Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Vtsqq.exe Not Found - Hjt Log Posted


  • This topic is locked This topic is locked
18 replies to this topic

#1 theodore

theodore

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:47 PM

Posted 22 June 2008 - 10:41 AM

At start up two error messages appear, one is cannot run C:\WINDOWS\system32\vtsqq.exe, the other is error loading C:\WINDOWS\system32\qkailcxn.dll

i copied and pasted the above from 'flatdeck''s post as his issue is identical to mine.
i have heeded the warnings not to just copy what he was told to do.


below is my hijack this log in full(also attached).






Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:22:03, on 19/06/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\mrofinu1535.exe
C:\DOCUME~1\trojan87\LOCALS~1\Temp\winlogan.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\Rundll32.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\WgaTray.exe
C:\DOCUME~1\trojan87\LOCALS~1\Temp\csrssc.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.rd.yahoo.com/customize/ycomp/def.../search/ie.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.rd.yahoo.com/customize/ycomp/def...://uk.yahoo.com
R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
F3 - REG:win.ini: load=C:\WINDOWS\System32\vtsqq.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\System32\ntos.exe,
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SManager] smanager.7.exe
O4 - HKLM\..\Run: [ipmon] ipmon.exe
O4 - HKLM\..\Run: [MPSExe] c:\PROGRA~1\mcafee.com\mps\mscifapp.exe /embedding
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6172\SiteAdv.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\issch.exe" -start
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\mrofinu1535.exe 61A847B5BBF7281337983D466188719AB689201522886B092CBD44BD8689220221DD3257
O4 - HKLM\..\Run: [jdgf894jrghoiiskd] C:\DOCUME~1\trojan87\LOCALS~1\Temp\winlogan.exe
O4 - HKLM\..\Run: [BMN] "C:\Program Files\Common Files\AntiSpywareMaster\bm.exe" dm=http://antispywaremaster.com ad=http://antispywaremaster.com sd=http://ykeeper.antispywaremaster.com
O4 - HKLM\..\Run: [a88d7fca] rundll32.exe "C:\WINDOWS\System32\ysnjmfdr.dll",b
O4 - HKLM\..\Run: [BMabbe4c56] Rundll32.exe "C:\WINDOWS\System32\jernldph.dll",s
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [EPSON Stylus DX4400 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\E_S20IC1.EXE /FU "C:\DOCUME~1\trojan87\LOCALS~1\Temp\E_S1B.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [jdgf894jrghoiiskd] C:\DOCUME~1\trojan87\LOCALS~1\Temp\winlogan.exe
O4 - HKCU\..\Run: [Jnskdfmf9eldfd] C:\DOCUME~1\trojan87\LOCALS~1\Temp\csrssc.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab56986.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{BF4F422E-4E00-4F57-805C-FF332126BB01}: NameServer = 158.43.128.72,158.43.192.1,158.43.128.1
O21 - SSODL: SysRun - {D7FFD784-5276-42D1-887B-00267870A4C7} - (no file)
O21 - SSODL: WinCTL - {009541A0-3B00-1F1C-00F3-040224009C02} - (no file)
O22 - SharedTaskScheduler: jhsf8d984jief8dsfus98jkefn - {C5AF49A2-94F3-42BD-F434-2604812C897D} - C:\WINDOWS\System32\jfiehayd.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: DomainService - Unknown owner - C:\WINDOWS\System32\dcphkhmt.exe (file missing)
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\System32\PSIService.exe (file missing)

--
End of file - 6480 bytes









all help appreciated




theodore

Attached Files


Edited by Orange Blossom, 22 June 2008 - 07:20 PM.
Fix code tags and spelling. ~ OB


BC AdBot (Login to Remove)

 


#2 Baabiouz

Baabiouz

    Finnish Malware Fighter


  • Members
  • 3,355 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:07:47 PM

Posted 23 June 2008 - 10:56 AM

Hello Theodore! :thumbsup:

I will be handling your log to help you get cleaned up. Please give me some time to look it over and I will get back to you as soon as possible. I'm in Hijackthis school and Teachers will check my posts.
Posted Image

#3 Baabiouz

Baabiouz

    Finnish Malware Fighter


  • Members
  • 3,355 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:07:47 PM

Posted 24 June 2008 - 10:55 AM

Hello

Your computer appears to have been infected by a backdoor trojan. These programs have the ability to steal passwords and other information from your system. If you use your computer for sensitive purposes such as internet banking then I recommend you take the following steps immediately:

* Use another, uninfected computer to change all your internet passwords, especially ones with financial implications such as banks, paypal, ebay, etc. You should also change the passwords for any other site you use.
* Call your bank(s), credit card company or any other institution which may be affected and advise them that your login/password or credit card information may have been stolen and ask what steps to take with regard to your account.
* Consider what other private information could possibly have been taken from your computer and take appropriate steps

This infection can almost certainly be cleaned, but as the malware could be configured to run any program a remote attacker requires, it will be impossible to be 100% sure that the machine is clean, if this is unacceptable to you then you should consider reformatting the system partition and reinstalling Windows as this is the only 100% sure answer.

If you wish to reformat then please let me know in your next response, I'll now continue with instructions for cleaning.
__________________________

Step #1
Before we start fixing anything you should print out these instructions or copy them to a NotePad file so they will be accessible. Some steps will require you to disconnect from the Internet or use Safe Mode and you will not have access to this page.

Please download SDFix by AndyManchesta and save it to your desktop.
When using this tool, you must use the Administrator's account or an account with "Administrative rights"
  • Double click SDFix.exe and it will extract the files to %systemdrive%
  • (this is the drive that contains the Windows Directory, typically C:\SDFix).
  • DO NOT use it just yet.
Reboot your computer in "Safe Mode" using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode".

Open the SDFix folder and double click RunThis.bat to start the script.
  • Type Y to begin the cleanup process.
  • It will remove any Trojan Services or Registry Entries found then prompt you to press any key to Reboot.
  • Press any Key and it will restart the PC.
  • When the PC restarts, the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
  • Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt.
  • Copy and paste the contents of the results file Report.txt in your next replyalong with a new HijackThis log.
-- If this error message is displayed when running SDFix: "The command prompt has been disabled by your administrator. Press any key to continue..."
Please go to Start Menu > Run > and copy/paste the following line:
%systemdrive%\SDFix\apps\swreg IMPORT %systemdrive%\SDFix\apps\Enable_Command_Prompt.reg
Press Ok and then run SDFix again.

-- If the Command Prompt window flashes on then off again on XP or Win 2000, please go to Start Menu > Run > and copy/paste the following line:
%systemdrive%\SDFix\apps\FixPath.exe /Q
Reboot and then run SDFix again.

-- If SDFix still does not run, check the %comspec% variable. Right-click My Computer > click Properties > Advanced > Environment Variables and check that the ComSpec variable points to cmd.exe.
%SystemRoot%\system32\cmd.exe


Step #2
Download Combofix from any of the links below, and save it to your desktop. For information regarding this download, please visit this webpage: http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Link 1
Link 2
Link 3


**Note: It is important that it is saved directly to your desktop**

--------------------------------------------------------------------

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

--------------------------------------------------------------------

Double click on combofix.exe & follow the prompts.
  • When finished, it will produce a report for you.
  • Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.
Note:
Do not mouseclick combofix's window while it's running. That may cause it to stall


Step #3
You are missing one important program on that computer: An antivirus.
This is somewhat suicidal in today's digital world.
You need to install an antivirus program as soon as you can and run a complete scan of the computer:Install it and then run a full scan. Let it quarantine/delete anything it finds. Let me know if there is anything that it reports but can not remove.

Step #4
Please post Combofix log, Sdfix log and a fresh HijackThis log back here. :thumbsup:
Posted Image

#4 theodore

theodore
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:47 PM

Posted 27 June 2008 - 09:13 AM

HERE IS THE SDFIX REPORT.

---------------------------------------


SDFix: Version 1.197
Run by Administrator on 25/06/2008 at 18:56

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\DOCUME~1\ADMINI~1\Desktop\sdfix\SDFix

Checking Services :

Name :
narqwe
runtime
smtpdrv
wincom32
xpdx

Path :
\??\C:\WINDOWS\system32\narqwe.sys
\??\C:\WINDOWS\System32\drivers\runtime.sys
System32\DRIVERS\smtpdrv.sys
\??\C:\WINDOWS\System32\wincom32.sys
\??\C:\WINDOWS\System32\xpdx.sys

narqwe - Deleted
runtime - Deleted
smtpdrv - Deleted
wincom32 - Deleted
xpdx - Deleted



Restoring Default Security Values
Restoring Default Hosts File

Rebooting

Service asc355O - Deleted

Checking Files :

Trojan Files Found:

C:\WINDOWS\system32\wvUmljig.dll - Deleted
C:\WINDOWS\system32\WINZOA32.dll - Deleted
C:\WINDOWS\system32\jfiehayd.dll - Deleted
C:\WINDOWS\SYSTEM32\VTSQQ.EXE - Deleted
C:\Program Files\mjc\mjc.exe - Deleted
C:\WINDOWS\b152.exe - Deleted
C:\WINDOWS\mrofinu1535.exe - Deleted
C:\WINDOWS\system32\8_exception.nls - Deleted
C:\WINDOWS\system32\bsn32.dll - Deleted
C:\WINDOWS\system32\csm.txt - Deleted
C:\WINDOWS\system32\googlech.dll - Deleted
C:\WINDOWS\system32\pac.txt - Deleted
C:\WINDOWS\system32\sys.dat - Deleted
C:\WINDOWS\system32\drivers\asc355O.sys - Deleted
C:\WINDOWS\system32\narqwe.sys - Deleted
C:\WINDOWS\system32\ntos.exe - Deleted
C:\WINDOWS\system32\drivers\asc355O.sys - Deleted
C:\WINDOWS\system32\narqwe.sys - Deleted
C:\WINDOWS\system32\ntos.exe - Deleted
C:\WINDOWS\system32\wsnpoem\audio.dll.cla - Deleted
C:\WINDOWS\system32\wsnpoem\video.dll - Deleted
C:\Documents and Settings\Guest.XFDXFG-1NPE3D14\Application Data\wsnpoem\video.dll - Deleted
C:\WINDOWS\system32\wsnpoem\audio.dll - Deleted
C:\Documents and Settings\Guest.XFDXFG-1NPE3D14\Application Data\wsnpoem\audio.dll - Deleted
C:\WINDOWS\Fonts\*.zip - 1 File(s) 16,384 bytes - Deleted
C:\WINDOWS\Fonts\'\*.zip - 993 File(s) 16,270,305 bytes - Deleted



Folder C:\Program Files\InetGet2 - Removed
Folder C:\Program Files\mjc - Removed
Folder C:\Program Files\Temporary - Removed
Folder C:\WINDOWS\system32\wsnpoem - Removed


Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-26 19:30:55
Windows 5.1.2600 Service Pack 1 FAT NTAPI

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :

runtime



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"c:\\windows\\system32\\nvsvct0.exe"="c:\\windows\\system32\\nvsvct0.exe:*:Enabled:nvsvct0"
"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"="C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE:*:Enabled:Internet Explorer"
"C:\\WINDOWS\\System32\\dcphkhmt.exe"="C:\\WINDOWS\\System32\\dcp"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

Remaining Files :


File Backups: - C:\DOCUME~1\ADMINI~1\Desktop\sdfix\SDFix\backups\backups.zip

Files with Hidden Attributes :

