Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Can Someone Help Me?


  • This topic is locked This topic is locked
20 replies to this topic

#1 PlatinumX

PlatinumX

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:04:05 AM

Posted 20 June 2008 - 09:17 PM

First off thanks to anyone that helps me. ok my problem is this when i start my computer the task bar sometimes shows and disappears and when it shows it has VIRUS ALERT! where the time should be. I cant access the task manger i get a message that is has been disabled by administrator and i am Admin. I can access no of my files such a control panel, my documents, my computer. Any help to fix this would be greatly appreciated and thanks again in advance.


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:11: VIRUS ALERT!, on 6/20/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
O3 - Toolbar: vrmdtneg - {B4B8E731-19DA-43DF-9E91-4B33E8478EF3} - C:\WINDOWS\vrmdtneg.dll (file missing)
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [DownloadAccelerator] "C:\Program Files\DAP\DAP.EXE" /STARTUP
O4 - HKLM\..\Run: [DelayLoad] C:\DOCUME~1\TERRANCE\LOCALS~1\Temp\atmadm.exe
O4 - HKLM\..\Run: [Antivirus] C:\Program Files\VAV\vav.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Antivirus] C:\Program Files\VAV\vav.exe
O4 - HKCU\..\Run: [WinSpywareProtect] "C:\Documents and Settings\All Users\Application Data\ADSL Software Ltd\WinSpywareProtect\winspywareprotect.exe" /autorun
O4 - Startup: Yahoo! Widgets.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Microsoft Office Groove Audit Service - Unknown owner - C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

--
End of file - 5447 bytes

BC AdBot (Login to Remove)

 


#2 Buckeye_Sam

Buckeye_Sam

    Malware Expert


  • Members
  • 17,382 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Pickerington, Ohio
  • Local time:04:05 AM

Posted 21 June 2008 - 08:18 AM

Hi and welcome to Bleeping Computer! My name is Sam and I will be helping you. :thumbsup:

Please download Deckard's System Scanner (DSS) and save to your Desktop.
alternate download site

DSS will do the following:
  • Create a new System Restore point in Windows XP and Vista.
  • Clean your Temporary Files, Downloaded Program Files, Internet Cache Files, and empty the Recycle Bin on all drives.
  • Check some important areas of your system and produce a report for an analyst to review.
  • Automatically run HijackThis. It will also install and place a shortcut to HijackThis on your desktop if you do not already have it installed. So if HijackThis is not installed and DSS prompts you to download it, please answer yes.
You must be logged onto an account with administrator privileges when using.
  • Close all applications and windows.
  • Double-click on dss.exe to run it and follow the prompts.
  • If your anti-virus or firewall complains, please allow this script to run as it is not
    malicious.
  • When the scan is complete, two text files will open in Notepad:
    • main.txt <- this one will be maximized
    • extra.txt <- this one will be minimized
  • If not, they both can be found in the C:\Deckard\System Scanner folder.
  • Please copy (Ctrl+C) and paste (Ctrl+V) the contents of main.txt and extra.txt in your next reply.
-- When running DSS, some firewalls may warn that it is trying to access the Internet especially if your asked to download the most current version of HijackThis. Please ensure that you allow it permission to do so.
-- If you get a warning from your anti-virus while DSS is scanning, please allow DSS to continue as the scan is not harmful.

Posted Image If I have helped you in any way, please consider a donation to help me continue the fight against malware.


Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it!


========================================================

#3 PlatinumX

PlatinumX
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:04:05 AM

Posted 21 June 2008 - 11:36 AM

Sorry it took me so long to reply thanks for taking time out to help me here is what you requested.

Main.txt

Deckard's System Scanner v20071014.68
Run by TERRANCE on 2008-06-20 17:38:46
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.


-- Last 5 Restore Point(s) --
43: 2008-06-20 21:39:06 UTC - RP257 - Deckard's System Scanner Restore Point
42: 2008-06-20 16:31:09 UTC - RP256 - Avira AntiVir Personal - 6/20/2008 12:31: VIRUS ALERT!
41: 2008-06-20 15:48:31 UTC - RP255 - Windows Defender Checkpoint
40: 2008-06-20 12:32:53 UTC - RP254 - Avira AntiVir Personal - 6/20/2008 08:31: VIRUS ALERT!
39: 2008-06-20 12:17:45 UTC - RP253 - Software Distribution Service 3.0


-- First Restore Point --
1: 2008-05-31 02:58:49 UTC - RP215 - System Checkpoint


Backed up registry hives.
Performed disk cleanup.

Total Physical Memory: 256 MiB (512 MiB recommended).


-- HijackThis (run as TERRANCE.exe) --------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:42: VIRUS ALERT!, on 6/20/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\TERRANCE\Desktop\dss.exe
C:\PROGRA~1\Trend Micro\HijackThis\TERRANCE.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=...6Ojg5&lid=2
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
O2 - BHO: (no name) - {062DF89E-6897-4AC2-A071-3C82ABF10563} - C:\WINDOWS\system32\opnomlME.dll
O2 - BHO: BurstWriting module - {18CB1A7B-94CD-4582-8022-ADA16851E44B} - C:\Program Files\BurstWriting\BurstWriting.dll (file missing)
O2 - BHO: QXK Olive - {20D7B970-2B28-4F39-802D-8D6837AD02EC} - C:\WINDOWS\ksendlbtmat.dll (file missing)
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {47B753D7-567E-477B-8AB2-B29EA29757F3} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {94BC3D1D-22E9-4744-8ED1-3E08A3B74078} - (no file)
O2 - BHO: (no name) - {E9F95501-14DB-4639-96CE-88AC51BFA7C5} - C:\WINDOWS\system32\rqRHyVMg.dll (file missing)
O3 - Toolbar: vrmdtneg - {B4B8E731-19DA-43DF-9E91-4B33E8478EF3} - C:\WINDOWS\vrmdtneg.dll (file missing)
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [DownloadAccelerator] "C:\Program Files\DAP\DAP.EXE" /STARTUP
O4 - HKLM\..\Run: [DelayLoad] C:\DOCUME~1\TERRANCE\LOCALS~1\Temp\atmadm.exe
O4 - HKLM\..\Run: [Antivirus] C:\Program Files\VAV\vav.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Antivirus] C:\Program Files\VAV\vav.exe
O4 - HKCU\..\Run: [WinSpywareProtect] "C:\Documents and Settings\All Users\Application Data\ADSL Software Ltd\WinSpywareProtect\winspywareprotect.exe" /autorun
O4 - Startup: Yahoo! Widgets.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O20 - Winlogon Notify: rqRHyVMg - rqRHyVMg.dll (file missing)
O20 - Winlogon Notify: tuvUKBtq - tuvUKBtq.dll (file missing)
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Microsoft Office Groove Audit Service - Unknown owner - C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

--
End of file - 7113 bytes

-- File Associations -----------------------------------------------------------

.cpl - cplfile - shell\cplopen\command - rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.cpl - cplfile - shell\runas\command - rundll32.exe shell32.dll,Control_RunDLLAsUser "%1",%*


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

S3 XDva032 - c:\windows\system32\xdva032.sys (file missing)
S3 XDva120 - c:\windows\system32\xdva120.sys (file missing)


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 AntiVirScheduler (Avira AntiVir Personal – Free Antivirus Scheduler) - "c:\program files\avira\antivir personaledition classic\sched.exe" <Not Verified; Avira GmbH; AntiVir Workstation>

S3 aspnet_state (ASP.NET State Service) - c:\windows\microsoft.net\framework\v2.0.50727\aspnet_state.exe (file missing)
S3 Microsoft Office Groove Audit Service - "c:\program files\microsoft office\office12\grooveauditservice.exe" (file missing)


-- Device Manager: Disabled ----------------------------------------------------

No disabled devices found.


-- Scheduled Tasks -------------------------------------------------------------

2008-06-20 17:41:01 330 --ah----- C:\WINDOWS\Tasks\MP Scheduled Scan.job
2008-06-20 17:40:59 418 --a----c- C:\WINDOWS\Tasks\Symantec NetDetect.job
2008-06-13 20:00:00 470 --a----c- C:\WINDOWS\Tasks\Norton AntiVirus - Scan my computer.job


-- Files created between 2008-05-20 and 2008-06-20 -----------------------------

2008-06-20 17:41:27 0 d-------- C:\Program Files\Trend Micro
2008-06-20 12:31:22 0 d-------- C:\Program Files\Avira
2008-06-20 08:06:22 0 d-------- C:\Program Files\Windows Defender
2008-06-19 22:07:06 0 d-------- C:\WINDOWS\system32\drivers\Avg
2008-06-19 22:06:44 0 d-------- C:\Program Files\AVG
2008-06-19 20:25:58 0 d-------- C:\Program Files\BurstWriting
2008-06-19 19:32:02 32772 --ahs---- C:\WINDOWS\system32\EMlmonpo.ini2
2008-06-19 19:31:38 318176 -----n--- C:\WINDOWS\system32\opnomlME.dll
2008-06-19 19:25:48 0 d-------- C:\Program Files\VAV
2008-06-19 19:25:46 0 d-------- C:\Program Files\PCHealthCenter
2008-06-19 19:25:19 0 d-------- C:\Documents and Settings\TERRANCE\Application Data\TmpRecentIcons
2008-06-19 19:24:53 163840 --a------ C:\WINDOWS\eaqb.exe
2008-06-19 19:24:45 0 d-------- C:\Documents and Settings\All Users\Application Data\ADSL Software Ltd
2008-06-19 13:58:23 0 d-------- C:\Program Files\Yahoo!
2008-06-17 20:40:25 0 d-------- C:\Program Files\Wolfenstein - Enemy Territory
2008-06-17 11:47:24 0 d-------- C:\Program Files\Common Files\INCA Shared
2008-06-13 23:24:28 0 d-------- C:\Documents and Settings\TERRANCE\Application Data\Songbird2
2008-06-13 21:12:55 0 d-------- C:\Program Files\euro gunz beta 6
2008-06-13 15:38:53 0 d-------- C:\Documents and Settings\TERRANCE\Application Data\Opera
2008-06-13 15:38:40 0 d-------- C:\Program Files\Opera
2008-06-13 13:17:11 0 d-------- C:\Program Files\Phoenix Dynasty Online
2008-06-12 21:17:38 0 d-------- C:\Documents and Settings\All Users\Application Data\Avg8
2008-06-12 21:14:16 0 d-------- C:\Program Files\DAP
2008-06-08 11:42:53 0 d-------- C:\Documents and Settings\TERRANCE\Application Data\IDM(2)
2008-05-30 22:58:43 5505024 --a------ C:\Documents and Settings\TERRANCE\ntuser.dat
2008-05-29 17:33:03 0 d-------- C:\Documents and Settings\TERRANCE\Application Data\BSD
2008-05-29 17:33:01 0 d-------- C:\Documents and Settings\All Users\Application Data\MediaWidget
2008-05-29 17:32:55 1386496 --a------ C:\WINDOWS\bsdsetup.dll <Not Verified; Bootstrap Development, LLC.; >
2008-05-21 19:48:24 0 d-------- C:\Program Files\Windows Live
2008-05-20 18:21:57 0 d-------- C:\Program Files\IObit


