Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Virtumonde/vundo.trojan/malware.trace


  • This topic is locked This topic is locked
28 replies to this topic

#1 ^sims^

^sims^

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:07:34 PM

Posted 22 September 2008 - 08:56 AM

Hi!

I'm an idiot and managed to put this stupid thing on my computer!! Hasn't create any real problems as far as I can see apart from being a major pain in my arse and creating popups and not letting me search google etc (Although I worked around this by renaming FireFox to something else). I can't for the life of me remove this thing - I've been trying for 2 weeks now. I've tried so much stuff. I've now decided to ask for some help.


Hijackthis log is as follows:



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:48, on 2008-09-22
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\DU Meter\DUMeter.exe
C:\Windows\SOUNDMAN.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Mozilla Firefox\simone.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {0D18FDE6-7BE4-4529-BD0E-77D23204306A} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {AF8A26EB-04A2-4642-B22A-9B28E3EC4569} - (no file)
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [DU Meter] C:\Program Files\DU Meter\DUMeter.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NSLauncher] C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe /startup
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [WinFast Schedule] C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\hgGxUKbX.dll,#1
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O13 - Gopher Prefix:
O16 - DPF: {9732FB42-C321-11D1-836F-00A0C993F125} (mhLabel Class) - http://www.pcpitstop.com/mhLbl.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: avgrsstx.dll dccyoo.dll zocbtc.dll lqgjuk.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvsvc32.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\system32\IoctlSvc.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SmartLinkService (SLService) - - C:\Windows\SYSTEM32\slserv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: VundoFix Service (VundoFixSvc) - Atribune.org - C:\Windows\SYSTEM32\VundoFixSVC.exe

--
End of file - 8302 bytes




Also upon system start up this pops up...

Attached File  Untitled.jpg   14.36KB   16 downloads

Any help would be greatly appreciated!!

Thanks in advance.

BC AdBot (Login to Remove)

 


#2 ^sims^

^sims^
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:07:34 PM

Posted 22 September 2008 - 09:43 PM

O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\hgGxUKbX.dll,#1


I'm pretty sure this guy is part of my problem. Although, I could be wrong.

As far as I know it seems I have removed most of it. I've done boot scans and things and only the initial scan found 1 infected file and since then nothing. Upon start up of Windows I scan with SUPERAntiSpyware and Malwarebytes and they keep bringing up Malware.Trace (it links me to the above file).

I have run the scans every time I start windows and remove the files but as soon as I reboot they're back again.

#3 ^sims^

^sims^
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:07:34 PM

Posted 23 September 2008 - 08:13 AM

Still doing my head in.

Tried deleting the file manually. It's not visible in C:\Windows\System32\. I tried searching for hidden files but that didn't help either.

I opened the registry thingo and deleted it manually but again, upon restart, it's there again.

#4 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,717 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:11:34 AM

Posted 27 September 2008 - 04:20 AM

Hi ^sims^,

Welcome to BC HijackThis forum and sorry for the delay. I am farbar. I am going to assist you with your problem.

Note 1. Please refrain from making any changes to your system from now on as it might prolong handling your log and make the job for both of us more difficult.

Your log(s) show that you are using so called peer-to-peer or file-sharing programs (in your case uTorrent). These programs allow to share files between users as the name(s) suggest. In today's world the cyber crime has come to an enormous dimension and any means is used to infect personal computers to make use of their stored data or machine power for further propagation of the malware files. A popular means is the use of file-sharing tools as a tremendous amount of prospective victims can be reached through it.

It is therefore possible to be infected by downloading manipulated files via peer-to-peer tools and thus suggested to be used with intense care. Some further readings on this subject, along the included links, are as follows: "File-Sharing, otherwise known as Peer To Peer" and "Risks of File-Sharing Technology."

Removal Instructions
  • Please either uninstall uTorrent or set it not to start with Windows. Also empty its download folder as there might be infected files. Please don't use it as log as we are not done with disinfection as it might cause reinfection or infect other users.

  • Now we need to make sure to turn off UAC ( UAC = User Account Control )
    • Click Start, and then click Control Panel.
    • In Control Panel, click User Accounts.
    • In the User Accounts window, click User Accounts.
    • In the User Accounts tasks window, click Turn User Account Control on or off.
    • If UAC is currently configured in Admin Approval Mode, the User Account Control message appears. Click Continue.
    • Clear the Use User Account Control (UAC) to help protect your computer check box, and then click OK. If it is already uncheck, then you should also notice a red shield with an X in it located in your system tray. Ignore any mesages about UAC being disabled.
    • Click Restart Now to apply the change right away. (Restart even if you did not make the above change, we need to be sure that a reboot has occurred since the first time that UAC was disabled.)
    NOTE: DO NOT CONTINUE UNTIL UAC has been disabled and you have rebooted.

  • You have the program Spybot S&D (Teatimer option) running on your machine. We need to disable TeaTimer so it does not interfere with the fixes we are about to do.
    • First disable TeaTimer:
      • Run Spybot-S&D
      • Go to the Mode menu, and make sure Advanced Mode is selected
      • On the left hand side, choose Tools -> Resident
      • Uncheck Resident TeaTimer and OK any prompts
      • Restart your computer.
      Instruction is also here: How to disable TeaTimer during HijackThis Cleanup

      Note:If teatimer gives you a warning afterwards that some changes were made, allow this instead of blocking it.
    • Then download ResetTeaTimer.bat to your desktop. (In case you use Firefox, rightclick the link and choose "Save Link As". Make sure "Save as type" is set to "All Types").
      • Doubleclick ResetTeaTimer.bat and let it run.
    This will only take a few seconds.

  • We need to disable your Windows Defender Real-time Protection as it may interfere with the fixes that we need to make.
    • Open Windows Defender.
    • Click on Tools, Options.
    • Scroll down the list of options to select "Real-time Protection Options."
    • Uncheck "Use Real-Time Protection (Recommended)".
    • After you uncheck this, click on the Save button and close Windows Defender.
    After all of the fixes are complete it is very important that you enable Real-time Protection again.

  • You have one AVG 8 service on your computer. It looks like a leftover from an incomplete uninstall. Tell me if you are still using AVG 8.

  • Download Combofix from any of the links below, and save it to your desktop. For information regarding this download, please visit this webpage: http://www.bleepingcomputer.com/combofix/how-to-use-combofix

    Link 1
    Link 2
    Link 3


    **Note: It is important that it is saved directly to your desktop**

    --------------------------------------------------------------------

    1. Close any open browsers.

    2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

    --------------------------------------------------------------------

    Double click on combofix.exe & follow the prompts.
    • When finished, it will produce a report for you.
    • Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.
    Note:
    Do not mouseclick combofix's window while it's running. That may cause it to stall


  • Please download random's system information tool (RSIT) by random/random from here and save it to your desktop.
    • Double click on RSIT.exe to run RSIT.
    • Click Continue at the disclaimer screen.
    • Once it has finished, two logs will open. Please post the contents of both log.txt (<<will be maximized) and info.txt (<<will be minimized)

      Note 1:The logs will be created in this folder: C:\rsit

      Note 2:The tool takes not more than one minute to scan the system.


#5 ^sims^

^sims^
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:07:34 PM

Posted 27 September 2008 - 07:21 AM

Firstly, thanks heaps for getting back to me...

Ok I got as far as Step 3.2.

Upon running ResetTeaTimer.bat it came up with this....

Please advise where to go from here.....


Also, I am still running AVG 8.

Cheers :thumbsup:

Attached Files


Edited by ^sims^, 27 September 2008 - 07:23 AM.


#6 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,717 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:11:34 AM

Posted 27 September 2008 - 08:22 AM

Thanks for asking and for the screenshot. I'm impressed. :thumbsup:

Please skip that step with resetting teatimer and proceed to the next one. Disabling teatimer should do. If needed we can reset the teatimer manually without a batch file.

As antivirus concern:

I do not recommend that you have more than one anti virus product installed and running on your computer at a time. The reason for this is that if both products have their automatic (Real-Time) protection switched on, then those products which do not encrypt the virus strings within them can cause other anti virus products to cause "false alarms". It can also lead to a clash as both products fight for access to files which are opened again this is the resident/automatic protection. In general terms, the two programs may conflict and cause:
1) False Alarms: When the anti virus software tells you that your PC has a virus when it actually doesn't.
2) System Performance Problems: Your system may lock up due to both products attempting to access the same file at the same time.

Therefore please keep one of them and uninstall the other (start -> Control Panel -> [if the option is there click Programs ] click Programs and Features).

#7 ^sims^

^sims^
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:07:34 PM

Posted 27 September 2008 - 07:05 PM

ComboFix Log:

ComboFix 08-09-27.01 - Skim0an Desktop 2008-09-28 9:50:56.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.1252 [GMT 10:00]
Running from: C:\Users\Skim0an Desktop\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Windows\system32\MSINET.oca
C:\Windows\system32\skinboxer43.dll

.
((((((((((((((((((((((((( Files Created from 2008-08-27 to 2008-09-27 )))))))))))))))))))))))))))))))
.

