Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Tratbho[trj] Infection


  • This topic is locked This topic is locked
10 replies to this topic

#1 Kheldar

Kheldar

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:09:57 PM

Posted 19 April 2008 - 03:17 AM

My Anti Virus program has picked up an instance of TratBHO [Trj] in System 32 dll files. I am running Avast free anti-virus and it has not been able to remove it. I have also tried CCleaner and Lavasoft AdAware. Neither have been able to remove it. I am unable to use Windows IE7 since the infection. I usually use Firefox in any case and I have notice that trying to Google from Firefox seems to hang up unless I use CCleaner first. On several occasions the Windows startup has hung up prior to the program icons appearing on the wallpaper.

I followed the instructions as best I could on your tutorial for preparation for Hijack this. The DSS run only gave me a Main.txt and I could not see a minimised extra.txt as stated in the tutorial.

Any advice would be greatly appreciated.

The DSS report follows

Deckard's System Scanner v20071014.68
Run by Jack on 2008-04-19 17:56:32
Computer is in Normal Mode.
--------------------------------------------------------------------------------



-- HijackThis (run as Jack.exe) ------------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:56:34 PM, on 19/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\SiSoftware\SiSoftware Sandra Lite XII.SP2a\RpcAgentSrv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\RTHDCPL.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\PuXpMan2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Jack\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Jack.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: (no name) - {9CB65206-89C4-402c-BA80-02D8C59F9B1D} - C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL
O2 - BHO: (no name) - {02715E47-5A8E-495B-8F63-0D30470B8E72} - C:\WINDOWS\system32\hgGaxvtS.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1A06E336-9A7B-417C-9FA7-B74EE294B26C} - C:\WINDOWS\system32\jkkICstq.dll
O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Ask Search Assistant BHO - {9CB65201-89C4-402c-BA80-02D8C59F9B1D} - C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL
O2 - BHO: Ask Toolbar BHO - {FE063DB1-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL
O3 - Toolbar: Ask Toolbar - {FE063DB9-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\JM\JMInsIDE.exe
O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\system32\JMRaidSetup.exe boot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [mspwr] C:\WINDOWS\system32\PuXpMan2.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [BM234de423] Rundll32.exe "C:\WINDOWS\system32\rorvgwfp.dll",s
O4 - HKLM\..\Run: [207ed7bf] rundll32.exe "C:\WINDOWS\system32\rvvocftg.dll",b
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v5.cab
O20 - Winlogon Notify: hgGaxvtS - C:\WINDOWS\SYSTEM32\hgGaxvtS.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SiSoftware Deployment Agent Service (SandraAgentSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XII.SP2a\RpcAgentSrv.exe

--
End of file - 8442 bytes

-- Files created between 2008-03-19 and 2008-04-19 -----------------------------

2008-04-19 17:33:14 0 d-------- C:\Program Files\Trend Micro
2008-04-19 16:18:25 0 dr-h----- C:\Documents and Settings\Jack\Recent
2008-04-19 09:11:45 87616 --a------ C:\WINDOWS\system32\rvvocftg.dll
2008-04-19 09:09:54 96320 --a------ C:\WINDOWS\system32\rorvgwfp.dll
2008-04-17 22:02:11 0 d-------- C:\Program Files\Lavasoft
2008-04-17 22:01:30 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-04-17 19:34:51 88128 -----n--- C:\WINDOWS\system32\akdnadys.dll
2008-04-17 19:31:40 96320 --a------ C:\WINDOWS\system32\bbuwanhp.dll
2008-04-17 19:30:54 96320 --a------ C:\WINDOWS\system32\cpxnmasy.dll
2008-04-16 21:20:47 0 d-------- C:\Program Files\SiSoftware
2008-04-15 19:45:50 199076 --ahs---- C:\WINDOWS\system32\qtsCIkkj.ini2
2008-04-15 19:45:44 272384 --a------ C:\WINDOWS\system32\jkkICstq.dll
2008-04-15 19:42:08 0 d-------- C:\Documents and Settings\Jack\Application Data\TVU Networks
2008-04-15 19:40:41 39936 --a------ C:\WINDOWS\system32\hgGaxvtS.dll
2008-04-12 09:28:42 0 d-------- C:\Program Files\Common Files\INCA Shared
2008-04-12 09:27:04 4682 --a------ C:\WINDOWS\system32\npptNT2.sys <Not Verified; INCA Internet Co., Ltd.; nProtect NPSC Kernel Mode Driver for NT>
2008-04-10 21:34:35 195856 -ra------ C:\WINDOWS\dsetup32.dll <Not Verified; Microsoft Corporation; Microsoft® DirectX for Windows® 95 and 98>
2008-04-10 21:34:34 376832 -----n--- C:\WINDOWS\Pool of Radiance remove.exe <Not Verified; Edgies; Pool of Radiance II Installer Application>
2008-04-10 21:34:34 40208 -ra------ C:\WINDOWS\dsetup.dll <Not Verified; Microsoft Corporation; Microsoft® DirectX for Windows® 95 and 98>
2008-04-10 20:23:27 35190 --a------ C:\WINDOWS\scunin.dat
2008-04-10 20:23:26 967 --a------ C:\WINDOWS\ScUnin.pif
2008-04-10 20:23:26 94208 --a------ C:\WINDOWS\ScUnin.exe <Not Verified; Blizzard Entertainment; Starcraft Uninstaller>
2008-04-10 17:02:15 2829 --a------ C:\WINDOWS\War3Unin.pif
2008-04-10 17:02:14 139264 --a------ C:\WINDOWS\War3Unin.exe <Not Verified; Blizzard Entertainment; Warcraft III Uninstaller>
2008-04-09 21:10:34 0 dr-h----- C:\Documents and Settings\Jack\Application Data\SecuROM
2008-04-09 17:23:46 0 d-------- C:\Program Files\PM
2008-04-09 10:02:08 94208 --a------ C:\WINDOWS\rtpmsi32.dll <Not Verified; Pocket Soft, Inc.; RTPatch>
2008-04-08 21:19:16 69632 --a------ C:\WINDOWS\system32\xmltok.dll
2008-04-08 21:19:16 36864 --a------ C:\WINDOWS\system32\xmlparse.dll
2008-04-08 21:19:16 24576 --a------ C:\WINDOWS\system32\msxml3a.dll <Not Verified; Microsoft Corporation; Microsoft XML Core Services>
2008-04-08 21:19:16 0 d-------- C:\Program Files\Ubisoft
2008-04-08 20:13:33 0 d-------- C:\Program Files\DOSBox-0.72
2008-04-08 20:07:52 0 d-------- C:\Program Files\DAEMON Tools Lite
2008-04-08 20:04:59 717296 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-04-08 20:04:56 0 d-------- C:\Documents and Settings\Jack\Application Data\DAEMON Tools
2008-04-06 10:05:00 0 d-------- C:\Program Files\Safari
2008-04-06 09:53:30 0 d-------- C:\Program Files\iPod
2008-04-06 09:53:24 0 d-------- C:\Program Files\iTunes
2008-03-19 20:19:36 0 d-------- C:\Documents and Settings\All Users\Application Data\1Click DVD Copy Pro
2008-03-19 20:17:53 0 d-------- C:\Program Files\LG Software Innovations