-- Find3M Report ---------------------------------------------------------------

2008-06-19 19:32:35 0 d-------- C:\Documents and Settings\TERRANCE\Application Data\uTorrent
2008-06-17 11:47:24 0 d-------- C:\Program Files\Common Files
2008-06-16 18:14:55 0 d-------- C:\Documents and Settings\TERRANCE\Application Data\Adobe
2008-06-13 13:17:10 0 d-------- C:\Program Files\InstallShield Installation Information
2008-06-11 19:15:11 0 d-------- C:\Documents and Settings\TERRANCE\Application Data\LimeWire
2008-06-08 19:59:03 0 d-------- C:\Documents and Settings\TERRANCE\Application Data\DMCache
2008-05-24 18:51:07 2075 --a----c- C:\WINDOWS\mozver.dat
2008-05-24 18:02:35 0 d-------- C:\Documents and Settings\TERRANCE\Application Data\FrostWire
2008-05-20 18:47:20 0 d-------- C:\Documents and Settings\TERRANCE\Application Data\Real
2008-05-16 21:16:31 0 d-------- C:\Program Files\uTorrent
2008-05-09 16:43:44 1324 --a------ C:\WINDOWS\system32\d3d9caps.dat
2008-05-09 13:52:44 0 d-------- C:\Program Files\Java
2008-05-07 22:33:46 0 d-------- C:\Program Files\Movie Maker
2008-05-07 22:30:30 0 d-------- C:\Program Files\Windows NT
2008-05-03 16:29:14 0 d------c- C:\Program Files\Common Files\WindowsLiveInstaller
2008-05-02 21:36:31 0 d-------- C:\Documents and Settings\TERRANCE\Application Data\DivX
2008-04-27 15:28:51 0 d-------- C:\Program Files\Common Files\Adobe
2008-04-26 15:00:52 0 d-------- C:\Program Files\MSBuild
2008-04-26 14:22:38 0 d-------- C:\Documents and Settings\TERRANCE\Application Data\Mozilla
2008-04-21 20:20:43 0 d--h----- C:\Documents and Settings\TERRANCE\Application Data\ijjigame
2008-04-21 20:16:54 0 d-------- C:\Program Files\Microsoft.NET
2008-04-21 20:14:23 0 d-------- C:\Documents and Settings\TERRANCE\Application Data\uTorrent(3)
2008-04-20 19:11:13 0 d-------- C:\Documents and Settings\TERRANCE\Application Data\Macromedia
2008-04-07 16:23:32 286615 --ahs--c- C:\WINDOWS\system32\TAKUxyxx.ini2
2008-04-07 06:42:14 7713 --ahs--c- C:\WINDOWS\system32\oXEgPqru.ini2
2008-04-06 19:35:27 345 --ahs--c- C:\WINDOWS\system32\XGOrAJlm.ini2
2008-03-26 17:16:49 227 --a----c- C:\WINDOWS\PowerReg.dat


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{062DF89E-6897-4AC2-A071-3C82ABF10563}]
06/19/2008 19:31: VIRUS ALERT! 318176 --------- C:\WINDOWS\system32\opnomlME.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{18CB1A7B-94CD-4582-8022-ADA16851E44B}]
C:\Program Files\BurstWriting\BurstWriting.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{20D7B970-2B28-4F39-802D-8D6837AD02EC}]
C:\WINDOWS\ksendlbtmat.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{47B753D7-567E-477B-8AB2-B29EA29757F3}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{94BC3D1D-22E9-4744-8ED1-3E08A3B74078}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E9F95501-14DB-4639-96CE-88AC51BFA7C5}]
C:\WINDOWS\system32\rqRHyVMg.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [08/24/2007 07:00: VIRUS ALERT!]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [02/22/2008 04:25: VIRUS ALERT!]
"DownloadAccelerator"="C:\Program Files\DAP\DAP.exe" [05/16/2008 21:32: VIRUS ALERT!]
"DelayLoad"="C:\DOCUME~1\TERRANCE\LOCALS~1\Temp\atmadm.exe" []
"Antivirus"="C:\Program Files\VAV\vav.exe" []
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [06/19/2008 22:06: VIRUS ALERT!]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [11/03/2006 19:20: VIRUS ALERT!]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [02/12/2008 10:06: VIRUS ALERT!]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [10/18/2007 11:34: VIRUS ALERT!]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [04/13/2008 20:12: VIRUS ALERT!]
"Antivirus"="C:\Program Files\VAV\vav.exe" []
"WinSpywareProtect"="C:\Documents and Settings\All Users\Application Data\ADSL Software Ltd\WinSpywareProtect\winspywareprotect.exe" [06/19/2008 19:24: VIRUS ALERT!]

C:\Documents and Settings\TERRANCE\Start Menu\Programs\Startup\
Yahoo! Widgets.lnk - C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe [12/11/2007 6:34:48 PM]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=1 (0x1)
"NoDispCPL"=1 (0x1)
"DisableRegistryTools"=1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"LinkResolveIgnoreLinkInfo"=0 (0x0)
"NoResolveSearch"=1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"LinkResolveIgnoreLinkInfo"=0 (0x0)
"NoToolbarCustomize"=1 (0x1)
"StartMenuLogoff"=1 (0x1)
"NoStartMenuMorePrograms"=1 (0x1)
"NoSetFolders"=1 (0x1)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{E9F95501-14DB-4639-96CE-88AC51BFA7C5}"= C:\WINDOWS\system32\rqRHyVMg.dll [ ]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
C:\WINDOWS\System32\dimsntfy.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\rqRHyVMg]
rqRHyVMg.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tuvUKBtq]
tuvUKBtq.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\opnomlME

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
eapsvcs eaphost
dot3svc dot3svc

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
napagent
hkmsvc




-- End of Deckard's System Scanner: finished at 2008-06-20 17:48:30 ------------



Extra.txt

Deckard's System Scanner v20071014.68
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------

-- System Information ----------------------------------------------------------

Microsoft Windows XP Home Edition (build 2600) SP 3.0
Architecture: X86; Language: English

CPU 0: Intel® Pentium® 4 CPU 1.60GHz
Percentage of Memory in Use: 76%
Physical Memory (total/avail): 255.01 MiB / 60.28 MiB
Pagefile Memory (total/avail): 619.85 MiB / 350.67 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1814.13 MiB

A: is Removable (No Media)
C: is Fixed (NTFS) - 19.13 GiB total, 4.13 GiB free.
D: is CDROM (No Media)

\\.\PHYSICALDRIVE0 - MAXTOR 6L020J1 - 19.14 GiB - 1 partition
\PARTITION0 (bootable) - Installable File System - 19.13 GiB - C:



-- Security Center -------------------------------------------------------------

AUOptions is disabled.


-- Environment Variables -------------------------------------------------------

ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\TERRANCE\Application Data
CLIENTNAME=Console
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=TERRANCE-170A1B
ComSpec=C:\WINDOWS\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\TERRANCE
LOGONSERVER=\\TERRANCE-170A1B
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 15 Model 1 Stepping 2, GenuineIntel
PROCESSOR_LEVEL=15
PROCESSOR_REVISION=0102
ProgramFiles=C:\Program Files
PROMPT=$P$G
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\TERRANCE\LOCALS~1\Temp
TMP=C:\DOCUME~1\TERRANCE\LOCALS~1\Temp
USERDOMAIN=TERRANCE-170A1B
USERNAME=TERRANCE
USERPROFILE=C:\Documents and Settings\TERRANCE
windir=C:\WINDOWS


-- User Profiles ---------------------------------------------------------------

TERRANCE (admin)