2008-09-22 23:47 . 2008-09-22 23:47 <DIR> d-------- C:\Program Files\Trend Micro
2008-09-22 23:29 . 2008-09-22 23:28 102,664 --a------ C:\Windows\System32\drivers\tmcomm.sys
2008-09-22 23:28 . 2008-09-22 23:29 <DIR> d-------- C:\Users\Skim0an Desktop\.housecall6.6
2008-09-14 21:55 . 2008-09-14 21:55 <DIR> d-------- C:\Program Files\Alwil Software
2008-09-14 21:31 . 2008-09-14 21:31 61,224 --a------ C:\Users\Skim0an Desktop\GoToAssistDownloadHelper.exe
2008-09-13 09:34 . 2008-09-13 09:34 <DIR> d----c--- C:\Windows\System32\DRVSTORE
2008-09-13 09:34 . 2008-04-17 13:12 107,368 --a------ C:\Windows\System32\GEARAspi.dll
2008-09-13 09:34 . 2008-04-17 13:12 15,464 --a------ C:\Windows\System32\drivers\GEARAspiWDM.sys
2008-09-13 09:33 . 2008-09-13 09:34 <DIR> d-------- C:\Users\All Users\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-09-13 09:33 . 2008-09-13 09:34 <DIR> d-------- C:\ProgramData\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-09-13 09:33 . 2008-09-13 09:34 <DIR> d-------- C:\Program Files\iTunes
2008-09-13 09:33 . 2008-09-13 09:33 <DIR> d-------- C:\Program Files\iPod
2008-09-13 09:32 . 2008-09-13 09:32 <DIR> d-------- C:\Program Files\Bonjour
2008-09-13 09:31 . 2008-09-13 09:31 <DIR> d-------- C:\Program Files\QuickTime
2008-09-11 17:31 . 2008-09-11 17:31 <DIR> d-------- C:\Users\Skim0an Desktop\AppData\Roaming\Malwarebytes
2008-09-11 17:31 . 2008-09-11 17:31 <DIR> d-------- C:\Users\All Users\Malwarebytes
2008-09-11 17:31 . 2008-09-11 17:31 <DIR> d-------- C:\ProgramData\Malwarebytes
2008-09-11 17:31 . 2008-09-11 17:31 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-09-11 17:31 . 2008-09-10 00:08 38,528 --a------ C:\Windows\System32\drivers\mbamswissarmy.sys
2008-09-11 17:31 . 2008-09-10 00:08 17,200 --a------ C:\Windows\System32\drivers\mbam.sys
2008-09-10 22:38 . 2008-09-10 22:38 <DIR> d-------- C:\Users\All Users\SUPERAntiSpyware.com
2008-09-10 22:38 . 2008-09-10 22:38 <DIR> d-------- C:\ProgramData\SUPERAntiSpyware.com
2008-09-10 22:37 . 2008-09-10 22:37 <DIR> d-------- C:\Users\Skim0an Desktop\AppData\Roaming\SUPERAntiSpyware.com
2008-09-10 22:37 . 2008-09-10 22:37 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2008-09-10 22:34 . 2008-09-10 22:34 1,266,807 --a------ C:\MGtools.exe
2008-09-09 22:30 . 2008-09-09 22:30 24,576 --a------ C:\Windows\System32\VundoFixSVC.exe
2008-09-09 22:06 . 2008-09-09 22:29 <DIR> d-------- C:\VundoFix Backups
2008-09-09 18:21 . 2008-06-23 17:02 <DIR> d-------- C:\Users\Skim0an Desktop\Spyware Doctor 6.X.X.XXX
2008-09-09 18:01 . 2008-07-28 11:29 160,792 --a------ C:\Windows\System32\drivers\pctfw2.sys
2008-09-09 18:00 . 2008-09-09 18:00 <DIR> d-------- C:\Users\Skim0an Desktop\AppData\Roaming\PC Tools
2008-09-09 18:00 . 2008-09-09 18:00 <DIR> d-------- C:\Users\All Users\PC Tools
2008-09-09 18:00 . 2008-09-09 18:00 <DIR> d-------- C:\ProgramData\PC Tools
2008-09-09 18:00 . 2008-09-11 17:27 <DIR> d-------- C:\Program Files\Spyware Doctor
2008-09-09 18:00 . 2008-09-09 18:01 <DIR> d-------- C:\Program Files\Common Files\PC Tools
2008-09-09 18:00 . 2008-08-25 11:36 81,288 --a------ C:\Windows\System32\drivers\iksyssec.sys
2008-09-09 18:00 . 2008-08-25 11:36 66,952 --a------ C:\Windows\System32\drivers\iksysflt.sys
2008-09-09 18:00 . 2008-08-25 11:36 40,840 --a------ C:\Windows\System32\drivers\ikfilesec.sys
2008-09-09 18:00 . 2008-06-02 15:19 29,576 --a------ C:\Windows\System32\drivers\kcom.sys
2008-09-08 22:54 . 2006-11-01 13:06 170,808 --a------ C:\Users\Skim0an Desktop\Listdlls.exe
2008-09-08 21:44 . 2008-09-08 21:44 0 --ah----- C:\ntuser.dat.LOG2
2008-09-08 21:44 . 2008-09-08 21:44 0 --ah----- C:\ntuser.dat.LOG1
2008-09-08 21:44 . 2008-09-08 21:44 0 --a------ C:\ntuser.dat
2008-09-08 20:09 . 2008-09-08 20:12 <DIR> d-------- C:\Users\All Users\Lavasoft
2008-09-08 20:09 . 2008-09-08 20:12 <DIR> d-------- C:\ProgramData\Lavasoft
2008-09-08 20:09 . 2008-09-08 20:09 <DIR> d-------- C:\Program Files\Lavasoft
2008-09-08 20:04 . 2008-09-10 22:37 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-09-08 16:22 . 2008-09-08 17:55 345 --ahs---- C:\Windows\System32\BJkmlnmp.ini
2008-09-07 14:44 . 2008-09-07 14:45 <DIR> d-------- C:\Users\Skim0an Desktop\AppData\Roaming\Thunderbird
2008-09-07 12:47 . 2008-09-08 08:40 629,247 --ahs---- C:\Windows\System32\MVyaGjjl.ini2
2008-09-07 12:47 . 2008-09-08 08:41 629,247 --ahs---- C:\Windows\System32\MVyaGjjl.ini
2008-09-07 12:42 . 2008-09-07 12:42 <DIR> d-------- C:\Temp\dax41
2008-09-07 12:42 . 2008-09-07 12:42 <DIR> d-------- C:\Temp
2008-09-06 22:12 . 2008-09-28 09:18 <DIR> d-------- C:\Windows\System32\drivers\Avg
2008-09-06 22:12 . 2008-09-06 22:36 97,928 --a------ C:\Windows\System32\drivers\avgldx86.sys
2008-09-06 22:12 . 2008-09-06 22:12 10,520 --a------ C:\Windows\System32\avgrsstx.dll
2008-09-06 22:11 . 2008-09-06 22:33 <DIR> d-------- C:\Users\All Users\avg8
2008-09-06 22:11 . 2008-09-06 22:33 <DIR> d-------- C:\ProgramData\avg8
2008-09-06 15:09 . 2008-09-06 15:09 90,112 --a------ C:\Windows\System32\QuickTimeVR.qtx
2008-09-06 15:09 . 2008-09-06 15:09 57,344 --a------ C:\Windows\System32\QuickTime.qts
2008-08-31 23:02 . 2008-07-16 11:32 2,048 --a------ C:\Windows\System32\tzres.dll
2008-08-31 22:57 . 2008-06-27 11:55 1,383,424 --a------ C:\Windows\System32\mshtml.tlb
2008-08-31 22:57 . 2008-06-27 14:15 827,392 --a------ C:\Windows\System32\wininet.dll
2008-08-31 22:57 . 2008-06-19 13:31 361,984 --a------ C:\Windows\System32\IPSECSVC.DLL
2008-08-31 22:57 . 2008-04-18 15:48 269,312 --a------ C:\Windows\System32\es.dll
2008-08-31 22:55 . 2008-04-10 15:12 738,304 --a------ C:\Windows\System32\inetcomm.dll
2008-08-29 10:18 . 2008-08-29 10:18 87,336 --a------ C:\Windows\System32\dns-sd.exe
2008-08-29 09:53 . 2008-08-29 09:53 61,440 --a------ C:\Windows\System32\dnssd.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-27 12:17 --------- d-----w C:\Users\Skim0an Desktop\AppData\Roaming\skypePM
2008-09-27 12:17 --------- d-----w C:\Users\Skim0an Desktop\AppData\Roaming\Skype
2008-09-27 12:09 --------- d-----w C:\ProgramData\Spybot - Search & Destroy
2008-09-27 12:01 --------- d-----w C:\Users\Skim0an Desktop\AppData\Roaming\uTorrent
2008-09-26 18:47 --------- d-----w C:\Program Files\Unlocker
2008-09-19 10:31 --------- d---a-w C:\ProgramData\TEMP
2008-09-13 09:17 --------- d-----w C:\Program Files\PKR
2008-09-12 23:31 --------- d-----w C:\Program Files\Common Files\Apple
2008-09-09 12:25 --------- d-----w C:\Program Files\Java
2008-09-07 04:39 --------- d-----w C:\Program Files\Pidgin
2008-09-07 04:09 --------- d-----w C:\Users\Skim0an Desktop\AppData\Roaming\Azureus
2008-08-31 13:59 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-08-31 13:51 --------- d-----w C:\Program Files\Windows Mail
2008-08-31 12:58 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-08-09 08:05 --------- d-----w C:\Users\Skim0an Desktop\AppData\Roaming\Apple Computer
2008-08-09 07:57 --------- d-----w C:\Program Files\DivX
2008-08-09 07:56 --------- d-----w C:\Users\Skim0an Desktop\AppData\Roaming\DivX
2008-08-09 07:38 --------- d-----w C:\Program Files\Apple Software Update
2008-08-09 01:40 --------- d-----w C:\ProgramData\NVIDIA
2008-07-31 07:24 --------- d-----w C:\Program Files\Optus Wireless Broadband
2008-07-29 00:17 --------- d-----w C:\Program Files\Google
2008-05-26 17:21 174 --sha-w C:\Program Files\desktop.ini
2008-04-20 04:36 32 ----a-w C:\Users\All Users\ezsid.dat
2008-04-20 04:36 32 ----a-w C:\ProgramData\ezsid.dat
2008-01-19 07:33 362,636 --sh--r C:\Windows\System32\tzuwfx.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-09-03 1576176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DU Meter"="C:\Program Files\DU Meter\DUMeter.exe" [2005-02-01 1469952]
"NSLauncher"="C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe" [2007-09-07 3100672]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2008-05-16 13529088]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2008-05-16 86016]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-09-06 1235736]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-09-06 413696]
"AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-09-03 111936]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-09-10 289576]
"SoundMan"="SOUNDMAN.EXE" [2007-03-09 C:\Windows\SOUNDMAN.EXE]
"nwiz"="nwiz.exe" [2008-05-16 C:\Windows\System32\nwiz.exe]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{93994DE8-8239-4655-B1D1-5F4E91300429}"= "C:\Program Files\DVD Region-Free\DVDShell.dll" [2003-08-26 49152]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-07-23 16:28 352256 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll dccyoo.dll zocbtc.dll lqgjuk.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AVG Anti-Spyware Driver]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AVG Anti-Spyware Guard]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1228558681-2970168192-1038802850-1000]
"EnableNotificationsRef"=dword:00000004

