Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Core.cache.dsk Won't Delete


  • This topic is locked This topic is locked
2 replies to this topic

#1 JSeiler

JSeiler

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:02:10 AM

Posted 24 January 2008 - 12:28 PM

Hello, I have tried multiple Spyware removals and Smitfraud removals to try and get rid of Core.cache.dsk, and none of them removed it. I still get popups with IE and occasionally firefox.

Here's the HijackThis Log:

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\DesktopAuthority\DaMaint.exe
C:\WINDOWS\system32\EmbargoSvc.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
c:\windows\system32\slclient.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
C:\WINDOWS\system32\vmnat.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Exchsrvr\bin\exmgmt.exe
C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
C:\WINDOWS\system32\vmnetdhcp.exe
C:\WINDOWS\TEMP\DW81E0.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\OfficeScan Client\CNTAoSMgr.exe
C:\Program Files\DesktopAuthority\DesktopAuthority.exe
C:\WINDOWS\system32\slagent.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\RightFax\FaxCtrl.exe
C:\Program Files\Canon Electronics\DR1210C\TrkMonitor.exe
C:\Program Files\Scriptlogic\PortSecurity\EmbargoEvents.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\VMware\VMware Workstation\vmware-tray.exe
C:\Program Files\VMware\VMware Workstation\hqtray.exe
C:\Program Files\DesktopAuthority\rmgui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Microsoft Office Communicator\Communicator.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\jseiler\Desktop\HiJackThis.exe
C:\WINDOWS\system32\SearchProtocolHost.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://neptune.scriptlogic.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar5.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar5.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [RightFAX Print-to-Fax Driver] C:\Program Files\RightFax\\FaxCtrl.exe
O4 - HKLM\..\Run: [TrkMonitor] "C:\Program Files\Canon Electronics\DR1210C\TrkMonitor.exe"
O4 - HKLM\..\Run: [EmbargoEvents] C:\Program Files\Scriptlogic\PortSecurity\EmbargoEvents.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [vmware-tray] C:\Program Files\VMware\VMware Workstation\vmware-tray.exe
O4 - HKLM\..\Run: [VMware hqtray] "C:\Program Files\VMware\VMware Workstation\hqtray.exe"
O4 - HKLM\..\Run: [Desktop Authority GUI] "C:\Program Files\DesktopAuthority\rmgui.exe"
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [COMMUNICATOR] "C:\Program Files\Microsoft Office Communicator\Communicator.exe" /silentRetrials
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Eshc] "C:\DOCUME~1\jseiler\APPLIC~1\SSTEM~1\netdde.exe" -vt ndrv
O4 - HKCU\..\Run: [Lqs] "C:\Documents and Settings\jseiler\Application Data\?ssembly\fast.exe"
O4 - HKUS\S-1-5-19\..\Run: [Communicator] "C:\Program Files\Microsoft Office Communicator\Communicator.exe" (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Communicator] "C:\Program Files\Microsoft Office Communicator\Communicator.exe" (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [Communicator] "C:\Program Files\Microsoft Office Communicator\Communicator.exe" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Communicator] "C:\Program Files\Microsoft Office Communicator\Communicator.exe" (User 'Default user')
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare Software\bin\EasyShare.exe
O4 - Global Startup: Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://*.dogstar
O15 - Trusted Zone: http://*.intranet
O15 - Trusted Zone: http://*.neptune
O15 - Trusted Zone: http://*.pluto
O15 - Trusted Zone: http://*.salesforce.com
O15 - Trusted Zone: http://webdemo.scriptlogic.com
O15 - Trusted Zone: http://*.scriptlogic.local
O15 - Trusted Zone: http://*.dogstar (HKLM)
O15 - Trusted Zone: http://*.intranet (HKLM)
O15 - Trusted Zone: http://*.musicmatch.com (HKLM)
O15 - Trusted Zone: http://*.neptune (HKLM)
O15 - Trusted Zone: http://*.pluto (HKLM)
O15 - Trusted Zone: http://webdemo.scriptlogic.com (HKLM)
O15 - Trusted Zone: http://*.scriptlogic.local (HKLM)
O15 - ESC Trusted Zone: http://runonce.msn.com
O16 - DPF: {00134F72-5284-44F7-95A8-52A619F70751} (ObjWinNTCheck Class) - https://dogstar.scriptlogic.local:4343/offi...ll/WinNTChk.cab
O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} - https://components.viewpoint.com/MTSInstall...od/install.html
O16 - DPF: {08D75BC1-D2B5-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment SetupCtrl Class) - https://dogstar.scriptlogic.local:4343/offi...stall/setup.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {3299935F-2C5A-499A-9908-95CFFF6EF8C1} (Quicksilver Class) - http://vapwhc.ops.placeware.com/etc/place/...quicksilver.cab
O16 - DPF: {5EFE8CB1-D095-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment ObjRemoveCtrl Class) - https://dogstar.scriptlogic.local:4343/offi.../RemoveCtrl.cab
O16 - DPF: {D4FC3BED-35BF-45D0-8BB4-56586370053B} - https://na3.salesforce.com/setup/sforce/off...ForceOffice.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/RACtrl.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = scriptlogic.local
O17 - HKLM\Software\..\Telephony: DomainName = scriptlogic.local
O17 - HKLM\System\CCS\Services\Tcpip\..\{8F9F3470-5D0B-4337-ABA6-11377D05D77D}: NameServer = 10.10.1.13,10.10.1.16
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = scriptlogic.local
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O20 - AppInit_DLLs: DAinit.dll
O20 - Winlogon Notify: EmbargoLogon - C:\WINDOWS\SYSTEM32\EmbargoLogon.dll
O23 - Service: Desktop Authority Maintenance Service (DAMaint) - ScriptLogic Corporation - C:\Program Files\DesktopAuthority\DaMaint.exe
O23 - Service: Desktop Authority Service (DesktopAuthority) - ScriptLogic Corporation - C:\Program Files\DesktopAuthority\DesktopAuthority.exe
O23 - Service: ScriptLogic USB/Port Security (EmbargoSvc) - ScriptLogic Software Corporation - C:\WINDOWS\system32\EmbargoSvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: ScriptLogic Service (SLClient) - ScriptLogic Software Corporation - c:\windows\system32\slclient.exe
O23 - Service: OfficeScan NT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
O23 - Service: VMware Agent Service (ufad-ws60) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-ufad.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe
O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe

Here's the latest ComboFix log:

ComboFix 08-01-23.2 - jseiler 2008-01-24 11:28:45.6 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1253 [GMT -5:00]
Running from: C:\Documents and Settings\jseiler\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\temp\tn3
C:\WINDOWS\system32\drivers\core.cache.dsk . . . . failed to delete
.
---- Previous Run -------
.
C:\temp\tn3
C:\WINDOWS\system32\drivers\core.cache.dsk . . . . failed to delete

.
((((((((((((((((((((((((( Files Created from 2007-12-24 to 2008-01-24 )))))))))))))))))))))))))))))))
.

2008-01-24 11:32 . 2008-01-24 11:32 <DIR> d-------- C:\Temp\tn3
2008-01-23 19:10 . 2008-01-23 19:44 <DIR> d-------- C:\Program Files\RogueRemover FREE
2008-01-23 18:29 . 2008-01-24 11:34 167,545 --------- C:\WINDOWS\system32\drivers\core.cache.dsk
2008-01-23 17:22 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\Nircmd.exe
2008-01-23 16:27 . 2008-01-23 16:28 <DIR> d-------- C:\WINDOWS\ERUNT
2008-01-23 11:58 . 2008-01-23 19:29 3,314 --a------ C:\WINDOWS\system32\tmp.reg
2008-01-22 19:06 . 2008-01-22 19:06 <DIR> d-------- C:\WINDOWS\system32\winzs6
2008-01-22 19:06 . 2008-01-22 19:06 <DIR> d-------- C:\WINDOWS\system32\nGpxx01
2008-01-22 19:06 . 2008-01-22 19:06 <DIR> d-------- C:\WINDOWS\system32\extz1
2008-01-22 19:06 . 2008-01-23 11:20 <DIR> d-------- C:\WINDOWS\system32\comm7
2008-01-22 19:06 . 2008-01-22 19:06 <DIR> d-------- C:\Temp\gTiis19
2008-01-22 19:06 . 2008-01-22 19:06 <DIR> d-------- C:\Temp\cXzz9
2008-01-22 19:06 . 2008-01-22 19:06 86,016 --a------ C:\WINDOWS\system32\drivers\rasptii.sys
2008-01-09 13:33 . 2008-01-09 13:33 <DIR> d-------- C:\HP
2008-01-09 13:05 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-01-09 13:05 . 2004-08-03 23:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2008-01-08 13:24 . 2008-01-08 13:24 <DIR> d-------- C:\Program Files\Quest Software
2007-12-28 13:28 . 2007-12-28 13:29 49 --a------ C:\WINDOWS\wwwbatch.ini

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-24 00:11 --------- d-----w C:\Program Files\DesktopAuthority
2008-01-24 00:10 --------- d-----w C:\Program Files\Yahoo!
2008-01-23 22:25 --------- d-----w C:\Program Files\VMware
2008-01-22 19:27 --------- d-----w C:\Program Files\Trillian
2008-01-16 16:28 --------- d-----w C:\Program Files\Microsoft Office Communicator
2007-12-20 21:27 --------- d-----w C:\Program Files\PassGo Technologies
2007-12-11 00:21 --------- d-----w C:\Program Files\Certification Preparation
2006-05-23 16:28 2,144,879 ----a-w C:\Program Files\rs_setup.exe
.