-- Add/Remove Programs ---------------------------------------------------------

--> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
µTorrent --> "C:\Program Files\uTorrent\uTorrent.exe" /UNINSTALL
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-0015-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-0019-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-001A-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {3EC77D26-799B-4CD8-914F-C1565E796173}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {430971B1-C31E-45DA-81E0-72C095BAB72C}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {F7A31780-33C4-4E39-951A-5EC9B91D7BF1}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {BEE75E01-DD3F-4D5F-B96C-609E6538D419}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-0044-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {FAD8A83E-9BAC-4179-9268-A35948034D85}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-00A1-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-00BA-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-0114-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-0115-0409-0000-0000000FF1CE} /uninstall {FAD8A83E-9BAC-4179-9268-A35948034D85}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-0117-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
Adobe Flash Player ActiveX --> C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Advanced WindowsCare Personal --> "C:\Program Files\IObit\Advanced WindowsCare V2\unins000.exe"
ATI Display Driver --> rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
AVG Free 8.0 --> C:\Program Files\AVG\AVG8\setup.exe /UNINSTALL
Avira AntiVir Personal – Free Antivirus --> C:\Program Files\Avira\AntiVir PersonalEdition Classic\SETUP.EXE /REMOVE
BurstWriting --> "C:\Program Files\BurstWriting\Uninstall.exe"
Corona Visualization Plug-in for WMP --> MsiExec.exe /I{6C3CE73B-E7B8-4979-8740-1476C5CBDEBA}
Download Accelerator Plus (DAP) --> C:\PROGRA~1\DAP\DAPREMOVE.EXE
Hotfix for Windows Media Format 11 SDK (KB929399) --> "C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
ijji --> C:\ijji\ENGLISH\ijjiUninstall.exe
ijji - Gunz --> C:\ijji\ENGLISH\Gunz\Uninstall.exe
ijji Auto Installer --> "C:\Program Files\InstallShield Installation Information\{1DCC7418-2089-4BDD-B321-3771956160FC}\setup.exe" -runfromtemp -l0x0009 -removeonly
ijji FireFox Launcher 1.0 --> C:\Documents and Settings\All Users\Application Data\IJJIGame\uninst.exe
Java™ 6 Update 3 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030}
Java™ 6 Update 5 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}
Lexmark Z600 Series --> C:\WINDOWS\system32\spool\drivers\w32x86\3\LXBCUN5C.EXE -dLexmark Z600 Series
Microsoft Base Smart Card Cryptographic Service Provider Package --> "C:\WINDOWS\$NtUninstallbasecsp$\spuninst\spuninst.exe"
Microsoft Compression Client Pack 1.0 for Windows XP --> "C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Office Access MUI (English) 2007 --> MsiExec.exe /X{90120000-0015-0409-0000-0000000FF1CE}
Microsoft Office Access Setup Metadata MUI (English) 2007 --> MsiExec.exe /X{90120000-0117-0409-0000-0000000FF1CE}
Microsoft Office Enterprise 2007 --> MsiExec.exe /X{90120000-0030-0000-0000-0000000FF1CE}
Microsoft Office Excel MUI (English) 2007 --> MsiExec.exe /X{90120000-0016-0409-0000-0000000FF1CE}
Microsoft Office Groove MUI (English) 2007 --> MsiExec.exe /X{90120000-00BA-0409-0000-0000000FF1CE}
Microsoft Office Groove Setup Metadata MUI (English) 2007 --> MsiExec.exe /X{90120000-0114-0409-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (English) 2007 --> MsiExec.exe /X{90120000-0044-0409-0000-0000000FF1CE}
Microsoft Office OneNote MUI (English) 2007 --> MsiExec.exe /X{90120000-00A1-0409-0000-0000000FF1CE}
Microsoft Office Outlook MUI (English) 2007 --> MsiExec.exe /X{90120000-001A-0409-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (English) 2007 --> MsiExec.exe /X{90120000-0018-0409-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007 --> MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007 --> MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007 --> MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (English) 2007 --> MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE}
Microsoft Office Publisher MUI (English) 2007 --> MsiExec.exe /X{90120000-0019-0409-0000-0000000FF1CE}
Microsoft Office Shared MUI (English) 2007 --> MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE}
Microsoft Office Shared Setup Metadata MUI (English) 2007 --> MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE}
Microsoft Office Word MUI (English) 2007 --> MsiExec.exe /X{90120000-001B-0409-0000-0000000FF1CE}
Microsoft Silverlight --> MsiExec.exe /I{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft User-Mode Driver Framework Feature Pack 1.0 --> "C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 Redistributable --> MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
MSXML 6.0 Parser (KB933579) --> MsiExec.exe /I{0A869A65-8C94-4F7C-A5C7-972D3C8CED9E}
Opera 9.50 --> MsiExec.exe /X{7472B5B4-3FB7-446F-BC78-6BBA506EC473}
Security Update for Excel 2007 (KB946974) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {85E83E2E-AF9B-439B-B4F9-EB9B7EF6A00E}
Security Update for Office 2007 (KB947801) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {02B5A17B-01BE-4BA6-95F1-1CBB46EBC76E}
Security Update for Outlook 2007 (KB946983) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {66B9496E-C0C3-4065-9868-85CCA92126C3}
Security Update for Visio 2007 (KB947590) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {6BAD036C-261F-4BEF-96CF-C20678D07A41}
TC:Elite Test --> C:\PROGRA~1\Wolfenstein - Enemy Territory\tcetest\uninst.exe
Uninstall Phoenix Dynasty Online --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{15DF6FD4-7653-4BBA-B4E7-87C5B1273FED}\Setup.exe" -uninst
Update for Office 2007 (KB946691) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {A420F522-7395-4872-9882-C591B4B92278}
Update for Outlook 2007 Junk Email Filter (kb949037) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {B4F188C6-6DBF-42A5-A8A3-3086D1A384F2}
Windows Defender --> MsiExec.exe /I{A06275F4-324B-4E85-95E6-87B2CD729401}
Windows Imaging Component --> "C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
Windows Live Messenger --> MsiExec.exe /X{508CE775-4BA4-4748-82DF-FE28DA9F03B0}
Windows Media Format 11 runtime --> "C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Format SDK Hotfix - KB891122 --> "C:\WINDOWS\$NtUninstallKB891122$\spuninst\spuninst.exe"
Windows Presentation Foundation --> MsiExec.exe /X{BAF78226-3200-4DB4-BE33-4D922A799840}
Windows XP Service Pack 3 --> "C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
Wolfenstein - Enemy Territory --> C:\PROGRA~1\Wolfenstein - Enemy Territory\Uninstall\Unwise.exe /u C:\PROGRA~1\Wolfenstein - Enemy Territory\Uninstall\Install.log
XML Paper Specification Shared Components Pack 1.0 -->
Yahoo! Install Manager --> C:\WINDOWS\system32\regsvr32 /u C:\PROGRA~1\Yahoo!\Common\Yinsthelper.dll
Yahoo! Widgets --> C:\PROGRA~1\Yahoo!\Widgets\uninstall.exe


-- Application Event Log -------------------------------------------------------

Event Record #/Type5051 / Error
Event Submitted/Written: 06/20/2008 05:23:27 PM
Event ID/Source: 4609 / EventSystem
Event Description:
The COM+ Event System detected a bad return code during its internal processing. HRESULT was 8007043C from line 44 of f:\xpsp3\com\com1x\src\events\tier1\eventsystemobj.cpp. Please contact Microsoft Product Support Services to report this error.

Event Record #/Type5027 / Warning
Event Submitted/Written: 06/20/2008 03:54:25 PM
Event ID/Source: 1524 / Userenv
Event Description:
Windows cannot unload your classes registry file - it is still in use by other applications or services. The file will be unloaded when it is no longer in use.

Event Record #/Type4953 / Warning
Event Submitted/Written: 06/20/2008 02:39:05 PM
Event ID/Source: 1524 / Userenv
Event Description:
Windows cannot unload your classes registry file - it is still in use by other applications or services. The file will be unloaded when it is no longer in use.

Event Record #/Type4946 / Success
Event Submitted/Written: 06/20/2008 01:49:20 PM
Event ID/Source: 12001 / usnjsvc
Event Description:
The Messenger Sharing USN Journal Reader service started successfully.

Event Record #/Type4938 / Warning
Event Submitted/Written: 06/20/2008 00:56:30 PM
Event ID/Source: 1524 / Userenv
Event Description:
Windows cannot unload your classes registry file - it is still in use by other applications or services. The file will be unloaded when it is no longer in use.



-- Security Event Log ----------------------------------------------------------

No Errors/Warnings found.


-- System Event Log ------------------------------------------------------------

Event Record #/Type35746 / Error
Event Submitted/Written: 06/20/2008 05:34:33 PM
Event ID/Source: 10005 / DCOM
Event Description:
DCOM got error "%%1084" attempting to start the service EventSystem with arguments ""
in order to run the server:
{1BE1F766-5536-11D1-B726-00C04FB926AF}

Event Record #/Type35745 / Error
Event Submitted/Written: 06/20/2008 05:24:14 PM
Event ID/Source: 10005 / DCOM
Event Description:
DCOM got error "%%1084" attempting to start the service usnjsvc with arguments ""
in order to run the server:
{98AC5C33-EE18-4EC2-BE25-3B16EE8F75F1}

Event Record #/Type35744 / Error
Event Submitted/Written: 06/20/2008 05:24:04 PM
Event ID/Source: 10005 / DCOM
Event Description:
DCOM got error "%%1084" attempting to start the service usnjsvc with arguments ""
in order to run the server:
{98AC5C33-EE18-4EC2-BE25-3B16EE8F75F1}

Event Record #/Type35743 / Error
Event Submitted/Written: 06/20/2008 05:23:53 PM
Event ID/Source: 10005 / DCOM
Event Description:
DCOM got error "%%1084" attempting to start the service usnjsvc with arguments ""
in order to run the server:
{98AC5C33-EE18-4EC2-BE25-3B16EE8F75F1}

Event Record #/Type35742 / Error
Event Submitted/Written: 06/20/2008 05:23:41 PM
Event ID/Source: 10005 / DCOM
Event Description:
DCOM got error "%%1084" attempting to start the service usnjsvc with arguments ""
in order to run the server:
{98AC5C33-EE18-4EC2-BE25-3B16EE8F75F1}



-- End of Deckard's System Scanner: finished at 2008-06-20 17:48:30 ------------

#4 Buckeye_Sam

Buckeye_Sam

    Malware Expert


  • Members
  • 17,382 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Pickerington, Ohio
  • Local time:04:05 AM

Posted 21 June 2008 - 12:08 PM

Run Hijackthis again, click scan, and Put a checkmark next to each of the lines listed below. Then close all other windows--you should only see HijackThis on your Desktop--and click the Fix Checked button.

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=...6Ojg5&lid=2
O2 - BHO: (no name) - {062DF89E-6897-4AC2-A071-3C82ABF10563} - C:\WINDOWS\system32\opnomlME.dll
O2 - BHO: BurstWriting module - {18CB1A7B-94CD-4582-8022-ADA16851E44B} - C:\Program Files\BurstWriting\BurstWriting.dll (file missing)
O2 - BHO: QXK Olive - {20D7B970-2B28-4F39-802D-8D6837AD02EC} - C:\WINDOWS\ksendlbtmat.dll (file missing)
O2 - BHO: (no name) - {47B753D7-567E-477B-8AB2-B29EA29757F3} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {94BC3D1D-22E9-4744-8ED1-3E08A3B74078} - (no file)
O2 - BHO: (no name) - {E9F95501-14DB-4639-96CE-88AC51BFA7C5} - C:\WINDOWS\system32\rqRHyVMg.dll (file missing)
O3 - Toolbar: vrmdtneg - {B4B8E731-19DA-43DF-9E91-4B33E8478EF3} - C:\WINDOWS\vrmdtneg.dll (file missing)
O4 - HKLM\..\Run: [DelayLoad] C:\DOCUME~1\TERRANCE\LOCALS~1\Temp\atmadm.exe
O4 - HKLM\..\Run: [Antivirus] C:\Program Files\VAV\vav.exe
O4 - HKCU\..\Run: [Antivirus] C:\Program Files\VAV\vav.exe
O4 - HKCU\..\Run: [WinSpywareProtect] "C:\Documents and Settings\All Users\Application Data\ADSL Software Ltd\WinSpywareProtect\winspywareprotect.exe" /autorun
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O20 - Winlogon Notify: rqRHyVMg - rqRHyVMg.dll (file missing)
O20 - Winlogon Notify: tuvUKBtq - tuvUKBtq.dll (file missing)



===============


You are running an older version of Java. This can be a security risk so let's get you the latest version.
Upgrading Java:
  • Download the latest version of Java Runtime Environment (JRE) 6 Update 6.
  • Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications".
  • Click the "Download" button to the right.
  • Select your Platform and check the box that says: "I agree to the Java SE Runtime Environment 6 License Agreement.".
  • Click on Continue.
  • Click on the link to download Windows Offline Installation (jre-6u6-windows-i586-p.exe) and save it to your desktop. Do NOT use the Sun Download Manager..
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel, double-click on Add/Remove programs and remove all older versions of Java.
  • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java version.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on the download to install the newest version.