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{D4B96E43-13CE-4A99-AFAA-BF3AE0703A91}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{ED3A69AB-627D-4F03-B7FC-4718D85DC133}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{D2F3B1F7-AAFE-41F7-BBA3-C8DE0597D565}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"TCP Query User{BD061F38-AFBA-4FD7-9C3E-3E7C228F2DE6}C:\\invision\\mirc.exe"= UDP:C:\invision\mirc.exe:mIRC
"UDP Query User{A8026B29-A179-43D9-8F1E-0880D1F67FC1}C:\\invision\\mirc.exe"= TCP:C:\invision\mirc.exe:mIRC
"TCP Query User{79FE7414-EABF-4ED9-916E-BB9BFCAECD80}C:\\program files\\azureus\\azureus.exe"= UDP:C:\program files\azureus\azureus.exe:Azureus
"UDP Query User{912E69CA-41BF-4B3A-BBCB-3F2F30A74470}C:\\program files\\azureus\\azureus.exe"= TCP:C:\program files\azureus\azureus.exe:Azureus
"TCP Query User{BFBDEC52-09B9-4049-9D6A-EF62CB93EDC1}C:\\program files\\limewire\\limewire.exe"= UDP:C:\program files\limewire\limewire.exe:LimeWire
"UDP Query User{2C59EE1C-24C5-494C-A8B6-4E1EF493A09A}C:\\program files\\limewire\\limewire.exe"= TCP:C:\program files\limewire\limewire.exe:LimeWire
"{014FDAA8-DA12-4E6A-8B1E-DE27486E93E2}"= Disabled:UDP:C:\Users\Skim0an Desktop\AppData\Roaming\U3\0000169BA77512F7\0DE4F643-C398-46ec-9339-2362F2311932\Exec\Skype.exe:Skype
"{C30FA0FA-DFBC-42ED-8B3C-F8D7D6BCF9B0}"= Disabled:TCP:C:\Users\Skim0an Desktop\AppData\Roaming\U3\0000169BA77512F7\0DE4F643-C398-46ec-9339-2362F2311932\Exec\Skype.exe:Skype
"{1D580E89-9C67-4CBC-A4D4-1916D7BF1DBE}"= Disabled:UDP:C:\Program Files\Skype\Phone\Skype.exe:Skype
"{5339502C-08CA-4A36-B680-971CCA034951}"= Disabled:TCP:C:\Program Files\Skype\Phone\Skype.exe:Skype
"{691DE129-C134-46D3-B3AF-5371B45805B7}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{B0D73522-69F7-42C5-AD8C-97EA86F4A9DD}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{D953CBDD-23B9-4F43-920D-77F3DD71C473}"= UDP:C:\Program Files\Windows Defender\MSASCui.exe:Windows Defender
"{269EE88A-7986-4B41-9AD7-E6E925F2F563}"= TCP:C:\Program Files\Windows Defender\MSASCui.exe:Windows Defender
"{1250B643-810D-4968-A651-5AB1EE05587F}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{6F3F3EDE-5C29-453A-AE67-F00B975603B7}"= UDP:C:\Program Files\Azureus\Azureus.exe:Azureus Vuze
"{16FAB5A7-C0E3-4A56-A1AC-78C281714CFC}"= TCP:C:\Program Files\Azureus\Azureus.exe:Azureus Vuze
"{6E80D422-9C6D-4ACF-9203-844AC234F19F}"= UDP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire PRO 4.8.0
"{8E5E60F6-2443-4F45-9B8A-8489735E94FA}"= TCP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire PRO 4.8.0
"{91DE75EF-3866-4DB1-B289-46D3653EE5A3}"= UDP:C:\Program Files\mIRC\mirc.exe:mIRC
"{F22AEC19-FE5C-4D1D-BF17-6D208A751C60}"= TCP:C:\Program Files\mIRC\mirc.exe:mIRC
"{3F4238E4-568B-4F22-81B0-DAC4CD7C9F0E}"= UDP:C:\Invision\mirc.exe:mIRC - Invision
"{8C0C1494-D3D5-447E-8881-909734C37EBC}"= TCP:C:\Invision\mirc.exe:mIRC - Invision
"{70CE96D9-33AA-4579-8F5D-B79179DF1CFA}"= UDP:C:\Program Files\PKR\pkr.exe:Play PKR
"{75D7F5EE-E51B-4E1F-8BFE-CDC9283CD7EC}"= TCP:C:\Program Files\PKR\pkr.exe:Play PKR
"{E34D65AB-BEBA-4548-8B6D-3A7AA1C89EA7}"= UDP:C:\Program Files\AVG\AVG8\avgtray.exe:AVG Free Tray Icon
"{36D445BA-0282-4795-8471-4225F4D3AA0B}"= TCP:C:\Program Files\AVG\AVG8\avgtray.exe:AVG Free Tray Icon
"TCP Query User{C6136AF7-99F1-4374-BF6C-6AE143800323}C:\\program files\\icq6\\icq.exe"= UDP:C:\program files\icq6\icq.exe:ICQ Library
"UDP Query User{D58E6496-6B8B-4E52-B8BA-E1C6646ED216}C:\\program files\\icq6\\icq.exe"= TCP:C:\program files\icq6\icq.exe:ICQ Library
"{56AC8DA7-73D3-4B75-8A24-CF03B76DB292}"= UDP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent
"{174F277B-6B8D-4131-9E25-F1788A53BFE5}"= TCP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent
"TCP Query User{A1560FDA-D4B5-4AC0-B419-B320CF574D63}C:\\program files\\mozilla firefox\\firefox.exe"= UDP:C:\program files\mozilla firefox\firefox.exe:Firefox
"UDP Query User{2B8CDACE-0ABD-47C4-8EAA-94E5304AB5E2}C:\\program files\\mozilla firefox\\firefox.exe"= TCP:C:\program files\mozilla firefox\firefox.exe:Firefox
"TCP Query User{1DC7B720-1FC8-471D-8D17-D377B79F93B1}C:\\doomsday\\bin\\doomsday.exe"= UDP:C:\doomsday\bin\doomsday.exe:Doomsday
"UDP Query User{2477F089-2994-4824-81A2-E6898027B7E7}C:\\doomsday\\bin\\doomsday.exe"= TCP:C:\doomsday\bin\doomsday.exe:Doomsday
"TCP Query User{8F4671E7-F964-4118-9722-DAB56D0DBF95}C:\\program files\\nokia\\nokia software updater\\nsu_ui_client.exe"= UDP:C:\program files\nokia\nokia software updater\nsu_ui_client.exe:Nokia Software Updater
"UDP Query User{9632B333-8CD9-43EE-8E83-33E8ED94D68A}C:\\program files\\nokia\\nokia software updater\\nsu_ui_client.exe"= TCP:C:\program files\nokia\nokia software updater\nsu_ui_client.exe:Nokia Software Updater
"TCP Query User{71B58089-6809-4F83-9044-C3D3477C2AAC}C:\\program files\\common files\\nokia\\service layer\\a\\nsl_host_process.exe"= UDP:C:\program files\common files\nokia\service layer\a\nsl_host_process.exe:Nokia Service Layer Host Process
"UDP Query User{AEF7F20E-CF46-4998-A59A-E6A1E874E188}C:\\program files\\common files\\nokia\\service layer\\a\\nsl_host_process.exe"= TCP:C:\program files\common files\nokia\service layer\a\nsl_host_process.exe:Nokia Service Layer Host Process
"{F33615E3-39A5-43E5-8139-8549A9B995F4}"= UDP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent (TCP-In)
"{CE36E74E-4C9C-46A8-ABCA-B0BE6B59625D}"= TCP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent (UDP-In)
"{5E848D77-64C9-4CAE-99EE-6D7A165EE72B}"= C:\Program Files\AVG\AVG8\avgupd.exe:avgupd.exe
"{610F2B97-FCDB-4C8F-AF2E-5A6E913228D9}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{BF37B36B-E0E9-40A6-96D9-4CD4DD8C96C0}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{88D3B8D7-B483-4E2E-B504-0FB974A7CCF0}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{BC837D71-D0DA-43C8-BA74-C0FBF325D392}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{AE6CA285-76F5-45A6-B73E-4366224E427C}"= Disabled:UDP:C:\Program Files\Skype\Phone\Skype.exe:Skype
"{ADFE5D46-CB6E-418E-81F2-040BCFC79A09}"= Disabled:TCP:C:\Program Files\Skype\Phone\Skype.exe:Skype

R1 AvgLdx86;AVG Free AVI Loader Driver x86;C:\Windows\system32\Drivers\avgldx86.sys [2008-09-06 97928]
R1 pctfw2;pctfw2;C:\Windows\System32\drivers\pctfw2.sys [2008-07-28 160792]
R2 avg8wd;AVG Free8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-09-06 231704]
R2 SBSDWSCService;SBSD Security Center Service;C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [2008-07-30 809296]
R3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk60x86.sys [2007-12-06 298496]
S3 Slnt7554;USB Soft Modem Driver;C:\Windows\system32\DRIVERS\SLDRV\slnt7554.sys [2005-03-22 225280]
S3 WFIOCTL;WFIOCTL;C:\Program Files\WinFast\WFDTV\WFIOCTL.SYS [2005-01-06 9446]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1022452c-1558-11dd-9a1f-0015f2e753ee}]
\shell\AutoRun\command - F:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1022452e-1558-11dd-9a1f-0015f2e753ee}]
\shell\AutoRun\command - F:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{65badd8b-f7a1-11dc-ae80-0015f2e753ee}]
\shell\AutoRun\command - F:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{65badd9e-f7a1-11dc-ae80-0015f2e753ee}]
\shell\AutoRun\command - F:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d189586d-5cfb-11dd-9a43-0015f2e753ee}]
\shell\AutoRun\command - F:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d1895882-5cfb-11dd-9a43-0015f2e753ee}]
\shell\AutoRun\command - F:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dfa8d7b8-2b0c-11dd-91e3-0015f2e753ee}]
\shell\AutoRun\command - G:\LaunchU3.exe -a
.
Contents of the 'Scheduled Tasks' folder
.
- - - - ORPHANS REMOVED - - - -

BHO-{0D18FDE6-7BE4-4529-BD0E-77D23204306A} - (no file)
BHO-{AF8A26EB-04A2-4642-B22A-9B28E3EC4569} - (no file)
HKLM-Run-WinFast Schedule - C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
HKLM-Run-MSServer - C:\Windows\system32\hgGxUKbX.dll
MSConfigStartUp-MSServer - C:\Windows\system32\hgGxUKbX.dll


.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Users\Skim0an Desktop\AppData\Roaming\Mozilla\Firefox\Profiles\y739n1gx.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.boostcruising.com/ | www.facebook.com | www.westpac.com.au | www.ebay.com.au
FF -: plugin - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-28 09:56:12
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Windows\System32\audiodg.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Windows\System32\IoctlSvc.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Windows\System32\wbem\unsecapp.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\System32\wbem\WMIADAP.exe
.
**************************************************************************
.
Completion time: 2008-09-28 10:00:27 - machine was rebooted
ComboFix-quarantined-files.txt 2008-09-28 00:00:07

Pre-Run: 30,000,795,648 bytes free
Post-Run: 29,799,591,936 bytes free

265 --- E O F --- 2008-09-06 12:33:15



HiJackThis Log


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:03, on 2008-09-28
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\DU Meter\DUMeter.exe
C:\Windows\SOUNDMAN.EXE
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\Explorer.exe
C:\Windows\system32\notepad.exe
C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [DU Meter] C:\Program Files\DU Meter\DUMeter.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NSLauncher] C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe /startup
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O13 - Gopher Prefix:
O16 - DPF: {9732FB42-C321-11D1-836F-00A0C993F125} (mhLabel Class) - http://www.pcpitstop.com/mhLbl.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: avgrsstx.dll dccyoo.dll zocbtc.dll lqgjuk.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvsvc32.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\system32\IoctlSvc.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SmartLinkService (SLService) - - C:\Windows\SYSTEM32\slserv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: VundoFix Service (VundoFixSvc) - Atribune.org - C:\Windows\SYSTEM32\VundoFixSVC.exe

--
End of file - 6972 bytes

#8 ^sims^

^sims^
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:07:34 PM

Posted 27 September 2008 - 07:08 PM

RSIT Log

Logfile of random's system information tool 1.02 (written by random/random)
Run by Skim0an Desktop at 2008-09-28 10:06:23
Microsoft® Windows Vista™ Home Premium Service Pack 1
System drive C: has 28 GB (37%) free of 76 GB
Total RAM: 2047 MB (66% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:06, on 2008-09-28
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\DU Meter\DUMeter.exe
C:\Windows\SOUNDMAN.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\Explorer.exe
C:\Windows\system32\notepad.exe
C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Skim0an Desktop\Desktop\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Skim0an Desktop.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [DU Meter] C:\Program Files\DU Meter\DUMeter.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NSLauncher] C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe /startup
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O13 - Gopher Prefix:
O16 - DPF: {9732FB42-C321-11D1-836F-00A0C993F125} (mhLabel Class) - http://www.pcpitstop.com/mhLbl.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: avgrsstx.dll dccyoo.dll zocbtc.dll lqgjuk.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvsvc32.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\system32\IoctlSvc.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SmartLinkService (SLService) - - C:\Windows\SYSTEM32\slserv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: VundoFix Service (VundoFixSvc) - Atribune.org - C:\Windows\SYSTEM32\VundoFixSVC.exe