-- Find3M Report ---------------------------------------------------------------

2008-04-17 22:43:53 0 d-------- C:\Documents and Settings\Jack\Application Data\Azureus
2008-04-17 22:39:58 0 d-------- C:\Program Files\Azureus
2008-04-17 22:01:30 0 d-------- C:\Program Files\Common Files
2008-04-15 20:33:11 0 d-------- C:\Documents and Settings\Jack\Application Data\Real
2008-04-15 20:31:55 0 d-------- C:\Program Files\Real
2008-04-15 20:31:55 0 d-------- C:\Program Files\Common Files\Real
2008-04-12 09:13:13 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-04-10 17:32:18 151458 --a------ C:\WINDOWS\War3Unin.dat
2008-04-10 10:17:26 0 d-------- C:\Documents and Settings\Jack\Application Data\Vso
2008-04-09 21:10:33 98304 --a------ C:\WINDOWS\system32CmdLineExt.dll <Not Verified; Sony DADC Austria AG.; >
2008-04-06 17:12:17 37773 --a------ C:\WINDOWS\DIIUnin.dat
2008-04-06 16:30:54 21840 --a-----t C:\WINDOWS\system32\SIntfNT.dll
2008-04-06 16:30:54 17212 --a-----t C:\WINDOWS\system32\SIntf32.dll
2008-04-06 16:30:54 12067 --a-----t C:\WINDOWS\system32\SIntf16.dll
2008-04-06 11:10:28 0 d-------- C:\Documents and Settings\Jack\Application Data\Apple Computer
2008-04-06 09:52:43 0 d-------- C:\Program Files\QuickTime
2008-04-02 18:12:42 0 d-------- C:\Program Files\Java
2008-03-21 15:28:26 0 d-------- C:\Program Files\dvdSanta
2008-02-28 20:03:05 0 d-------- C:\Documents and Settings\Jack\Application Data\FrostWire
2008-02-23 21:07:00 43 ---hs---- C:\Documents and Settings\Jack\Application Data\.zreglib
2008-02-23 12:55:18 0 d-------- C:\Program Files\Nancy Drew
2008-02-21 18:27:02 0 d-------- C:\Program Files\Common Files\Adobe
2008-02-16 12:29:27 320640 --a------ C:\WINDOWS\ilda16.dll <Not Verified; Creative Development LTD; >
2008-02-14 20:17:55 34 --a------ C:\Documents and Settings\Jack\Application Data\ezplay.log
2008-02-14 20:17:53 34 --a------ C:\Documents and Settings\Jack\Application Data\pcouffin.log
2008-02-14 20:17:53 94208 --a------ C:\Documents and Settings\Jack\Application Data\ezplay.sys <Not Verified; VSO Software; ezplay driver>
2008-02-14 20:17:53 125 --a------ C:\Documents and Settings\Jack\Application Data\ezplay.ini
2008-02-14 20:17:53 1103 --a------ C:\Documents and Settings\Jack\Application Data\ezplay.inf
2008-02-14 20:17:53 7861 --a------ C:\Documents and Settings\Jack\Application Data\ezplay.cat
2008-02-14 20:17:44 47360 --a------ C:\Documents and Settings\Jack\Application Data\pcouffin.sys <Not Verified; VSO Software; Patin couffin engine>
2008-02-14 20:17:44 1144 --a------ C:\Documents and Settings\Jack\Application Data\pcouffin.inf
2008-02-14 20:17:44 7887 --a------ C:\Documents and Settings\Jack\Application Data\pcouffin.cat


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{02715E47-5A8E-495B-8F63-0D30470B8E72}]
15/04/2008 07:40 PM 39936 --a------ C:\WINDOWS\system32\hgGaxvtS.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1A06E336-9A7B-417C-9FA7-B74EE294B26C}]
15/04/2008 07:45 PM 272384 --a------ C:\WINDOWS\system32\jkkICstq.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}]
05/10/2007 06:06 AM 1135968 --a------ C:\Program Files\Winamp Toolbar\winamptb.dll

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [05/10/2007 06:06 AM 1135968]

[-HKEY_CLASSES_ROOT\CLSID\{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [28/02/2006 10:00 PM]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [28/02/2006 10:00 PM]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [28/02/2006 10:00 PM]
"RTHDCPL"="RTHDCPL.EXE" [12/04/2007 07:33 PM C:\WINDOWS\RTHDCPL.exe]
"Alcmtr"="ALCMTR.EXE" [03/05/2005 08:43 PM C:\WINDOWS\Alcmtr.exe]
"JMB36X IDE Setup"="C:\WINDOWS\JM\JMInsIDE.exe" [30/10/2006 10:44 PM]
"36X Raid Configurer"="C:\WINDOWS\system32\JMRaidSetup.exe" [06/02/2007 10:08 PM]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [05/12/2007 12:41 AM]
"nwiz"="nwiz.exe" [05/12/2007 12:41 AM C:\WINDOWS\system32\nwiz.exe]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [30/03/2008 04:37 AM]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [22/02/2008 03:25 AM]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [05/12/2007 12:41 AM]
"NeroCheck"="C:\WINDOWS\system32\NeroCheck.exe" [09/07/2001 07:50 PM]
"mspwr"="C:\WINDOWS\system32\PuXpMan2.exe" [29/09/2005 09:05 AM]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [11/01/2008 09:16 PM]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [28/03/2008 11:37 PM]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [30/03/2008 10:36 AM]
"BM234de423"="C:\WINDOWS\system32\rorvgwfp.dll" [19/04/2008 09:09 AM]
"207ed7bf"="C:\WINDOWS\system32\rvvocftg.dll" [19/04/2008 09:11 AM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [14/10/2004 02:24 AM]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [28/02/2006 10:00 PM]
"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [01/04/2008 07:39 PM]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.exe.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [23/12/2007 11:19:20 AM]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [13/02/2001 1:01:04 AM]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{02715E47-5A8E-495B-8F63-0D30470B8E72}"= C:\WINDOWS\system32\hgGaxvtS.dll [15/04/2008 07:40 PM 39936]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\hgGaxvtS]
hgGaxvtS.dll 15/04/2008 07:40 PM 39936 C:\WINDOWS\system32\hgGaxvtS.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\jkkICstq

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"




-- End of Deckard's System Scanner: finished at 2008-04-19 17:57:09 ------------

BC AdBot (Login to Remove)

 


m

#2 -David-

-David-

  • Members
  • 10,603 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London
  • Local time:12:57 PM

Posted 19 April 2008 - 04:36 AM

Hello there and welcome to Bleeping Computer's security forum.
My name is David, I will be helping you with your log today.

It is a good idea to print off these instructions. There is a possibility some of the instructions will need to be carried out where internet access is not available. It is important that you complete the instructions in the right order, and that you don't miss out any steps.

Please set your system to show all files.
Click Start, open My Computer, select the Tools menu and click Folder Options.
Select the View Tab. Under the Hidden files and folders heading, select Show hidden files and folders.
Uncheck: Hide file extensions for known file types
Uncheck the Hide protected operating system files (recommended) option.
Click Yes to confirm.