===============


Please download ComboFix and save it to your desktop.
Prior to running Combofix.exe you should disable your antivirus program and disconnect from the internet.

Double click combofix.exe and follow the prompts.
When it's done running it will produce a log for you. Please post that log in your next reply.

Important Note - Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
Posted Image If I have helped you in any way, please consider a donation to help me continue the fight against malware.


Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it!


========================================================

#5 PlatinumX

PlatinumX
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:04:05 AM

Posted 21 June 2008 - 12:21 PM

Sam i didnt see any of those files u specified

#6 Buckeye_Sam

Buckeye_Sam

    Malware Expert


  • Members
  • 17,382 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Pickerington, Ohio
  • Local time:04:05 AM

Posted 21 June 2008 - 12:25 PM

:thumbsup:
Which files are you talking about?
Posted Image If I have helped you in any way, please consider a donation to help me continue the fight against malware.


Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it!


========================================================

#7 PlatinumX

PlatinumX
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:04:05 AM

Posted 21 June 2008 - 12:26 PM

when u told me to run a hijack scan and put a check next to those files i didnt see any of them

#8 Buckeye_Sam

Buckeye_Sam

    Malware Expert


  • Members
  • 17,382 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Pickerington, Ohio
  • Local time:04:05 AM

Posted 21 June 2008 - 12:28 PM

Those aren't files, those are lines that should show up in your hijackthis log. They were present in your first log that you posted yesterday, so it's odd that they wouldn't be there. Nevertheless, if they aren't there, then proceed with the next steps.
Posted Image If I have helped you in any way, please consider a donation to help me continue the fight against malware.


Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it!


========================================================

#9 PlatinumX

PlatinumX
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:04:05 AM

Posted 21 June 2008 - 12:57 PM

My computer is running alot better now the virus alert is gone but my task bar still disappears
i can now access task manager and all folders the only problem is my task bar keep disappearing
thx again for your help

ComboFix 08-06-20.4 - TERRANCE 2008-06-21 13:34:27.1 - NTFSx86 MINIMAL
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.121 [GMT -4:00]
Running from: C:\Documents and Settings\TERRANCE\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\TERRANCE\Favorites\Error Cleaner.url
C:\Documents and Settings\TERRANCE\Favorites\Privacy Protector.url
C:\Documents and Settings\TERRANCE\Favorites\Spyware&Malware Protection.url
C:\Documents and Settings\TERRANCE\Local Settings\Temporary Internet Files\ijjistarter_verinfo.dat
C:\Documents and Settings\TERRANCE\Local Settings\Temporary Internet Files\ijjistarter2.exe
C:\Program Files\BurstWriting
C:\Program Files\BurstWriting\uninstall.dat
C:\Program Files\BurstWriting\Uninstall.exe
C:\WINDOWS\Downloaded Program Files\setup.inf
C:\WINDOWS\eaqb.exe
C:\WINDOWS\system32\EMlmonpo.ini
C:\WINDOWS\system32\EMlmonpo.ini2
C:\WINDOWS\system32\oXEgPqru.ini2
C:\WINDOWS\system32\TAKUxyxx.ini
C:\WINDOWS\system32\TAKUxyxx.ini2
C:\WINDOWS\system32\XGOrAJlm.ini2

.
((((((((((((((((((((((((( Files Created from 2008-05-21 to 2008-06-21 )))))))))))))))))))))))))))))))
.

2008-06-20 22:45 . 2008-06-20 22:45 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-06-20 17:41 . 2008-06-20 17:41 <DIR> d-------- C:\Program Files\Trend Micro
2008-06-20 15:48 . 2008-06-20 15:48 <DIR> d-------- C:\Deckard
2008-06-20 12:31 . 2008-06-20 21:17 <DIR> d-------- C:\Program Files\Avira
2008-06-20 08:06 . 2008-06-20 21:17 <DIR> d-------- C:\Program Files\Windows Defender
2008-06-19 22:07 . 2008-06-21 11:45 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg
2008-06-19 22:07 . 2008-06-19 22:07 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys
2008-06-19 22:07 . 2008-06-19 22:07 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll
2008-06-19 22:06 . 2008-06-19 22:06 <DIR> d-------- C:\Program Files\AVG
2008-06-19 19:31 . 2008-06-19 19:31 318,176 --------- C:\WINDOWS\system32\opnomlME.dll
2008-06-19 19:29 . 2008-06-16 17:18 3,262 --a------ C:\WINDOWS\system32\sex2.ico
2008-06-19 19:25 . 2008-06-20 21:17 <DIR> d-------- C:\Program Files\VAV
2008-06-19 19:25 . 2008-06-19 23:30 <DIR> d-------- C:\Program Files\PCHealthCenter
2008-06-19 19:25 . 2008-06-16 17:18 3,262 --a------ C:\WINDOWS\system32\sex1.ico
2008-06-19 19:24 . 2008-06-19 19:24 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ADSL Software Ltd
2008-06-19 13:58 . 2008-06-19 13:58 <DIR> d-------- C:\Program Files\Yahoo!
2008-06-17 20:40 . 2008-06-17 20:48 <DIR> d-------- C:\Program Files\Wolfenstein - Enemy Territory
2008-06-17 11:47 . 2008-06-17 11:47 <DIR> d-------- C:\Program Files\Common Files\INCA Shared
2008-06-13 23:24 . 2008-06-13 23:24 <DIR> d-------- C:\Documents and Settings\TERRANCE\Application Data\Songbird2
2008-06-13 21:12 . 2008-06-19 23:27 <DIR> d-------- C:\Program Files\euro gunz beta 6
2008-06-13 15:38 . 2008-06-20 21:17 <DIR> d-------- C:\Program Files\Opera
2008-06-13 13:17 . 2008-06-19 11:20 <DIR> d-------- C:\Program Files\Phoenix Dynasty Online
2008-06-12 21:17 . 2008-06-19 22:06 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avg8
2008-06-12 21:14 . 2008-06-13 12:39 <DIR> d-------- C:\Program Files\DAP
2008-06-08 11:42 . 2008-06-12 21:14 <DIR> d-------- C:\Documents and Settings\TERRANCE\Application Data\IDM(2)
2008-05-29 18:24 . 2008-05-30 16:33 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-05-29 18:24 . 2008-05-29 18:24 1,409 --a------ C:\WINDOWS\QTFont.for
2008-05-29 17:33 . 2008-05-29 17:33 <DIR> d-------- C:\Documents and Settings\TERRANCE\Application Data\BSD
2008-05-29 17:33 . 2008-05-29 17:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\MediaWidget
2008-05-29 17:32 . 2008-03-17 19:05 1,386,496 --a------ C:\WINDOWS\bsdsetup.dll
2008-05-21 19:48 . 2008-06-16 18:16 <DIR> d-------- C:\Program Files\Windows Live