--
End of file - 6958 bytes

======Scheduled tasks folder======

C:\Windows\tasks\User_Feed_Synchronization-{8135EA19-91F9-49C8-8197-5B6AC9D40868}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2008-07-30 1562448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10 509328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2007-09-20 328752]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{327C2873-E90D-4c37-AA9D-10AC9BABA46C} - Easy-WebPrint - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll [2006-04-18 552960]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"DU Meter"=C:\Program Files\DU Meter\DUMeter.exe [2005-02-01 1469952]
"SoundMan"=C:\Windows\SOUNDMAN.EXE [2007-03-09 598016]
"NSLauncher"=C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe [2007-09-07 3100672]
"NvCplDaemon"=C:\Windows\system32\NvCpl.dll [2008-05-16 13529088]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=C:\Windows\system32\NvMcTray.dll [2008-05-16 86016]
"AVG8_TRAY"=C:\PROGRA~1\AVG\AVG8\avgtray.exe [2008-09-06 1235736]
"SunJavaUpdateSched"=C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2008-09-06 413696]
"AppleSyncNotifier"=C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [2008-09-03 111936]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2008-09-10 289576]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2008-01-19 1233920]
"SUPERAntiSpyware"=C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [2008-09-03 1576176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="avgrsstx.dll dccyoo.dll zocbtc.dll lqgjuk.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [2008-07-23 352256]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{93994DE8-8239-4655-B1D1-5F4E91300429}"=C:\Program Files\DVD Region-Free\DVDShell.dll [2003-08-26 49152]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AVG Anti-Spyware Driver]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AVG Anti-Spyware Guard]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AVG Anti-Spyware Driver]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AVG Anti-Spyware Guard]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sdauxservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sdcoreservice]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"EnableLUA"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1022452c-1558-11dd-9a1f-0015f2e753ee}]
shell\AutoRun\command - F:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1022452e-1558-11dd-9a1f-0015f2e753ee}]
shell\AutoRun\command - F:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{65badd8b-f7a1-11dc-ae80-0015f2e753ee}]
shell\AutoRun\command - F:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{65badd9e-f7a1-11dc-ae80-0015f2e753ee}]
shell\AutoRun\command - F:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d189586d-5cfb-11dd-9a43-0015f2e753ee}]
shell\AutoRun\command - F:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d1895882-5cfb-11dd-9a43-0015f2e753ee}]
shell\AutoRun\command - F:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dfa8d7b8-2b0c-11dd-91e3-0015f2e753ee}]
shell\AutoRun\command - G:\LaunchU3.exe -a


======List of files/folders created in the last 1 months======

2008-09-28 10:06:23 ----D---- C:\rsit
2008-09-28 10:00:29 ----D---- C:\Windows\temp
2008-09-28 10:00:28 ----A---- C:\ComboFix.txt
2008-09-28 09:50:32 ----D---- C:\Windows\erdnt
2008-09-28 09:50:08 ----D---- C:\QooBox
2008-09-28 09:49:51 ----A---- C:\Windows\swreg.exe
2008-09-22 23:47:32 ----D---- C:\Program Files\Trend Micro
2008-09-14 21:55:53 ----D---- C:\Program Files\Alwil Software
2008-09-13 09:40:11 ----A---- C:\Windows\zip.exe
2008-09-13 09:40:11 ----A---- C:\Windows\VFind.exe
2008-09-13 09:40:11 ----A---- C:\Windows\swsc.exe
2008-09-13 09:40:11 ----A---- C:\Windows\sed.exe
2008-09-13 09:40:11 ----A---- C:\Windows\Nircmd.exe
2008-09-13 09:40:11 ----A---- C:\Windows\grep.exe
2008-09-13 09:40:11 ----A---- C:\Windows\fdsv.exe
2008-09-13 09:39:40 ----A---- C:\Windows\swxcacls.exe
2008-09-13 09:34:08 ----DC---- C:\Windows\system32\DRVSTORE
2008-09-13 09:34:08 ----A---- C:\Windows\system32\GEARAspi.dll
2008-09-13 09:33:53 ----D---- C:\Program Files\iPod
2008-09-13 09:33:52 ----D---- C:\ProgramData\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-09-13 09:33:52 ----D---- C:\Program Files\iTunes
2008-09-13 09:32:26 ----D---- C:\Program Files\Bonjour
2008-09-13 09:31:16 ----D---- C:\Program Files\QuickTime
2008-09-11 17:31:07 ----D---- C:\Users\Skim0an Desktop\AppData\Roaming\Malwarebytes
2008-09-11 17:31:03 ----D---- C:\ProgramData\Malwarebytes
2008-09-11 17:31:02 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2008-09-10 22:38:07 ----D---- C:\ProgramData\SUPERAntiSpyware.com
2008-09-10 22:37:40 ----D---- C:\Users\Skim0an Desktop\AppData\Roaming\SUPERAntiSpyware.com
2008-09-10 22:37:40 ----D---- C:\Program Files\SUPERAntiSpyware
2008-09-10 22:34:19 ----A---- C:\MGtools.exe
2008-09-09 22:30:16 ----A---- C:\Windows\system32\VundoFixSVC.exe
2008-09-09 22:06:17 ----D---- C:\VundoFix Backups
2008-09-09 18:00:52 ----D---- C:\Program Files\Common Files\PC Tools
2008-09-09 18:00:45 ----D---- C:\Users\Skim0an Desktop\AppData\Roaming\PC Tools
2008-09-09 18:00:45 ----D---- C:\ProgramData\PC Tools
2008-09-09 18:00:45 ----D---- C:\Program Files\Spyware Doctor
2008-09-08 20:09:58 ----D---- C:\Program Files\Lavasoft
2008-09-08 20:09:57 ----D---- C:\ProgramData\Lavasoft
2008-09-08 20:04:12 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2008-09-08 17:56:26 ----A---- C:\VundoFix.txt
2008-09-08 16:22:42 ----ASH---- C:\Windows\system32\BJkmlnmp.ini
2008-09-07 18:04:23 ----A---- C:\ProgramData\pskt.ini
2008-09-07 18:04:23 ----A---- C:\ProgramData\BMa39acf1b.txt
2008-09-07 14:44:58 ----D---- C:\Users\Skim0an Desktop\AppData\Roaming\Thunderbird
2008-09-07 12:54:27 ----A---- C:\Windows\system32\ab8a38f9-.txt
2008-09-07 12:47:36 ----ASH---- C:\Windows\system32\MVyaGjjl.ini2
2008-09-07 12:47:36 ----ASH---- C:\Windows\system32\MVyaGjjl.ini
2008-09-07 12:42:12 ----D---- C:\Temp
2008-09-06 22:12:12 ----A---- C:\Windows\system32\avgrsstx.dll
2008-09-06 22:11:46 ----D---- C:\ProgramData\avg8
2008-08-31 23:02:13 ----A---- C:\Windows\system32\tzres.dll
2008-08-31 22:57:24 ----A---- C:\Windows\system32\es.dll
2008-08-31 22:57:23 ----A---- C:\Windows\system32\IPSECSVC.DLL
2008-08-31 22:57:18 ----A---- C:\Windows\system32\mshtml.dll
2008-08-31 22:57:17 ----A---- C:\Windows\system32\ieframe.dll
2008-08-31 22:57:16 ----A---- C:\Windows\system32\wininet.dll
2008-08-31 22:57:16 ----A---- C:\Windows\system32\urlmon.dll
2008-08-31 22:57:15 ----A---- C:\Windows\system32\mstime.dll
2008-08-31 22:57:15 ----A---- C:\Windows\system32\jsproxy.dll
2008-08-31 22:55:55 ----A---- C:\Windows\system32\inetcomm.dll
2008-08-29 10:18:58 ----A---- C:\Windows\system32\dns-sd.exe
2008-08-29 09:53:50 ----A---- C:\Windows\system32\dnssd.dll

======List of files/folders modified in the last 1 months======

2008-09-28 10:03:40 ----D---- C:\Program Files\Mozilla Firefox
2008-09-28 10:01:32 ----D---- C:\Windows\System32
2008-09-28 10:01:32 ----D---- C:\Windows\inf
2008-09-28 10:01:32 ----A---- C:\Windows\system32\PerfStringBackup.INI
2008-09-28 10:00:30 ----D---- C:\Windows\system32\drivers
2008-09-28 10:00:29 ----D---- C:\Windows
2008-09-28 09:56:09 ----A---- C:\Windows\system.ini
2008-09-28 09:53:51 ----D---- C:\Windows\system32\config
2008-09-28 09:52:35 ----D---- C:\Windows\AppPatch
2008-09-28 09:52:35 ----D---- C:\Program Files\Common Files
2008-09-28 09:50:30 ----SHD---- C:\System Volume Information
2008-09-28 09:49:41 ----D---- C:\Windows\Prefetch
2008-09-28 05:08:22 ----HD---- C:\$AVG8.VAULT$
2008-09-27 22:17:12 ----D---- C:\Users\Skim0an Desktop\AppData\Roaming\Skype
2008-09-27 22:17:10 ----D---- C:\Users\Skim0an Desktop\AppData\Roaming\skypePM
2008-09-27 22:09:40 ----D---- C:\ProgramData\Spybot - Search & Destroy
2008-09-27 22:01:37 ----D---- C:\Users\Skim0an Desktop\AppData\Roaming\uTorrent
2008-09-27 16:21:20 ----A---- C:\Windows\NeroDigital.ini
2008-09-27 04:47:55 ----D---- C:\Program Files\Unlocker
2008-09-25 17:34:48 ----SHD---- C:\Windows\Installer
2008-09-25 17:33:14 ----SD---- C:\Users\Skim0an Desktop\AppData\Roaming\Microsoft
2008-09-23 22:47:34 ----SD---- C:\ProgramData\Microsoft
2008-09-22 23:47:32 ----RD---- C:\Program Files
2008-09-19 20:31:34 ----AD---- C:\ProgramData\TEMP
2008-09-19 19:58:40 ----D---- C:\Windows\Minidump
2008-09-16 01:18:07 ----D---- C:\Windows\system32\catroot2
2008-09-13 19:17:20 ----D---- C:\Program Files\PKR
2008-09-13 09:34:09 ----D---- C:\Windows\system32\catroot
2008-09-13 09:33:52 ----HD---- C:\ProgramData
2008-09-13 09:31:20 ----D---- C:\Program Files\Common Files\Apple
2008-09-09 22:25:11 ----D---- C:\Program Files\Java
2008-09-07 17:53:25 ----D---- C:\Windows\system32\LogFiles
2008-09-07 17:53:20 ----D---- C:\Windows\Debug
2008-09-07 14:45:10 ----D---- C:\Users\Skim0an Desktop\AppData\Roaming\Mozilla
2008-09-07 14:39:30 ----D---- C:\Program Files\Pidgin
2008-09-07 14:09:20 ----D---- C:\Users\Skim0an Desktop\AppData\Roaming\Azureus
2008-09-01 00:12:30 ----D---- C:\Windows\rescache
2008-09-01 00:04:27 ----D---- C:\Windows\winsxs
2008-08-31 23:59:49 ----D---- C:\Program Files\Spybot - Search & Destroy
2008-08-31 23:51:24 ----D---- C:\Windows\system32\migration
2008-08-31 23:51:24 ----D---- C:\Windows\system32\en-US
2008-08-31 23:51:23 ----D---- C:\Program Files\Windows Mail
2008-08-31 22:58:28 ----D---- C:\Program Files\Microsoft Silverlight
2008-08-31 22:08:50 ----D---- C:\Windows\system32\WDI