Start HijackThis, close all open windows leaving only HijackThis running. Place a check against each of the following if still present:

O2 - BHO: (no name) - {02715E47-5A8E-495B-8F63-0D30470B8E72} - C:\WINDOWS\system32\hgGaxvtS.dll
O2 - BHO: (no name) - {1A06E336-9A7B-417C-9FA7-B74EE294B26C} - C:\WINDOWS\system32\jkkICstq.dll
O4 - HKLM\..\Run: [BM234de423] Rundll32.exe "C:\WINDOWS\system32\rorvgwfp.dll",s
O4 - HKLM\..\Run: [207ed7bf] rundll32.exe "C:\WINDOWS\system32\rvvocftg.dll",b
O20 - Winlogon Notify: hgGaxvtS - C:\WINDOWS\SYSTEM32\hgGaxvtS.dll

Click on Fix Checked when finished and exit HijackThis.
Make sure your Internet Explorer is closed when you click Fix Checked!

Download KillBox from the following link :
http://www.bleepingcomputer.com/files/killbox.php
Unzip the folder to your desktop.

Start Killbox.exe
Select the "Delete on Reboot" option.
Click on the "All Files" button (!important!),which will then flash green.
Copy the complete text in bold below to the clipboard by highlighting the filepaths and pressing Control + C:

C:\WINDOWS\system32\akdnadys.dll
C:\WINDOWS\system32\bbuwanhp.dll
C:\WINDOWS\system32\rvvocftg.dll
C:\WINDOWS\system32\rorvgwfp.dll
C:\WINDOWS\system32\cpxnmasy.dll
C:\WINDOWS\system32\qtsCIkkj.ini2
C:\WINDOWS\system32\jkkICstq.dll
C:\WINDOWS\system32\hgGaxvtS.dll


Open 'file' in the killboxmenu on top and choose Paste from clipboard
You must use the file File menu--pasting by right-clicking the mouse will only enter one file.
Then press the button that looks like a red circle with a white X in it.
Killbox will tell you that all listed files will be removed on next reboot and asks if you would like to Reboot now, click "yes".
Click OK at any Pending File Rename Operations prompt, let me know if there appear.
If you don't get that message, reboot manually.
Your computer should reboot now.

I want you to clean your cache and cookies from your internet explorer.
There are a few infected files which need to be removed from your system.

° Close all instances of Internet Explorer .
° Go to your control panel and open "Internet Options".
° Click on the "General" tab.
° Click the "Delete Cookies" button, then the "Delete Files" button.
° If prompted, place a tick in the "Delete all offline content" box and click OK.

Also, please clean other Temporary files and Empty the Recycle Bin

° Go to start and click on the "run" button.
° Type the following in the box --> cleanmgr and click ok.
° Let it scan your system for files to remove.
° Make sure only Temporary Files, Temporary Internet Files, and Recycle Bin are checked.
° Press OK to remove them.

Please download Combofix to your desktop.
Doubleclick combofix.exe to launch the application.

Follow the prompts that will be displayed on the screen.
Don't click on the window while the fix is running, because that will cause your system to hang.
When finished, it should produce a log, combofix.txt.
Post this log in your next reply together with a new hijackthislog.

#3 Kheldar

Kheldar
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:09:57 PM

Posted 19 April 2008 - 11:29 PM

Thank you for your prompt advice David

I followed you instructions, at the end of the Killbox operation I got the Pending file name operations registry data has been removed by external process, pressed ok and then had to manually reboot.

The requested logs from combofix and Hijack this follow:

ComboFix 08-04-18.3 - Jack 2008-04-20 14:04:04.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1476 [GMT 10:00]
Running from: C:\Documents and Settings\Jack\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\OPTIONS\CABS\_desktop.ini
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\bbuwanhp.dll
C:\WINDOWS\system32\cpxnmasy.dll
C:\WINDOWS\system32\cyajxitm.dll
C:\WINDOWS\system32\dhxfsshx.dll
C:\WINDOWS\system32\gtfcovvr.ini
C:\WINDOWS\system32\hgGaxvtS.dll
C:\WINDOWS\system32\jkkICstq.dll
C:\WINDOWS\system32\otguoyrr.ini
C:\WINDOWS\system32\qtsCIkkj.ini
C:\WINDOWS\system32\qtsCIkkj.ini2
C:\WINDOWS\system32\rorvgwfp.dll
C:\WINDOWS\system32\rryougto.dll
C:\WINDOWS\system32\rvvocftg.dll

.
((((((((((((((((((((((((( Files Created from 2008-03-20 to 2008-04-20 )))))))))))))))))))))))))))))))
.