Sat 5 May 2007 879,180 ..SH. --- "C:\WINDOWS\system32\npqss.tmp"
Sun 17 Jun 2007 1,216,996 ..SH. --- "C:\WINDOWS\system32\npqss.bak1"
Thu 6 Sep 2007 848 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys"
Wed 20 Jun 2007 1,227,731 ..SH. --- "C:\WINDOWS\system32\npqss.bak2"
Thu 6 Sep 2007 88 ..SHR --- "C:\WINDOWS\system32\93E7034298.sys"
Sat 9 Feb 2008 20,532 ..SH. --- "C:\WINDOWS\system32\isuhibja.dllbox"
Wed 3 Sep 2003 401 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv12.bak"
Wed 3 Sep 2003 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Mon 6 Aug 2007 401 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv10.bak"
Thu 26 Jun 2008 15,505 ...H. --- "C:\Documents and Settings\vicki morgan\Local Settings\Temp\csrssc.exe"
Sun 28 Oct 2007 20,222,992 A..H. --- "C:\Documents and Settings\vicki morgan\Local Settings\Temp\BITF.tmp"
Sun 28 Oct 2007 20,222,992 A..H. --- "C:\Documents and Settings\vicki morgan\Local Settings\Temp\BIT51.tmp"
Sun 28 Oct 2007 20,222,992 A..H. --- "C:\Documents and Settings\vicki morgan\Local Settings\Temp\BIT2.tmp"
Sun 28 Oct 2007 20,222,992 ...H. --- "C:\Documents and Settings\trojan87\Local Settings\Temp\BIT14.tmp"
Thu 26 Jun 2008 15,505 ...H. --- "C:\Documents and Settings\trojan87\Local Settings\Temp\csrssc.exe"
Sun 28 Oct 2007 20,222,992 A..H. --- "C:\Documents and Settings\trojan87\Local Settings\Temp\BIT2.tmp"
Fri 23 Nov 2007 65,536 ...H. --- "C:\Documents and Settings\nubian2\My Documents\COMM CHAMPIONS\~WRL2231.tmp"
Fri 23 Nov 2007 65,536 ...H. --- "C:\Documents and Settings\nubian2\My Documents\COMM CHAMPIONS\~WRL1845.tmp"
Fri 23 Nov 2007 65,536 ...H. --- "C:\Documents and Settings\nubian2\My Documents\COMM CHAMPIONS\~WRL3546.tmp"
Fri 23 Nov 2007 65,536 ...H. --- "C:\Documents and Settings\nubian2\My Documents\COMM CHAMPIONS\~WRL2318.tmp"
Thu 19 Jun 2008 22,016 ...H. --- "C:\Documents and Settings\nubian2\My Documents\RITES OF PASSAGE\~WRL2884.tmp"
Thu 19 Jun 2008 22,528 ...H. --- "C:\Documents and Settings\nubian2\My Documents\RITES OF PASSAGE\~WRL3997.tmp"
Thu 19 Jun 2008 25,088 ...H. --- "C:\Documents and Settings\nubian2\My Documents\RITES OF PASSAGE\~WRL2612.tmp"
Thu 19 Jun 2008 25,088 ...H. --- "C:\Documents and Settings\nubian2\My Documents\RITES OF PASSAGE\~WRL0694.tmp"
Fri 20 Jun 2008 27,648 ...H. --- "C:\Documents and Settings\nubian2\My Documents\RITES OF PASSAGE\~WRL3942.tmp"
Fri 20 Jun 2008 28,160 ...H. --- "C:\Documents and Settings\nubian2\My Documents\RITES OF PASSAGE\~WRL1945.tmp"
Fri 20 Jun 2008 29,696 ...H. --- "C:\Documents and Settings\nubian2\My Documents\RITES OF PASSAGE\~WRL0146.tmp"
Fri 20 Jun 2008 30,720 ...H. --- "C:\Documents and Settings\nubian2\My Documents\RITES OF PASSAGE\~WRL1437.tmp"
Fri 20 Jun 2008 34,304 ...H. --- "C:\Documents and Settings\nubian2\My Documents\RITES OF PASSAGE\~WRL0131.tmp"
Tue 17 Apr 2007 19,456 ...H. --- "C:\Documents and Settings\vicki morgan\My Documents\Coursework1\Drama\~WRL2283.tmp"
Sun 8 Oct 2006 27,136 ...H. --- "C:\Documents and Settings\Francine\Application Data\Microsoft\Templates\~WRL3317.tmp"
Sun 23 Jul 2006 23,040 ...H. --- "C:\Documents and Settings\Francine\Application Data\Microsoft\Word\~WRL0197.tmp"
Sat 14 Apr 2007 35,328 ...H. --- "C:\Documents and Settings\Francine\Application Data\Microsoft\Word\~WRL0004.tmp"
Sat 14 Apr 2007 35,840 ...H. --- "C:\Documents and Settings\Francine\Application Data\Microsoft\Word\~WRL2862.tmp"
Thu 29 Mar 2007 30,720 ...H. --- "C:\Documents and Settings\Francine\Application Data\Microsoft\Word\~WRL2591.tmp"
Thu 29 Mar 2007 31,744 ...H. --- "C:\Documents and Settings\Francine\Application Data\Microsoft\Word\~WRL1543.tmp"
Sun 21 Jan 2007 22,528 ...H. --- "C:\Documents and Settings\Francine\Application Data\Microsoft\Word\~WRL0003.tmp"
Sun 21 Jan 2007 24,064 ...H. --- "C:\Documents and Settings\Francine\Application Data\Microsoft\Word\~WRL0005.tmp"
Thu 29 Mar 2007 35,328 ...H. --- "C:\Documents and Settings\Francine\Application Data\Microsoft\Word\~WRL1826.tmp"
Thu 29 Mar 2007 35,840 ...H. --- "C:\Documents and Settings\Francine\Application Data\Microsoft\Word\~WRL1974.tmp"
Thu 29 Mar 2007 35,328 ...H. --- "C:\Documents and Settings\Francine\Application Data\Microsoft\Word\~WRL2178.tmp"
Sun 10 Dec 2006 138,752 ...H. --- "C:\Documents and Settings\trojan87\Application Data\Microsoft\Word\~WRL0004.tmp"
Mon 12 Nov 2007 182,272 ...H. --- "C:\Documents and Settings\nubian2\Application Data\Microsoft\Word\~WRL0081.tmp"
Mon 12 Nov 2007 182,784 ...H. --- "C:\Documents and Settings\nubian2\Application Data\Microsoft\Word\~WRL2643.tmp"
Thu 7 Sep 2006 32,256 ...H. --- "C:\Documents and Settings\nubian2\Application Data\Microsoft\Word\~WRL3863.tmp"
Fri 30 Dec 2005 26,624 ...H. --- "C:\Documents and Settings\nubian2\Application Data\Microsoft\Word\~WRL2486.tmp"
Fri 30 Dec 2005 27,136 ...H. --- "C:\Documents and Settings\nubian2\Application Data\Microsoft\Word\~WRL0981.tmp"
Wed 12 Apr 2006 26,624 ...H. --- "C:\Documents and Settings\nubian2\Application Data\Microsoft\Word\~WRL2864.tmp"
Wed 12 Apr 2006 27,648 ...H. --- "C:\Documents and Settings\nubian2\Application Data\Microsoft\Word\~WRL2865.tmp"
Wed 12 Apr 2006 28,672 ...H. --- "C:\Documents and Settings\nubian2\Application Data\Microsoft\Word\~WRL3277.tmp"
Wed 12 Apr 2006 27,136 ...H. --- "C:\Documents and Settings\nubian2\Application Data\Microsoft\Word\~WRL1818.tmp"
Thu 7 Sep 2006 19,456 ...H. --- "C:\Documents and Settings\nubian2\Application Data\Microsoft\Word\~WRL1693.tmp"
Fri 20 Jun 2008 31,744 ...H. --- "C:\Documents and Settings\nubian2\Application Data\Microsoft\Word\~WRL0133.tmp"
Fri 20 Jun 2008 32,256 ...H. --- "C:\Documents and Settings\nubian2\Application Data\Microsoft\Word\~WRL1197.tmp"
Fri 20 Jun 2008 33,792 ...H. --- "C:\Documents and Settings\nubian2\Application Data\Microsoft\Word\~WRL1421.tmp"
Sun 17 Apr 2005 23,040 ...H. --- "C:\Documents and Settings\nubian2\Application Data\Microsoft\Word\~WRL0004.tmp"
Sun 17 Apr 2005 23,040 ...H. --- "C:\Documents and Settings\nubian2\Application Data\Microsoft\Word\~WRL2359.tmp"
Sun 17 Apr 2005 23,040 ...H. --- "C:\Documents and Settings\nubian2\Application Data\Microsoft\Word\~WRL3733.tmp"
Sun 17 Apr 2005 22,528 ...H. --- "C:\Documents and Settings\nubian2\Application Data\Microsoft\Word\~WRL1028.tmp"

Finished!


Rebooting


Checking Files :

No Trojan Files Found






Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-26 20:50:26
Windows 5.1.2600 Service Pack 1 FAT NTAPI

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"c:\\windows\\system32\\nvsvct0.exe"="c:\\windows\\system32\\nvsvct0.exe:*:Enabled:nvsvct0"
"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"="C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE:*:Enabled:Internet Explorer"
"C:\\WINDOWS\\System32\\dcphkhmt.exe"="C:\\WINDOWS\\System32\\dcp"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

Remaining Files :


File Backups: - C:\DOCUME~1\ADMINI~1\Desktop\sdfix\SDFix\backups\backups.zip

Files with Hidden Attributes :

Thu 6 Sep 2007 848 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys"
Thu 6 Sep 2007 88 ..SHR --- "C:\WINDOWS\system32\93E7034298.sys"
Sat 9 Feb 2008 20,532 ..SH. --- "C:\WINDOWS\system32\isuhibja.dllbox"
Wed 3 Sep 2003 401 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv12.bak"
Wed 3 Sep 2003 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Mon 6 Aug 2007 401 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv10.bak"
Sun 28 Oct 2007 20,222,992 A..H. --- "C:\Documents and Settings\trojan87\Local Settings\Temp\BIT4.tmp"
Fri 23 Nov 2007 65,536 ...H. --- "C:\Documents and Settings\nubian2\My Documents\COMM CHAMPIONS\~WRL2231.tmp"
Fri 23 Nov 2007 65,536 ...H. --- "C:\Documents and Settings\nubian2\My Documents\COMM CHAMPIONS\~WRL1845.tmp"
Fri 23 Nov 2007 65,536 ...H. --- "C:\Documents and Settings\nubian2\My Documents\COMM CHAMPIONS\~WRL3546.tmp"
Fri 23 Nov 2007 65,536 ...H. --- "C:\Documents and Settings\nubian2\My Documents\COMM CHAMPIONS\~WRL2318.tmp"
Thu 19 Jun 2008 22,016 ...H. --- "C:\Documents and Settings\nubian2\My Documents\RITES OF PASSAGE\~WRL2884.tmp"
Thu 19 Jun 2008 22,528 ...H. --- "C:\Documents and Settings\nubian2\My Documents\RITES OF PASSAGE\~WRL3997.tmp"
Thu 19 Jun 2008 25,088 ...H. --- "C:\Documents and Settings\nubian2\My Documents\RITES OF PASSAGE\~WRL2612.tmp"
Thu 19 Jun 2008 25,088 ...H. --- "C:\Documents and Settings\nubian2\My Documents\RITES OF PASSAGE\~WRL0694.tmp"
Fri 20 Jun 2008 27,648 ...H. --- "C:\Documents and Settings\nubian2\My Documents\RITES OF PASSAGE\~WRL3942.tmp"
Fri 20 Jun 2008 28,160 ...H. --- "C:\Documents and Settings\nubian2\My Documents\RITES OF PASSAGE\~WRL1945.tmp"
Fri 20 Jun 2008 29,696 ...H. --- "C:\Documents and Settings\nubian2\My Documents\RITES OF PASSAGE\~WRL0146.tmp"
Fri 20 Jun 2008 30,720 ...H. --- "C:\Documents and Settings\nubian2\My Documents\RITES OF PASSAGE\~WRL1437.tmp"
Fri 20 Jun 2008 34,304 ...H. --- "C:\Documents and Settings\nubian2\My Documents\RITES OF PASSAGE\~WRL0131.tmp"
Tue 17 Apr 2007 19,456 ...H. --- "C:\Documents and Settings\vicki morgan\My Documents\Coursework1\Drama\~WRL2283.tmp"
Sun 8 Oct 2006 27,136 ...H. --- "C:\Documents and Settings\Francine\Application Data\Microsoft\Templates\~WRL3317.tmp"
Sun 23 Jul 2006 23,040 ...H. --- "C:\Documents and Settings\Francine\Application Data\Microsoft\Word\~WRL0197.tmp"
Sat 14 Apr 2007 35,328 ...H. --- "C:\Documents and Settings\Francine\Application Data\Microsoft\Word\~WRL0004.tmp"
Sat 14 Apr 2007 35,840 ...H. --- "C:\Documents and Settings\Francine\Application Data\Microsoft\Word\~WRL2862.tmp"
Thu 29 Mar 2007 30,720 ...H. --- "C:\Documents and Settings\Francine\Application Data\Microsoft\Word\~WRL2591.tmp"
Thu 29 Mar 2007 31,744 ...H. --- "C:\Documents and Settings\Francine\Application Data\Microsoft\Word\~WRL1543.tmp"
Sun 21 Jan 2007 22,528 ...H. --- "C:\Documents and Settings\Francine\Application Data\Microsoft\Word\~WRL0003.tmp"
Sun 21 Jan 2007 24,064 ...H. --- "C:\Documents and Settings\Francine\Application Data\Microsoft\Word\~WRL0005.tmp"
Thu 29 Mar 2007 35,328 ...H. --- "C:\Documents and Settings\Francine\Application Data\Microsoft\Word\~WRL1826.tmp"
Thu 29 Mar 2007 35,840 ...H. --- "C:\Documents and Settings\Francine\Application Data\Microsoft\Word\~WRL1974.tmp"
Thu 29 Mar 2007 35,328 ...H. --- "C:\Documents and Settings\Francine\Application Data\Microsoft\Word\~WRL2178.tmp"
Sun 10 Dec 2006 138,752 ...H. --- "C:\Documents and Settings\trojan87\Application Data\Microsoft\Word\~WRL0004.tmp"
Mon 12 Nov 2007 182,272 ...H. --- "C:\Documents and Settings\nubian2\Application Data\Microsoft\Word\~WRL0081.tmp"
Mon 12 Nov 2007 182,784 ...H. --- "C:\Documents and Settings\nubian2\Application Data\Microsoft\Word\~WRL2643.tmp"
Thu 7 Sep 2006 32,256 ...H. --- "C:\Documents and Settings\nubian2\Application Data\Microsoft\Word\~WRL3863.tmp"
Fri 30 Dec 2005 26,624 ...H. --- "C:\Documents and Settings\nubian2\Application Data\Microsoft\Word\~WRL2486.tmp"
Fri 30 Dec 2005 27,136 ...H. --- "C:\Documents and Settings\nubian2\Application Data\Microsoft\Word\~WRL0981.tmp"
Wed 12 Apr 2006 26,624 ...H. --- "C:\Documents and Settings\nubian2\Application Data\Microsoft\Word\~WRL2864.tmp"
Wed 12 Apr 2006 27,648 ...H. --- "C:\Documents and Settings\nubian2\Application Data\Microsoft\Word\~WRL2865.tmp"
Wed 12 Apr 2006 28,672 ...H. --- "C:\Documents and Settings\nubian2\Application Data\Microsoft\Word\~WRL3277.tmp"
Wed 12 Apr 2006 27,136 ...H. --- "C:\Documents and Settings\nubian2\Application Data\Microsoft\Word\~WRL1818.tmp"
Thu 7 Sep 2006 19,456 ...H. --- "C:\Documents and Settings\nubian2\Application Data\Microsoft\Word\~WRL1693.tmp"
Fri 20 Jun 2008 31,744 ...H. --- "C:\Documents and Settings\nubian2\Application Data\Microsoft\Word\~WRL0133.tmp"
Fri 20 Jun 2008 32,256 ...H. --- "C:\Documents and Settings\nubian2\Application Data\Microsoft\Word\~WRL1197.tmp"
Fri 20 Jun 2008 33,792 ...H. --- "C:\Documents and Settings\nubian2\Application Data\Microsoft\Word\~WRL1421.tmp"
Sun 17 Apr 2005 23,040 ...H. --- "C:\Documents and Settings\nubian2\Application Data\Microsoft\Word\~WRL0004.tmp"
Sun 17 Apr 2005 23,040 ...H. --- "C:\Documents and Settings\nubian2\Application Data\Microsoft\Word\~WRL2359.tmp"
Sun 17 Apr 2005 23,040 ...H. --- "C:\Documents and Settings\nubian2\Application Data\Microsoft\Word\~WRL3733.tmp"
Sun 17 Apr 2005 22,528 ...H. --- "C:\Documents and Settings\nubian2\Application Data\Microsoft\Word\~WRL1028.tmp"

Finished!