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AvgLdx86;AVG Free AVI Loader Driver x86; C:\Windows\System32\Drivers\avgldx86.sys [2008-09-06 97928]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86; C:\Windows\System32\Drivers\avgmfx86.sys [2008-09-06 26824]
R1 pctfw2;pctfw2; \??\C:\Windows\System32\drivers\pctfw2.sys [2008-07-28 160792]
R1 SASDIFSV;SASDIFSV; \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS [2008-09-03 8944]
R1 SASKUTIL;SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys [2008-09-03 55024]
R2 CX23880;WinFast CX2388x WDM Video Capture.; C:\Windows\system32\drivers\cx88vid.sys [2006-10-18 162944]
R2 CXAVXBAR;WinFast CX2388x WDM Crossbar.; C:\Windows\system32\drivers\cxavxbar.sys [2006-10-18 9728]
R2 CXTUNE;WinFast CX2388x WDM TVTuner.; C:\Windows\system32\drivers\CX88TUNE.sys [2006-10-18 50816]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\Windows\system32\drivers\RTKVAC.SYS [2008-03-25 4137312]
R3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\System32\Drivers\GEARAspiWDM.sys [2008-04-17 15464]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\Windows\system32\DRIVERS\ASACPI.sys [2004-08-13 5810]
R3 nv;nv; C:\Windows\system32\DRIVERS\nv4_mini.sys [2008-05-16 6557408]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\Windows\system32\DRIVERS\nvmfdx32.sys [2007-11-18 1040544]
R3 QCDonner;Logitech QuickCam Express(PID_0840); C:\Windows\system32\DRIVERS\LVCD.sys [2004-04-26 474304]
R3 SASENUM;SASENUM; \??\C:\Program Files\SUPERAntiSpyware\SASENUM.SYS [2008-09-03 7408]
R3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller; C:\Windows\system32\DRIVERS\yk60x86.sys [2007-12-06 298496]
S3 drmkaud;Microsoft Kernel DRM Audio Descrambler; C:\Windows\system32\drivers\drmkaud.sys [2008-01-19 5632]
S3 IKFileSec;File Security Driver; C:\Windows\system32\drivers\ikfilesec.sys [2008-08-25 40840]
S3 IKSysFlt;System Filter Driver; C:\Windows\system32\drivers\iksysflt.sys [2008-08-25 66952]
S3 IKSysSec;System Security Driver; C:\Windows\system32\drivers\iksyssec.sys [2008-08-25 81288]
S3 MODEMCSA;Unimodem Streaming Filter Device; C:\Windows\system32\drivers\MODEMCSA.sys [2008-01-19 18432]
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-19 8192]
S3 MSPCLOCK;Microsoft Streaming Clock Proxy; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-19 5888]
S3 MSPQM;Microsoft Streaming Quality Manager Proxy; C:\Windows\system32\drivers\MSPQM.sys [2008-01-19 5504]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\Windows\system32\drivers\MSTEE.sys [2008-01-19 6016]
S3 Mtlmnt5;Mtlmnt5; C:\Windows\system32\DRIVERS\SLDRV\Mtlmnt5.sys [2005-03-22 229848]
S3 Mtlstrm;Mtlstrm; C:\Windows\system32\DRIVERS\SLDRV\Mtlstrm.sys [2005-03-22 1397136]
S3 nmwcd;Nokia USB Phone Parent; C:\Windows\system32\drivers\nmwcd.sys [2007-02-22 137216]
S3 nmwcdc;Nokia USB Generic; C:\Windows\system32\drivers\nmwcdc.sys [2007-02-22 8320]
S3 nmwcdcj;Nokia USB Port; C:\Windows\system32\drivers\nmwcdcj.sys [2007-02-22 12288]
S3 nmwcdcm;Nokia USB Modem; C:\Windows\system32\drivers\nmwcdcm.sys [2007-02-22 12288]
S3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2008-05-16 7465312]
S3 Slnt7554;USB Soft Modem Driver; C:\Windows\system32\DRIVERS\SLDRV\slnt7554.sys [2005-03-22 225280]
S3 SlNtHal;SlNtHal; C:\Windows\system32\DRIVERS\SLDRV\Slnthal.sys [2005-03-22 101328]
S3 SlWdmSup;SlWdmSup; C:\Windows\system32\DRIVERS\SLDRV\SlWdmSup.sys [2005-03-22 13280]
S3 USBAAPL;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl.sys [2008-07-22 32000]
S3 usbaudio;USB Audio Driver (WDM); C:\Windows\system32\drivers\usbaudio.sys [2008-01-19 73088]
S3 WFIOCTL;WFIOCTL; \??\C:\Program Files\WinFast\WFDTV\WFIOCTL.SYS [2005-01-06 9446]
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-19 83328]
S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys [2006-11-02 11264]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aawservice;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe [2008-09-08 611664]
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-09-10 116040]
R2 avg8wd;AVG Free8 WatchDog; C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-09-06 231704]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-08-29 238888]
R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3; C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe [2008-02-18 877864]
R2 PLFlash DeviceIoControl Service;PLFlash DeviceIoControl Service; C:\Windows\system32\IoctlSvc.exe [2006-12-19 81920]
R2 SBSDWSCService;SBSD Security Center Service; C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [2008-07-30 809296]
R2 UleadBurningHelper;Ulead Burning Helper; C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe [2004-12-13 49152]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2008-09-10 536872]
S2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvsvc32.exe [2008-05-16 159812]
S2 SLService;SmartLinkService; C:\Windows\system32\slserv.exe [2003-10-28 45056]
S3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe [2008-02-28 529704]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 sdAuxService;PC Tools Auxiliary Service; C:\Program Files\Spyware Doctor\pctsAuxs.exe [2008-06-13 356920]
S3 sdCoreService;PC Tools Security Service; C:\Program Files\Spyware Doctor\pctsSvc.exe [2008-08-25 1077640]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2007-02-08 212480]
S3 usnjsvc;Messenger Sharing Folders USN Journal Reader service; C:\Program Files\Windows Live\Messenger\usnsvc.exe [2007-10-18 98328]
S3 VundoFixSvc;VundoFix Service; C:\Windows\system32\VundoFixSVC.exe [2008-09-09 24576]
S3 WLSetupSvc;Windows Live Setup Service; C:\Program Files\Windows Live\installer\WLSetupSvc.exe [2007-10-25 266240]

-----------------EOF-----------------


RSIT info

info.txt logfile of random's system information tool 1.02 2008-09-28 10:06:30

======Uninstall list======

-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
-->C:\Program Files\Nero\Nero8\\nero\uninstall\UNNERO.exe /UNINSTALL
-->C:\Windows\UNNeroBackItUp.exe /UNINSTALL
-->C:\Windows\UNNeroMediaHome.exe /UNINSTALL
-->C:\Windows\UNNeroShowTime.exe /UNINSTALL
-->C:\Windows\UNNeroVision.exe /UNINSTALL
-->C:\Windows\UNRecode.exe /UNINSTALL
Ad-Aware-->MsiExec.exe /I{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)-->MsiExec.exe /X{6846389C-BAC0-4374-808E-B120F86AF5D7}
Adobe Flash Player ActiveX-->C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Reader 8.1.2-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81200000003}
Apple Mobile Device Support-->MsiExec.exe /I{AA9768AA-FF0B-4C66-A085-31E934F77841}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
Aspell English Dictionary-0.50-2-->"C:\Program Files\Aspell\unins001.exe"
AVG Free 8.0-->C:\Program Files\AVG\AVG8\setup.exe /UNINSTALL
Azureus Vuze-->C:\Program Files\Azureus\uninstall.exe
Blaze Media Pro-->"C:\Users\Public\Application Data\{FBDA53F5-763E-4114-A576-612E9769C133}\setup_blazemp.exe" REMOVE=TRUE MODIFY=FALSE
Bonjour-->MsiExec.exe /I{8A25392D-C5D2-4E79-A2BD-C15DDC5B0959}
Canon iP6700D Memory Card Utility-->"C:\Program Files\Canon\Memory Card Utility\iP6700D\Maint.exe" /UninstallRemove C:\Program Files\Canon\Memory Card Utility\iP6700D\uninst.ini
Canon iP6700D-->"C:\Windows\system32\CanonIJ Uninstaller Information\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP6700D\DelDrv.exe" /U:{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP6700D /L0x0009
Canon Utilities Easy-PhotoPrint-->C:\Program Files\Canon\Easy-PhotoPrint\uninst.exe uninst.ini
Canon Utilities Easy-PrintToolBox-->C:\Windows\BJPSUNST.EXE
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
CD-LabelPrint-->"C:\Program Files\Canon\CD-LabelPrint\Uninstal.exe" Canon.CDLabelPrint.Application
Compatibility Pack for the 2007 Office system-->MsiExec.exe /X{90120000-0020-0409-0000-0000000FF1CE}
CutePDF Writer 2.7-->C:\Program Files\Acro Software\CutePDF Writer\uninscpw.exe /uninstall
DivX Converter-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
DivX Player-->C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
DU Meter-->"C:\Program Files\DU Meter\unins000.exe"
DVD Shrink 3.2-->"C:\Program Files\DVD Shrink\unins000.exe"
Easy-WebPrint-->C:\Windows\IsUninst.exe -f"C:\Program Files\Canon\Easy-WebPrint\Uninst.isu"
End It All-->C:\PROGRA~1\EndItAll\UNWISE.EXE C:\PROGRA~1\EndItAll\INSTALL.LOG
FireTune-->C:\Windows\iun6002.exe "C:\Program Files\FireTune\irunin.ini"
Free iPod Video Converter 1.34-->"C:\Program Files\Free iPod Video Converter\unins000.exe"
getPlus®_ocx-->rundll32.exe advpack.dll,LaunchINFSection C:\Windows\inf\GETPLUSo.INF, DefaultUninstall
GNU Aspell 0.50-3-->"C:\Program Files\Aspell\unins000.exe"
Google Earth-->MsiExec.exe /I{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}
GTK+ Runtime 2.12.8 rev a (remove only)-->C:\Program Files\Common Files\GTK\2.0\uninst.exe
HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
ICQ6-->"C:\Program Files\InstallShield Installation Information\{60DE4033-9503-48D1-A483-7846BD217CA9}\setup.exe" -runfromtemp -l0x0009 -removeonly
iTunes-->MsiExec.exe /I{41B9E2CF-0B3F-442A-B5B3-592A4A355634}
J2SE Runtime Environment 5.0 Update 1-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150010}
Java™ 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
LimeWire PRO 4.18.2-->"C:\Program Files\LimeWire\uninstall.exe"
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft Office Professional Edition 2003-->MsiExec.exe /I{90110409-6000-11D3-8CFE-0150048383C9}
Microsoft Silverlight-->MsiExec.exe /I{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
mIRC-->C:\Program Files\mIRC\uninstall.exe _?=C:\Program Files\mIRC
MobileMe Control Panel-->MsiExec.exe /I{6DA9102E-199F-43A0-A36B-6EF48081A658}
Mozilla Firefox (3.0.3)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB941833)-->MsiExec.exe /I{C523D256-313D-4866-B36A-F3DE528246EF}
Nero 8 Trial-->MsiExec.exe /X{3C5F1B30-B10B-4579-86DD-D00F662E1033}
neroxml-->MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}
Nokia Connectivity Cable Driver-->MsiExec.exe /X{972B1D9B-0EAD-49E8-B7D6-3B83FD5665B1}
Nokia Lifeblog 2.5-->MsiExec.exe /I{E94603CA-2996-4154-8EE2-A5FCD4BFB500}
Nokia NSeries Application Installer-->MsiExec.exe /I{FD349381-D79C-4E5C-8980-015DFFB962D5}
Nokia NSeries Content Copier-->MsiExec.exe /X{F779EC8D-6703-4C4A-817C-37B07898E647}
Nokia NSeries Multimedia Player-->MsiExec.exe /I{FA25FAF6-3097-43C9-BBB2-A77CE8AF1881}
Nokia NSeries System Utilities-->MsiExec.exe /X{96E94E18-54D6-42C1-8FC4-24DACEDC3395}
Nokia Software Launcher-->MsiExec.exe /I{A8C856AD-63CD-4613-AA29-E6C85607EA06}
Nokia Software Updater-->MsiExec.exe /X{3186AEAE-E104-424D-9152-1BF6A4404758}
NVIDIA Drivers-->C:\Windows\system32\nvuninst.exe UninstallGUI
OJOsoft Total Video Converter-->"C:\Program Files\OJOsoft\uninstall.exe" "/U:C:\Program Files\OJOsoft\OJOsoft Total Video Converter\Uninstall\uninstall.xml"
PC Connectivity Solution-->MsiExec.exe /I{6094AB91-4CC8-498E-9DFF-134CC0B159DE}
PKR-->"C:\Program Files\PKR\uninstall-pkr.exe"
QuickTime-->MsiExec.exe /I{8DC42D05-680B-41B0-8878-6C14D24602DB}
Realtek AC'97 Audio-->Alcrmv.exe -r -m
Send To Toys v2.5-->"C:\Program Files\Send To Toys\unins000.exe"
Sibelius Scorch (ActiveX Only)-->MsiExec.exe /I{15CCBC5D-66A7-4131-8D36-E05F27B0E68F}
Skype™ 3.6-->MsiExec.exe /X{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}
Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
Spyware Doctor 6.0-->C:\Program Files\Spyware Doctor\unins000.exe /LOG
SUPERAntiSpyware Free Edition-->MsiExec.exe /X{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}
TMPGEnc DVD Author 1.6-->MsiExec.exe /I{9CD89DD7-234A-4801-9D87-3DE352E146A0}
Unlocker 1.8.7-->C:\Program Files\Unlocker\uninst.exe
VideoLAN VLC media player 0.8.5-->C:\Program Files\VideoLAN\VLC\uninstall.exe
Windows Live installer-->MsiExec.exe /X{A7E4ECCA-4A8E-4258-8EC8-2DCCF5B11320}
Windows Live Mail-->MsiExec.exe /I{184E7118-0295-43C4-B72C-1D54AA75AAF7}
Windows Live Messenger-->MsiExec.exe /X{508CE775-4BA4-4748-82DF-FE28DA9F03B0}
Windows Live Sign-in Assistant-->MsiExec.exe /I{AFA4E5FD-ED70-4D92-99D0-162FD56DC986}
Windows Media Player Firefox Plugin-->MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}
WinFast PVR2-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C92C584E-C781-475E-A8E2-C67D993A6B95}\Setup.exe" -l0x9 -removeonly
WinFast TV2000XP Expert Driver -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{93461FB1-59B0-4BF4-A302-537684CF4ED0}\setup.exe" -l0x9 -removeonly
WinRAR archiver-->C:\Program Files\WinRAR\uninstall.exe