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-21 17:46 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-06-21 01:17 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avira
2008-06-19 23:32 --------- d-----w C:\Documents and Settings\TERRANCE\Application Data\uTorrent
2008-06-19 02:19 23,352 -c--a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-06-19 02:19 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-06-18 15:08 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-06-13 17:17 --------- d-----w C:\Program Files\InstallShield Installation Information
2008-06-12 19:08 58,800 ----a-w C:\WINDOWS\system32\ijjiPlugin2.dll
2008-06-11 23:15 --------- d-----w C:\Documents and Settings\TERRANCE\Application Data\LimeWire
2008-06-08 23:59 --------- d-----w C:\Documents and Settings\TERRANCE\Application Data\DMCache
2008-05-30 21:42 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-05-24 22:02 --------- d-----w C:\Documents and Settings\TERRANCE\Application Data\FrostWire
2008-05-21 23:47 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-05-20 22:21 --------- d-----w C:\Program Files\IObit
2008-05-18 02:01 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
2008-05-18 02:01 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
2008-05-17 01:16 --------- d-----w C:\Program Files\uTorrent
2008-05-09 17:52 --------- d-----w C:\Program Files\Java
2008-05-03 20:29 --------- dc----w C:\Program Files\Common Files\WindowsLiveInstaller
2008-05-03 01:36 --------- d-----w C:\Documents and Settings\TERRANCE\Application Data\DivX
2008-04-27 19:28 --------- d-----w C:\Program Files\Common Files\Adobe
2008-04-26 19:00 --------- d-----w C:\Program Files\MSBuild
2008-04-22 00:20 --------- d--h--w C:\Documents and Settings\TERRANCE\Application Data\ijjigame
2008-04-22 00:16 --------- d-----w C:\Program Files\Microsoft.NET
2008-04-22 00:14 --------- d-----w C:\Documents and Settings\TERRANCE\Application Data\uTorrent(3)
2008-04-22 00:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft(2)
2008-04-22 00:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avg7(2)
2008-04-14 09:42 985,088 ----a-w C:\WINDOWS\system32\setupapi.dll
2008-04-14 09:42 11,264 ----a-w C:\WINDOWS\system32\spnpinst.exe
2008-04-14 09:41 423,936 ----a-w C:\WINDOWS\system32\licdll.dll
2008-04-14 00:25 1,804 -c--a-w C:\WINDOWS\system32\dcache.bin
2008-04-14 00:16 329,728 -c--a-w C:\WINDOWS\system32\netsetup.exe
2008-04-14 00:13 92,424 -c--a-w C:\WINDOWS\system32\rdpdd.dll
2008-04-14 00:13 87,176 -c--a-w C:\WINDOWS\system32\rdpwsx.dll
2008-04-14 00:13 12,168 -c--a-w C:\WINDOWS\system32\tsddd.dll
2008-04-14 00:11 997,376 ----a-w C:\WINDOWS\system32\msgina.dll
2008-04-14 00:10 53,279 -c--a-w C:\WINDOWS\system32\odbcji32.dll
2008-04-14 00:10 4,126 -c--a-w C:\WINDOWS\system32\msdxmlc.dll
2008-04-14 00:10 3,584 -c--a-w C:\WINDOWS\system32\msafd.dll
2008-04-13 21:00 103,424 -c--a-w C:\WINDOWS\system32\dpcdll.dll
2008-04-13 19:30 1,845,632 ----a-w C:\WINDOWS\system32\win32k.sys
2008-04-13 19:27 2,188,928 -c--a-w C:\WINDOWS\system32\ntoskrnl.exe
2008-04-13 18:44 17,664 -c--a-w C:\WINDOWS\system32\watchdog.sys
2008-04-13 18:35 24,064 -c--a-w C:\WINDOWS\system32\pidgen.dll
2008-04-13 18:31 7,424 -c--a-w C:\WINDOWS\system32\kd1394.dll
2008-04-13 18:31 2,065,792 -c--a-w C:\WINDOWS\system32\ntkrnlpa.exe
2008-04-13 18:30 61,440 -c--a-w C:\WINDOWS\system32\msvcrt40.dll
2008-04-13 18:14 76,800 -c----w C:\WINDOWS\system32\msshavmsg.dll
2008-04-13 17:39 438,784 -c--a-w C:\WINDOWS\system32\xpob2res.dll
2008-04-13 17:39 2,897,920 ----a-w C:\WINDOWS\system32\xpsp2res.dll
2008-04-13 17:39 187,392 -c--a-w C:\WINDOWS\system32\xpsp1res.dll
2008-04-13 17:37 208,384 ----a-w C:\WINDOWS\system32\rsaenh.dll
2008-04-13 17:37 138,752 ----a-w C:\WINDOWS\system32\dssenh.dll
2008-04-13 17:27 79,872 -c--a-w C:\WINDOWS\system32\msxml6r.dll
2008-04-13 17:26 94,208 ----a-w C:\WINDOWS\system32\odbcint.dll
2008-04-13 17:26 12,288 -c--a-w C:\WINDOWS\system32\odbcp32r.dll
2008-04-13 17:26 12,288 -c--a-w C:\WINDOWS\system32\mscpx32r.dll
2008-04-13 17:24 20,480 -c--a-w C:\WINDOWS\system32\msorc32r.dll
2008-04-13 17:21 733,696 -c--a-w C:\WINDOWS\system32\qedwipes.dll
2008-04-13 17:09 4,096 -c--a-w C:\WINDOWS\system32\dsprpres.dll
2008-04-13 17:03 63,488 ----a-w C:\WINDOWS\system32\browselc.dll
2008-04-13 17:03 549,376 ----a-w C:\WINDOWS\system32\shdoclc.dll
2008-04-13 16:48 1,647,616 -c--a-w C:\WINDOWS\system32\winbrand.dll
2008-04-13 16:45 216,064 -c--a-w C:\WINDOWS\system32\moricons.dll
2008-04-13 16:23 48,128 ----a-w C:\WINDOWS\system32\msprivs.dll
2008-04-13 16:22 48,128 -c--a-w C:\WINDOWS\system32\inetres.dll
2008-04-13 15:39 884,736 -c--a-w C:\WINDOWS\system32\msimsg.dll
2008-03-31 21:25 161,096 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-03-21 20:30 129,784 -c----w C:\WINDOWS\system32\pxafs.dll
2008-05-17 01:32 251,392 ----a-w C:\Program Files\opera\program\plugins\dapop.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{20D7B970-2B28-4F39-802D-8D6837AD02EC}]
C:\WINDOWS\ksendlbtmat.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{47B753D7-567E-477B-8AB2-B29EA29757F3}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{718549C4-2A03-462E-886E-4935B0F15949}]
2008-06-19 19:31 318176 --------- C:\WINDOWS\system32\opnomlME.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E9F95501-14DB-4639-96CE-88AC51BFA7C5}]
C:\WINDOWS\system32\rqRHyVMg.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{B4B8E731-19DA-43DF-9E91-4B33E8478EF3}"= "C:\WINDOWS\vrmdtneg.dll" [ ]

[HKEY_CLASSES_ROOT\clsid\{b4b8e731-19da-43df-9e91-4b33e8478ef3}]
[HKEY_CLASSES_ROOT\vrmdtneg.1]
[HKEY_CLASSES_ROOT\TypeLib\{1A009ABF-9098-4692-9ACE-81760596FFC2}]
[HKEY_CLASSES_ROOT\vrmdtneg]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 20:12 15360]
"WinSpywareProtect"="C:\Documents and Settings\All Users\Application Data\ADSL Software Ltd\WinSpywareProtect\winspywareprotect.exe" [2008-06-19 19:24 1159680]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 07:00 33648]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"DownloadAccelerator"="C:\Program Files\DAP\DAP.EXE" [2008-05-16 21:32 3053056]
"Antivirus"="C:\Program Files\VAV\vav.exe" [ ]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-06-19 22:06 1177368]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-12 10:06 262401]

C:\Documents and Settings\TERRANCE\Start Menu\Programs\Startup\
Yahoo! Widgets.lnk - C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe [2007-12-11 18:34:48 3746856]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveSearch"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{E9F95501-14DB-4639-96CE-88AC51BFA7C5}"= C:\WINDOWS\system32\rqRHyVMg.dll [ ]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="C:\\WINDOWS\\system32\\logonui.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\rqRHyVMg]
rqRHyVMg.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tuvUKBtq]
tuvUKBtq.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"19938:TCP"= 19938:TCP:BitCometLite 19938 TCP
"19938:UDP"= 19938:UDP:BitCometLite 19938 UDP
"37204:TCP"= 37204:TCP:*:Disabled:SolidNetworkManager
"37204:UDP"= 37204:UDP:*:Disabled:SolidNetworkManager

R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-06-19 22:07]
R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-06-19 22:06]
R3 ati2mtaa;ati2mtaa;C:\WINDOWS\system32\DRIVERS\ati2mtaa.sys [2001-08-31 00:40]
S3 XDva032;XDva032;C:\WINDOWS\system32\XDva032.sys []
S3 XDva120;XDva120;C:\WINDOWS\system32\XDva120.sys []

.
Contents of the 'Scheduled Tasks' folder
"2008-06-21 17:44:22 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
"2008-06-14 00:00:00 C:\WINDOWS\Tasks\Norton AntiVirus - Scan my computer.job"
- C:\PROGRA~1\NORTON~1\NAVW32.exeG/task:C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec\NORTON~1\Tasks\mycomp.sca
"2008-06-21 17:50:03 C:\WINDOWS\Tasks\Symantec NetDetect.job"
- C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-21 13:45:42
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2008-06-21 13:52:42 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-21 17:52:19

Pre-Run: 4,254,932,992 bytes free
Post-Run: 4,562,022,400 bytes free

230 --- E O F --- 2008-05-08 03:01:05

Edited by PlatinumX, 21 June 2008 - 02:15 PM.


#10 Buckeye_Sam

Buckeye_Sam

    Malware Expert


  • Members
  • 17,382 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Pickerington, Ohio
  • Local time:04:05 AM

Posted 21 June 2008 - 02:51 PM

Still a few issues that we need to resolve.

First, you are running two antivirus programs. This can cause conflicts and system instability. You should uninstall either Avira or AVG so that you are only running one of them.


You are running an older version of Java. This can be a security risk so let's get you the latest version.
Upgrading Java:
  • Download the latest version of Java Runtime Environment (JRE) 6 Update 6.
  • Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications".
  • Click the "Download" button to the right.
  • Select your Platform and check the box that says: "I agree to the Java SE Runtime Environment 6 License Agreement.".
  • Click on Continue.
  • Click on the link to download Windows Offline Installation (jre-6u6-windows-i586-p.exe) and save it to your desktop. Do NOT use the Sun Download Manager..
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel, double-click on Add/Remove programs and remove all older versions of Java.
  • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java version.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on the download to install the newest version.

==================


Copy and paste ALL the following text in the Quote box below into Notepad.
Click on File(in the menu at the top)>Save as../Save as Type: 'All Files' /File name: CFScript to your desktop.

Folder::
C:\Program Files\VAV
C:\Documents and Settings\All Users\Application Data\ADSL Software Ltd

File::
C:\WINDOWS\Tasks\Norton AntiVirus - Scan my computer.job
C:\WINDOWS\Tasks\Symantec NetDetect.job


Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\rqRHyVMg]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tuvUKBtq]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{E9F95501-14DB-4639-96CE-88AC51BFA7C5}"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Antivirus"=-
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinSpywareProtect"=-
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{20D7B970-2B28-4F39-802D-8D6837AD02EC}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{47B753D7-567E-477B-8AB2-B29EA29757F3}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{718549C4-2A03-462E-886E-4935B0F15949}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E9F95501-14DB-4639-96CE-88AC51BFA7C5}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{B4B8E731-19DA-43DF-9E91-4B33E8478EF3}"=-
[-HKEY_CLASSES_ROOT\clsid\{b4b8e731-19da-43df-9e91-4b33e8478ef3}]
[-HKEY_CLASSES_ROOT\vrmdtneg.1]
[-HKEY_CLASSES_ROOT\TypeLib\{1A009ABF-9098-4692-9ACE-81760596FFC2}]
[-HKEY_CLASSES_ROOT\vrmdtneg]
Prior to running Combofix.exe you should disable your antivirus program and disconnect from the internet.

Now drag then drop the CFScript file onto ComboFix.exe as seen in the image below.

Posted Image

This will start ComboFix again.
After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.
Posted Image If I have helped you in any way, please consider a donation to help me continue the fight against malware.


Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it!


========================================================

#11 PlatinumX

PlatinumX
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:04:05 AM

Posted 21 June 2008 - 03:18 PM

Thanks again for all your help

here is the log u requestes

ComboFix 08-06-20.4 - TERRANCE 2008-06-21 16:01:50.2 - NTFSx86 NETWORK
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.112 [GMT -4:00]
Running from: C:\Documents and Settings\TERRANCE\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\TERRANCE\Desktop\CFScript.txt

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\WINDOWS\Tasks\Norton AntiVirus - Scan my computer.job
C:\WINDOWS\Tasks\Symantec NetDetect.job
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\ADSL Software Ltd
C:\Documents and Settings\All Users\Application Data\ADSL Software Ltd\WinSpywareProtect\LOG\20080619202547781.log
C:\Documents and Settings\All Users\Application Data\ADSL Software Ltd\WinSpywareProtect\LOG\20080619204550046.log
C:\Documents and Settings\All Users\Application Data\ADSL Software Ltd\WinSpywareProtect\LOG\20080619204844265.log
C:\Documents and Settings\All Users\Application Data\ADSL Software Ltd\WinSpywareProtect\LOG\20080619205255781.log
C:\Documents and Settings\All Users\Application Data\ADSL Software Ltd\WinSpywareProtect\LOG\20080619215447843.log
C:\Documents and Settings\All Users\Application Data\ADSL Software Ltd\WinSpywareProtect\LOG\20080619215739125.log
C:\Documents and Settings\All Users\Application Data\ADSL Software Ltd\WinSpywareProtect\LOG\20080621114836343.log
C:\Documents and Settings\All Users\Application Data\ADSL Software Ltd\WinSpywareProtect\LOG\20080621134730375.log
C:\Documents and Settings\All Users\Application Data\ADSL Software Ltd\WinSpywareProtect\winspywareprotect.exe
C:\Program Files\VAV
C:\Program Files\VAV\vav0.dat
C:\Program Files\VAV\vav1.dat
C:\WINDOWS\system32\EMlmonpo.ini
C:\WINDOWS\system32\EMlmonpo.ini2
C:\WINDOWS\Tasks\Norton AntiVirus - Scan my computer.job
C:\WINDOWS\Tasks\Symantec NetDetect.job

.
((((((((((((((((((((((((( Files Created from 2008-05-21 to 2008-06-21 )))))))))))))))))))))))))))))))
.