HERE IS THE COMBOFIX REPORT
------------------------------------------

ComboFix 08-06-20.4 - trojan87 2008-06-26 19:35:44.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.1.1252.1.1033.18.72 [GMT 1:00]
Running from: C:\Documents and Settings\trojan87\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\salesmonitor
C:\Documents and Settings\All Users\Application Data\WinAntiVirus Pro 2007
C:\Documents and Settings\All Users\Application Data\WinAntiVirus Pro 2007\Data\Abbr
C:\Documents and Settings\All Users\Application Data\WinAntiVirus Pro 2007\Data\ActivationCode
C:\Documents and Settings\All Users\Application Data\WinAntiVirus Pro 2007\Data\ProductCode
C:\Documents and Settings\vicki morgan\Application Data\macromedia\Flash Player\#SharedObjects\BC5PEFQJ\iforex.com
C:\Documents and Settings\vicki morgan\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com
C:\Program Files\Common Files\companion wizard
C:\Program Files\Common Files\companion wizard\compwiz.exe
C:\Program Files\Common Files\companion wizard\WapCHK.dll
C:\Program Files\Common Files\winantivirus pro 2007
C:\Program Files\Common Files\winantivirus pro 2007\err.log
C:\UWA7P
C:\WINDOWS\BMabbe4c56.xml
C:\WINDOWS\cookies.ini
C:\WINDOWS\Fonts\'
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\abomnwpy.ini
C:\WINDOWS\system32\acwikyea.ini
C:\WINDOWS\system32\agkxixux.ini
C:\WINDOWS\system32\akfkajuk.ini
C:\WINDOWS\system32\amgvofkh.ini
C:\WINDOWS\system32\aoaxwune.ini
C:\WINDOWS\system32\auimusra.ini
C:\WINDOWS\system32\awtrOgdD.dll
C:\WINDOWS\system32\barhgibo.ini
C:\WINDOWS\system32\bboigoif.ini
C:\WINDOWS\system32\bdlootnu.dll
C:\WINDOWS\system32\bfmunyqj.ini
C:\WINDOWS\system32\bfytnnpw.ini
C:\WINDOWS\system32\bmf.cs
C:\WINDOWS\system32\bmstqpms.dll
C:\WINDOWS\system32\boyulgxp.ini
C:\WINDOWS\system32\bqlftnbv.ini
C:\WINDOWS\system32\btfsyhya.ini
C:\WINDOWS\system32\bvxodpqf.dll
C:\WINDOWS\system32\bwnjqhoh.ini
C:\WINDOWS\system32\bxxcniui.ini
C:\WINDOWS\system32\ccs.so
C:\WINDOWS\system32\ckhfojfc.ini
C:\WINDOWS\system32\cobpkbbe.ini
C:\WINDOWS\system32\ctfmon.exe.tmp
C:\WINDOWS\system32\cvdwmgtc.ini
C:\WINDOWS\system32\cvschitc.ini
C:\WINDOWS\system32\cwwbtwqg.dll
C:\WINDOWS\system32\cyvllwgr.ini
C:\WINDOWS\system32\dbiomvnj.ini
C:\WINDOWS\system32\DdgOrtwa.ini
C:\WINDOWS\system32\DdgOrtwa.ini2
C:\WINDOWS\system32\dfhwjykn.ini
C:\WINDOWS\system32\dtokpqfv.ini
C:\WINDOWS\system32\dtpnllem.ini
C:\WINDOWS\system32\dvnyxwik.ini
C:\WINDOWS\system32\ediddfse.ini
C:\WINDOWS\system32\eejxsgxn.ini
C:\WINDOWS\system32\ekbntqrf.ini
C:\WINDOWS\system32\emngxkna.ini
C:\WINDOWS\system32\eosfvfdc.ini
C:\WINDOWS\system32\ewfkfevk.ini
C:\WINDOWS\system32\eyovvwug.dll
C:\WINDOWS\system32\fcklxffa.ini
C:\WINDOWS\system32\flminmwb.dll
C:\WINDOWS\system32\fosvacwl.ini
C:\WINDOWS\system32\fovmydnv.ini
C:\WINDOWS\system32\fshlwluc.ini
C:\WINDOWS\system32\fsjateyt.ini
C:\WINDOWS\system32\ftctfmmb.ini
C:\WINDOWS\system32\gcqmhbyt.ini
C:\WINDOWS\system32\gipcojmt.ini
C:\WINDOWS\system32\gqiwcniw.ini
C:\WINDOWS\system32\gvjtmell.ini
C:\WINDOWS\system32\hbaaibgj.ini
C:\WINDOWS\system32\hlfxsjrh.ini
C:\WINDOWS\system32\ho.ln
C:\WINDOWS\system32\hoecpcgp.ini
C:\WINDOWS\system32\hpfrofhv.ini
C:\WINDOWS\system32\hrhvegcc.dll
C:\WINDOWS\system32\htqhgkxq.ini
C:\WINDOWS\system32\idhuecdn.ini
C:\WINDOWS\system32\igbwxxog.ini
C:\WINDOWS\system32\iijdwmsu.ini
C:\WINDOWS\system32\iitvrglg.ini
C:\WINDOWS\system32\ioyvcyfy.ini
C:\WINDOWS\system32\ipfftxlg.dll
C:\WINDOWS\system32\irmtylkr.ini
C:\WINDOWS\system32\jernldph.dll
C:\WINDOWS\system32\jeslostt.ini
C:\WINDOWS\system32\jgwundor.dll
C:\WINDOWS\system32\jkkpappb.dll
C:\WINDOWS\system32\jmklakpx.ini
C:\WINDOWS\system32\jtcygxnn.ini
C:\WINDOWS\system32\jvxglepm.ini
C:\WINDOWS\system32\khkogwij.ini
C:\WINDOWS\system32\klvplqrl.ini
C:\WINDOWS\system32\kmmollgf.ini
C:\WINDOWS\system32\ko.o
C:\WINDOWS\system32\kujljjot.ini
C:\WINDOWS\system32\kxhvraoo.ini
C:\WINDOWS\system32\lbffphgy.ini
C:\WINDOWS\system32\ljJDSlJb.dll
C:\WINDOWS\system32\lmqtqkbo.dll
C:\WINDOWS\system32\lqeoagkg.ini
C:\WINDOWS\system32\lrjycgsm.ini
C:\WINDOWS\system32\lrmfixqc.ini
C:\WINDOWS\system32\ltptlput.ini
C:\WINDOWS\system32\lxjrbofy.ini
C:\WINDOWS\system32\lyrjwcmw.ini
C:\WINDOWS\system32\lytfhpkg.ini
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mdrmsvlp.ini
C:\WINDOWS\system32\mfixnqoc.dll
C:\WINDOWS\system32\mfsgtdkc.dll
C:\WINDOWS\system32\mjsmmvdq.ini
C:\WINDOWS\system32\mlJAPIyY.dll
C:\WINDOWS\system32\mmdvrtba.ini
C:\WINDOWS\system32\mn.n
C:\WINDOWS\system32\mqljhnax.ini
C:\WINDOWS\system32\MSINET.oca
C:\WINDOWS\system32\muahukrb.ini
C:\WINDOWS\system32\mwpyfdcn.ini
C:\WINDOWS\system32\nbeuijgs.dll
C:\WINDOWS\system32\nhrjwvtu.ini
C:\WINDOWS\system32\nhtemaqe.ini
C:\WINDOWS\system32\nipjmcdh.ini
C:\WINDOWS\system32\nkpuuxpr.ini
C:\WINDOWS\system32\nnyqyrik.ini
C:\WINDOWS\system32\npqss.bak1
C:\WINDOWS\system32\npqss.bak2
C:\WINDOWS\system32\npqss.ini
C:\WINDOWS\system32\npqss.ini2
C:\WINDOWS\system32\npqss.tmp
C:\WINDOWS\system32\nultkcac.ini
C:\WINDOWS\system32\nvbattql.ini
C:\WINDOWS\system32\nvrsma.dll
C:\WINDOWS\system32\oemhuvse.dll
C:\WINDOWS\system32\ogajkuik.ini
C:\WINDOWS\system32\oipauddm.ini
C:\WINDOWS\system32\omkjwemy.ini
C:\WINDOWS\system32\orjqadof.ini
C:\WINDOWS\system32\oxlpskvx.ini
C:\WINDOWS\system32\oytpcttb.dll
C:\WINDOWS\system32\pcspajvs.ini
C:\WINDOWS\system32\pdlqwlhe.ini
C:\WINDOWS\system32\pfbfaqjm.ini
C:\WINDOWS\system32\phkubfdw.ini
C:\WINDOWS\system32\pklkbbea.ini
C:\WINDOWS\system32\povgjujj.ini
C:\WINDOWS\system32\proxupeb.ini
C:\WINDOWS\system32\psmohxbs.ini
C:\WINDOWS\system32\pvbswsds.ini
C:\WINDOWS\system32\pyeumogm.dll
C:\WINDOWS\system32\qaoskvir.ini
C:\WINDOWS\system32\qnkrcxxe.ini
C:\WINDOWS\system32\qoMgfeDw.dll
C:\WINDOWS\system32\qpdodtbg.dll
C:\WINDOWS\system32\qqstv.ini
C:\WINDOWS\system32\qqstv.ini2
C:\WINDOWS\system32\qwhwabtv.ini
C:\WINDOWS\system32\qxygewtf.ini
C:\WINDOWS\system32\rdfmjnsy.ini
C:\WINDOWS\system32\rigyjqte.ini
C:\WINDOWS\system32\rlmbolho.ini
C:\WINDOWS\system32\roibnwrs.ini
C:\WINDOWS\system32\rrartfpy.ini
C:\WINDOWS\system32\rrxnashi.ini
C:\WINDOWS\system32\rsschips.ini
C:\WINDOWS\system32\rubjdrbe.dll
C:\WINDOWS\system32\sacahpte.ini
C:\WINDOWS\system32\saesgcxc.ini
C:\WINDOWS\system32\salypoxt.ini
C:\WINDOWS\system32\sasboene.ini
C:\WINDOWS\system32\seffkedi.ini
C:\WINDOWS\system32\snqvsikj.ini
C:\WINDOWS\system32\snyokjfg.ini
C:\WINDOWS\system32\stera.job
C:\WINDOWS\system32\stera.log
C:\WINDOWS\system32\strhufsa.ini
C:\WINDOWS\system32\syeluwps.ini
C:\WINDOWS\system32\sykoqncw.ini
C:\WINDOWS\system32\taamjayg.ini
C:\WINDOWS\system32\thjjxdou.ini
C:\WINDOWS\system32\tjcacxuw.ini
C:\WINDOWS\system32\tjeytynn.ini
C:\WINDOWS\system32\tkwxdfct.ini
C:\WINDOWS\system32\tnflwrbs.ini
C:\WINDOWS\system32\toesevdt.ini
C:\WINDOWS\system32\tutywskj.ini
C:\WINDOWS\system32\twkwfegy.ini
C:\WINDOWS\system32\uacftykh.ini
C:\WINDOWS\system32\ubedbyun.dll
C:\WINDOWS\system32\udqxepwk.ini
C:\WINDOWS\system32\uixtrkua.ini
C:\WINDOWS\system32\ujviotpd.dll
C:\WINDOWS\system32\ulvbdtyo.ini
C:\WINDOWS\system32\urtwqgxy.ini
C:\WINDOWS\system32\utgxmovg.ini
C:\WINDOWS\system32\uuarherv.ini
C:\WINDOWS\system32\uvijlarw.ini
C:\WINDOWS\system32\uvusoyxe.ini
C:\WINDOWS\system32\uvyjfukl.ini
C:\WINDOWS\system32\uxlgqnxi.ini
C:\WINDOWS\system32\vbfmiwex.ini
C:\WINDOWS\system32\vdudmhls.dll
C:\WINDOWS\system32\vetdanjv.ini
C:\WINDOWS\system32\vhfjxboq.ini
C:\WINDOWS\system32\vlytjrgm.ini
C:\WINDOWS\system32\vnnfjlrg.ini
C:\WINDOWS\system32\vwcaxyhp.dll
C:\WINDOWS\system32\vybkorty.ini
C:\WINDOWS\system32\weygwswk.ini
C:\WINDOWS\system32\wgigymjn.ini
C:\WINDOWS\system32\wilbcusf.ini
C:\WINDOWS\system32\windbg___
C:\WINDOWS\system32\wjlmffgw.ini
C:\WINDOWS\system32\wpeplmxo.ini
C:\WINDOWS\system32\xbewhmgc.dll
C:\WINDOWS\system32\xdkdndfc.ini
C:\WINDOWS\system32\xjvomsjy.dll
C:\WINDOWS\system32\xjyndkve.ini
C:\WINDOWS\system32\xkoyfgna.ini
C:\WINDOWS\system32\xnovboik.ini
C:\WINDOWS\system32\xqxukhel.ini
C:\WINDOWS\system32\xtxaukoh.ini
C:\WINDOWS\system32\xvksplxo.dll
C:\WINDOWS\system32\xxsnhffv.ini
C:\WINDOWS\system32\ydkfdfbu.ini
C:\WINDOWS\system32\yemkhqys.ini
C:\WINDOWS\system32\yjnvocxr.ini
C:\WINDOWS\system32\ykpxqybl.ini
C:\WINDOWS\system32\ymxlkmvl.ini
C:\WINDOWS\system32\ypacsxdk.dll
C:\WINDOWS\system32\ypiknofo.ini
C:\WINDOWS\system32\yptwfqtv.ini
C:\WINDOWS\system32\ytvqcmua.ini
C:\WINDOWS\system32\yuhngdsd.ini
C:\WINDOWS\system32\yywuwbti.ini
C:\WINDOWS\winhelp.ini

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_DOMAINSERVICE
-------\Legacy_FOPN
-------\Legacy_RUNTIME
-------\Legacy_SMTPDRV
-------\Legacy_WINCOM32
-------\Legacy_WINDEV-4AF9-514C
-------\Service_DomainService
-------\Service_runtime
-------\Service_windev-4af9-514c


((((((((((((((((((((((((( Files Created from 2008-05-26 to 2008-06-26 )))))))))))))))))))))))))))))))
.