======Security center information======

AV: AVG Anti-Virus Free (disabled)
AS: AVG Anti-Virus Free (disabled)
AS: Spybot - Search and Destroy (disabled) (outdated)
AS: AVG Anti-Spyware (disabled) (outdated)
AS: Windows Defender (outdated)
AS: SUPERAntiSpyware (disabled)

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"Path"=%systemroot%\system32;%systemroot%;%systemroot%\system32\wbem;C:\Program Files\PC Connectivity Solution;C:\Program Files\QuickTime\QTSystem
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE"=x86
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"USERNAME"=SYSTEM
"windir"=%SystemRoot%
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 47 Stepping 2, AuthenticAMD
"PROCESSOR_REVISION"=2f02
"NUMBER_OF_PROCESSORS"=1
"CLASSPATH"=.;C:\Program Files\Java\jre1.6.0_07\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files\Java\jre1.6.0_07\lib\ext\QTJava.zip

-----------------EOF-----------------

#9 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,717 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:11:34 AM

Posted 28 September 2008 - 06:18 AM

We are almost there.
  • You have the latest version of Java and it is good. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please uninstall the older version of Java:

    J2SE Runtime Environment 5.0 Update 1

  • Make sure that you can view all hidden and system files. Instructions on how to do this can be found here: How to see hidden files in Windows

    Click on this link--> virustotal

    Click the browse button and navigate to the file below in bold, then click Send File.

    C:\Windows\System32\tzuwfx.exe

    Please copy and paste the results of the scan in your next post.

  • Please read the note first.
    Open notepad and copy/paste the text in the code box below into it:

    http://www.bleepingcomputer.com/forums/t/170747/virtumondevundotrojanmalwaretrace/
    
    Collect::[4]
    C:\Windows\System32\BJkmlnmp.ini
    C:\Windows\System32\MVyaGjjl.ini2
    C:\Windows\System32\MVyaGjjl.ini
    
    Suspect::
    C:\Windows\System32\tzuwfx.exe
    
    Folder::
    C:\Temp\dax41
    
    Registry::
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] 
    "Appinit_dlls"="avgrsstx.dll"

    Save this as CFScript.txt


    Posted Image


    Referring to the picture above, drag CFScript.txt into ComboFix.exe

    When finished, it shall produce a log for you. Post that log in your next reply.

    **Important Note**

    When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.
    • Ensure you are connected to the internet and click OK on the message box.
    • A browser will open.
    • Simply follow the instructions to copy/paste/send the requested file.
  • Please copy and paste a fresh Hijackthis log to your reply and tell me how is your computer running.
Please copy/paste in your next reply:
  • The Combofix log.
  • A fresh Hijackthis log.


#10 ^sims^

^sims^
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:07:34 PM

Posted 28 September 2008 - 07:24 AM

Step 2


File has already been analysed:
MD5: 74edb9e052ac3e9301726097584673b5
First received: 09.09.2008 21:24:40 (CET)
Date: 09.16.2008 10:13:00 (CET) [>12D]
Results: 3/36
Permalink: analisis/2555064ba8f40347f68804e5e2b9694d





The .zip file has been submitted.





ComboFix Log



ComboFix 08-09-27.03 - Skim0an Desktop 2008-09-28 22:13:37.2 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.1284 [GMT 10:00]
Running from: C:\Users\Skim0an Desktop\Desktop\ComboFix.exe
Command switches used :: C:\Users\Skim0an Desktop\Desktop\CFScript.txt
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Temp\dax41
C:\Windows\System32\BJkmlnmp.ini
C:\Windows\System32\MVyaGjjl.ini
C:\Windows\System32\MVyaGjjl.ini2

.
((((((((((((((((((((((((( Files Created from 2008-08-28 to 2008-09-28 )))))))))))))))))))))))))))))))
.

2008-09-28 10:06 . 2008-09-28 10:06 <DIR> d-------- C:\rsit
2008-09-22 23:47 . 2008-09-22 23:47 <DIR> d-------- C:\Program Files\Trend Micro
2008-09-22 23:29 . 2008-09-22 23:28 102,664 --a------ C:\Windows\System32\drivers\tmcomm.sys
2008-09-22 23:28 . 2008-09-22 23:29 <DIR> d-------- C:\Users\Skim0an Desktop\.housecall6.6
2008-09-14 21:55 . 2008-09-14 21:55 <DIR> d-------- C:\Program Files\Alwil Software
2008-09-14 21:31 . 2008-09-14 21:31 61,224 --a------ C:\Users\Skim0an Desktop\GoToAssistDownloadHelper.exe
2008-09-13 09:34 . 2008-09-13 09:34 <DIR> d----c--- C:\Windows\System32\DRVSTORE
2008-09-13 09:34 . 2008-04-17 13:12 107,368 --a------ C:\Windows\System32\GEARAspi.dll
2008-09-13 09:34 . 2008-04-17 13:12 15,464 --a------ C:\Windows\System32\drivers\GEARAspiWDM.sys
2008-09-13 09:33 . 2008-09-13 09:34 <DIR> d-------- C:\Users\All Users\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-09-13 09:33 . 2008-09-13 09:34 <DIR> d-------- C:\ProgramData\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-09-13 09:33 . 2008-09-13 09:34 <DIR> d-------- C:\Program Files\iTunes
2008-09-13 09:33 . 2008-09-13 09:33 <DIR> d-------- C:\Program Files\iPod
2008-09-13 09:32 . 2008-09-13 09:32 <DIR> d-------- C:\Program Files\Bonjour
2008-09-13 09:31 . 2008-09-13 09:31 <DIR> d-------- C:\Program Files\QuickTime
2008-09-11 17:31 . 2008-09-11 17:31 <DIR> d-------- C:\Users\Skim0an Desktop\AppData\Roaming\Malwarebytes
2008-09-11 17:31 . 2008-09-11 17:31 <DIR> d-------- C:\Users\All Users\Malwarebytes
2008-09-11 17:31 . 2008-09-11 17:31 <DIR> d-------- C:\ProgramData\Malwarebytes
2008-09-11 17:31 . 2008-09-11 17:31 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-09-11 17:31 . 2008-09-10 00:08 38,528 --a------ C:\Windows\System32\drivers\mbamswissarmy.sys
2008-09-11 17:31 . 2008-09-10 00:08 17,200 --a------ C:\Windows\System32\drivers\mbam.sys
2008-09-10 22:38 . 2008-09-10 22:38 <DIR> d-------- C:\Users\All Users\SUPERAntiSpyware.com
2008-09-10 22:38 . 2008-09-10 22:38 <DIR> d-------- C:\ProgramData\SUPERAntiSpyware.com
2008-09-10 22:37 . 2008-09-10 22:37 <DIR> d-------- C:\Users\Skim0an Desktop\AppData\Roaming\SUPERAntiSpyware.com
2008-09-10 22:37 . 2008-09-10 22:37 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2008-09-10 22:34 . 2008-09-10 22:34 1,266,807 --a------ C:\MGtools.exe
2008-09-09 22:30 . 2008-09-09 22:30 24,576 --a------ C:\Windows\System32\VundoFixSVC.exe
2008-09-09 22:06 . 2008-09-09 22:29 <DIR> d-------- C:\VundoFix Backups
2008-09-09 18:21 . 2008-06-23 17:02 <DIR> d-------- C:\Users\Skim0an Desktop\Spyware Doctor 6.X.X.XXX
2008-09-09 18:01 . 2008-07-28 11:29 160,792 --a------ C:\Windows\System32\drivers\pctfw2.sys
2008-09-09 18:00 . 2008-09-09 18:00 <DIR> d-------- C:\Users\Skim0an Desktop\AppData\Roaming\PC Tools
2008-09-09 18:00 . 2008-09-09 18:00 <DIR> d-------- C:\Users\All Users\PC Tools
2008-09-09 18:00 . 2008-09-09 18:00 <DIR> d-------- C:\ProgramData\PC Tools
2008-09-09 18:00 . 2008-09-11 17:27 <DIR> d-------- C:\Program Files\Spyware Doctor
2008-09-09 18:00 . 2008-09-09 18:01 <DIR> d-------- C:\Program Files\Common Files\PC Tools
2008-09-09 18:00 . 2008-08-25 11:36 81,288 --a------ C:\Windows\System32\drivers\iksyssec.sys
2008-09-09 18:00 . 2008-08-25 11:36 66,952 --a------ C:\Windows\System32\drivers\iksysflt.sys
2008-09-09 18:00 . 2008-08-25 11:36 40,840 --a------ C:\Windows\System32\drivers\ikfilesec.sys
2008-09-09 18:00 . 2008-06-02 15:19 29,576 --a------ C:\Windows\System32\drivers\kcom.sys
2008-09-08 22:54 . 2006-11-01 13:06 170,808 --a------ C:\Users\Skim0an Desktop\Listdlls.exe
2008-09-08 21:44 . 2008-09-08 21:44 0 --ah----- C:\ntuser.dat.LOG2
2008-09-08 21:44 . 2008-09-08 21:44 0 --ah----- C:\ntuser.dat.LOG1
2008-09-08 21:44 . 2008-09-08 21:44 0 --a------ C:\ntuser.dat
2008-09-08 20:09 . 2008-09-08 20:12 <DIR> d-------- C:\Users\All Users\Lavasoft
2008-09-08 20:09 . 2008-09-08 20:12 <DIR> d-------- C:\ProgramData\Lavasoft
2008-09-08 20:09 . 2008-09-08 20:09 <DIR> d-------- C:\Program Files\Lavasoft
2008-09-08 20:04 . 2008-09-10 22:37 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-09-07 14:44 . 2008-09-07 14:45 <DIR> d-------- C:\Users\Skim0an Desktop\AppData\Roaming\Thunderbird
2008-09-07 12:42 . 2008-09-28 22:14 <DIR> d-------- C:\Temp
2008-09-06 22:12 . 2008-09-28 09:18 <DIR> d-------- C:\Windows\System32\drivers\Avg
2008-09-06 22:12 . 2008-09-06 22:36 97,928 --a------ C:\Windows\System32\drivers\avgldx86.sys
2008-09-06 22:12 . 2008-09-06 22:12 10,520 --a------ C:\Windows\System32\avgrsstx.dll
2008-09-06 22:11 . 2008-09-06 22:33 <DIR> d-------- C:\Users\All Users\avg8
2008-09-06 22:11 . 2008-09-06 22:33 <DIR> d-------- C:\ProgramData\avg8
2008-09-06 15:09 . 2008-09-06 15:09 90,112 --a------ C:\Windows\System32\QuickTimeVR.qtx
2008-09-06 15:09 . 2008-09-06 15:09 57,344 --a------ C:\Windows\System32\QuickTime.qts
2008-08-31 23:02 . 2008-07-16 11:32 2,048 --a------ C:\Windows\System32\tzres.dll
2008-08-31 22:57 . 2008-06-27 11:55 1,383,424 --a------ C:\Windows\System32\mshtml.tlb
2008-08-31 22:57 . 2008-06-27 14:15 827,392 --a------ C:\Windows\System32\wininet.dll
2008-08-31 22:57 . 2008-06-19 13:31 361,984 --a------ C:\Windows\System32\IPSECSVC.DLL
2008-08-31 22:57 . 2008-04-18 15:48 269,312 --a------ C:\Windows\System32\es.dll
2008-08-31 22:55 . 2008-04-10 15:12 738,304 --a------ C:\Windows\System32\inetcomm.dll
2008-08-29 10:18 . 2008-08-29 10:18 87,336 --a------ C:\Windows\System32\dns-sd.exe
2008-08-29 09:53 . 2008-08-29 09:53 61,440 --a------ C:\Windows\System32\dnssd.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-28 11:32 --------- d-----w C:\Program Files\Java
2008-09-27 12:17 --------- d-----w C:\Users\Skim0an Desktop\AppData\Roaming\skypePM
2008-09-27 12:17 --------- d-----w C:\Users\Skim0an Desktop\AppData\Roaming\Skype
2008-09-27 12:09 --------- d-----w C:\ProgramData\Spybot - Search & Destroy
2008-09-27 12:01 --------- d-----w C:\Users\Skim0an Desktop\AppData\Roaming\uTorrent
2008-09-26 18:47 --------- d-----w C:\Program Files\Unlocker
2008-09-19 10:31 --------- d---a-w C:\ProgramData\TEMP
2008-09-13 09:17 --------- d-----w C:\Program Files\PKR
2008-09-12 23:31 --------- d-----w C:\Program Files\Common Files\Apple
2008-09-07 04:39 --------- d-----w C:\Program Files\Pidgin
2008-09-07 04:09 --------- d-----w C:\Users\Skim0an Desktop\AppData\Roaming\Azureus
2008-08-31 13:59 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-08-31 13:51 --------- d-----w C:\Program Files\Windows Mail
2008-08-31 12:58 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-08-09 08:05 --------- d-----w C:\Users\Skim0an Desktop\AppData\Roaming\Apple Computer
2008-08-09 07:57 --------- d-----w C:\Program Files\DivX
2008-08-09 07:56 --------- d-----w C:\Users\Skim0an Desktop\AppData\Roaming\DivX
2008-08-09 07:38 --------- d-----w C:\Program Files\Apple Software Update
2008-08-09 01:40 --------- d-----w C:\ProgramData\NVIDIA
2008-07-31 07:24 --------- d-----w C:\Program Files\Optus Wireless Broadband
2008-07-29 00:17 --------- d-----w C:\Program Files\Google
2008-07-25 08:36 524,288 ----a-w C:\Windows\System32\DivXsm.exe
2008-07-23 16:50 3,596,288 ----a-w C:\Windows\System32\qt-dx331.dll
2008-07-23 16:48 200,704 ----a-w C:\Windows\System32\ssldivx.dll
2008-07-23 16:48 1,044,480 ----a-w C:\Windows\System32\libdivx.dll
2008-07-23 16:46 12,288 ----a-w C:\Windows\System32\DivXWMPExtType.dll
2008-05-26 17:21 174 --sha-w C:\Program Files\desktop.ini
2008-04-20 04:36 32 ----a-w C:\Users\All Users\ezsid.dat
2008-04-20 04:36 32 ----a-w C:\ProgramData\ezsid.dat
2008-01-19 07:33 362,636 --sh--r C:\Windows\System32\tzuwfx.exe
.