2008-04-20 14:04 . 2008-04-20 14:04 1,024 --ah----- C:\WINDOWS\system32\config\systemprofile\ntuser.dat.LOG
2008-04-20 13:12 . 2008-04-20 13:14 <DIR> d-------- C:\!KillBox
2008-04-20 13:06 . 2008-04-20 13:06 32,320 --a------ C:\WINDOWS\system32\__c00EDE06.dat
2008-04-19 17:33 . 2008-04-19 17:33 <DIR> d-------- C:\Program Files\Trend Micro
2008-04-19 16:46 . 2008-04-19 16:46 <DIR> d-------- C:\Deckard
2008-04-17 22:02 . 2008-04-17 22:02 <DIR> d-------- C:\Program Files\Lavasoft
2008-04-17 22:01 . 2008-04-17 22:01 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-04-17 19:35 . 2008-04-19 09:09 1,524,412 --ahs---- C:\WINDOWS\system32\sydandka.ini
2008-04-16 21:20 . 2008-04-16 21:20 <DIR> d-------- C:\Program Files\SiSoftware
2008-04-16 19:02 . 2008-04-17 07:34 1,577,309 --ahs---- C:\WINDOWS\system32\xftiaaol.ini
2008-04-16 19:01 . 2008-04-20 14:01 109,169 --a------ C:\WINDOWS\BM234de423.xml
2008-04-15 19:42 . 2008-04-15 19:42 <DIR> d-------- C:\Documents and Settings\Jack\Application Data\TVU Networks
2008-04-12 09:28 . 2008-04-12 09:28 <DIR> d-------- C:\Program Files\Common Files\INCA Shared
2008-04-12 09:27 . 2003-07-20 01:17 5,174 --a------ C:\WINDOWS\system32\nppt9x.vxd
2008-04-12 09:27 . 2005-01-03 16:43 4,682 --a------ C:\WINDOWS\system32\npptNT2.sys
2008-04-10 21:34 . 2001-11-06 15:34 376,832 --------- C:\WINDOWS\Pool of Radiance remove.exe
2008-04-10 21:34 . 1999-09-09 00:56 195,856 -ra------ C:\WINDOWS\dsetup32.dll
2008-04-10 21:34 . 1999-09-09 00:51 40,208 -ra------ C:\WINDOWS\dsetup.dll
2008-04-10 20:23 . 2008-04-10 20:26 94,208 --a------ C:\WINDOWS\ScUnin.exe
2008-04-10 20:23 . 2008-04-10 20:26 35,190 --a------ C:\WINDOWS\scunin.dat
2008-04-10 20:23 . 2008-04-10 20:26 967 --a------ C:\WINDOWS\ScUnin.pif
2008-04-10 17:02 . 2008-04-10 17:17 139,264 --a------ C:\WINDOWS\War3Unin.exe
2008-04-10 17:02 . 2008-04-10 17:17 2,829 --a------ C:\WINDOWS\War3Unin.pif
2008-04-09 21:10 . 2008-04-09 21:10 <DIR> dr-h----- C:\Documents and Settings\Jack\Application Data\SecuROM
2008-04-09 17:23 . 2008-04-09 17:23 <DIR> d-------- C:\Program Files\PM
2008-04-09 10:02 . 2008-04-09 10:02 94,208 --a------ C:\WINDOWS\rtpmsi32.dll
2008-04-08 21:19 . 2008-04-08 21:19 <DIR> d-------- C:\Program Files\Ubisoft
2008-04-08 21:19 . 2000-03-17 16:21 69,632 --a------ C:\WINDOWS\system32\xmltok.dll
2008-04-08 21:19 . 2000-03-17 16:21 36,864 --a------ C:\WINDOWS\system32\xmlparse.dll
2008-04-08 21:19 . 2002-04-24 20:43 35,840 --a------ C:\WINDOWS\system32\comdlg32.oca
2008-04-08 21:19 . 2002-04-10 01:23 29,184 --a------ C:\WINDOWS\system32\MSINET.oca
2008-04-08 21:19 . 2002-10-17 18:35 26,096 --a------ C:\WINDOWS\system32\xmlinst.exe
2008-04-08 21:19 . 2002-01-08 00:30 24,576 --a------ C:\WINDOWS\system32\msxml3a.dll
2008-04-08 20:13 . 2008-04-08 20:14 <DIR> d-------- C:\Program Files\DOSBox-0.72
2008-04-08 20:07 . 2008-04-09 16:29 <DIR> d-------- C:\Program Files\DAEMON Tools Lite
2008-04-08 20:04 . 2008-04-08 20:04 <DIR> d-------- C:\Documents and Settings\Jack\Application Data\DAEMON Tools
2008-04-08 20:04 . 2008-04-08 20:04 717,296 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-04-06 10:05 . 2008-04-06 10:05 <DIR> d-------- C:\Program Files\Safari
2008-04-06 09:53 . 2008-04-06 09:53 <DIR> d-------- C:\Program Files\iTunes
2008-04-06 09:53 . 2008-04-06 09:53 <DIR> d-------- C:\Program Files\iPod
2008-04-06 09:53 . 2008-04-20 13:36 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-04-06 09:53 . 2008-04-06 09:53 1,409 --a------ C:\WINDOWS\QTFont.for
2008-03-28 23:37 . 2008-03-28 23:37 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
2008-03-28 23:37 . 2008-03-28 23:37 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-19 10:35 --------- d-----w C:\Documents and Settings\Jack\Application Data\Vso
2008-04-17 12:43 --------- d-----w C:\Documents and Settings\Jack\Application Data\Azureus
2008-04-17 12:39 --------- d-----w C:\Program Files\Azureus
2008-04-17 12:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-04-15 10:31 --------- d-----w C:\Program Files\Real
2008-04-15 10:31 --------- d-----w C:\Program Files\Common Files\Real
2008-04-12 07:17 --------- d-----w C:\Documents and Settings\All Users\Application Data\1Click DVD Copy Pro
2008-04-11 23:13 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-10 10:32 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-04-09 11:10 98,304 ----a-w C:\WINDOWS\system32CmdLineExt.dll
2008-04-06 01:10 --------- d-----w C:\Documents and Settings\Jack\Application Data\Apple Computer
2008-04-05 23:52 --------- d-----w C:\Program Files\QuickTime
2008-04-02 08:12 --------- d-----w C:\Program Files\Java
2008-03-21 05:34 --------- d-----w C:\Documents and Settings\All Users\Application Data\DVD Shrink
2008-03-21 05:28 --------- d-----w C:\Program Files\dvdSanta
2008-03-19 10:17 --------- d-----w C:\Program Files\LG Software Innovations
2008-02-28 10:03 --------- d-----w C:\Documents and Settings\Jack\Application Data\FrostWire
2008-02-23 02:55 --------- d-----w C:\Program Files\Nancy Drew
2008-02-23 00:32 --------- d-----w C:\Documents and Settings\Katrina.JACK-3B93E50B47\Application Data\Ashampoo
2008-02-21 08:27 --------- d-----w C:\Program Files\Common Files\Adobe
2008-02-16 02:29 320,640 ----a-w C:\WINDOWS\ilda16.dll
2008-02-14 10:17 94,208 ----a-w C:\Documents and Settings\Jack\Application Data\ezplay.sys
2008-02-14 10:17 87,608 ----a-w C:\Documents and Settings\Jack\Application Data\inst.exe
2008-02-14 10:17 47,360 ----a-w C:\Documents and Settings\Jack\Application Data\pcouffin.sys
2007-10-26 12:28 50,488 ----a-w C:\Documents and Settings\Jack\Application Data\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}]
2007-10-05 06:06 1135968 --a------ C:\Program Files\Winamp Toolbar\winamptb.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= "C:\Program Files\Winamp Toolbar\winamptb.dll" [2007-10-05 06:06 1135968]

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-10-05 06:06 1135968]

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-14 02:24 1694208]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-02-28 22:00 15360]
"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-04-01 19:39 486856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2006-02-28 22:00 208952]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2006-02-28 22:00 455168]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2006-02-28 22:00 455168]
"RTHDCPL"="RTHDCPL.EXE" [2007-04-12 19:33 16132608 C:\WINDOWS\RTHDCPL.exe]
"JMB36X IDE Setup"="C:\WINDOWS\JM\JMInsIDE.exe" [2006-10-30 22:44 36864]
"36X Raid Configurer"="C:\WINDOWS\system32\JMRaidSetup.exe" [2007-02-06 22:08 1953792]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 00:41 8523776]
"nwiz"="nwiz.exe" [2007-12-05 00:41 1626112 C:\WINDOWS\system32\nwiz.exe]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 03:25 144784]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 00:41 81920]
"NeroCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 19:50 155648]
"mspwr"="C:\WINDOWS\system32\PuXpMan2.exe" [2005-09-29 09:05 110592]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 21:16 39792]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-02-28 22:00 15360]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.exe.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-12-23 11:19:20 113664]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dhxfsshx]
dhxfsshx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\__c00EDE06]
__c00EDE06.dat 2008-04-20 13:06 32320 C:\WINDOWS\system32\__c00EDE06.dat