2008-06-26 19:53 . 2008-06-26 19:53 294 ---hs---- C:\WINDOWS\system32\gipcojmt.ini
2008-06-26 18:40 . 2008-06-26 18:41 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-06-26 18:40 . 2008-06-26 18:41 1,409 --a------ C:\WINDOWS\QTFont.for
2008-06-26 18:25 . 2008-06-26 18:25 107,008 --a------ C:\WINDOWS\system32\ucwhbtno.dll
2008-06-26 18:25 . 2008-06-26 18:25 95,232 --a------ C:\WINDOWS\system32\kllkthue.dll
2008-06-26 18:25 . 2008-06-26 18:25 86,016 --a------ C:\WINDOWS\system32\tmjocpig.dll
2008-06-26 18:24 . 2008-06-26 18:24 107,008 --a------ C:\WINDOWS\system32\fdvjimrd.dll
2008-06-26 18:21 . 2008-06-26 18:21 86,016 --a------ C:\WINDOWS\system32\kiukjago.dll
2008-06-26 18:20 . 2008-06-26 18:20 107,008 --a------ C:\WINDOWS\system32\ufdqbnyn.dll
2008-06-26 18:20 . 2008-06-26 18:20 95,232 --a------ C:\WINDOWS\system32\ddxvisvu.dll
2008-06-25 19:51 . 2008-06-25 19:51 <DIR> d--h----- C:\WINDOWS\system32\GroupPolicy
2008-06-25 19:25 . 2008-06-25 19:25 <DIR> d--hs---- C:\FOUND.003
2008-06-25 18:49 . 2008-06-25 18:49 <DIR> d-------- C:\WINDOWS\ERUNT
2008-06-25 18:42 . 2008-06-25 15:45 <DIR> d-------- C:\SDFix
2008-06-25 18:25 . 2008-06-25 18:25 <DIR> d-------- C:\Documents and Settings\Administrator
2008-06-25 18:24 . 2008-06-25 18:24 <DIR> d--hs---- C:\FOUND.002
2008-06-25 18:00 . 2008-06-25 18:00 <DIR> d--hs---- C:\FOUND.001
2008-06-25 17:51 . 2008-06-25 17:51 <DIR> d-------- C:\Program Files\Common Files\Softwin
2008-06-25 17:44 . 2008-06-25 17:44 107,520 --a------ C:\WINDOWS\system32\ajwjmxkt.dll
2008-06-25 17:38 . 2008-06-25 17:38 95,232 --a------ C:\WINDOWS\system32\eucniien.dll
2008-06-23 19:24 . 2008-06-23 19:24 106,496 --a------ C:\WINDOWS\system32\msgsmuqf.dll
2008-06-23 19:21 . 2008-06-23 19:21 95,232 --a------ C:\WINDOWS\system32\qvijbtpw.dll
2008-06-21 18:07 . 2008-06-21 18:07 <DIR> d-------- C:\Program Files\Disc2Phone
2008-06-21 16:56 . 2008-06-21 16:56 101,888 --a------ C:\WINDOWS\system32\wuaregfa.dll
2008-06-21 16:48 . 2008-06-21 16:49 94,208 --a------ C:\WINDOWS\system32\mcveadln.dll
2008-06-19 19:49 . 2008-06-19 19:49 <DIR> d-------- C:\WINDOWS\Sun
2008-06-19 19:21 . 2008-06-19 19:21 <DIR> d-------- C:\Program Files\Trend Micro
2008-06-19 16:59 . 2008-06-19 16:59 <DIR> d---s---- C:\WINDOWS\Downloaded Program Files
2008-06-19 14:58 . 2008-06-19 14:58 <DIR> d--hs---- C:\FOUND.000
2008-06-18 20:39 . 2008-06-18 20:39 2,855 --a------ C:\WINDOWS\system32\vtsqq.PIF
2008-06-18 18:51 . 2008-06-18 18:51 <DIR> d-------- C:\WINDOWS\system32\NtmsData
2008-06-18 18:33 . 2008-06-18 18:33 <DIR> d-------- C:\Program Files\Zone Labs
2008-06-18 18:33 . 2008-06-18 18:33 <DIR> d--hs---- C:\AntiSpywareMaster
2008-06-18 18:06 . 2008-06-18 18:06 <DIR> d-------- C:\Documents and Settings\Guest.XFDXFG-1NPE3D14
2008-06-16 18:44 . 2008-06-16 18:44 <DIR> d-------- C:\Program Files\Comodo
2008-06-16 18:42 . 2008-06-16 18:42 7,943,248 --------- C:\CFP_Setup_English_2.4.18.184.exe
2008-06-16 15:57 . 2008-04-02 21:07 75,248 --a------ C:\WINDOWS\zllsputility.exe
2008-06-16 15:57 . 2008-06-16 16:30 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat
2008-06-16 15:56 . 2008-06-16 15:56 <DIR> d-------- C:\WINDOWS\system32\ZoneLabs
2008-06-16 15:38 . 2008-06-16 15:38 28,515,288 --------- C:\a2FreeSetup.exe
2008-06-16 15:38 . 2008-06-16 15:38 1,670,040 --------- C:\a2HiJackFreeSetup.exe
2008-06-16 14:12 . 2008-06-16 14:11 140,288 --------- C:\vcleaner.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-13 13:29 561,152 ----a-w C:\WINDOWS\system32\user32.DLL
2008-06-13 13:29 561,152 ----a-w C:\WINDOWS\system32\dllcache\user32.dll
2008-05-20 12:48 --------- d-----w C:\Documents and Settings\vicki morgan\Application Data\U3
2008-05-17 18:23 51,716 ----a-w C:\WINDOWS\system32\pdf995mon.dll
2008-05-17 18:23 249,856 ----a-w C:\WINDOWS\system32\pdfmona.dll
2008-05-17 17:42 --------- d-----w C:\Documents and Settings\All Users\Application Data\pdf995
2008-05-17 17:41 --------- d-----w C:\Program Files\pdf995
2008-04-28 19:10 --------- d-----w C:\Program Files\LimeWire
2008-04-15 22:46 89,070 ----a-w C:\WINDOWS\system32\myss_sb_uninstall.exe
2008-01-05 22:35 77 ------w C:\Documents and Settings\nubian2\2012.bat
2006-11-18 09:12 318,336 ----a-w C:\Documents and Settings\vicki morgan\Application Data\GDIPFONTCACHEV1.DAT
2007-09-06 19:48 848 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2007-09-06 19:48 88 --sh--r C:\WINDOWS\system32\93E7034298.sys
.
<pre>
----a-w			13,312 2008-01-21 10:54:04  C:\WINDOWS\system32\ctfmon .exe
</pre>

C:\WINDOWS\system32\user32.dll ... is infected !! (additional data below)
561,152 2008-06-13 13:29:38 C:\WINDOWS\system32\user32.DLL
561,152 2008-06-13 13:29:38 C:\WINDOWS\system32\dllcache\user32.dll


------- Sigcheck -------

2008-06-13 14:29 561152 359469dda81d28aee3f8790225a084ab C:\WINDOWS\system32\user32.DLL
2008-06-13 14:29 561152 359469dda81d28aee3f8790225a084ab C:\WINDOWS\system32\dllcache\user32.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{167B2B6C-BB60-4EDD-AAD7-4686EA75B595}]
C:\WINDOWS\System32\awtrOgdD.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{514A5C49-0C7D-42c3-A71B-38864A269B7A}]
C:\WINDOWS\System32\bmstqpms.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{77377263-961e-497c-9a64-f4e78059a20a}]
2008-06-26 18:25 107008 --a------ C:\WINDOWS\System32\ucwhbtno.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [ ]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:54 5674352]
"EPSON Stylus DX4400 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\E_S20IC1.EXE" [ ]
"jdgf894jrghoiiskd"="C:\DOCUME~1\trojan87\LOCALS~1\Temp\winlogan.exe" [ ]
"Jnskdfmf9eldfd"="C:\DOCUME~1\trojan87\LOCALS~1\Temp\csrssc.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [ ]
"ipmon"="ipmon.exe" []
"MPSExe"="c:\PROGRA~1\mcafee.com\mps\mscifapp.exe" [ ]
"SiteAdvisor"="C:\Program Files\SiteAdvisor\6172\SiteAdv.exe" [ ]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [ ]
"ISUSScheduler"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\issch.exe" [ ]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [ ]
"SDFix"="C:\DOCUME~1\ADMINI~1\Desktop\sdfix\SDFix\RunThis.bat" [2008-06-25 15:43 734899]
"jdgf894jrghoiiskd"="C:\DOCUME~1\trojan87\LOCALS~1\Temp\winlogan.exe" [ ]
"a88d7fca"="C:\WINDOWS\System32\tmjocpig.dll" [2008-06-26 18:25 86016]
"combofix"="C:\WINDOWS\system32\CF20704.exe" [2001-08-18 11:00 375808]
"BMabbe4c56"="C:\WINDOWS\System32\kllkthue.dll" [2008-06-26 18:25 95232]

C:\Documents and Settings\vicki morgan\Start Menu\Programs\Startup\
LimeWire On Startup.lnk - C:\Program Files\LimeWire\LimeWire.exe [2008-04-18 20:21:09 147456]

C:\Documents and Settings\trojan87\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 19:16:50 110592]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"disableregistrytools"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoFolderOptions"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{FFF29BE4-24AC-4E31-B99B-45238B764111}"= C:\WINDOWS\system32\byxvvut.dll [ ]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\byxvvut]
byxvvut.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\isuhibja]
isuhibja.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ssqpn]
C:\WINDOWS\System32\ssqpn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winubg32]
winubg32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\xxyvvwv]
xxyvvwv.dll

[HKEY_CURRENT_USER\software\microsoft\windows nt\currentversion\windows]
"load"=C:\WINDOWS\System32\vtsqq.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=msgsmuqf.dll
"wapInit_Dlls"=nvrsma

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\windows\\system32\\nvsvct0.exe"=
"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"=
"C:\WINDOWS\System32\dcphkhmt.exe"= C:\WINDOWS\System32\dcp

R3 iadusb;MT882;C:\WINDOWS\System32\DRIVERS\glauiad.sys [2006-07-27 16:37]
S3 w200bus;Sony Ericsson W200 driver (WDM);C:\WINDOWS\System32\DRIVERS\w200bus.sys [2006-11-07 09:42]
S3 w200mdfl;Sony Ericsson W200 USB WMC Modem Filter;C:\WINDOWS\System32\DRIVERS\w200mdfl.sys [2006-10-24 14:11]
S3 w200mdm;Sony Ericsson W200 USB WMC Modem Driver;C:\WINDOWS\System32\DRIVERS\w200mdm.sys [2006-10-24 14:11]
S3 w200mgmt;Sony Ericsson W200 USB WMC Device Management Drivers (WDM);C:\WINDOWS\System32\DRIVERS\w200mgmt.sys [2006-10-24 14:12]
S3 w200obex;Sony Ericsson W200 USB WMC OBEX Interface;C:\WINDOWS\System32\DRIVERS\w200obex.sys [2006-10-24 14:12]

.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-26 19:53:00
Windows 5.1.2600 Service Pack 1 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\GUARD.EXE
C:\WINDOWS\SYSTEM32\WDFMGR.EXE
C:\WINDOWS\System32\WgaTray.exe
C:\WINDOWS\SYSTEM32\RUNDLL32.EXE
C:\WINDOWS\SYSTEM32\RUNDLL32.EXE
.
**************************************************************************
.
Completion time: 2008-06-26 19:56:22 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-26 18:56:18