((((((((((((((((((((((((((((( snapshot@2008-01-23_17.39.15.75 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-01-23 22:23:30 245,760 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT
+ 2008-01-23 23:39:44 245,760 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT
- 2008-01-23 22:23:30 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
+ 2008-01-23 23:39:44 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
- 2008-01-23 22:23:30 245,760 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\NTUSER.DAT
+ 2008-01-23 23:39:44 245,760 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\NTUSER.DAT
- 2008-01-23 22:23:31 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
+ 2008-01-23 23:39:44 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
- 2008-01-23 22:23:31 1,810,432 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\NTUSER.DAT
+ 2008-01-23 23:39:44 1,855,488 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\NTUSER.DAT
- 2008-01-23 22:23:31 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
+ 2008-01-23 23:39:44 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
- 2008-01-23 22:31:11 220,723 ----a-w C:\WINDOWS\system32\inetsrv\MetaBase.bin
+ 2008-01-24 16:36:44 220,728 ----a-w C:\WINDOWS\system32\inetsrv\MetaBase.bin
+ 2007-05-08 04:43:40 300,656 ----a-w C:\WINDOWS\temp\DW81E0.EXE
+ 2008-01-24 16:36:51 16,384 ----atw C:\WINDOWS\temp\Perflib_Perfdata_288.dat
+ 2008-01-24 16:35:55 16,384 ----atw C:\WINDOWS\temp\Perflib_Perfdata_684.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:56 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-17 18:36 68856]
"COMMUNICATOR"="C:\Program Files\Microsoft Office Communicator\Communicator.exe" [2007-07-23 10:33 5803368]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 18:04 139264]
"Eshc"="C:\DOCUME~1\jseiler\APPLIC~1\SSTEM~1\netdde.exe" [ ]
"Lqs"="C:\Documents and Settings\jseiler\Application Data\?ssembly\fast.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2003-11-16 21:33 3022848]
"nwiz"="nwiz.exe" [2003-11-16 21:33 753664 C:\WINDOWS\system32\nwiz.exe]
"RightFAX Print-to-Fax Driver"="C:\Program Files\RightFax\\FaxCtrl.exe" [2004-05-20 01:34 110592]
"TrkMonitor"="C:\Program Files\Canon Electronics\DR1210C\TrkMonitor.exe" [2006-01-24 16:21 69632]
"EmbargoEvents"="C:\Program Files\Scriptlogic\PortSecurity\EmbargoEvents.exe" [2007-03-27 23:56 121000]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 23:47 31016]
"OfficeScanNT Monitor"="C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" [2007-06-07 14:12 702072]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 14:40 155648]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-06-28 09:16 98304]
"vmware-tray"="C:\Program Files\VMware\VMware Workstation\vmware-tray.exe" [2007-05-01 21:52 68400]
"VMware hqtray"="C:\Program Files\VMware\VMware Workstation\hqtray.exe" [2007-05-01 21:52 56112]
"Desktop Authority GUI"="C:\Program Files\DesktopAuthority\rmgui.exe" [2007-09-28 23:12 485296]
"RoxWatchTray"="C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2007-03-26 07:07 228088]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Communicator"="C:\Program Files\Microsoft Office Communicator\Communicator.exe" [2007-07-23 10:33 5803368]

C:\Documents and Settings\jdipaolo\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 19:24:54 98632]

C:\Documents and Settings\jseiler\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 19:24:54 98632]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoDisconnect"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceStartMenuLogOff"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [2006-10-19 14:53 293888]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\EmbargoLogon]
EmbargoLogon.dll 2007-03-27 23:56 22696 C:\WINDOWS\system32\EmbargoLogon.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=DAinit.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Desktop Manager.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Desktop Manager.lnk
backup=C:\WINDOWS\pss\Desktop Manager.lnkCommon Startup

