click on combofix.exe and follow the prompts.
When it's finished it will produce a log.
Post the entire contents of C:\ComboFix.txt into your next reply.
Posted Image
Posted Image

#14 Tom S.

Tom S.
  • Topic Starter

  • Members
  • 24 posts
  • OFFLINE
  •  
  • Local time:02:08 AM

Posted 05 January 2008 - 04:55 PM

Kasperkey will not install. I am getting a message that says an error has occurred and the innstallation quits. The first time I tried it I was told that I dont have access to a certain file.

#15 Tom S.

Tom S.
  • Topic Starter

  • Members
  • 24 posts
  • OFFLINE
  •  
  • Local time:02:08 AM

Posted 05 January 2008 - 05:50 PM

I figured it out. I had to do a custom install and disable a feature but got it to install. I am ruuning a scan next.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users