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Azureus\\Azureus.exe"=
"F:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe"=
"F:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Warlords\\Civ4Warlords.exe"=
"F:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Warlords\\Civ4Warlords_PitBoss.exe"=
"F:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Beyond the Sword\\Civ4BeyondSword.exe"=
"F:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Beyond the Sword\\Civ4BeyondSword_PitBoss.exe"=
"C:\\Program Files\\FrostWire\\FrostWire.exe"=
"F:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2main.exe"=
"F:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2main_amdxp.exe"=
"F:\\Program Files\\Atari\\Neverwinter Nights 2\\nwupdate.exe"=
"F:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2server.exe"=
"C:\\NeverwinterNights\\NWN\\nwmain.exe"=
"C:\\Program Files\\DAP\\DAP.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"F:\\Program Files\\Microsoft Games\\Rise of Nations\\thrones.exe"=
"F:\\Program Files\\Warcraft III\\Warcraft III.exe"=
"C:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite XII.SP2a\\RpcAgentSrv.exe"=
"C:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite XII.SP2a\\WNt500x86\\RpcSandraSrv.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-30 04:31]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-30 04:35]
R2 SandraAgentSrv;SiSoftware Deployment Agent Service;C:\Program Files\SiSoftware\SiSoftware Sandra Lite XII.SP2a\RpcAgentSrv.exe [2008-04-10 11:53]
S3 gdrv;gdrv;C:\WINDOWS\gdrv.sys [2007-09-20 15:03]

.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-20 14:08:10
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\__c00EDE06.dat
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2008-04-20 14:12:46 - machine was rebooted
ComboFix-quarantined-files.txt 2008-04-20 04:12:43

Pre-Run: 179,498,549,248 bytes free
Post-Run: 179,548,090,368 bytes free

210 --- E O F --- 2008-04-16 21:45:23


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:15:42 PM, on 20/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\SiSoftware\SiSoftware Sandra Lite XII.SP2a\RpcAgentSrv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\PuXpMan2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: (no name) - {9CB65206-89C4-402c-BA80-02D8C59F9B1D} - C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Ask Search Assistant BHO - {9CB65201-89C4-402c-BA80-02D8C59F9B1D} - C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\JM\JMInsIDE.exe
O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\system32\JMRaidSetup.exe boot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [mspwr] C:\WINDOWS\system32\PuXpMan2.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v5.cab
O20 - Winlogon Notify: dhxfsshx - dhxfsshx.dll (file missing)
O20 - Winlogon Notify: __c00EDE06 - C:\WINDOWS\SYSTEM32\__c00EDE06.dat
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SiSoftware Deployment Agent Service (SandraAgentSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XII.SP2a\RpcAgentSrv.exe

--
End of file - 7658 bytes

#4 Kheldar

Kheldar
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:09:57 PM

Posted 20 April 2008 - 04:23 AM

David,

After I added my reply to your advice I started a Avast virus scan which came up with a warning that the Win32: TratBHO was contained in C:\Windows\System32\_cooede06.dat. The scan then reported that there was a virus in memory and recommended a reboot with a scan in safe mode. It did this and reported that:
FileC:\!Killbox\hgGaxvs.dll is infected by Win32:TratBHO[Trj] &
FileC:\!Killbox\jkkICstq.dll is infected by Win32:TratBHO[Trj]

The scan also reported that it was also present in C:\QooBox\Quarantine\C\Windows\System32\dhxfsshx.vir and C:\QooBox\Quarantine\C\Windows\System32\hgGaxvts.dll.vir as well as in some System Volume Information files.

I used the option to move them to chest apart from the first mentioned .dat file.

#5 -David-

-David-

  • Members
  • 10,603 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London
  • Local time:12:57 PM

Posted 20 April 2008 - 07:14 AM

Good work, let's continue.. :thumbsup:

Start Killbox.exe
Select the "Delete on Reboot" option.
Click on the "All Files" button (!important!),which will then flash green.
Copy the complete text in bold below to the clipboard by highlighting the filepaths and pressing Control + C:

C:\WINDOWS\system32\__c00EDE06.dat
C:\WINDOWS\system32\sydandka.ini
C:\WINDOWS\system32\xftiaaol.ini


Open 'file' in the killboxmenu on top and choose Paste from clipboard
You must use the file File menu--pasting by right-clicking the mouse will only enter one file.
Then press the button that looks like a red circle with a white X in it.
Killbox will tell you that all listed files will be removed on next reboot and asks if you would like to Reboot now, click "yes".
Click OK at any Pending File Rename Operations prompt, let me know if there appear.
If you don't get that message, reboot manually.
Your computer should reboot now.

Please open notepad and and copy and paste next bold in it:
(don't forget to copy and paste REGEDIT4)

REGEDIT4

[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dhxfsshx]

[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\__c00EDE06]

Save this as "fix.reg" Choose to save as *all files and place it on your desktop.
It should look like this: Posted Image
Doubleclick on it and when it asks you if you want to merge the contents to the registry, click yes/ok.

The following two folders: 'C:\!Killbox' and 'C:\QooBox' are backup folders for both Killbox and Combofix - we will be deleteing them once we have finished up here, so if you can, ignore the Avast warnings about infections there, it's normal.. :blink:

Please perform this online scan: Kaspersky Webscan
Note that this scanner will only work on Internet Explorer, so please use this browser for the scan.
Read the Requirements and Privacy statement, then select "Accept"
A dialogue box will appearing asking "Do you want to install this software?" Name: kavwebscan_unicode.cab
Select "Install" to download the ActiveX controls that allows ActiveScan to run.

When the download is complete it will say ready, click "Next"
Select a target to scan: Click on "My Computer"
When the scan is complete choose to save the results as "Save as Text"
Post the Kaspersky scan results in your next reply, along with a new Hijackthis log.

#6 Kheldar

Kheldar
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:09:57 PM

Posted 22 April 2008 - 07:59 AM

David,

Kaspersky and Hijackthis logs follow.

Thanks again for your help.

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Tuesday, April 22, 2008 10:45:28 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 22/04/2008
Kaspersky Anti-Virus database records: 720827
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\
G:\
H:\

Scan Statistics:
Total number of scanned objects: 468461
Number of viruses found: 9
Number of infected objects: 33
Number of suspicious objects: 0
Duration of the scan process: 03:03:48