R0 Embargo;Embargo_ClassFilterLowerService;C:\WINDOWS\system32\DRIVERS\Embargo.sys [2007-03-27 23:56]
R0 rttmntr;R-TT Backup Archive Explorer;C:\WINDOWS\system32\DRIVERS\rttmntr.sys [2005-08-09 04:47]
R0 snaprtt;R-TT Snapshots Manager;C:\WINDOWS\system32\DRIVERS\snaprtt.sys [2004-12-22 08:39]
R1 rasptii;rasptii;C:\WINDOWS\system32\drivers\rasptii.sys [2008-01-22 19:06]
R2 DAInfo;Desktop Authority Kernel Information Provider;C:\Program Files\DesktopAuthority\DAInfo.sys [2007-09-28 23:13]
R2 DAMaint;Desktop Authority Maintenance Service;C:\Program Files\DesktopAuthority\DaMaint.exe [2007-09-28 23:12]
R2 DAtf;Desktop Authority Token Factory;C:\Program Files\DesktopAuthority\DAtf.sys [2007-09-28 23:13]
R2 DesktopAuthority;Desktop Authority Service;C:\Program Files\DesktopAuthority\DesktopAuthority.exe [2007-09-28 23:12]
R2 EmbargoSvc;ScriptLogic USB/Port Security;C:\WINDOWS\system32\EmbargoSvc.exe [2007-03-27 23:56]
R2 MSExchangeMGMT;Microsoft Exchange Management;"C:\Program Files\Exchsrvr\bin\exmgmt.exe" [2004-04-02 00:25]
R2 rttfsfilt;R-TT FS Filter;C:\WINDOWS\system32\DRIVERS\rttfsfilt.sys [2004-12-22 08:39]
R2 SLClient;ScriptLogic Service;c:\windows\system32\slclient.exe [2007-08-17 14:29]
R2 SMTPSVC;Simple Mail Transfer Protocol (SMTP);C:\WINDOWS\System32\inetsrv\inetinfo.exe [2004-08-03 23:56]
R2 vstor2-ws60;Vstor2 WS60 Virtual Storage Driver;C:\Program Files\VMware\VMware Workstation\vstor2-ws60.sys [2007-04-09 12:55]
R3 EmbargoMini;EmbargoMini;C:\WINDOWS\system32\DRIVERS\EmbargoM.sys [2007-03-27 23:56]
R3 vmkbd;VMware kbd;C:\WINDOWS\system32\drivers\VMkbd.sys [2007-05-01 21:52]
S3 DAmirr;DAmirr;C:\WINDOWS\system32\DRIVERS\DAmirr.sys []
S3 RimSerPort;RIM Virtual Serial Port;C:\WINDOWS\system32\DRIVERS\RimSerial.sys [2007-01-18 10:24]
S3 ufad-ws60;VMware Agent Service;"C:\Program Files\VMware\VMware Workstation\vmware-ufad.exe" -d "C:\Program Files\VMware\VMware Workstation\\" []
S3 v3drv;Authenex A-Key Driver;C:\WINDOWS\system32\Drivers\v3drv.sys [2004-12-22 14:53]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
TapiSrv REG_MULTI_SZ TapiSrv
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs


.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-24 12:09:44
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************


I won't be around tomorrow and won't be back till Monday, so please don't mark this topic closed. Thanks for your help!

BC AdBot (Login to Remove)

 


#2 JSeiler

JSeiler
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:02:10 AM

Posted 24 January 2008 - 05:02 PM

After browsing the forums a bit, I found a user that was having a similar problem as myself. Richie was helping this person, so I found this line in the ComboFix log...

R1 rasptii;rasptii;C:\WINDOWS\system32\drivers\rasptii.sys [2008-01-22 19:06]


Comparing it to the other files in that section, I noticed that this one had a completely different date, so I made a CFScript text file and sure enough, it got rid of the core.cache.dsk. I ran SuperAntiSpyware like Richie suggested in that other thread, and I got rid of any remaining spyware, then I decided to run Spybot Search and Destroy just to make sure, and the only thing that found was Tracking cookies. Therefore, my computer is clean! :thumbsup:

Thank you Richie for indirectly helping me.

You can close this thread now, thanks!

#3 KoanYorel

KoanYorel

    Bleepin' Conundrum


  • Staff Emeritus
  • 19,461 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:65 miles due East of the &quot;Logic Free Zone&quot;, in Md, USA
  • Local time:03:10 AM

Posted 24 January 2008 - 05:19 PM

Thanks for informing us of your situation.

Should you find other problems, please start a new topic.

This thread is closed.
The only easy day was yesterday.

...some do, some don't; some will, some won't (WR)




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users