2008-06-20 22:45 . 2008-06-20 22:45 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-06-20 17:41 . 2008-06-20 17:41 <DIR> d-------- C:\Program Files\Trend Micro
2008-06-20 15:48 . 2008-06-20 15:48 <DIR> d-------- C:\Deckard
2008-06-20 08:06 . 2008-06-20 21:17 <DIR> d-------- C:\Program Files\Windows Defender
2008-06-19 22:07 . 2008-06-21 11:45 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg
2008-06-19 22:07 . 2008-06-19 22:07 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys
2008-06-19 22:07 . 2008-06-19 22:07 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll
2008-06-19 22:06 . 2008-06-19 22:06 <DIR> d-------- C:\Program Files\AVG
2008-06-19 19:31 . 2008-06-19 19:31 318,176 --------- C:\WINDOWS\system32\opnomlME.dll
2008-06-19 19:29 . 2008-06-16 17:18 3,262 --a------ C:\WINDOWS\system32\sex2.ico
2008-06-19 19:25 . 2008-06-19 23:30 <DIR> d-------- C:\Program Files\PCHealthCenter
2008-06-19 19:25 . 2008-06-16 17:18 3,262 --a------ C:\WINDOWS\system32\sex1.ico
2008-06-19 13:58 . 2008-06-19 13:58 <DIR> d-------- C:\Program Files\Yahoo!
2008-06-17 20:40 . 2008-06-17 20:48 <DIR> d-------- C:\Program Files\Wolfenstein - Enemy Territory
2008-06-17 11:47 . 2008-06-17 11:47 <DIR> d-------- C:\Program Files\Common Files\INCA Shared
2008-06-13 23:24 . 2008-06-13 23:24 <DIR> d-------- C:\Documents and Settings\TERRANCE\Application Data\Songbird2
2008-06-13 21:12 . 2008-06-19 23:27 <DIR> d-------- C:\Program Files\euro gunz beta 6
2008-06-13 15:38 . 2008-06-20 21:17 <DIR> d-------- C:\Program Files\Opera
2008-06-13 13:17 . 2008-06-19 11:20 <DIR> d-------- C:\Program Files\Phoenix Dynasty Online
2008-06-12 21:17 . 2008-06-19 22:06 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avg8
2008-06-12 21:14 . 2008-06-13 12:39 <DIR> d-------- C:\Program Files\DAP
2008-06-08 11:42 . 2008-06-12 21:14 <DIR> d-------- C:\Documents and Settings\TERRANCE\Application Data\IDM(2)
2008-05-29 18:24 . 2008-05-30 16:33 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-05-29 18:24 . 2008-05-29 18:24 1,409 --a------ C:\WINDOWS\QTFont.for
2008-05-29 17:33 . 2008-05-29 17:33 <DIR> d-------- C:\Documents and Settings\TERRANCE\Application Data\BSD
2008-05-29 17:33 . 2008-05-29 17:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\MediaWidget
2008-05-29 17:32 . 2008-03-17 19:05 1,386,496 --a------ C:\WINDOWS\bsdsetup.dll
2008-05-21 19:48 . 2008-06-16 18:16 <DIR> d-------- C:\Program Files\Windows Live

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-21 20:10 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-06-21 19:22 --------- d-----w C:\Program Files\Java
2008-06-21 18:25 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avira
2008-06-19 23:32 --------- d-----w C:\Documents and Settings\TERRANCE\Application Data\uTorrent
2008-06-19 02:19 23,352 -c--a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-06-18 15:08 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-06-13 17:17 --------- d-----w C:\Program Files\InstallShield Installation Information
2008-06-11 23:15 --------- d-----w C:\Documents and Settings\TERRANCE\Application Data\LimeWire
2008-06-08 23:59 --------- d-----w C:\Documents and Settings\TERRANCE\Application Data\DMCache
2008-05-30 21:42 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-05-24 22:02 --------- d-----w C:\Documents and Settings\TERRANCE\Application Data\FrostWire
2008-05-21 23:47 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-05-20 22:21 --------- d-----w C:\Program Files\IObit
2008-05-17 01:16 --------- d-----w C:\Program Files\uTorrent
2008-05-03 20:29 --------- dc----w C:\Program Files\Common Files\WindowsLiveInstaller
2008-05-03 01:36 --------- d-----w C:\Documents and Settings\TERRANCE\Application Data\DivX
2008-04-27 19:28 --------- d-----w C:\Program Files\Common Files\Adobe
2008-04-26 19:00 --------- d-----w C:\Program Files\MSBuild
2008-04-22 00:20 --------- d--h--w C:\Documents and Settings\TERRANCE\Application Data\ijjigame
2008-04-22 00:16 --------- d-----w C:\Program Files\Microsoft.NET
2008-04-22 00:14 --------- d-----w C:\Documents and Settings\TERRANCE\Application Data\uTorrent(3)
2008-04-22 00:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft(2)
2008-04-22 00:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avg7(2)
2008-04-14 00:25 1,804 -c--a-w C:\WINDOWS\system32\dcache.bin
2008-04-14 00:11 98,304 ----a-w C:\WINDOWS\system32\actxprxy.dll
2008-04-14 00:09 9,344 -c--a-w C:\WINDOWS\system32\framebuf.dll
2008-04-14 00:09 3,072 -c--a-w C:\WINDOWS\system32\dpnlobby.dll
2008-04-14 00:09 3,072 -c--a-w C:\WINDOWS\system32\dpnaddr.dll
2008-04-14 00:09 285,696 ----a-w C:\WINDOWS\system32\atmfd.dll
2008-04-14 00:09 16,896 -c--a-w C:\WINDOWS\system32\cfgmgr32.dll
2008-04-13 21:00 103,424 -c--a-w C:\WINDOWS\system32\dpcdll.dll
2008-04-13 17:37 138,752 ----a-w C:\WINDOWS\system32\dssenh.dll
2008-04-13 17:09 4,096 -c--a-w C:\WINDOWS\system32\dsprpres.dll
2008-04-13 17:03 63,488 ----a-w C:\WINDOWS\system32\browselc.dll
2008-03-31 21:25 161,096 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-05-17 01:32 251,392 ----a-w C:\Program Files\opera\program\plugins\dapop.dll
.

((((((((((((((((((((((((((((( snapshot@2008-06-21_13.51.39.39 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-21 17:40:36 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-21 20:05:45 2,048 --s-a-w C:\WINDOWS\bootstat.dat
- 2008-02-22 05:23:35 135,168 ----a-w C:\WINDOWS\system32\java.exe
+ 2008-03-25 05:28:39 135,168 ----a-w C:\WINDOWS\system32\java.exe
- 2008-02-22 05:23:39 135,168 ----a-w C:\WINDOWS\system32\javaw.exe
+ 2008-03-25 05:28:43 135,168 ----a-w C:\WINDOWS\system32\javaw.exe
- 2008-02-22 06:33:32 139,264 ----a-w C:\WINDOWS\system32\javaws.exe
+ 2008-03-25 06:37:01 139,264 ----a-w C:\WINDOWS\system32\javaws.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4835CEF4-B27D-4F59-A4B3-F7AD2EC0483D}]
2008-06-19 19:31 318176 --------- C:\WINDOWS\system32\opnomlME.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 20:12 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 07:00 33648]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784]
"DownloadAccelerator"="C:\Program Files\DAP\DAP.EXE" [2008-05-16 21:32 3053056]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-06-19 22:06 1177368]

C:\Documents and Settings\TERRANCE\Start Menu\Programs\Startup\
Yahoo! Widgets.lnk - C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe [2007-12-11 18:34:48 3746856]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveSearch"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="C:\\WINDOWS\\system32\\logonui.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"19938:TCP"= 19938:TCP:BitCometLite 19938 TCP
"19938:UDP"= 19938:UDP:BitCometLite 19938 UDP
"37204:TCP"= 37204:TCP:*:Disabled:SolidNetworkManager
"37204:UDP"= 37204:UDP:*:Disabled:SolidNetworkManager

R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-06-19 22:07]
R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-06-19 22:06]
R3 ati2mtaa;ati2mtaa;C:\WINDOWS\system32\DRIVERS\ati2mtaa.sys [2001-08-31 00:40]
S3 XDva032;XDva032;C:\WINDOWS\system32\XDva032.sys []
S3 XDva120;XDva120;C:\WINDOWS\system32\XDva120.sys []

.
Contents of the 'Scheduled Tasks' folder
"2008-06-21 20:10:04 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-21 16:07:52
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
.
**************************************************************************
.
Completion time: 2008-06-21 16:14:21 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-21 20:14:09
ComboFix2.txt 2008-06-21 17:52:45

Pre-Run: 5,541,265,408 bytes free
Post-Run: 5,553,520,640 bytes free

185 --- E O F --- 2008-05-08 03:01:05

#12 Buckeye_Sam

Buckeye_Sam

    Malware Expert


  • Members
  • 17,382 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Pickerington, Ohio
  • Local time:04:05 AM

Posted 21 June 2008 - 03:30 PM

You can just delete these files manually.

C:\WINDOWS\system32\sex2.ico
C:\WINDOWS\system32\sex1.ico



Please post a new log from DSS.
How is your computer behaving now?
Posted Image If I have helped you in any way, please consider a donation to help me continue the fight against malware.


Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it!


========================================================

#13 PlatinumX

PlatinumX
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:04:05 AM

Posted 21 June 2008 - 03:52 PM

Im still trying to locate those files looked in the specified folder didnt see them
my computer is running alright can access everything but no my task bar keeps disappearing and reappearing

here is the log

Deckard's System Scanner v20071014.68
Run by TERRANCE on 2008-06-21 16:43:54
Computer is in Normal Mode.
--------------------------------------------------------------------------------

Percentage of Memory in Use: 91% (more than 75%).
Total Physical Memory: 256 MiB (512 MiB recommended).