Infected Object Name / Virus Name / Last Action
C:\!KillBox\rvvocftg.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.pjx skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp Object is locked skipped
C:\Documents and Settings\Jack\Application Data\Mozilla\Firefox\Profiles\v87cjbnh.default\cert8.db Object is locked skipped
C:\Documents and Settings\Jack\Application Data\Mozilla\Firefox\Profiles\v87cjbnh.default\formhistory.dat Object is locked skipped
C:\Documents and Settings\Jack\Application Data\Mozilla\Firefox\Profiles\v87cjbnh.default\history.dat Object is locked skipped
C:\Documents and Settings\Jack\Application Data\Mozilla\Firefox\Profiles\v87cjbnh.default\key3.db Object is locked skipped
C:\Documents and Settings\Jack\Application Data\Mozilla\Firefox\Profiles\v87cjbnh.default\parent.lock Object is locked skipped
C:\Documents and Settings\Jack\Application Data\Mozilla\Firefox\Profiles\v87cjbnh.default\search.sqlite Object is locked skipped
C:\Documents and Settings\Jack\Application Data\Mozilla\Firefox\Profiles\v87cjbnh.default\urlclassifier2.sqlite Object is locked skipped
C:\Documents and Settings\Jack\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Jack\Desktop\System Files\System Stuff\BSINSTALL.exe/WISE0024.BIN Infected: not-a-virus:AdTool.Win32.WhenU.a skipped
C:\Documents and Settings\Jack\Desktop\System Files\System Stuff\BSINSTALL.exe WiseSFX: infected - 1 skipped
C:\Documents and Settings\Jack\Desktop\System Files\System Stuff\BSINSTALL.exe WiseSFXDropper: infected - 1 skipped
C:\Documents and Settings\Jack\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Jack\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Jack\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Jack\Local Settings\History\History.IE5\MSHist012008042220080423\index.dat Object is locked skipped
C:\Documents and Settings\Jack\Local Settings\Temp\~DF9B81.tmp Object is locked skipped
C:\Documents and Settings\Jack\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\Jack\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Jack\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Jack\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\aswResp.dat Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\Avast4.db Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\log\AshWebSv.ws Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\log\aswMaiSv.log Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\log\nshield.log Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\report\Resident protection.txt Object is locked skipped
C:\Program Files\AskTBar\bar\1.bin\A5POPSWT.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.az skipped
C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.az skipped
C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.az skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\cyajxitm.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.plw skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\rryougto.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.plw skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\rvvocftg.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.pjx skipped
C:\QooBox\Quarantine\catchme2008-04-20_140606.26.zip/jkkICstq.dll Infected: Packed.Win32.Monder.gen skipped
C:\QooBox\Quarantine\catchme2008-04-20_140606.26.zip ZIP: infected - 1 skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{7305B8E6-A14A-4670-8C80-B112C9E64F49}\RP290\A0023734.exe Infected: not-a-virus:AdWare.Win32.Shopper.r skipped
C:\System Volume Information\_restore{7305B8E6-A14A-4670-8C80-B112C9E64F49}\RP301\A0026986.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.pke skipped
C:\System Volume Information\_restore{7305B8E6-A14A-4670-8C80-B112C9E64F49}\RP306\A0028435.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.pke skipped
C:\System Volume Information\_restore{7305B8E6-A14A-4670-8C80-B112C9E64F49}\RP307\A0030477.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.plw skipped
C:\System Volume Information\_restore{7305B8E6-A14A-4670-8C80-B112C9E64F49}\RP307\A0030481.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.plw skipped
C:\System Volume Information\_restore{7305B8E6-A14A-4670-8C80-B112C9E64F49}\RP307\A0030482.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.pjx skipped
C:\System Volume Information\_restore{7305B8E6-A14A-4670-8C80-B112C9E64F49}\RP309\A0030631.exe/WISE0024.BIN Infected: not-a-virus:AdTool.Win32.WhenU.a skipped
C:\System Volume Information\_restore{7305B8E6-A14A-4670-8C80-B112C9E64F49}\RP309\A0030631.exe WiseSFX: infected - 1 skipped
C:\System Volume Information\_restore{7305B8E6-A14A-4670-8C80-B112C9E64F49}\RP309\A0030631.exe WiseSFXDropper: infected - 1 skipped
C:\System Volume Information\_restore{7305B8E6-A14A-4670-8C80-B112C9E64F49}\RP309\A0030634.exe/data0000.cab/is152443.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.nnm skipped
C:\System Volume Information\_restore{7305B8E6-A14A-4670-8C80-B112C9E64F49}\RP309\A0030634.exe/data0000.cab Infected: not-a-virus:AdWare.Win32.Virtumonde.nnm skipped
C:\System Volume Information\_restore{7305B8E6-A14A-4670-8C80-B112C9E64F49}\RP309\A0030634.exe Rsrc-Package: infected - 2 skipped
C:\System Volume Information\_restore{7305B8E6-A14A-4670-8C80-B112C9E64F49}\RP309\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SAA8F8CD6.tmp Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_600.dat Object is locked skipped
C:\WINDOWS\Temp\_avast4_\Webshlock.txt Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
F:\Knights of the Force 2.0 Add-On\KotF2.0Setup.rar/KotFSetup.exe/data0480 Infected: not-a-virus:RiskTool.Win32.HideWindows skipped
F:\Knights of the Force 2.0 Add-On\KotF2.0Setup.rar/KotFSetup.exe Infected: not-a-virus:RiskTool.Win32.HideWindows skipped
F:\Knights of the Force 2.0 Add-On\KotF2.0Setup.rar RAR: infected - 2 skipped
F:\Knights of the Force 2.0 Add-On\KotFSetup.exe/data0480 Infected: not-a-virus:RiskTool.Win32.HideWindows skipped
F:\Knights of the Force 2.0 Add-On\KotFSetup.exe NSIS: infected - 1 skipped
F:\Program Files\LucasArts\KotF Jedi Academy Expansion Pack\src\cmds\menucmds\cmdow.exe Infected: not-a-virus:RiskTool.Win32.HideWindows skipped
F:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
F:\System Volume Information\_restore{7305B8E6-A14A-4670-8C80-B112C9E64F49}\RP309\change.log Object is locked skipped
G:\KOTF\Knights of the Force 2.0 Add-On\KotF2.0Setup.rar/KotFSetup.exe/data0480 Infected: not-a-virus:RiskTool.Win32.HideWindows skipped
G:\KOTF\Knights of the Force 2.0 Add-On\KotF2.0Setup.rar/KotFSetup.exe Infected: not-a-virus:RiskTool.Win32.HideWindows skipped
G:\KOTF\Knights of the Force 2.0 Add-On\KotF2.0Setup.rar RAR: infected - 2 skipped
G:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
G:\System Volume Information\_restore{7305B8E6-A14A-4670-8C80-B112C9E64F49}\RP309\change.log Object is locked skipped

Scan process completed.


Deckard's System Scanner v20071014.68
Run by Jack on 2008-04-22 22:45:55
Computer is in Normal Mode.
--------------------------------------------------------------------------------



-- HijackThis (run as Jack.exe) ------------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:45:59 PM, on 22/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\SiSoftware\SiSoftware Sandra Lite XII.SP2a\RpcAgentSrv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\PuXpMan2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\internet explorer\iexplore.exe
c:\program files\winamp toolbar\WinampTbServer.exe
C:\Documents and Settings\Jack\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Jack.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: (no name) - {9CB65206-89C4-402c-BA80-02D8C59F9B1D} - C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Ask Search Assistant BHO - {9CB65201-89C4-402c-BA80-02D8C59F9B1D} - C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\JM\JMInsIDE.exe
O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\system32\JMRaidSetup.exe boot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [mspwr] C:\WINDOWS\system32\PuXpMan2.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v5.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SiSoftware Deployment Agent Service (SandraAgentSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XII.SP2a\RpcAgentSrv.exe