((((((((((((((((((((((((((((( snapshot@2008-09-28_ 9.59.09.35 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-09-27 23:55:17 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2008-09-27 23:55:17 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2008-09-27 23:55:33 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-09-27 23:57:09 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-09-27 23:57:09 262,144 ---ha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat.LOG1
- 2008-09-27 23:55:33 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-09-27 23:57:15 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
- 2008-09-27 23:50:50 262,144 ----a-w C:\Windows\System32\config\systemprofile\ntuser.dat
+ 2008-09-28 12:13:15 262,144 ----a-w C:\Windows\System32\config\systemprofile\ntuser.dat
- 2008-09-27 23:20:08 105,502 ----a-w C:\Windows\System32\perfc009.dat
+ 2008-09-28 00:01:32 105,502 ----a-w C:\Windows\System32\perfc009.dat
- 2008-09-27 23:20:08 601,686 ----a-w C:\Windows\System32\perfh009.dat
+ 2008-09-28 00:01:32 601,686 ----a-w C:\Windows\System32\perfh009.dat
- 2008-09-27 23:18:21 9,832 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1228558681-2970168192-1038802850-1000_UserData.bin
+ 2008-09-27 23:57:34 10,098 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1228558681-2970168192-1038802850-1000_UserData.bin
- 2008-09-27 23:18:20 57,524 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-09-27 23:57:34 57,610 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-09-03 1576176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DU Meter"="C:\Program Files\DU Meter\DUMeter.exe" [2005-02-01 1469952]
"NSLauncher"="C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe" [2007-09-07 3100672]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2008-05-16 13529088]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2008-05-16 86016]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-09-06 1235736]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-09-06 413696]
"AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-09-03 111936]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-09-10 289576]
"SoundMan"="SOUNDMAN.EXE" [2007-03-09 C:\Windows\SOUNDMAN.EXE]
"nwiz"="nwiz.exe" [2008-05-16 C:\Windows\System32\nwiz.exe]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{93994DE8-8239-4655-B1D1-5F4E91300429}"= "C:\Program Files\DVD Region-Free\DVDShell.dll" [2003-08-26 49152]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-07-23 16:28 352256 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AVG Anti-Spyware Driver]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AVG Anti-Spyware Guard]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1228558681-2970168192-1038802850-1000]
"EnableNotificationsRef"=dword:00000004

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{D4B96E43-13CE-4A99-AFAA-BF3AE0703A91}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{ED3A69AB-627D-4F03-B7FC-4718D85DC133}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{D2F3B1F7-AAFE-41F7-BBA3-C8DE0597D565}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"TCP Query User{BD061F38-AFBA-4FD7-9C3E-3E7C228F2DE6}C:\\invision\\mirc.exe"= UDP:C:\invision\mirc.exe:mIRC
"UDP Query User{A8026B29-A179-43D9-8F1E-0880D1F67FC1}C:\\invision\\mirc.exe"= TCP:C:\invision\mirc.exe:mIRC
"TCP Query User{79FE7414-EABF-4ED9-916E-BB9BFCAECD80}C:\\program files\\azureus\\azureus.exe"= UDP:C:\program files\azureus\azureus.exe:Azureus
"UDP Query User{912E69CA-41BF-4B3A-BBCB-3F2F30A74470}C:\\program files\\azureus\\azureus.exe"= TCP:C:\program files\azureus\azureus.exe:Azureus
"TCP Query User{BFBDEC52-09B9-4049-9D6A-EF62CB93EDC1}C:\\program files\\limewire\\limewire.exe"= UDP:C:\program files\limewire\limewire.exe:LimeWire
"UDP Query User{2C59EE1C-24C5-494C-A8B6-4E1EF493A09A}C:\\program files\\limewire\\limewire.exe"= TCP:C:\program files\limewire\limewire.exe:LimeWire
"{014FDAA8-DA12-4E6A-8B1E-DE27486E93E2}"= Disabled:UDP:C:\Users\Skim0an Desktop\AppData\Roaming\U3\0000169BA77512F7\0DE4F643-C398-46ec-9339-2362F2311932\Exec\Skype.exe:Skype
"{C30FA0FA-DFBC-42ED-8B3C-F8D7D6BCF9B0}"= Disabled:TCP:C:\Users\Skim0an Desktop\AppData\Roaming\U3\0000169BA77512F7\0DE4F643-C398-46ec-9339-2362F2311932\Exec\Skype.exe:Skype
"{1D580E89-9C67-4CBC-A4D4-1916D7BF1DBE}"= Disabled:UDP:C:\Program Files\Skype\Phone\Skype.exe:Skype
"{5339502C-08CA-4A36-B680-971CCA034951}"= Disabled:TCP:C:\Program Files\Skype\Phone\Skype.exe:Skype
"{691DE129-C134-46D3-B3AF-5371B45805B7}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{B0D73522-69F7-42C5-AD8C-97EA86F4A9DD}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{D953CBDD-23B9-4F43-920D-77F3DD71C473}"= UDP:C:\Program Files\Windows Defender\MSASCui.exe:Windows Defender
"{269EE88A-7986-4B41-9AD7-E6E925F2F563}"= TCP:C:\Program Files\Windows Defender\MSASCui.exe:Windows Defender
"{1250B643-810D-4968-A651-5AB1EE05587F}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{6F3F3EDE-5C29-453A-AE67-F00B975603B7}"= UDP:C:\Program Files\Azureus\Azureus.exe:Azureus Vuze
"{16FAB5A7-C0E3-4A56-A1AC-78C281714CFC}"= TCP:C:\Program Files\Azureus\Azureus.exe:Azureus Vuze
"{6E80D422-9C6D-4ACF-9203-844AC234F19F}"= UDP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire PRO 4.8.0
"{8E5E60F6-2443-4F45-9B8A-8489735E94FA}"= TCP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire PRO 4.8.0
"{91DE75EF-3866-4DB1-B289-46D3653EE5A3}"= UDP:C:\Program Files\mIRC\mirc.exe:mIRC
"{F22AEC19-FE5C-4D1D-BF17-6D208A751C60}"= TCP:C:\Program Files\mIRC\mirc.exe:mIRC
"{3F4238E4-568B-4F22-81B0-DAC4CD7C9F0E}"= UDP:C:\Invision\mirc.exe:mIRC - Invision
"{8C0C1494-D3D5-447E-8881-909734C37EBC}"= TCP:C:\Invision\mirc.exe:mIRC - Invision
"{70CE96D9-33AA-4579-8F5D-B79179DF1CFA}"= UDP:C:\Program Files\PKR\pkr.exe:Play PKR
"{75D7F5EE-E51B-4E1F-8BFE-CDC9283CD7EC}"= TCP:C:\Program Files\PKR\pkr.exe:Play PKR
"{E34D65AB-BEBA-4548-8B6D-3A7AA1C89EA7}"= UDP:C:\Program Files\AVG\AVG8\avgtray.exe:AVG Free Tray Icon
"{36D445BA-0282-4795-8471-4225F4D3AA0B}"= TCP:C:\Program Files\AVG\AVG8\avgtray.exe:AVG Free Tray Icon
"TCP Query User{C6136AF7-99F1-4374-BF6C-6AE143800323}C:\\program files\\icq6\\icq.exe"= UDP:C:\program files\icq6\icq.exe:ICQ Library
"UDP Query User{D58E6496-6B8B-4E52-B8BA-E1C6646ED216}C:\\program files\\icq6\\icq.exe"= TCP:C:\program files\icq6\icq.exe:ICQ Library
"{56AC8DA7-73D3-4B75-8A24-CF03B76DB292}"= UDP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent
"{174F277B-6B8D-4131-9E25-F1788A53BFE5}"= TCP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent
"TCP Query User{A1560FDA-D4B5-4AC0-B419-B320CF574D63}C:\\program files\\mozilla firefox\\firefox.exe"= UDP:C:\program files\mozilla firefox\firefox.exe:Firefox
"UDP Query User{2B8CDACE-0ABD-47C4-8EAA-94E5304AB5E2}C:\\program files\\mozilla firefox\\firefox.exe"= TCP:C:\program files\mozilla firefox\firefox.exe:Firefox
"TCP Query User{1DC7B720-1FC8-471D-8D17-D377B79F93B1}C:\\doomsday\\bin\\doomsday.exe"= UDP:C:\doomsday\bin\doomsday.exe:Doomsday
"UDP Query User{2477F089-2994-4824-81A2-E6898027B7E7}C:\\doomsday\\bin\\doomsday.exe"= TCP:C:\doomsday\bin\doomsday.exe:Doomsday
"TCP Query User{8F4671E7-F964-4118-9722-DAB56D0DBF95}C:\\program files\\nokia\\nokia software updater\\nsu_ui_client.exe"= UDP:C:\program files\nokia\nokia software updater\nsu_ui_client.exe:Nokia Software Updater
"UDP Query User{9632B333-8CD9-43EE-8E83-33E8ED94D68A}C:\\program files\\nokia\\nokia software updater\\nsu_ui_client.exe"= TCP:C:\program files\nokia\nokia software updater\nsu_ui_client.exe:Nokia Software Updater
"TCP Query User{71B58089-6809-4F83-9044-C3D3477C2AAC}C:\\program files\\common files\\nokia\\service layer\\a\\nsl_host_process.exe"= UDP:C:\program files\common files\nokia\service layer\a\nsl_host_process.exe:Nokia Service Layer Host Process
"UDP Query User{AEF7F20E-CF46-4998-A59A-E6A1E874E188}C:\\program files\\common files\\nokia\\service layer\\a\\nsl_host_process.exe"= TCP:C:\program files\common files\nokia\service layer\a\nsl_host_process.exe:Nokia Service Layer Host Process
"{F33615E3-39A5-43E5-8139-8549A9B995F4}"= UDP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent (TCP-In)
"{CE36E74E-4C9C-46A8-ABCA-B0BE6B59625D}"= TCP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent (UDP-In)
"{5E848D77-64C9-4CAE-99EE-6D7A165EE72B}"= C:\Program Files\AVG\AVG8\avgupd.exe:avgupd.exe
"{610F2B97-FCDB-4C8F-AF2E-5A6E913228D9}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{BF37B36B-E0E9-40A6-96D9-4CD4DD8C96C0}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{88D3B8D7-B483-4E2E-B504-0FB974A7CCF0}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{BC837D71-D0DA-43C8-BA74-C0FBF325D392}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{AE6CA285-76F5-45A6-B73E-4366224E427C}"= Disabled:UDP:C:\Program Files\Skype\Phone\Skype.exe:Skype
"{ADFE5D46-CB6E-418E-81F2-040BCFC79A09}"= Disabled:TCP:C:\Program Files\Skype\Phone\Skype.exe:Skype