-- HijackThis (run as TERRANCE.exe) --------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:44, on 6/21/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Opera\opera.exe
C:\Documents and Settings\TERRANCE\Desktop\dss.exe
C:\PROGRA~1\Trend Micro\HijackThis\TERRANCE.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
O2 - BHO: (no name) - {2F620E3A-C6B6-4732-8810-0A1600398608} - C:\WINDOWS\system32\opnomlME.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [DownloadAccelerator] "C:\Program Files\DAP\DAP.EXE" /STARTUP
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Yahoo! Widgets.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Microsoft Office Groove Audit Service - Unknown owner - C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

--
End of file - 4887 bytes

-- Files created between 2008-05-21 and 2008-06-21 -----------------------------

2008-06-21 16:27:16 226862 --ahs---- C:\WINDOWS\system32\EMlmonpo.ini2
2008-06-21 13:33:07 68096 --a------ C:\WINDOWS\zip.exe
2008-06-21 13:33:07 49152 --a------ C:\WINDOWS\VFind.exe
2008-06-21 13:33:07 212480 --a------ C:\WINDOWS\swxcacls.exe <Not Verified; SteelWerX; SteelWerX Extended Configurator ACLists>
2008-06-21 13:33:07 136704 --a------ C:\WINDOWS\swsc.exe <Not Verified; SteelWerX; SteelWerX Service Controller>
2008-06-21 13:33:07 161792 --a------ C:\WINDOWS\swreg.exe <Not Verified; SteelWerX; SteelWerX Registry Editor>
2008-06-21 13:33:07 98816 --a------ C:\WINDOWS\sed.exe
2008-06-21 13:33:07 80412 --a------ C:\WINDOWS\grep.exe
2008-06-21 13:33:07 89504 --a------ C:\WINDOWS\fdsv.exe <Not Verified; Smallfrogs Studio; >
2008-06-20 22:45:45 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-06-20 17:41:27 0 d-------- C:\Program Files\Trend Micro
2008-06-20 08:06:22 0 d-------- C:\Program Files\Windows Defender
2008-06-19 22:07:06 0 d-------- C:\WINDOWS\system32\drivers\Avg
2008-06-19 22:06:44 0 d-------- C:\Program Files\AVG
2008-06-19 19:31:38 318176 -----n--- C:\WINDOWS\system32\opnomlME.dll
2008-06-19 19:25:46 0 d-------- C:\Program Files\PCHealthCenter
2008-06-19 13:58:23 0 d-------- C:\Program Files\Yahoo!
2008-06-17 20:40:25 0 d-------- C:\Program Files\Wolfenstein - Enemy Territory
2008-06-17 11:47:24 0 d-------- C:\Program Files\Common Files\INCA Shared
2008-06-13 23:24:28 0 d-------- C:\Documents and Settings\TERRANCE\Application Data\Songbird2
2008-06-13 21:12:55 0 d-------- C:\Program Files\euro gunz beta 6
2008-06-13 15:38:53 0 d-------- C:\Documents and Settings\TERRANCE\Application Data\Opera
2008-06-13 15:38:40 0 d-------- C:\Program Files\Opera
2008-06-13 13:17:11 0 d-------- C:\Program Files\Phoenix Dynasty Online
2008-06-12 21:17:38 0 d-------- C:\Documents and Settings\All Users\Application Data\Avg8
2008-06-12 21:14:16 0 d-------- C:\Program Files\DAP
2008-06-08 11:42:53 0 d-------- C:\Documents and Settings\TERRANCE\Application Data\IDM(2)
2008-05-30 22:58:43 5505024 --a------ C:\Documents and Settings\TERRANCE\ntuser.dat
2008-05-29 17:33:03 0 d-------- C:\Documents and Settings\TERRANCE\Application Data\BSD
2008-05-29 17:33:01 0 d-------- C:\Documents and Settings\All Users\Application Data\MediaWidget
2008-05-29 17:32:55 1386496 --a------ C:\WINDOWS\bsdsetup.dll <Not Verified; Bootstrap Development, LLC.; >
2008-05-21 19:48:24 0 d-------- C:\Program Files\Windows Live


-- Find3M Report ---------------------------------------------------------------

2008-06-21 15:22:21 0 d-------- C:\Program Files\Java
2008-06-19 19:32:35 0 d-------- C:\Documents and Settings\TERRANCE\Application Data\uTorrent
2008-06-17 11:47:24 0 d-------- C:\Program Files\Common Files
2008-06-16 18:14:55 0 d-------- C:\Documents and Settings\TERRANCE\Application Data\Adobe
2008-06-13 13:17:10 0 d-------- C:\Program Files\InstallShield Installation Information
2008-06-11 19:15:11 0 d-------- C:\Documents and Settings\TERRANCE\Application Data\LimeWire
2008-06-08 19:59:03 0 d-------- C:\Documents and Settings\TERRANCE\Application Data\DMCache
2008-05-24 18:51:07 2075 --a----c- C:\WINDOWS\mozver.dat
2008-05-24 18:02:35 0 d-------- C:\Documents and Settings\TERRANCE\Application Data\FrostWire
2008-05-20 18:47:20 0 d-------- C:\Documents and Settings\TERRANCE\Application Data\Real
2008-05-20 18:21:57 0 d-------- C:\Program Files\IObit
2008-05-16 21:16:31 0 d-------- C:\Program Files\uTorrent
2008-05-09 16:43:44 1324 --a------ C:\WINDOWS\system32\d3d9caps.dat
2008-05-07 22:33:46 0 d-------- C:\Program Files\Movie Maker
2008-05-07 22:30:30 0 d-------- C:\Program Files\Windows NT
2008-05-03 16:29:14 0 d------c- C:\Program Files\Common Files\WindowsLiveInstaller
2008-05-02 21:36:31 0 d-------- C:\Documents and Settings\TERRANCE\Application Data\DivX
2008-04-27 15:28:51 0 d-------- C:\Program Files\Common Files\Adobe
2008-04-26 15:00:52 0 d-------- C:\Program Files\MSBuild
2008-04-26 14:22:38 0 d-------- C:\Documents and Settings\TERRANCE\Application Data\Mozilla
2008-04-21 20:20:43 0 d--h----- C:\Documents and Settings\TERRANCE\Application Data\ijjigame
2008-04-21 20:16:54 0 d-------- C:\Program Files\Microsoft.NET
2008-04-21 20:14:23 0 d-------- C:\Documents and Settings\TERRANCE\Application Data\uTorrent(3)
2008-03-26 17:16:49 227 --a----c- C:\WINDOWS\PowerReg.dat


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2F620E3A-C6B6-4732-8810-0A1600398608}]
06/19/2008 19:31 318176 --------- C:\WINDOWS\system32\opnomlME.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [08/24/2007 07:00]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [03/25/2008 04:28]
"DownloadAccelerator"="C:\Program Files\DAP\DAP.exe" [05/16/2008 21:32]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [06/19/2008 22:06]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [10/18/2007 11:34]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [04/13/2008 20:12]

C:\Documents and Settings\TERRANCE\Start Menu\Programs\Startup\
Yahoo! Widgets.lnk - C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe [12/11/2007 6:34:48 PM]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)
"HideLegacyLogonScripts"=0 (0x0)
"HideLogoffScripts"=0 (0x0)
"RunLogonScriptSync"=1 (0x1)
"RunStartupScriptSync"=0 (0x0)
"HideStartupScripts"=0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"HideLegacyLogonScripts"=0 (0x0)
"HideLogoffScripts"=0 (0x0)
"RunLogonScriptSync"=1 (0x1)
"RunStartupScriptSync"=0 (0x0)
"HideStartupScripts"=0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"LinkResolveIgnoreLinkInfo"=0 (0x0)
"NoResolveSearch"=1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"LinkResolveIgnoreLinkInfo"=0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
C:\WINDOWS\System32\dimsntfy.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\opnomlME

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
eapsvcs eaphost
dot3svc dot3svc

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
napagent
hkmsvc




-- End of Deckard's System Scanner: finished at 2008-06-21 16:49:28 ------------

Edited by PlatinumX, 21 June 2008 - 04:17 PM.


#14 Buckeye_Sam

Buckeye_Sam

    Malware Expert


  • Members
  • 17,382 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Pickerington, Ohio
  • Local time:04:05 AM

Posted 22 June 2008 - 06:32 AM

Copy and paste ALL the following text in the Quote box below into Notepad.
Click on File(in the menu at the top)>Save as../Save as Type: 'All Files' /File name: CFScript to your desktop.

File::
C:\WINDOWS\system32\opnomlME.dll
C:\WINDOWS\system32\EMlmonpo.ini2
C:\WINDOWS\system32\sex2.ico
C:\WINDOWS\system32\sex1.ico

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2F620E3A-C6B6-4732-8810-0A1600398608}]
Prior to running Combofix.exe you should disable your antivirus program and disconnect from the internet.

Now drag then drop the CFScript file onto ComboFix.exe as seen in the image below.

Posted Image

This will start ComboFix again.
After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.


Let me know if there is any changes in the behavior of your taskbar.
Posted Image If I have helped you in any way, please consider a donation to help me continue the fight against malware.


Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it!


========================================================

#15 PlatinumX

PlatinumX
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:04:05 AM

Posted 22 June 2008 - 09:33 AM

Task bar has remained on no more disappearing :thumbsup:
here is the log u requested and thanks again

ComboFix 08-06-20.4 - TERRANCE 2008-06-22 10:15:29.3 - NTFSx86 NETWORK
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.111 [GMT -4:00]
Running from: C:\Documents and Settings\TERRANCE\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\TERRANCE\Desktop\CFScript.txt

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\WINDOWS\system32\EMlmonpo.ini2
C:\WINDOWS\system32\opnomlME.dll
C:\WINDOWS\system32\sex1.ico
C:\WINDOWS\system32\sex2.ico
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\TERRANCE\Local Settings\Temporary Internet Files\ijjistarter_verinfo.dat
C:\WINDOWS\system32\EMlmonpo.ini
C:\WINDOWS\system32\EMlmonpo.ini2
C:\WINDOWS\system32\opnomlME.dll
C:\WINDOWS\system32\sex1.ico
C:\WINDOWS\system32\sex2.ico

.
((((((((((((((((((((((((( Files Created from 2008-05-22 to 2008-06-22 )))))))))))))))))))))))))))))))
.