--
End of file - 7662 bytes

-- Files created between 2008-03-22 and 2008-04-22 -----------------------------

2008-04-21 20:10:18 0 d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-04-21 20:10:18 0 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-04-20 14:02:56 68096 --a------ C:\WINDOWS\zip.exe
2008-04-20 14:02:56 49152 --a------ C:\WINDOWS\VFind.exe
2008-04-20 14:02:56 212480 --a------ C:\WINDOWS\swxcacls.exe <Not Verified; SteelWerX; SteelWerX Extended Configurator ACLists>
2008-04-20 14:02:56 136704 --a------ C:\WINDOWS\swsc.exe <Not Verified; SteelWerX; SteelWerX Service Controller>
2008-04-20 14:02:56 161792 --a------ C:\WINDOWS\swreg.exe <Not Verified; SteelWerX; SteelWerX Registry Editor>
2008-04-20 14:02:56 98816 --a------ C:\WINDOWS\sed.exe
2008-04-20 14:02:56 80412 --a------ C:\WINDOWS\grep.exe
2008-04-20 14:02:56 73728 --a------ C:\WINDOWS\fdsv.exe <Not Verified; Smallfrogs Studio; >
2008-04-20 14:01:06 0 dr-h----- C:\Documents and Settings\Jack\Recent
2008-04-20 13:12:35 0 d-------- C:\!KillBox
2008-04-19 17:33:14 0 d-------- C:\Program Files\Trend Micro
2008-04-17 22:02:11 0 d-------- C:\Program Files\Lavasoft
2008-04-17 22:01:30 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-04-16 21:20:47 0 d-------- C:\Program Files\SiSoftware
2008-04-15 19:42:08 0 d-------- C:\Documents and Settings\Jack\Application Data\TVU Networks
2008-04-12 09:28:42 0 d-------- C:\Program Files\Common Files\INCA Shared
2008-04-12 09:27:04 4682 --a------ C:\WINDOWS\system32\npptNT2.sys <Not Verified; INCA Internet Co., Ltd.; nProtect NPSC Kernel Mode Driver for NT>
2008-04-10 21:34:35 195856 -ra------ C:\WINDOWS\dsetup32.dll <Not Verified; Microsoft Corporation; Microsoft® DirectX for Windows® 95 and 98>
2008-04-10 21:34:34 376832 -----n--- C:\WINDOWS\Pool of Radiance remove.exe <Not Verified; Edgies; Pool of Radiance II Installer Application>
2008-04-10 21:34:34 40208 -ra------ C:\WINDOWS\dsetup.dll <Not Verified; Microsoft Corporation; Microsoft® DirectX for Windows® 95 and 98>
2008-04-10 20:23:27 35190 --a------ C:\WINDOWS\scunin.dat
2008-04-10 20:23:26 967 --a------ C:\WINDOWS\ScUnin.pif
2008-04-10 20:23:26 94208 --a------ C:\WINDOWS\ScUnin.exe <Not Verified; Blizzard Entertainment; Starcraft Uninstaller>
2008-04-10 17:02:15 2829 --a------ C:\WINDOWS\War3Unin.pif
2008-04-10 17:02:14 139264 --a------ C:\WINDOWS\War3Unin.exe <Not Verified; Blizzard Entertainment; Warcraft III Uninstaller>
2008-04-09 21:10:34 0 dr-h----- C:\Documents and Settings\Jack\Application Data\SecuROM
2008-04-09 17:23:46 0 d-------- C:\Program Files\PM
2008-04-09 10:02:08 94208 --a------ C:\WINDOWS\rtpmsi32.dll <Not Verified; Pocket Soft, Inc.; RTPatch>
2008-04-08 21:19:16 69632 --a------ C:\WINDOWS\system32\xmltok.dll
2008-04-08 21:19:16 36864 --a------ C:\WINDOWS\system32\xmlparse.dll
2008-04-08 21:19:16 24576 --a------ C:\WINDOWS\system32\msxml3a.dll <Not Verified; Microsoft Corporation; Microsoft XML Core Services>
2008-04-08 21:19:16 0 d-------- C:\Program Files\Ubisoft
2008-04-08 20:13:33 0 d-------- C:\Program Files\DOSBox-0.72
2008-04-08 20:07:52 0 d-------- C:\Program Files\DAEMON Tools Lite
2008-04-08 20:04:59 717296 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-04-08 20:04:56 0 d-------- C:\Documents and Settings\Jack\Application Data\DAEMON Tools
2008-04-06 10:05:00 0 d-------- C:\Program Files\Safari
2008-04-06 09:53:30 0 d-------- C:\Program Files\iPod
2008-04-06 09:53:24 0 d-------- C:\Program Files\iTunes


-- Find3M Report ---------------------------------------------------------------

2008-04-20 22:12:41 0 d-------- C:\Documents and Settings\Jack\Application Data\Azureus
2008-04-19 20:35:08 0 d-------- C:\Documents and Settings\Jack\Application Data\Vso
2008-04-17 22:39:58 0 d-------- C:\Program Files\Azureus
2008-04-17 22:01:30 0 d-------- C:\Program Files\Common Files
2008-04-15 20:33:11 0 d-------- C:\Documents and Settings\Jack\Application Data\Real
2008-04-15 20:31:55 0 d-------- C:\Program Files\Real
2008-04-15 20:31:55 0 d-------- C:\Program Files\Common Files\Real
2008-04-12 09:13:13 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-04-10 17:32:18 151458 --a------ C:\WINDOWS\War3Unin.dat
2008-04-09 21:10:33 98304 --a------ C:\WINDOWS\system32CmdLineExt.dll <Not Verified; Sony DADC Austria AG.; >
2008-04-06 17:12:17 37773 --a------ C:\WINDOWS\DIIUnin.dat
2008-04-06 16:30:54 21840 --a-----t C:\WINDOWS\system32\SIntfNT.dll
2008-04-06 16:30:54 17212 --a-----t C:\WINDOWS\system32\SIntf32.dll
2008-04-06 16:30:54 12067 --a-----t C:\WINDOWS\system32\SIntf16.dll
2008-04-06 11:10:28 0 d-------- C:\Documents and Settings\Jack\Application Data\Apple Computer
2008-04-06 09:52:43 0 d-------- C:\Program Files\QuickTime
2008-04-02 18:12:42 0 d-------- C:\Program Files\Java
2008-03-21 15:28:26 0 d-------- C:\Program Files\dvdSanta
2008-03-19 20:17:53 0 d-------- C:\Program Files\LG Software Innovations
2008-02-28 20:03:05 0 d-------- C:\Documents and Settings\Jack\Application Data\FrostWire
2008-02-23 21:07:00 43 ---hs---- C:\Documents and Settings\Jack\Application Data\.zreglib
2008-02-23 12:55:18 0 d-------- C:\Program Files\Nancy Drew
2008-02-16 12:29:27 320640 --a------ C:\WINDOWS\ilda16.dll <Not Verified; Creative Development LTD; >
2008-02-14 20:17:55 34 --a------ C:\Documents and Settings\Jack\Application Data\ezplay.log
2008-02-14 20:17:53 34 --a------ C:\Documents and Settings\Jack\Application Data\pcouffin.log
2008-02-14 20:17:53 94208 --a------ C:\Documents and Settings\Jack\Application Data\ezplay.sys <Not Verified; VSO Software; ezplay driver>
2008-02-14 20:17:53 125 --a------ C:\Documents and Settings\Jack\Application Data\ezplay.ini
2008-02-14 20:17:53 1103 --a------ C:\Documents and Settings\Jack\Application Data\ezplay.inf
2008-02-14 20:17:53 7861 --a------ C:\Documents and Settings\Jack\Application Data\ezplay.cat
2008-02-14 20:17:44 47360 --a------ C:\Documents and Settings\Jack\Application Data\pcouffin.sys <Not Verified; VSO Software; Patin couffin engine>
2008-02-14 20:17:44 1144 --a------ C:\Documents and Settings\Jack\Application Data\pcouffin.inf
2008-02-14 20:17:44 7887 --a------ C:\Documents and Settings\Jack\Application Data\pcouffin.cat