Pre-Run: 4,395,220,992 bytes free
Post-Run: 4,842,962,944 bytes free

421 --- E O F --- 2008-06-12 09:29:48

#5 theodore

theodore
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:47 PM

Posted 27 June 2008 - 09:14 AM

HERE IS THE COMBOFIX QUARANTINED FILES REPORT

---------------------------------------------------------------

2007-04-26 05:30 29184 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\MSINET.oca.vir
2007-04-26 14:23 1509574 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\strhufsa.ini.vir
2007-05-05 18:54 879180 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\npqss.ini.vir
2007-05-05 18:54 879180 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\npqss.tmp.vir
2007-05-10 18:45 1445272 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\vhfjxboq.ini.vir
2007-05-12 23:02 1431341 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\syeluwps.ini.vir
2007-05-13 18:09 1431626 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\orjqadof.ini.vir
2007-05-13 18:11 1431350 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\oipauddm.ini.vir
2007-05-13 19:34 1431386 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\udqxepwk.ini.vir
2007-05-13 19:34 1431446 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\bfmunyqj.ini.vir
2007-05-13 19:35 1429676 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\yuhngdsd.ini.vir
2007-05-13 21:52 1431368 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\qnkrcxxe.ini.vir
2007-05-14 10:16 1429883 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\omkjwemy.ini.vir
2007-05-14 10:47 1429695 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\tkwxdfct.ini.vir
2007-05-15 11:47 1328520 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\klvplqrl.ini.vir
2007-05-15 11:48 1462725 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\bfytnnpw.ini.vir
2007-05-15 16:19 1462803 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\iitvrglg.ini.vir
2007-05-15 16:22 1462431 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\jvxglepm.ini.vir
2007-05-15 20:51 1464735 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\acwikyea.ini.vir
2007-05-16 08:40 1466274 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\xkoyfgna.ini.vir
2007-05-18 12:49 844889 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\iijdwmsu.ini.vir
2007-05-18 19:16 833222 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\nkpuuxpr.ini.vir
2007-05-19 00:48 833282 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\barhgibo.ini.vir
2007-05-19 12:06 833221 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\tjeytynn.ini.vir
2007-05-21 18:35 831918 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\lytfhpkg.ini.vir
2007-05-21 18:35 832517 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\rrartfpy.ini.vir
2007-05-22 20:52 830763 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\mjsmmvdq.ini.vir
2007-05-23 18:22 828102 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\wilbcusf.ini.vir
2007-05-23 22:34 574180 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\nvbattql.ini.vir
2007-05-24 10:10 690289 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\aoaxwune.ini.vir
2007-05-24 10:10 719996 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\abomnwpy.ini.vir
2007-05-24 23:01 1010897 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\tutywskj.ini.vir
2007-05-24 23:02 1010776 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\irmtylkr.ini.vir
2007-05-27 11:36 1083839 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\lbffphgy.ini.vir
2007-05-27 12:49 1083838 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\sasboene.ini.vir
2007-05-28 12:54 1084198 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\gqiwcniw.ini.vir
2007-05-28 19:50 1083899 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\psmohxbs.ini.vir
2007-05-30 14:05 657104 --a------ C:\Qoobox\Quarantine\C\Program Files\Common Files\Companion Wizard\compwiz.exe.vir
2007-05-30 23:36 1105592 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\weygwswk.ini.vir
2007-05-30 23:38 1105119 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\eejxsgxn.ini.vir
2007-05-31 22:28 1101454 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\pvbswsds.ini.vir
2007-06-01 13:48 1100540 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\xxsnhffv.ini.vir
2007-06-02 11:34 1067896 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\ykpxqybl.ini.vir
2007-06-03 16:29 1101076 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\ypiknofo.ini.vir
2007-06-04 21:20 1099265 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\dvnyxwik.ini.vir
2007-06-04 21:23 1061572 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\rigyjqte.ini.vir
2007-06-05 18:40 1045683 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\sacahpte.ini.vir
2007-06-05 20:50 1045682 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\xqxukhel.ini.vir
2007-06-06 08:47 1067167 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\utgxmovg.ini.vir
2007-06-06 21:14 1105927 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\saesgcxc.ini.vir
2007-06-06 21:17 1011925 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\igbwxxog.ini.vir
2007-06-07 12:49 1004770 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\pcspajvs.ini.vir
2007-06-08 01:03 1005071 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\rlmbolho.ini.vir
2007-06-08 01:04 983922 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\nnyqyrik.ini.vir
2007-06-08 09:10 982784 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\vbfmiwex.ini.vir
2007-06-08 13:41 982905 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\lrmfixqc.ini.vir
2007-06-08 13:42 971662 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\hpfrofhv.ini.vir
2007-06-08 19:54 970851 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\jmklakpx.ini.vir
2007-06-09 11:02 970851 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\pklkbbea.ini.vir
2007-06-09 21:26 970793 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\ftctfmmb.ini.vir
2007-06-10 19:04 970792 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\fosvacwl.ini.vir
2007-06-10 19:34 970914 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\cvschitc.ini.vir
2007-06-10 19:37 970793 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\muahukrb.ini.vir
2007-06-11 21:19 1912771 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\bboigoif.ini.vir
2007-06-11 21:20 1908073 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\wjlmffgw.ini.vir
2007-06-11 21:24 943748 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\akfkajuk.ini.vir
2007-06-12 09:18 943808 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\nhtemaqe.ini.vir
2007-06-12 09:21 943868 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\htqhgkxq.ini.vir
2007-06-12 13:43 943928 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\pfbfaqjm.ini.vir
2007-06-13 11:56 938089 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\uuarherv.ini.vir
2007-06-13 12:56 943758 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\seffkedi.ini.vir
2007-06-13 22:00 943927 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\phkubfdw.ini.vir
2007-06-13 22:09 931081 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\nhrjwvtu.ini.vir
2007-06-13 22:55 936862 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\bxxcniui.ini.vir
2007-06-13 22:56 936922 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\ulvbdtyo.ini.vir
2007-06-14 07:13 931144 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\cyvllwgr.ini.vir
2007-06-14 10:11 931274 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\agkxixux.ini.vir
2007-06-14 10:15 931263 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\wpeplmxo.ini.vir
2007-06-14 13:22 933882 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\taamjayg.ini.vir
2007-06-14 22:55 934003 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\idhuecdn.ini.vir
2007-06-15 05:53 934123 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\auimusra.ini.vir
2007-06-15 05:55 922130 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\dbiomvnj.ini.vir
2007-06-15 07:16 921830 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\ymxlkmvl.ini.vir
2007-06-15 07:27 921949 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\vnnfjlrg.ini.vir
2007-06-15 09:15 922069 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\lxjrbofy.ini.vir
2007-06-15 09:16 922129 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\mwpyfdcn.ini.vir
2007-06-15 21:17 921768 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\ediddfse.ini.vir
2007-06-16 13:44 921950 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\uixtrkua.ini.vir
2007-06-16 15:29 921828 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\qaoskvir.ini.vir
2007-06-16 15:30 921767 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\qwhwabtv.ini.vir
2007-06-16 16:20 921829 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\hoecpcgp.ini.vir
2007-06-16 16:27 921890 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\yemkhqys.ini.vir
2007-06-16 16:35 921768 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\mqljhnax.ini.vir
2007-06-17 09:16 921950 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\boyulgxp.ini.vir
2007-06-17 09:17 921769 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\ytvqcmua.ini.vir
2007-06-17 11:38 921950 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\xjyndkve.ini.vir
2007-06-17 13:31 922069 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\xtxaukoh.ini.vir
2007-06-17 13:51 921768 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\qxygewtf.ini.vir
2007-06-17 13:51 921769 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\sykoqncw.ini.vir
2007-06-17 14:32 1216996 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\npqss.bak1.vir
2007-06-17 15:15 921830 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\fcklxffa.ini.vir
2007-06-17 15:16 921769 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\bwnjqhoh.ini.vir
2007-06-17 15:16 921770 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\kxhvraoo.ini.vir
2007-06-17 15:26 921768 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\lqeoagkg.ini.vir
2007-06-17 18:25 921830 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\yywuwbti.ini.vir
2007-06-17 18:26 921769 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\ydkfdfbu.ini.vir
2007-06-17 18:26 921770 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\pdlqwlhe.ini.vir
2007-06-17 18:50 0 --a------ C:\Qoobox\Quarantine\C\Program Files\Common Files\WinAntiVirus Pro 2007\err.log.vir
2007-06-17 18:50 20 --a------ C:\Qoobox\Quarantine\C\Documents and Settings\All Users\Application Data\WinAntiVirus Pro 2007\Data\ProductCode.vir
2007-06-17 18:50 5 --a------ C:\Qoobox\Quarantine\C\Documents and Settings\All Users\Application Data\WinAntiVirus Pro 2007\Data\Abbr.vir
2007-06-17 18:51 36 --a------ C:\Qoobox\Quarantine\C\Documents and Settings\All Users\Application Data\WinAntiVirus Pro 2007\Data\ActivationCode.vir
2007-06-17 21:34 921767 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\ckhfojfc.ini.vir
2007-06-18 06:48 2 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\stera.log.vir
2007-06-18 06:50 921830 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\jtcygxnn.ini.vir
2007-06-18 12:40 921959 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\mdrmsvlp.ini.vir
2007-06-18 12:43 922009 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\urtwqgxy.ini.vir
2007-06-18 13:46 898484 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\toesevdt.ini.vir
2007-06-18 19:49 898545 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\snyokjfg.ini.vir
2007-06-19 02:05 898943 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\ewfkfevk.ini.vir
2007-06-19 02:17 898762 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\cobpkbbe.ini.vir
2007-06-19 11:14 898823 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\dtpnllem.ini.vir
2007-06-19 16:15 898883 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\vybkorty.ini.vir
2007-06-20 12:48 1227731 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\npqss.bak2.vir
2007-06-20 16:35 879342 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\npqss.ini2.vir
2007-06-29 18:34 48128 --a------ C:\Qoobox\Quarantine\C\Program Files\Common Files\Companion Wizard\WapCHK.dll.vir
2007-06-30 18:14 2 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\stera.job.vir
2007-07-02 10:57 1462338 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\salypoxt.ini.vir
2007-09-11 04:00 32 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\windbg___.vir
2008-01-14 22:10 9 --a------ C:\Qoobox\Quarantine\C\WINDOWS\WinHelp.ini.vir
2008-01-20 14:01 1073292 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\uvusoyxe.ini.vir
2008-01-21 01:04 1073412 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\eosfvfdc.ini.vir
2008-01-21 01:04 1073481 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\ioyvcyfy.ini.vir
2008-01-23 23:17 13312 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\ctfmon.exe.tmp.vir
2008-01-24 10:01 1119969 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\ltptlput.ini.vir
2008-01-24 10:13 1119265 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\yjnvocxr.ini.vir
2008-01-25 18:54 1142572 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\rsschips.ini.vir
2008-01-25 21:08 1142684 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\hbaaibgj.ini.vir
2008-01-30 13:39 1166711 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\vetdanjv.ini.vir
2008-01-31 19:16 1184434 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\xnovboik.ini.vir
2008-02-02 11:09 1188432 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\kujljjot.ini.vir
2008-02-03 19:54 1188432 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\bqlftnbv.ini.vir
2008-02-07 18:11 1194375 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\wgigymjn.ini.vir
2008-02-07 18:11 1219534 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\fshlwluc.ini.vir
2008-02-08 22:10 1220530 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\ekbntqrf.ini.vir
2008-02-11 18:20 1220710 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\vlytjrgm.ini.vir
2008-02-12 12:23 1224936 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\btfsyhya.ini.vir
2008-02-13 20:55 1239737 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\hlfxsjrh.ini.vir
2008-02-14 20:52 1240175 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\dtokpqfv.ini.vir
2008-02-14 20:53 1245519 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\roibnwrs.ini.vir
2008-02-14 23:16 1240397 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\povgjujj.ini.vir
2008-02-17 15:28 1614719 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\jeslostt.ini.vir
2008-02-18 14:55 1085720 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\lyrjwcmw.ini.vir
2008-02-19 13:45 1086003 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\rrxnashi.ini.vir
2008-02-20 20:54 1244703 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\emngxkna.ini.vir
2008-02-20 20:54 1244763 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\proxupeb.ini.vir
2008-02-22 11:20 1245133 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\khkogwij.ini.vir
2008-02-23 14:54 1157637 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\uvyjfukl.ini.vir
2008-02-24 14:57 1094932 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\amgvofkh.ini.vir
2008-02-25 14:57 1095292 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\thjjxdou.ini.vir
2008-02-25 15:10 1095232 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\nultkcac.ini.vir
2008-02-28 10:23 1244598 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\uacftykh.ini.vir
2008-02-28 21:17 1244847 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\fovmydnv.ini.vir
2008-03-01 23:17 1286381 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\tnflwrbs.ini.vir
2008-03-02 16:13 1286717 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\tjcacxuw.ini.vir
2008-03-04 17:20 1303018 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\kmmollgf.ini.vir
2008-03-05 16:07 1307895 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\dfhwjykn.ini.vir
2008-03-06 00:27 1307443 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\gcqmhbyt.ini.vir
2008-03-07 12:44 1306746 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\fsjateyt.ini.vir
2008-03-09 16:46 1307913 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\gvjtmell.ini.vir
2008-03-09 18:24 1308033 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\cvdwmgtc.ini.vir
2008-03-10 19:47 1317743 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\twkwfegy.ini.vir
2008-03-12 10:58 201785 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\qqstv.ini2.vir
2008-03-12 11:01 201785 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\qqstv.ini.vir
2008-06-13 14:29 221184 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\nvrsma.dll.vir
2008-06-13 14:29 285696 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\awtrOgdD.dll.vir
2008-06-13 14:29 28672 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\bmf.cs.vir
2008-06-13 14:29 28672 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\ccs.so.vir
2008-06-13 14:29 28672 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\ko.o.vir
2008-06-13 14:30 102400 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\flminmwb.dll.vir
2008-06-13 14:30 94208 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\oytpcttb.dll.vir
2008-06-13 15:40 30208 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\mlJAPIyY.dll.vir
2008-06-13 16:27 94208 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\xbewhmgc.dll.vir
2008-06-13 16:28 102400 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\rubjdrbe.dll.vir
2008-06-14 18:42 95232 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\pyeumogm.dll.vir
2008-06-14 18:44 101376 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\vdudmhls.dll.vir
2008-06-14 18:59 1661929 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\yptwfqtv.ini.vir
2008-06-16 12:00 1659439 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\xdkdndfc.ini.vir
2008-06-16 12:01 101888 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\xjvomsjy.dll.vir
2008-06-16 12:01 94720 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\ipfftxlg.dll.vir
2008-06-16 13:58 94720 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\eyovvwug.dll.vir
2008-06-16 14:00 101888 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\mfixnqoc.dll.vir
2008-06-16 14:01 101888 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\ypacsxdk.dll.vir
2008-06-16 14:01 94720 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\bdlootnu.dll.vir
2008-06-16 14:03 1659920 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\oxlpskvx.ini.vir
2008-06-16 14:04 87040 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\xvksplxo.dll.vir
2008-06-16 14:11 1659742 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\uvijlarw.ini.vir
2008-06-16 15:12 33792 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\ljJDSlJb.dll.vir
2008-06-16 15:21 33792 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\qoMgfeDw.dll.vir
2008-06-17 12:02 92160 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\ujviotpd.dll.vir
2008-06-17 12:04 92160 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\ubedbyun.dll.vir
2008-06-17 12:07 95232 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\cwwbtwqg.dll.vir
2008-06-17 12:13 101376 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\jgwundor.dll.vir
2008-06-18 12:17 1656398 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\snqvsikj.ini.vir
2008-06-18 12:18 93696 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\vwcaxyhp.dll.vir
2008-06-18 12:19 101376 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\lmqtqkbo.dll.vir
2008-06-18 12:19 92160 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\mfsgtdkc.dll.vir
2008-06-19 14:34 1657806 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\uxlgqnxi.ini.vir
2008-06-19 14:34 92160 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\bvxodpqf.dll.vir
2008-06-19 14:36 93696 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\jernldph.dll.vir
2008-06-19 14:42 101376 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\jkkpappb.dll.vir
2008-06-21 16:47 1865307 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\rdfmjnsy.ini.vir
2008-06-21 16:50 92160 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\oemhuvse.dll.vir
2008-06-23 19:18 92160 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\qpdodtbg.dll.vir
2008-06-23 19:19 1693444 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\nipjmcdh.ini.vir
2008-06-25 17:38 2336834 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\mmdvrtba.ini.vir
2008-06-25 17:38 92160 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\nbeuijgs.dll.vir
2008-06-25 18:59 28672 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\mn.n.vir
2008-06-25 18:59 63488 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\ho.ln.vir
2008-06-26 18:18 92160 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\hrhvegcc.dll.vir
2008-06-26 18:21 1727367 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\lrjycgsm.ini.vir
2008-06-26 18:23 1727539 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\ogajkuik.ini.vir
2008-06-26 18:25 92160 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\bmstqpms.dll.vir
2008-06-26 19:15 2552 --a------ C:\Qoobox\Quarantine\C\WINDOWS\cookies.ini.vir
2008-06-26 19:17 143 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\mcrh.tmp.vir
2008-06-26 19:24 1727343 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\gipcojmt.ini.vir
2008-06-26 19:33 562659 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\DdgOrtwa.ini2.vir
2008-06-26 19:36 562659 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\DdgOrtwa.ini.vir
2008-06-26 19:40 1124 --a------ C:\Qoobox\Quarantine\Registry_backups\Legacy_WINDEV-4AF9-514C.reg.dat
2008-06-26 19:40 1322 --a------ C:\Qoobox\Quarantine\Registry_backups\Legacy_RUNTIME.reg.dat
2008-06-26 19:40 2750 --a------ C:\Qoobox\Quarantine\Registry_backups\Service_windev-4af9-514c.reg.dat
2008-06-26 19:40 284 --a------ C:\Qoobox\Quarantine\Registry_backups\Legacy_SMTPDRV.reg.dat
2008-06-26 19:40 286 --a------ C:\Qoobox\Quarantine\Registry_backups\Legacy_WINCOM32.reg.dat
2008-06-26 19:40 2956 --a------ C:\Qoobox\Quarantine\Registry_backups\Service_DomainService.reg.dat
2008-06-26 19:40 750 --a------ C:\Qoobox\Quarantine\Registry_backups\Service_runtime.reg.dat
2008-06-26 19:40 774 --a------ C:\Qoobox\Quarantine\Registry_backups\Legacy_FOPN.reg.dat
2008-06-26 19:40 846 --a------ C:\Qoobox\Quarantine\Registry_backups\Legacy_DOMAINSERVICE.reg.dat
2008-06-26 19:44 54 --a------ C:\Qoobox\Quarantine\catchme.log
2008-06-26 19:52 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\BMabbe4c56.xml.vir
2008-06-26 19:52 103269 --a------ C:\Qoobox\Quarantine\catchme2008-06-26_195244.25.zip
2008-06-26 19:52 22 --a------ C:\Qoobox\Quarantine\C\WINDOWS\pskt.ini.vir