2008-06-20 22:45 . 2008-06-20 22:45 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-06-20 17:41 . 2008-06-20 17:41 <DIR> d-------- C:\Program Files\Trend Micro
2008-06-20 15:48 . 2008-06-20 15:48 <DIR> d-------- C:\Deckard
2008-06-20 08:06 . 2008-06-20 21:17 <DIR> d-------- C:\Program Files\Windows Defender
2008-06-19 22:07 . 2008-06-22 10:03 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg
2008-06-19 22:07 . 2008-06-19 22:07 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys
2008-06-19 22:07 . 2008-06-19 22:07 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll
2008-06-19 22:06 . 2008-06-19 22:06 <DIR> d-------- C:\Program Files\AVG
2008-06-19 19:25 . 2008-06-19 23:30 <DIR> d-------- C:\Program Files\PCHealthCenter
2008-06-19 13:58 . 2008-06-19 13:58 <DIR> d-------- C:\Program Files\Yahoo!
2008-06-17 20:40 . 2008-06-17 20:48 <DIR> d-------- C:\Program Files\Wolfenstein - Enemy Territory
2008-06-17 11:47 . 2008-06-17 11:47 <DIR> d-------- C:\Program Files\Common Files\INCA Shared
2008-06-13 23:24 . 2008-06-13 23:24 <DIR> d-------- C:\Documents and Settings\TERRANCE\Application Data\Songbird2
2008-06-13 21:12 . 2008-06-19 23:27 <DIR> d-------- C:\Program Files\euro gunz beta 6
2008-06-13 15:38 . 2008-06-21 18:48 <DIR> d-------- C:\Program Files\Opera
2008-06-13 13:17 . 2008-06-21 23:32 <DIR> d-------- C:\Program Files\Phoenix Dynasty Online
2008-06-12 21:17 . 2008-06-19 22:06 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avg8
2008-06-12 21:14 . 2008-06-13 12:39 <DIR> d-------- C:\Program Files\DAP
2008-06-08 11:42 . 2008-06-12 21:14 <DIR> d-------- C:\Documents and Settings\TERRANCE\Application Data\IDM(2)
2008-05-29 18:24 . 2008-05-30 16:33 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-05-29 18:24 . 2008-05-29 18:24 1,409 --a------ C:\WINDOWS\QTFont.for
2008-05-29 17:33 . 2008-05-29 17:33 <DIR> d-------- C:\Documents and Settings\TERRANCE\Application Data\BSD
2008-05-29 17:33 . 2008-05-29 17:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\MediaWidget
2008-05-29 17:32 . 2008-03-17 19:05 1,386,496 --a------ C:\WINDOWS\bsdsetup.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-22 14:28 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-06-21 19:22 --------- d-----w C:\Program Files\Java
2008-06-21 18:25 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avira
2008-06-19 23:32 --------- d-----w C:\Documents and Settings\TERRANCE\Application Data\uTorrent
2008-06-19 02:19 23,352 -c--a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-06-19 02:19 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-06-18 15:08 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-06-16 22:16 --------- d-----w C:\Program Files\Windows Live
2008-06-13 17:17 --------- d-----w C:\Program Files\InstallShield Installation Information
2008-06-12 19:08 58,800 ----a-w C:\WINDOWS\system32\ijjiPlugin2.dll
2008-06-11 23:15 --------- d-----w C:\Documents and Settings\TERRANCE\Application Data\LimeWire
2008-06-08 23:59 --------- d-----w C:\Documents and Settings\TERRANCE\Application Data\DMCache
2008-05-30 21:42 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-05-24 22:02 --------- d-----w C:\Documents and Settings\TERRANCE\Application Data\FrostWire
2008-05-21 23:47 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-05-20 22:21 --------- d-----w C:\Program Files\IObit
2008-05-18 02:01 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
2008-05-18 02:01 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
2008-05-17 01:16 --------- d-----w C:\Program Files\uTorrent
2008-05-03 20:29 --------- dc----w C:\Program Files\Common Files\WindowsLiveInstaller
2008-05-03 01:36 --------- d-----w C:\Documents and Settings\TERRANCE\Application Data\DivX
2008-04-27 19:28 --------- d-----w C:\Program Files\Common Files\Adobe
2008-04-26 19:00 --------- d-----w C:\Program Files\MSBuild
2008-04-22 00:20 --------- d--h--w C:\Documents and Settings\TERRANCE\Application Data\ijjigame
2008-04-22 00:16 --------- d-----w C:\Program Files\Microsoft.NET
2008-04-22 00:14 --------- d-----w C:\Documents and Settings\TERRANCE\Application Data\uTorrent(3)
2008-04-22 00:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft(2)
2008-04-22 00:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avg7(2)
2008-04-14 09:42 985,088 ----a-w C:\WINDOWS\system32\setupapi.dll
2008-04-14 09:42 11,264 ----a-w C:\WINDOWS\system32\spnpinst.exe
2008-04-14 09:41 423,936 ----a-w C:\WINDOWS\system32\licdll.dll
2008-04-14 00:25 1,804 -c--a-w C:\WINDOWS\system32\dcache.bin
2008-04-14 00:16 329,728 -c--a-w C:\WINDOWS\system32\netsetup.exe
2008-04-14 00:13 92,424 -c--a-w C:\WINDOWS\system32\rdpdd.dll
2008-04-14 00:13 87,176 -c--a-w C:\WINDOWS\system32\rdpwsx.dll
2008-04-14 00:13 12,168 -c--a-w C:\WINDOWS\system32\tsddd.dll
2008-04-14 00:11 997,376 ----a-w C:\WINDOWS\system32\msgina.dll
2008-04-14 00:10 53,279 -c--a-w C:\WINDOWS\system32\odbcji32.dll
2008-04-14 00:10 4,126 -c--a-w C:\WINDOWS\system32\msdxmlc.dll
2008-04-14 00:10 3,584 -c--a-w C:\WINDOWS\system32\msafd.dll
2008-04-13 21:00 103,424 -c--a-w C:\WINDOWS\system32\dpcdll.dll
2008-04-13 19:30 1,845,632 ----a-w C:\WINDOWS\system32\win32k.sys
2008-04-13 19:27 2,188,928 -c--a-w C:\WINDOWS\system32\ntoskrnl.exe
2008-04-13 18:44 17,664 -c--a-w C:\WINDOWS\system32\watchdog.sys
2008-04-13 18:35 24,064 -c--a-w C:\WINDOWS\system32\pidgen.dll
2008-04-13 18:31 7,424 -c--a-w C:\WINDOWS\system32\kd1394.dll
2008-04-13 18:31 2,065,792 -c--a-w C:\WINDOWS\system32\ntkrnlpa.exe
2008-04-13 18:30 61,440 -c--a-w C:\WINDOWS\system32\msvcrt40.dll
2008-04-13 18:14 76,800 -c--a-w C:\WINDOWS\system32\msshavmsg.dll
2008-04-13 17:39 438,784 -c--a-w C:\WINDOWS\system32\xpob2res.dll
2008-04-13 17:39 2,897,920 ----a-w C:\WINDOWS\system32\xpsp2res.dll
2008-04-13 17:39 187,392 -c--a-w C:\WINDOWS\system32\xpsp1res.dll
2008-04-13 17:37 208,384 ----a-w C:\WINDOWS\system32\rsaenh.dll
2008-04-13 17:37 138,752 ----a-w C:\WINDOWS\system32\dssenh.dll
2008-04-13 17:27 79,872 -c--a-w C:\WINDOWS\system32\msxml6r.dll
2008-04-13 17:26 94,208 ----a-w C:\WINDOWS\system32\odbcint.dll
2008-04-13 17:26 12,288 -c--a-w C:\WINDOWS\system32\odbcp32r.dll
2008-04-13 17:26 12,288 -c--a-w C:\WINDOWS\system32\mscpx32r.dll
2008-04-13 17:24 20,480 -c--a-w C:\WINDOWS\system32\msorc32r.dll
2008-04-13 17:21 733,696 -c--a-w C:\WINDOWS\system32\qedwipes.dll
2008-04-13 17:09 4,096 -c--a-w C:\WINDOWS\system32\dsprpres.dll
2008-04-13 17:03 63,488 ----a-w C:\WINDOWS\system32\browselc.dll
2008-04-13 17:03 549,376 ----a-w C:\WINDOWS\system32\shdoclc.dll
2008-04-13 16:48 1,647,616 -c--a-w C:\WINDOWS\system32\winbrand.dll
2008-04-13 16:45 216,064 -c--a-w C:\WINDOWS\system32\moricons.dll
2008-04-13 16:23 48,128 ----a-w C:\WINDOWS\system32\msprivs.dll
2008-04-13 16:22 48,128 -c--a-w C:\WINDOWS\system32\inetres.dll
2008-04-13 15:39 884,736 -c--a-w C:\WINDOWS\system32\msimsg.dll
2008-03-31 21:25 161,096 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-05-17 01:32 251,392 ----a-w C:\Program Files\opera\program\plugins\dapop.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 20:12 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 07:00 33648]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784]
"DownloadAccelerator"="C:\Program Files\DAP\DAP.EXE" [2008-05-16 21:32 3053056]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-06-19 22:06 1177368]

C:\Documents and Settings\TERRANCE\Start Menu\Programs\Startup\
Yahoo! Widgets.lnk - C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe [2007-12-11 18:34:48 3746856]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveSearch"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="C:\\WINDOWS\\system32\\logonui.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"19938:TCP"= 19938:TCP:BitCometLite 19938 TCP
"19938:UDP"= 19938:UDP:BitCometLite 19938 UDP
"37204:TCP"= 37204:TCP:*:Disabled:SolidNetworkManager
"37204:UDP"= 37204:UDP:*:Disabled:SolidNetworkManager

R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-06-19 22:07]
R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-06-19 22:06]
R3 ati2mtaa;ati2mtaa;C:\WINDOWS\system32\DRIVERS\ati2mtaa.sys [2001-08-31 00:40]
S3 XDva032;XDva032;C:\WINDOWS\system32\XDva032.sys []
S3 XDva120;XDva120;C:\WINDOWS\system32\XDva120.sys []

.
Contents of the 'Scheduled Tasks' folder
"2008-06-22 14:27:24 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-22 10:25:24
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
.
**************************************************************************
.
Completion time: 2008-06-22 10:31:02 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-22 14:30:47
ComboFix2.txt 2008-06-21 20:14:27

Pre-Run: 5,233,385,472 bytes free
Post-Run: 5,228,695,552 bytes free

193 --- E O F --- 2008-05-08 03:01:05

Edited by PlatinumX, 22 June 2008 - 10:35 AM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users