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}]
05/10/2007 06:06 AM 1135968 --a------ C:\Program Files\Winamp Toolbar\winamptb.dll

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [05/10/2007 06:06 AM 1135968]

[-HKEY_CLASSES_ROOT\CLSID\{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [28/02/2006 10:00 PM]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [28/02/2006 10:00 PM]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [28/02/2006 10:00 PM]
"RTHDCPL"="RTHDCPL.EXE" [12/04/2007 07:33 PM C:\WINDOWS\RTHDCPL.exe]
"JMB36X IDE Setup"="C:\WINDOWS\JM\JMInsIDE.exe" [30/10/2006 10:44 PM]
"36X Raid Configurer"="C:\WINDOWS\system32\JMRaidSetup.exe" [06/02/2007 10:08 PM]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [05/12/2007 12:41 AM]
"nwiz"="nwiz.exe" [05/12/2007 12:41 AM C:\WINDOWS\system32\nwiz.exe]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [22/02/2008 03:25 AM]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [05/12/2007 12:41 AM]
"NeroCheck"="C:\WINDOWS\system32\NeroCheck.exe" [09/07/2001 07:50 PM]
"mspwr"="C:\WINDOWS\system32\PuXpMan2.exe" [29/09/2005 09:05 AM]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [11/01/2008 09:16 PM]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [28/03/2008 11:37 PM]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [30/03/2008 10:36 AM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [14/10/2004 02:24 AM]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [28/02/2006 10:00 PM]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.exe.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [23/12/2007 11:19:20 AM]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [13/02/2001 1:01:04 AM]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)
"HideLegacyLogonScripts"=0 (0x0)
"HideLogoffScripts"=0 (0x0)
"RunLogonScriptSync"=1 (0x1)
"RunStartupScriptSync"=1 (0x1)
"HideStartupScripts"=0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"HideLegacyLogonScripts"=0 (0x0)
"HideLogoffScripts"=0 (0x0)
"RunLogonScriptSync"=1 (0x1)
"RunStartupScriptSync"=1 (0x1)
"HideStartupScripts"=0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"




-- End of Deckard's System Scanner: finished at 2008-04-22 22:46:16 ------------

#7 -David-

-David-

  • Members
  • 10,603 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London
  • Local time:12:57 PM

Posted 23 April 2008 - 05:51 AM

Hi again, good work! :thumbsup:

Please delete the following two folders:
C:\!KillBox
C:\QooBox

Also, please find and delete the following file:
C:\Documents and Settings\Jack\Desktop\System Files\System Stuff\BSINSTALL.exe

We need to purge your infected system restore points.
On the Desktop, right-click My Computer, then click Properties.
Click the System Restore tab near the top of the window.
Check Turn off System Restore, click Apply, and then click OK.
More information on how to disable your system restore can be found here.

We want to create a new, clean restore point. Please first reboot your computer.
On the Desktop, right-click My Computer, then click Properties.
Click the System Restore tab near the top of the window.
Uncheck "Turn off System Restore", click Apply, and then click OK.

Click Start > All Programs > Accessories > System Tools, and select System Restore.
In the System Restore wizard, select the box next the text labeled "Create a restore point" and click the Next button.
Type a description for your new restore point - Something like "After trojan/spyware cleanup".
Click Create, and after it has created the restore point, click "Close".
Further instructions on creating a restore point can be found here

Please reboot a final time and let me know how the PC is running.
I see a clean Hijackthis log now!

#8 Kheldar

Kheldar
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:09:57 PM

Posted 23 April 2008 - 06:34 AM

Folders and file deleted.

Clean restore point created.

System running beautifully.

Fantastic job, thank you very much.

#9 -David-

-David-

  • Members
  • 10,603 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London
  • Local time:12:57 PM

Posted 23 April 2008 - 04:25 PM

Glad I could help! :thumbsup:
The latest log is looking clean!
Follow this list and your potential for being infected again will be reduced dramatically.

Use an Anti Virus Software -
* It is very important that your computer has an anti-virus software running on your machine.
* This alone can save you a lot of trouble with malware in the future. This link has listings of stand-alone anti virus programs:
* Click here for more information on -> Computer Safety On line - Anti-Virus
* I would recommend Grisoft's AVG or AVAST.
* These are the more secure and better ones.

Update your Anti Virus Software - It is imperitive that you update your Anti virus software at least once a week (Even more if you wish). If you do not update your anti virus software then it will not be able to catch any of the new variants that may come out.

Use a Firewall -
* I can not stress how important it is that you use a Firewall on your computer.
* Without a firewall your computer is susceptible to being hacked and taken over.
* Simply using a Firewall in its default configuration can lower your risk greatly.
* For an article on Firewalls and a listing of some available ones see the link below:
* Click here for more information on -> Computer Safety On line - Software Firewalls
* I would recommend ZoneAlarm as a firewall as it's easy to use.

Visit Microsoft's Windows Update Site Frequently -
* It is important that you visit http://www.windowsupdate.com regularly.
* This will ensure your computer has always the latest security updates available installed on your computer.
* If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

Next, if they're not already present, I would recommend the download and installation of some or all of the following programs (all free), and the updating of them regularly

Install Spybot© - Search and Destroy- Install and download Spybot - Search and Destroy with its TeaTimer option.
* This will provide real-time spyware & hijacker protection on your computer alongside your virus protection.
* You should also scan your computer with program on a regular basis just as you would an anti virus software.
* A tutorial on installing & using this product can be found here:
* Click here for more info -->Instructions for - Spybot S & D and Ad-aware

Install Lavasofts© Ad-Aware - Install and download Ad-Aware.
* You should also scan your computer with the program on a regular basis just as you would an anti virus software in conjunction with Spybot.
* A tutorial on installing & using this product can be found here:
* Click here for more info -->Instructions for - Spybot S & D and Ad-aware

Install Javacools© SpywareBlaster -
* SpywareBlaster will added a large list of programs and sites into your Internet Explorer and Firefox settings and that will protect you from running and downloading known malicious programs.
* A article on anti-malware products with links for this program and others can be found here:
* Click here for more info -->Computer Safety on line - Anti-Malware

Update all these programs regularly - Make sure you update all the programs I have listed regularly.
Without regular updates you WILL NOT be protected when new malicious programs are released.

If you have any addition questions just ask...
David

#10 Kheldar

Kheldar
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:09:57 PM

Posted 24 April 2008 - 04:30 AM

Thanks again I have followed your advice and installed the recommended programs.

#11 -David-

-David-

  • Members
  • 10,603 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London
  • Local time:12:57 PM

Posted 25 April 2008 - 05:07 AM

Since this issue appears resolved, this Topic is now closed.

If you need this topic reopened, please request this by sending me
a PM with the address of the thread using the link here. This applies only to the original topic starter.

Everyone else please begin a New Topic.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users