#6 theodore

theodore
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:47 PM

Posted 27 June 2008 - 09:15 AM

HERE IS THE HIJACKTHIS LOG RUN AFTER THE COMBOFIX

-----------------------------------------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:13:53, on 26/06/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\WgaTray.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\Rundll32.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.rd.yahoo.com/customize/ycomp/def.../search/ie.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.rd.yahoo.com/customize/ycomp/def...://uk.yahoo.com
R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
F3 - REG:win.ini: load=C:\WINDOWS\System32\vtsqq.exe
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: (no name) - {167B2B6C-BB60-4EDD-AAD7-4686EA75B595} - C:\WINDOWS\System32\awtrOgdD.dll (file missing)
O2 - BHO: (no name) - {514A5C49-0C7D-42c3-A71B-38864A269B7A} - C:\WINDOWS\System32\bmstqpms.dll (file missing)
O2 - BHO: {a02a9508-7e4f-46a9-c794-e16936277377} - {77377263-961e-497c-9a64-f4e78059a20a} - C:\WINDOWS\System32\ucwhbtno.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ipmon] ipmon.exe
O4 - HKLM\..\Run: [MPSExe] c:\PROGRA~1\mcafee.com\mps\mscifapp.exe /embedding
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6172\SiteAdv.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\issch.exe" -start
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [SDFix] C:\DOCUME~1\ADMINI~1\Desktop\sdfix\SDFix\RunThis.bat /second
O4 - HKLM\..\Run: [jdgf894jrghoiiskd] C:\DOCUME~1\trojan87\LOCALS~1\Temp\winlogan.exe
O4 - HKLM\..\Run: [a88d7fca] rundll32.exe "C:\WINDOWS\System32\tmjocpig.dll",b
O4 - HKLM\..\Run: [combofix] C:\WINDOWS\system32\CF20704.exe /c C:\ComboFix\Combobatch.bat
O4 - HKLM\..\Run: [BMabbe4c56] Rundll32.exe "C:\WINDOWS\System32\kllkthue.dll",s
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [EPSON Stylus DX4400 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\E_S20IC1.EXE /FU "C:\DOCUME~1\trojan87\LOCALS~1\Temp\E_S1B.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [jdgf894jrghoiiskd] C:\DOCUME~1\trojan87\LOCALS~1\Temp\winlogan.exe
O4 - HKCU\..\Run: [Jnskdfmf9eldfd] C:\DOCUME~1\trojan87\LOCALS~1\Temp\csrssc.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab56986.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{BF4F422E-4E00-4F57-805C-FF332126BB01}: NameServer = 158.43.128.72,158.43.192.1,158.43.128.1
O20 - AppInit_DLLs: msgsmuqf.dll
O20 - Winlogon Notify: byxvvut - byxvvut.dll (file missing)
O20 - Winlogon Notify: isuhibja - isuhibja.dll (file missing)
O20 - Winlogon Notify: ssqpn - C:\WINDOWS\System32\ssqpn.dll (file missing)
O20 - Winlogon Notify: winubg32 - winubg32.dll (file missing)
O20 - Winlogon Notify: xxyvvwv - xxyvvwv.dll (file missing)
O21 - SSODL: WinCTL - {009541A0-3B00-1F1C-00F3-040224009C02} - (no file)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\System32\PSIService.exe (file missing)

--
End of file - 6490 bytes

#7 theodore

theodore
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:47 PM

Posted 27 June 2008 - 09:18 AM

I THEN RAN VCLEANER (A VIRUS CHECK AS YOU RECOMMENDED) AND IT REPORTED NO ISSUES.
THIS IS THE HIJACKTHIS LOG RUN AFTERWARDS.

--------------------------------------------------------------------------------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:21:48, on 26/06/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\WgaTray.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\Rundll32.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.rd.yahoo.com/customize/ycomp/def.../search/ie.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.rd.yahoo.com/customize/ycomp/def...://uk.yahoo.com
R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
F3 - REG:win.ini: load=C:\WINDOWS\System32\vtsqq.exe
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: (no name) - {167B2B6C-BB60-4EDD-AAD7-4686EA75B595} - C:\WINDOWS\System32\awtrOgdD.dll (file missing)
O2 - BHO: (no name) - {514A5C49-0C7D-42c3-A71B-38864A269B7A} - C:\WINDOWS\System32\bmstqpms.dll (file missing)
O2 - BHO: {a02a9508-7e4f-46a9-c794-e16936277377} - {77377263-961e-497c-9a64-f4e78059a20a} - C:\WINDOWS\System32\ucwhbtno.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ipmon] ipmon.exe
O4 - HKLM\..\Run: [MPSExe] c:\PROGRA~1\mcafee.com\mps\mscifapp.exe /embedding
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6172\SiteAdv.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\issch.exe" -start
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [SDFix] C:\DOCUME~1\ADMINI~1\Desktop\sdfix\SDFix\RunThis.bat /second
O4 - HKLM\..\Run: [jdgf894jrghoiiskd] C:\DOCUME~1\trojan87\LOCALS~1\Temp\winlogan.exe
O4 - HKLM\..\Run: [a88d7fca] rundll32.exe "C:\WINDOWS\System32\tmjocpig.dll",b
O4 - HKLM\..\Run: [combofix] C:\WINDOWS\system32\CF20704.exe /c C:\ComboFix\Combobatch.bat
O4 - HKLM\..\Run: [BMabbe4c56] Rundll32.exe "C:\WINDOWS\System32\kllkthue.dll",s
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [EPSON Stylus DX4400 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\E_S20IC1.EXE /FU "C:\DOCUME~1\trojan87\LOCALS~1\Temp\E_S1B.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [jdgf894jrghoiiskd] C:\DOCUME~1\trojan87\LOCALS~1\Temp\winlogan.exe
O4 - HKCU\..\Run: [Jnskdfmf9eldfd] C:\DOCUME~1\trojan87\LOCALS~1\Temp\csrssc.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab56986.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{BF4F422E-4E00-4F57-805C-FF332126BB01}: NameServer = 158.43.128.72,158.43.192.1,158.43.128.1
O20 - AppInit_DLLs: msgsmuqf.dll
O20 - Winlogon Notify: byxvvut - byxvvut.dll (file missing)
O20 - Winlogon Notify: isuhibja - isuhibja.dll (file missing)
O20 - Winlogon Notify: ssqpn - C:\WINDOWS\System32\ssqpn.dll (file missing)
O20 - Winlogon Notify: winubg32 - winubg32.dll (file missing)
O20 - Winlogon Notify: xxyvvwv - xxyvvwv.dll (file missing)
O21 - SSODL: WinCTL - {009541A0-3B00-1F1C-00F3-040224009C02} - (no file)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\System32\PSIService.exe (file missing)

--
End of file - 6542 bytes

#8 theodore

theodore
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:47 PM

Posted 27 June 2008 - 09:43 AM

I fear it is not sorted.

when i ran the SDfix i did not complete the reboot the same day.(probably not an issue, i had to enable registry editing).
the second part keeps running when i log in, even after the complete 4 steps.

also, the two warnings still pop up:


-cannot find vstqq.exe. make sure you typed the name correctly, then try again.

-could not load or run vtsqq.exe specified in the registry. make sure the file exists on your computer or remove reference from registry.




Is it safe for me to remove it directly from the registry? the file does exist,(C:/windows/system32/) but is impossible to delete.


all help appreciated

#9 theodore

theodore
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:47 PM

Posted 27 June 2008 - 10:08 AM

all aforementioned files attached if easier.

Attached Files



#10 Baabiouz

Baabiouz

    Finnish Malware Fighter


  • Members
  • 3,355 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:07:47 PM

Posted 27 June 2008 - 11:48 AM

You don't need to attach those files. It's easy to read them here. :thumbsup:


Let's do this first:

Go to Microsoft's website => http://support.microsoft.com/kb/310994

Select the download that's appropriate for your Operating System


Posted Image


Download the file & save it as it's originally named, next to ComboFix.exe.



Posted Image


Now close all open windows and programs, including all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  • Drag the setup package onto ComboFix.exe and drop it.

  • Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console.

  • At the next prompt, click 'Yes' to run the full ComboFix scan.

    Posted Image

  • When the tool is finished, it will produce a report for you.
Please post the C:\ComboFix.txt along with a new HijackThis log for further review.

Edited by Baabiouz, 27 June 2008 - 11:48 AM.

Posted Image

#11 theodore

theodore
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:47 PM

Posted 01 July 2008 - 11:06 AM

WINDOWS XP SP1 COMBOFIX LOG

--------------------------------------------

ComboFix 08-06-20.4 - trojan87 2008-06-30 18:12:56.2 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.1.1252.1.1033.18.92 [GMT 1:00]
Running from: C:\Documents and Settings\trojan87\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\trojan87\Desktop\winxpsp1_en_pro_bf.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\BMabbe4c56.xml
C:\WINDOWS\cookies.ini
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\gipcojmt.ini
C:\WINDOWS\system32\mcrh.tmp
F:\autorun.inf

.
((((((((((((((((((((((((( Files Created from 2008-05-28 to 2008-06-30 )))))))))))))))))))))))))))))))
.