R1 AvgLdx86;AVG Free AVI Loader Driver x86;C:\Windows\system32\Drivers\avgldx86.sys [2008-09-06 97928]
R1 pctfw2;pctfw2;C:\Windows\System32\drivers\pctfw2.sys [2008-07-28 160792]
R2 avg8wd;AVG Free8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-09-06 231704]
R2 SBSDWSCService;SBSD Security Center Service;C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [2008-07-30 809296]
R3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk60x86.sys [2007-12-06 298496]
S3 Slnt7554;USB Soft Modem Driver;C:\Windows\system32\DRIVERS\SLDRV\slnt7554.sys [2005-03-22 225280]
S3 WFIOCTL;WFIOCTL;C:\Program Files\WinFast\WFDTV\WFIOCTL.SYS [2005-01-06 9446]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1022452c-1558-11dd-9a1f-0015f2e753ee}]
\shell\AutoRun\command - F:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1022452e-1558-11dd-9a1f-0015f2e753ee}]
\shell\AutoRun\command - F:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{65badd8b-f7a1-11dc-ae80-0015f2e753ee}]
\shell\AutoRun\command - F:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{65badd9e-f7a1-11dc-ae80-0015f2e753ee}]
\shell\AutoRun\command - F:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d189586d-5cfb-11dd-9a43-0015f2e753ee}]
\shell\AutoRun\command - F:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d1895882-5cfb-11dd-9a43-0015f2e753ee}]
\shell\AutoRun\command - F:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dfa8d7b8-2b0c-11dd-91e3-0015f2e753ee}]
\shell\AutoRun\command - G:\LaunchU3.exe -a
.
Contents of the 'Scheduled Tasks' folder
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-28 22:16:11
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-09-28 22:17:44
ComboFix-quarantined-files.txt 2008-09-28 12:17:41
ComboFix2.txt 2008-09-28 00:00:28

Pre-Run: 30,442,971,136 bytes free
Post-Run: 30,343,364,608 bytes free

261 --- E O F --- 2008-09-06 12:33:15



HiJackThis Log


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:22, on 2008-09-28
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\DU Meter\DUMeter.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\Explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [DU Meter] C:\Program Files\DU Meter\DUMeter.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NSLauncher] C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe /startup
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O13 - Gopher Prefix:
O16 - DPF: {9732FB42-C321-11D1-836F-00A0C993F125} (mhLabel Class) - http://www.pcpitstop.com/mhLbl.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: avgrsstx.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvsvc32.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\system32\IoctlSvc.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SmartLinkService (SLService) - - C:\Windows\SYSTEM32\slserv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: VundoFix Service (VundoFixSvc) - Atribune.org - C:\Windows\SYSTEM32\VundoFixSVC.exe

--
End of file - 6700 bytes




Computer seems a fair bit "smoother" than before.

#11 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,717 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:11:34 AM

Posted 28 September 2008 - 10:05 AM

Good job.

The virustotal scan report is not complete. The file is flagged 3 out of 36 but I would like to see the full report. You can select to analyze the file once more because sometime the report might be different from the previous scan.

#12 ^sims^

^sims^
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:07:34 PM

Posted 28 September 2008 - 04:34 PM

virustotal scan report again:




File has already been analysed:
MD5: 74edb9e052ac3e9301726097584673b5
First received: 09.09.2008 21:24:40 (CET)
Date: 09.16.2008 10:13:00 (CET) [>12D]
Results: 3/36
Permalink: analisis/2555064ba8f40347f68804e5e2b9694d

#13 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,717 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:11:34 AM

Posted 28 September 2008 - 05:24 PM

That is the same as before, I need to see the full report to make a decision on that file.

Make sure that you can view all hidden files. Instructions on how to do this can be found here: How to see hidden files in Windows
  • Click on this link--> virustotal
  • Click the browse button and navigate to the file below in bold:


    C:\Windows\System32\tzuwfx.exe

  • Click Send File.
  • After the report appears click Reanalyse file now button.
  • Wait until the file is analyzed.


    Please copy and paste the results of the scan in your next post.


#14 ^sims^

^sims^
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:07:34 PM

Posted 29 September 2008 - 03:15 AM

Ok so the initial thing that comes up is :


File has already been analysed:
MD5: 74edb9e052ac3e9301726097584673b5
First received: 09.09.2008 21:24:40 (CET)
Date: 09.16.2008 10:13:00 (CET) [>13D]
Results: 3/36
Permalink: analisis/2555064ba8f40347f68804e5e2b9694d



then upon clicking "reanalyze file now"...


Antivirus Version Last Update Result
AhnLab-V3 2008.9.25.0 2008.09.29 -
AntiVir 7.8.1.34 2008.09.29 BDS/Agent.nab
Authentium 5.1.0.4 2008.09.29 -
Avast 4.8.1195.0 2008.09.29 Win32:Trojan-gen {Other}
AVG 8.0.0.161 2008.09.28 -
BitDefender 7.2 2008.09.29 -
CAT-QuickHeal 9.50 2008.09.29 -
ClamAV 0.93.1 2008.09.29 -
DrWeb 4.44.0.09170 2008.09.29 -
eSafe 7.0.17.0 2008.09.28 -
eTrust-Vet 31.6.6110 2008.09.26 -
Ewido 4.0 2008.09.28 -
F-Prot 4.4.4.56 2008.09.28 -
F-Secure 8.0.14332.0 2008.09.29 -
Fortinet 3.113.0.0 2008.09.29 -
GData 19 2008.09.29 Win32:Trojan-gen {Other}
Ikarus T3.1.1.34.0 2008.09.29 Trojan-Dropper.Win32.VBInject.B
K7AntiVirus 7.10.476 2008.09.27 -
Kaspersky 7.0.0.125 2008.09.29 -
McAfee 5393 2008.09.27 -
Microsoft 1.3903 2008.09.29 TrojanDropper:Win32/VBInject.B
NOD32 3478 2008.09.28 -
Norman 5.80.02 2008.09.26 -
Panda 9.0.0.4 2008.09.28 -
PCTools 4.4.2.0 2008.09.26 -
Prevx1 V2 2008.09.29 Malicious Software
Rising 20.63.62.00 2008.09.28 -
SecureWeb-Gateway 6.7.6 2008.09.29 Trojan.Backdoor.Agent.nab
Sophos 4.34.0 2008.09.29 -
Sunbelt 3.1.1675.1 2008.09.27 -
Symantec 10 2008.09.29 -
TheHacker 6.3.0.9.096 2008.09.29 -
TrendMicro 8.700.0.1004 2008.09.29 -
VBA32 3.12.8.6 2008.09.28 -
ViRobot 2008.9.26.1394 2008.09.26 -
VirusBuster 4.5.11.0 2008.09.28 -
Additional information
File size: 362636 bytes
MD5...: 74edb9e052ac3e9301726097584673b5
SHA1..: dde82744a192dc32a2d40629e8e37468e2872931
SHA256: af0aec80427baa064a85e51841edcf8992c68f00b733ee734e56904ddb552a97
SHA512: c34623e937ec0ed71e5a757a39a8714f2de9e223bdd2f1bd8618e7470c3c9e3d
ca6c73bf56433eae907e83c830a7d1207fc39b9ec5a20ecdecfff6d02126632e
PEiD..: -
TrID..: File type identification
Win32 Executable Generic (68.0%)
Generic Win/DOS Executable (15.9%)
DOS Executable Generic (15.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x4010b8
timedatestamp.....: 0x48c05c72 (Thu Sep 04 22:08:50 2008)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x3c1c 0x4000 4.68 b9a42ac8b536538e2a0829c858f8bd48
.data 0x5000 0x4b0 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
.rsrc 0x6000 0x10 0x5388c 7.98 eb3253985885f9d1c8afbb50cab3f259

( 1 imports )
> MSVBVM60.DLL: -, DllFunctionCall, -, -, __vbaExceptHandler, -, -, -, -, ProcCallEngine, -, -, -, -, -, -, -

( 0 exports )
Prevx info: http://info.prevx.com/aboutprogramtext.asp...8F89A0057B32B5E

#15 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,717 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:11:34 AM

Posted 29 September 2008 - 07:03 AM

The number of hits is gone from 3 to 7 in a few days. This is malware.
  • Please remove the file: C:\Windows\System32\tzuwfx.exe

  • Go to start > run and copy and paste or type next command in the field then hit enter:

    ComboFix /u

    Note: There's a space between Combofix and /

    This will uninstall Combofix, delete its related folders and files, reset your clock settings, hide file extensions, hide the system/hidden files and resets System Restore again.

  • Combofix should remove Vundofix and its service and backup folder. but to make sure please post a fresh hijackthis log.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users