2008-06-26 20:02 . 2008-06-26 20:02 <DIR> d-------- C:\fixing documents
2008-06-26 18:25 . 2008-06-26 18:25 107,008 --a------ C:\WINDOWS\system32\ucwhbtno.dll
2008-06-26 18:25 . 2008-06-26 18:25 95,232 --a------ C:\WINDOWS\system32\kllkthue.dll
2008-06-26 18:25 . 2008-06-26 18:25 86,016 --a------ C:\WINDOWS\system32\tmjocpig.dll
2008-06-26 18:24 . 2008-06-26 18:24 107,008 --a------ C:\WINDOWS\system32\fdvjimrd.dll
2008-06-26 18:21 . 2008-06-26 18:21 86,016 --a------ C:\WINDOWS\system32\kiukjago.dll
2008-06-26 18:20 . 2008-06-26 18:20 107,008 --a------ C:\WINDOWS\system32\ufdqbnyn.dll
2008-06-26 18:20 . 2008-06-26 18:20 95,232 --a------ C:\WINDOWS\system32\ddxvisvu.dll
2008-06-25 19:51 . 2008-06-25 19:51 <DIR> d--h----- C:\WINDOWS\system32\GroupPolicy
2008-06-25 19:25 . 2008-06-25 19:25 <DIR> d--hs---- C:\FOUND.003
2008-06-25 18:49 . 2008-06-25 18:49 <DIR> d-------- C:\WINDOWS\ERUNT
2008-06-25 18:42 . 2008-06-25 15:45 <DIR> d-------- C:\SDFix
2008-06-25 18:25 . 2008-06-25 18:25 <DIR> d-------- C:\Documents and Settings\Administrator
2008-06-25 18:24 . 2008-06-25 18:24 <DIR> d--hs---- C:\FOUND.002
2008-06-25 18:00 . 2008-06-25 18:00 <DIR> d--hs---- C:\FOUND.001
2008-06-25 17:51 . 2008-06-25 17:51 <DIR> d-------- C:\Program Files\Common Files\Softwin
2008-06-25 17:44 . 2008-06-25 17:44 107,520 --a------ C:\WINDOWS\system32\ajwjmxkt.dll
2008-06-25 17:38 . 2008-06-25 17:38 95,232 --a------ C:\WINDOWS\system32\eucniien.dll
2008-06-23 19:24 . 2008-06-23 19:24 106,496 --a------ C:\WINDOWS\system32\msgsmuqf.dll
2008-06-23 19:21 . 2008-06-23 19:21 95,232 --a------ C:\WINDOWS\system32\qvijbtpw.dll
2008-06-21 18:07 . 2008-06-21 18:07 <DIR> d-------- C:\Program Files\Disc2Phone
2008-06-21 16:56 . 2008-06-21 16:56 101,888 --a------ C:\WINDOWS\system32\wuaregfa.dll
2008-06-21 16:48 . 2008-06-21 16:49 94,208 --a------ C:\WINDOWS\system32\mcveadln.dll
2008-06-19 19:49 . 2008-06-19 19:49 <DIR> d-------- C:\WINDOWS\Sun
2008-06-19 19:21 . 2008-06-19 19:21 <DIR> d-------- C:\Program Files\Trend Micro
2008-06-19 16:59 . 2008-06-19 16:59 <DIR> d---s---- C:\WINDOWS\Downloaded Program Files
2008-06-19 14:58 . 2008-06-19 14:58 <DIR> d--hs---- C:\FOUND.000
2008-06-18 20:39 . 2008-06-18 20:39 2,855 --a------ C:\WINDOWS\system32\vtsqq.PIF
2008-06-18 18:51 . 2008-06-18 18:51 <DIR> d-------- C:\WINDOWS\system32\NtmsData
2008-06-18 18:33 . 2008-06-18 18:33 <DIR> d-------- C:\Program Files\Zone Labs
2008-06-18 18:33 . 2008-06-18 18:33 <DIR> d--hs---- C:\AntiSpywareMaster
2008-06-18 18:06 . 2008-06-18 18:06 <DIR> d-------- C:\Documents and Settings\Guest.XFDXFG-1NPE3D14
2008-06-16 18:44 . 2008-06-16 18:44 <DIR> d-------- C:\Program Files\Comodo
2008-06-16 18:42 . 2008-06-16 18:42 7,943,248 --------- C:\CFP_Setup_English_2.4.18.184.exe
2008-06-16 15:57 . 2008-04-02 21:07 75,248 --a------ C:\WINDOWS\zllsputility.exe
2008-06-16 15:57 . 2008-06-16 16:30 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat
2008-06-16 15:56 . 2008-06-16 15:56 <DIR> d-------- C:\WINDOWS\system32\ZoneLabs
2008-06-16 14:12 . 2008-06-16 14:11 140,288 --a------ C:\vcleaner.exe
2008-05-20 13:48 . 2008-05-20 13:48 <DIR> d-------- C:\Documents and Settings\vicki morgan\Application Data\U3
2008-05-17 19:26 . 2008-05-17 19:26 28 --a------ C:\WINDOWS\pdf995.ini
2008-05-17 18:42 . 2008-05-17 18:42 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\pdf995
2008-05-17 18:42 . 2008-05-17 19:23 249,856 --a------ C:\WINDOWS\system32\pdfmona.dll
2008-05-17 18:42 . 2008-05-17 19:23 51,716 --a------ C:\WINDOWS\system32\pdf995mon.dll
2008-05-17 18:42 . 2008-05-21 01:40 60 --a------ C:\WINDOWS\wpd99.drv
2008-05-17 18:41 . 2008-05-17 18:41 <DIR> d-------- C:\Program Files\pdf995
2008-05-13 12:51 . 2008-05-13 12:51 244 ---h----- C:\sqmnoopt02.sqm
2008-05-13 12:51 . 2008-05-13 12:51 232 ---h----- C:\sqmdata02.sqm

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-30 17:15 561,152 ----a-w C:\WINDOWS\system32\user32.dll
2008-06-30 17:15 561,152 ----a-w C:\WINDOWS\system32\dllcache\user32.dll
2008-04-28 19:10 --------- d-----w C:\Program Files\LimeWire
2008-04-15 22:46 89,070 ----a-w C:\WINDOWS\system32\myss_sb_uninstall.exe
2008-03-10 20:07 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
2008-01-05 22:35 77 ------w C:\Documents and Settings\nubian2\2012.bat
2006-11-18 09:12 318,336 ----a-w C:\Documents and Settings\vicki morgan\Application Data\GDIPFONTCACHEV1.DAT
2007-09-06 19:48 848 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2007-09-06 19:48 88 --sh--r C:\WINDOWS\system32\93E7034298.sys
.
Infected C:\WINDOWS\system32\user32.dll hex repaired

<pre>
----a-w			13,312 2008-01-21 10:54:04  C:\WINDOWS\system32\ctfmon .exe
</pre>


((((((((((((((((((((((((((((( snapshot@2008-06-26_19.55.37.39 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-11-27 17:45:08 45,064 ----a-w C:\WINDOWS\Downloaded Program Files\PerformanceOptimizerPre_Installer.exe
- 2008-06-26 17:58:36 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2008-06-30 17:03:40 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
- 2008-06-26 17:58:36 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-06-30 17:03:40 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2008-06-26 17:58:36 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-06-30 17:03:40 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{167B2B6C-BB60-4EDD-AAD7-4686EA75B595}]
C:\WINDOWS\System32\awtrOgdD.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{514A5C49-0C7D-42c3-A71B-38864A269B7A}]
C:\WINDOWS\System32\bmstqpms.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{77377263-961e-497c-9a64-f4e78059a20a}]
2008-06-26 18:25 107008 --a------ C:\WINDOWS\System32\ucwhbtno.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [ ]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:54 5674352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [ ]
"MPSExe"="c:\PROGRA~1\mcafee.com\mps\mscifapp.exe" [ ]
"SiteAdvisor"="C:\Program Files\SiteAdvisor\6172\SiteAdv.exe" [ ]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [ ]
"ISUSScheduler"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\issch.exe" [ ]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [ ]
"SDFix"="C:\DOCUME~1\ADMINI~1\Desktop\sdfix\SDFix\RunThis.bat" [2008-06-25 15:43 734899]
"a88d7fca"="C:\WINDOWS\System32\tmjocpig.dll" [2008-06-26 18:25 86016]
"BMabbe4c56"="C:\WINDOWS\System32\kllkthue.dll" [2008-06-26 18:25 95232]

C:\Documents and Settings\vicki morgan\Start Menu\Programs\Startup\
LimeWire On Startup.lnk - C:\Program Files\LimeWire\LimeWire.exe [2008-04-18 20:21:09 147456]

C:\Documents and Settings\trojan87\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 19:16:50 110592]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\byxvvut]
byxvvut.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\isuhibja]
isuhibja.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ssqpn]
C:\WINDOWS\System32\ssqpn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winubg32]
winubg32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\xxyvvwv]
xxyvvwv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=msgsmuqf.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"=

R3 iadusb;MT882;C:\WINDOWS\System32\DRIVERS\glauiad.sys [2006-07-27 16:37]
S3 w200bus;Sony Ericsson W200 driver (WDM);C:\WINDOWS\System32\DRIVERS\w200bus.sys [2006-11-07 09:42]
S3 w200mdfl;Sony Ericsson W200 USB WMC Modem Filter;C:\WINDOWS\System32\DRIVERS\w200mdfl.sys [2006-10-24 14:11]
S3 w200mdm;Sony Ericsson W200 USB WMC Modem Driver;C:\WINDOWS\System32\DRIVERS\w200mdm.sys [2006-10-24 14:11]
S3 w200mgmt;Sony Ericsson W200 USB WMC Device Management Drivers (WDM);C:\WINDOWS\System32\DRIVERS\w200mgmt.sys [2006-10-24 14:12]
S3 w200obex;Sony Ericsson W200 USB WMC OBEX Interface;C:\WINDOWS\System32\DRIVERS\w200obex.sys [2006-10-24 14:12]

.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-30 18:16:18
Windows 5.1.2600 Service Pack 1 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-06-30 18:17:23
ComboFix-quarantined-files.txt 2008-06-30 17:17:20

Pre-Run: 4,821,745,664 bytes free
Post-Run: 4,817,993,728 bytes free

winxpsp1_en_pro_bf.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

164 --- E O F --- 2008-06-12 09:29:48

#12 theodore

theodore
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:47 PM

Posted 01 July 2008 - 11:08 AM

HIJACKTHIS LOG DONE AFTER PREVIOUS PROCESS

------------------------------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:20:15, on 30/06/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WgaTray.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.rd.yahoo.com/customize/ycomp/def...://uk.yahoo.com
R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: (no name) - {167B2B6C-BB60-4EDD-AAD7-4686EA75B595} - C:\WINDOWS\System32\awtrOgdD.dll (file missing)
O2 - BHO: (no name) - {514A5C49-0C7D-42c3-A71B-38864A269B7A} - C:\WINDOWS\System32\bmstqpms.dll (file missing)
O2 - BHO: {a02a9508-7e4f-46a9-c794-e16936277377} - {77377263-961e-497c-9a64-f4e78059a20a} - C:\WINDOWS\System32\ucwhbtno.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MPSExe] c:\PROGRA~1\mcafee.com\mps\mscifapp.exe /embedding
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6172\SiteAdv.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\issch.exe" -start
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [SDFix] C:\DOCUME~1\ADMINI~1\Desktop\sdfix\SDFix\RunThis.bat /second
O4 - HKLM\..\Run: [a88d7fca] rundll32.exe "C:\WINDOWS\System32\tmjocpig.dll",b
O4 - HKLM\..\Run: [BMabbe4c56] Rundll32.exe "C:\WINDOWS\System32\kllkthue.dll",s
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab56986.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{BF4F422E-4E00-4F57-805C-FF332126BB01}: NameServer = 158.43.128.72,158.43.192.1,158.43.128.1
O20 - AppInit_DLLs: msgsmuqf.dll
O20 - Winlogon Notify: byxvvut - byxvvut.dll (file missing)
O20 - Winlogon Notify: isuhibja - isuhibja.dll (file missing)
O20 - Winlogon Notify: ssqpn - C:\WINDOWS\System32\ssqpn.dll (file missing)
O20 - Winlogon Notify: winubg32 - winubg32.dll (file missing)
O20 - Winlogon Notify: xxyvvwv - xxyvvwv.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\System32\PSIService.exe (file missing)

--
End of file - 5850 bytes

#13 Baabiouz

Baabiouz

    Finnish Malware Fighter


  • Members
  • 3,355 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:07:47 PM

Posted 01 July 2008 - 11:37 AM

Hello :thumbsup:

Step #1
Please open HiJackThis and choose do a system scan only. Check the boxes next to ONLY the entries listed below:

R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: (no name) - {167B2B6C-BB60-4EDD-AAD7-4686EA75B595} - C:\WINDOWS\System32\awtrOgdD.dll (file missing)
O2 - BHO: (no name) - {514A5C49-0C7D-42c3-A71B-38864A269B7A} - C:\WINDOWS\System32\bmstqpms.dll (file missing)
O2 - BHO: {a02a9508-7e4f-46a9-c794-e16936277377} - {77377263-961e-497c-9a64-f4e78059a20a} - C:\WINDOWS\System32\ucwhbtno.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O4 - HKLM\..\Run: [a88d7fca] rundll32.exe "C:\WINDOWS\System32\tmjocpig.dll",b
O4 - HKLM\..\Run: [BMabbe4c56] Rundll32.exe "C:\WINDOWS\System32\kllkthue.dll",s
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O20 - AppInit_DLLs: msgsmuqf.dll
O20 - Winlogon Notify: byxvvut - byxvvut.dll (file missing)
O20 - Winlogon Notify: isuhibja - isuhibja.dll (file missing)
O20 - Winlogon Notify: ssqpn - C:\WINDOWS\System32\ssqpn.dll (file missing)
O20 - Winlogon Notify: winubg32 - winubg32.dll (file missing)
O20 - Winlogon Notify: xxyvvwv - xxyvvwv.dll (file missing)



Now close all windows other than HiJackThis, including browsers, so that nothing other than HijackThis is open, then click Fix Checked. A box will pop up asking you if you wish to fix the selected items. Please choose YES. Once it has fixed them, please exit/close HijackThis.

Step #2
Please click your Start button then Click on Run and type in the following without the quotes: "notepad" Then copy (Ctrl C) and paste (Ctrl V) the following text in the codebox,
File::
C:\WINDOWS\system32\ucwhbtno.dll
C:\WINDOWS\system32\kllkthue.dll
C:\WINDOWS\system32\tmjocpig.dll
C:\WINDOWS\system32\fdvjimrd.dll
C:\WINDOWS\system32\kiukjago.dll
C:\WINDOWS\system32\ufdqbnyn.dll
C:\WINDOWS\system32\ddxvisvu.dll
C:\WINDOWS\system32\ucwhbtno.dll
C:\WINDOWS\system32\kllkthue.dll
C:\WINDOWS\system32\tmjocpig.dll
C:\WINDOWS\system32\fdvjimrd.dll
C:\WINDOWS\system32\kiukjago.dll
C:\WINDOWS\system32\ufdqbnyn.dll
C:\WINDOWS\system32\ddxvisvu.dll
C:\WINDOWS\system32\wuaregfa.dll
C:\WINDOWS\system32\mcveadln.dll
C:\WINDOWS\system32\vtsqq.PIF
C:\WINDOWS\system32\myss_sb_uninstall.exe
C:\WINDOWS\system32\ctfmon .exe
C:\WINDOWS\Downloaded Program Files\PerformanceOptimizerPre_Installer.exe


Save this as CFScript.txt

Posted Image

Refering to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply.

Step #3
Please download ATF-cleaner and save it to your desktop.
  • Double-click ATF-Cleaner.exe to run the program.
  • Under Main choose: Select All
  • Click the Empty Selected button.

    If you use Firefox browser:

  • Click Firefox at the top and choose: Select All
  • Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

    If you use Opera browser:

  • Click Opera at the top and choose: Select All
  • Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.
  • Click Exit on the Main menu to close the program.
Step #4
Please download Malwarebytes Anti-Malware and save it to your desktop.
alternate download link 1
alternate download link 2
  • Make sure you are connected to the Internet.
  • Double-click on Download_mbam-setup.exe to install the application.
  • When the installation begins, follow the prompts and do not make any changes to default settings.
  • When installation has finished, make sure you leave both of these checked:
    • Update Malwarebytes' Anti-Malware
    • Launch Malwarebytes' Anti-Malware
  • Then click Finish.
  • MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
  • If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.
  • On the Scanner tab:
    • Make sure the "Perform Quick Acan" option is selected.
    • Then click on the Scan button.
  • The next screen will ask you to select the drives to scan. Leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
  • Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply and exit MBAM.
Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

Step #5
Please post Combofix log, Mbam log and a fresh HijackThis log back here :)
Posted Image

#14 theodore

theodore
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:47 PM

Posted 03 July 2008 - 01:19 PM

combofix log from step 2

-----------------------------------

ComboFix 08-07-02.5 - trojan87 2008-07-03 18:47:03.3 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.1.1252.1.1033.18.74 [GMT 1:00]
Running from: C:\Documents and Settings\trojan87\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\trojan87\Desktop\CFScript.txt
* Created a new restore point

FILE ::
File::C:\WINDOWS\system32\ucwhbtno.dllC:\WINDOWS\system32\kllkthue.dllC:\WINDOWS\system32\tmjocpig.dllC:\WINDOWS\system32\fdvjimrd.dllC:\WINDOWS\system32\kiukjago.dllC:\WINDOWS\system32\ufdqbnyn.dllC:\WINDOWS\system32\ddxvisvu.dllC:\WINDOWS\system32\ucwhbtno.dllC:\WINDOWS\system32\kllkthue.dllC:\WINDOWS\system32\tmjocpig.dllC:\WINDOWS\system32\fdvjimrd.dllC:\WINDOWS\system32\kiukjago.dllC:\WINDOWS\system32\ufdqbnyn.dllC:\WINDOWS\system32\ddxvisvu.dllC:\WINDOWS\system32\wuaregfa.dllC:\WINDOWS\system32\mcveadln.dllC:\WINDOWS\system32\vtsqq.PIFC:\WINDOWS\system32\myss_sb_uninstall.exeC:\WINDOWS\system32\ctfmon .exeC:\WINDOWS\Downloaded Program Files\PerformanceOptimizerPre_Installer.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\BMabbe4c56.txt
C:\WINDOWS\cookies.ini
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\ajwjmxkt.dll
C:\WINDOWS\system32\ddxvisvu.dll
C:\WINDOWS\system32\eucniien.dll
C:\WINDOWS\system32\fdvjimrd.dll
C:\WINDOWS\system32\gipcojmt.ini
C:\WINDOWS\system32\kiukjago.dll
C:\WINDOWS\system32\kllkthue.dll
C:\WINDOWS\system32\mcveadln.dll
C:\WINDOWS\system32\msgsmuqf.dll
C:\WINDOWS\system32\myss_sb_uninstall.exe
C:\WINDOWS\system32\qvijbtpw.dll
C:\WINDOWS\system32\tmjocpig.dll
C:\WINDOWS\system32\ufdqbnyn.dll
C:\WINDOWS\system32\wuaregfa.dll

.
((((((((((((((((((((((((( Files Created from 2008-06-03 to 2008-07-03 )))))))))))))))))))))))))))))))
.

2008-07-03 18:23 . 2008-07-03 18:23 <DIR> d--hs---- C:\FOUND.004
2008-06-30 18:49 . 2008-07-03 18:29 110,419 --a------ C:\WINDOWS\BMabbe4c56.xml
2008-06-26 20:02 . 2008-06-26 20:02 <DIR> d-------- C:\fixing documents
2008-06-25 19:51 . 2008-06-25 19:51 <DIR> d--h----- C:\WINDOWS\system32\GroupPolicy
2008-06-25 19:25 . 2008-06-25 19:25 <DIR> d--hs---- C:\FOUND.003
2008-06-25 18:49 . 2008-06-25 18:49 <DIR> d-------- C:\WINDOWS\ERUNT
2008-06-25 18:42 . 2008-06-25 15:45 <DIR> d-------- C:\SDFix
2008-06-25 18:25 . 2008-06-25 18:25 <DIR> d-------- C:\Documents and Settings\Administrator
2008-06-25 18:24 . 2008-06-25 18:24 <DIR> d--hs---- C:\FOUND.002
2008-06-25 18:00 . 2008-06-25 18:00 <DIR> d--hs---- C:\FOUND.001
2008-06-25 17:51 . 2008-06-25 17:51 <DIR> d-------- C:\Program Files\Common Files\Softwin
2008-06-21 18:07 . 2008-06-21 18:07 <DIR> d-------- C:\Program Files\Disc2Phone
2008-06-19 19:49 . 2008-06-19 19:49 <DIR> d-------- C:\WINDOWS\Sun
2008-06-19 19:21 . 2008-06-19 19:21 <DIR> d-------- C:\Program Files\Trend Micro
2008-06-19 16:59 . 2008-06-19 16:59 <DIR> d---s---- C:\WINDOWS\Downloaded Program Files
2008-06-19 14:58 . 2008-06-19 14:58 <DIR> d--hs---- C:\FOUND.000
2008-06-18 20:39 . 2008-06-18 20:39 2,855 --a------ C:\WINDOWS\system32\vtsqq.PIF
2008-06-18 18:51 . 2008-06-18 18:51 <DIR> d-------- C:\WINDOWS\system32\NtmsData
2008-06-18 18:33 . 2008-06-18 18:33 <DIR> d-------- C:\Program Files\Zone Labs
2008-06-18 18:33 . 2008-06-18 18:33 <DIR> d--hs---- C:\AntiSpywareMaster
2008-06-18 18:06 . 2008-06-18 18:06 <DIR> d-------- C:\Documents and Settings\Guest.XFDXFG-1NPE3D14
2008-06-16 18:44 . 2008-06-16 18:44 <DIR> d-------- C:\Program Files\Comodo
2008-06-16 18:42 . 2008-06-16 18:42 7,943,248 --------- C:\CFP_Setup_English_2.4.18.184.exe
2008-06-16 15:57 . 2008-04-02 21:07 75,248 --a------ C:\WINDOWS\zllsputility.exe
2008-06-16 15:57 . 2008-06-16 16:30 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat
2008-06-16 15:56 . 2008-06-16 15:56 <DIR> d-------- C:\WINDOWS\system32\ZoneLabs
2008-06-16 14:12 . 2008-06-16 14:11 140,288 --a------ C:\vcleaner.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-30 17:15 561,152 ----a-w C:\WINDOWS\system32\user32.dll
2008-06-30 17:15 561,152 ----a-w C:\WINDOWS\system32\dllcache\user32.dll
2008-05-20 12:48 --------- d-----w C:\Documents and Settings\vicki morgan\Application Data\U3
2008-05-17 18:23 51,716 ----a-w C:\WINDOWS\system32\pdf995mon.dll
2008-05-17 18:23 249,856 ----a-w C:\WINDOWS\system32\pdfmona.dll
2008-05-17 17:42 --------- d-----w C:\Documents and Settings\All Users\Application Data\pdf995
2008-05-17 17:41 --------- d-----w C:\Program Files\pdf995
2008-01-05 22:35 77 ------w C:\Documents and Settings\nubian2\2012.bat
2006-11-18 09:12 318,336 ----a-w C:\Documents and Settings\vicki morgan\Application Data\GDIPFONTCACHEV1.DAT
2007-09-06 19:48 848 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2007-09-06 19:48 88 --sh--r C:\WINDOWS\system32\93E7034298.sys
.
<pre>
----a-w			13,312 2008-01-21 10:54:04  C:\WINDOWS\system32\ctfmon .exe
</pre>


((((((((((((((((((((((((((((( snapshot@2008-06-26_19.55.37.39 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-11-27 17:45:08 45,064 ----a-w C:\WINDOWS\Downloaded Program Files\CONFLICT.1\PerformanceOptimizerPre_Installer.exe
- 2008-06-26 17:58:36 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2008-07-01 09:38:14 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
- 2008-06-26 17:58:36 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-07-01 09:38:14 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [N/A]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:54 5674352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [N/A]
"MPSExe"="c:\PROGRA~1\mcafee.com\mps\mscifapp.exe" [N/A]
"SiteAdvisor"="C:\Program Files\SiteAdvisor\6172\SiteAdv.exe" [N/A]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [N/A]
"ISUSScheduler"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\issch.exe" [N/A]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [N/A]
"SDFix"="C:\DOCUME~1\ADMINI~1\Desktop\sdfix\SDFix\RunThis.bat" [2008-06-25 15:43 734899]
"BMabbe4c56"="C:\WINDOWS\System32\kllkthue.dll" [N/A]

C:\Documents and Settings\vicki morgan\Start Menu\Programs\Startup\
LimeWire On Startup.lnk - C:\Program Files\LimeWire\LimeWire.exe [2008-04-18 20:21:09 147456]

C:\Documents and Settings\trojan87\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 19:16:50 110592]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"=

R3 iadusb;MT882;C:\WINDOWS\System32\DRIVERS\glauiad.sys [2006-07-27 16:37]
S3 w200bus;Sony Ericsson W200 driver (WDM);C:\WINDOWS\System32\DRIVERS\w200bus.sys [2006-11-07 09:42]
S3 w200mdfl;Sony Ericsson W200 USB WMC Modem Filter;C:\WINDOWS\System32\DRIVERS\w200mdfl.sys [2006-10-24 14:11]
S3 w200mdm;Sony Ericsson W200 USB WMC Modem Driver;C:\WINDOWS\System32\DRIVERS\w200mdm.sys [2006-10-24 14:11]
S3 w200mgmt;Sony Ericsson W200 USB WMC Device Management Drivers (WDM);C:\WINDOWS\System32\DRIVERS\w200mgmt.sys [2006-10-24 14:12]
S3 w200obex;Sony Ericsson W200 USB WMC OBEX Interface;C:\WINDOWS\System32\DRIVERS\w200obex.sys [2006-10-24 14:12]

.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-03 18:52:59
Windows 5.1.2600 Service Pack 1 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\GUARD.EXE
C:\WINDOWS\SYSTEM32\WDFMGR.EXE
C:\WINDOWS\System32\WgaTray.exe
.
**************************************************************************
.
Completion time: 2008-07-03 18:57:03 - machine was rebooted
ComboFix-quarantined-files.txt 2008-07-03 17:56:54

Pre-Run: 5,009,965,056 bytes free
Post-Run: 5,026,594,816 bytes free

138 --- E O F --- 2008-07-03 17:30:54

#15 theodore

theodore
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:47 PM

Posted 03 July 2008 - 01:21 PM

MBAM cleaner log from step 4

------------------------------------------

Malwarebytes' Anti-Malware 1.19
Database version: 918
Windows 5.1.2600 Service Pack 1

19:11:40 03/07/2008
mbam-log-7-3-2008 (19-11-40).txt

Scan type: Quick Scan
Objects scanned: 48496
Time elapsed: 4 minute(s), 22 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 8
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 7
Files Infected: 22

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\browsingadvisor.pornpro_bho (Adware.PlayMP3Z-biz) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\browsingadvisor.pornpro_bho.1 (Adware.PlayMP3Z-biz) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{85e06077-c824-43d0-a8dc-5efb17bc348a} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{5937cd7f-1c0b-41e1-9075-60ebdf3c7d34} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproductsinstaller.start (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproductsinstaller.start.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BMabbe4c56 (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\AntiSpywareMaster (Rogue.AntiSpywareMaster) -> Quarantined and deleted successfully.
C:\AntiSpywareMaster\AVQuar (Rogue.AntiSpywareMaster) -> Quarantined and deleted successfully.
C:\Documents and Settings\nubian2\Application Data\WinAntiVirus Pro 2007 (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
C:\Documents and Settings\nubian2\Application Data\WinAntiVirus Pro 2007\Logs (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
C:\Documents and Settings\Francine\Application Data\WinAntiVirus Pro 2007 (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
C:\Documents and Settings\Francine\Application Data\WinAntiVirus Pro 2007\Logs (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
C:\Documents and Settings\Guest.XFDXFG-1NPE3D14\Application Data\wsnpoem (Trojan.Agent) -> Quarantined and deleted successfully.

Files Infected:
C:\WINDOWS\system32\isuhibja.dllbox (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\Downloaded Program Files\PerformanceOptimizerPre_Installer.exe (Rogue.PerformanceOptimizer) -> Quarantined and deleted successfully.
C:\WINDOWS\Downloaded Program Files\CONFLICT.1\PerformanceOptimizerPre_Installer.exe (Rogue.PerformanceOptimizer) -> Quarantined and deleted successfully.
C:\Documents and Settings\nubian2\Application Data\WinAntiVirus Pro 2007\history.db (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
C:\Documents and Settings\nubian2\Application Data\WinAntiVirus Pro 2007\PGE.dat (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
C:\Documents and Settings\nubian2\Application Data\WinAntiVirus Pro 2007\avtasks.dat (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
C:\Documents and Settings\nubian2\Application Data\WinAntiVirus Pro 2007\Logs\winav.log (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
C:\Documents and Settings\nubian2\Application Data\WinAntiVirus Pro 2007\Logs\wa7Support.log (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
C:\Documents and Settings\nubian2\Application Data\WinAntiVirus Pro 2007\Logs\update.log (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
C:\Documents and Settings\nubian2\Application Data\WinAntiVirus Pro 2007\Logs\incmp.log (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
C:\Documents and Settings\Francine\Application Data\WinAntiVirus Pro 2007\history.db (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
C:\Documents and Settings\Francine\Application Data\WinAntiVirus Pro 2007\PGE.dat (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
C:\Documents and Settings\Francine\Application Data\WinAntiVirus Pro 2007\avtasks.dat (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
C:\Documents and Settings\Francine\Application Data\WinAntiVirus Pro 2007\Logs\winav.log (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
C:\Documents and Settings\Francine\Application Data\WinAntiVirus Pro 2007\Logs\wa7Support.log (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
C:\Documents and Settings\Francine\Application Data\WinAntiVirus Pro 2007\Logs\update.log (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\clkcnt.txt (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Guest.XFDXFG-1NPE3D14\Application Data\ntos.exe (Backdoor.Proxy) -> Quarantined and deleted successfully.
C:\Documents and Settings\nubian2\Desktop\Help and Support Center.lnk (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\trojan87\Desktop\Help and Support Center.lnk (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\Francine\Desktop\Help and Support Center.lnk (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\vicki morgan\Desktop\Help and Support Center.lnk (Rogue.Link) -> Quarantined and deleted successfully.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users