Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Finishing Off A System Antivirus 2008 Infection


  • This topic is locked This topic is locked
1 reply to this topic

#1 All Meshed Up

All Meshed Up

  • Members
  • 46 posts
  • OFFLINE
  •  
  • Local time:02:28 AM

Posted 30 September 2008 - 10:43 PM

I got the System Antivirus 2008 virus a while ago and have all but killed it except for one annoying little problem. About 30 minutes after windows boots up I get a random bogus warning pop-up on my taskbar from a "yellow exclamation-point" icon which informs me that a whole mess of malicious crap is going on with my system (not true) and that there is allot of undesirable internet activity going on (I'm on dial-up and not even connected).
I've cleaned EVERYTHING except for whatever the hell is causing this nuisance. I ran Combofix today, but forgot to start it in Safe mode first. It deleted a DLL file from my system and produced a log. Later, I ran it again in Safe Mode. The log produced by that scan was the same as before but did not include the DLL file (which is why the name doesn't show up in this log. I'm sorry for that).

So now, I have come here to the Jedi Council of PC help to find out what needs to be done to get rid of this damn thing.
Here is my most recent COMBOFIX LOG:

-----------------------------------
ComboFix 08-09-28.03 - Locutus 2008-09-30 15:19:19.2 - NTFSx86 MINIMAL
Running from: C:\Documents and Settings\Locutus\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-08-28 to 2008-09-30 )))))))))))))))))))))))))))))))
.

2008-09-29 09:25 . 2008-09-29 09:25 331 --a------ C:\WINDOWS\doom3.ini
2008-09-29 09:13 . 2008-09-29 09:29 <DIR> d-------- C:\Program Files\Doom 3
2008-09-28 20:45 . 2008-09-28 20:45 90,112 --a------ C:\WINDOWS\system32\gnmdunqt.exe
2008-09-28 17:54 . 2008-09-28 17:54 90,112 --a------ C:\WINDOWS\system32\utixinyz.exe
2008-09-28 10:16 . 1999-12-12 18:01 44,032 --------- C:\WINDOWS\system32\CTSVCCDA.EXE
2008-09-26 22:07 . 2008-09-26 22:07 606,208 --a------ C:\WINDOWS\ltwrp10n.dll
2008-09-26 22:07 . 2008-09-26 22:07 299,008 --a------ C:\WINDOWS\ltkrn10n.dll
2008-09-26 22:07 . 2008-09-26 22:07 270,336 --a------ C:\WINDOWS\lfcmp10n.dll
2008-09-26 22:07 . 2008-09-26 22:07 233,472 --a------ C:\WINDOWS\ltdis10n.dll
2008-09-26 22:07 . 2008-09-26 22:07 225,280 --a------ C:\WINDOWS\ltefx10n.dll
2008-09-26 22:07 . 2008-09-26 22:07 114,688 --a------ C:\WINDOWS\ltimg10n.dll
2008-09-26 22:07 . 2008-09-26 22:07 106,496 --a------ C:\WINDOWS\ltfil10n.dll
2008-09-26 22:07 . 2008-09-26 22:07 45,056 --a------ C:\WINDOWS\lfgif10n.dll
2008-09-26 22:07 . 2008-09-26 22:07 36,864 --a------ C:\WINDOWS\lfbmp10n.dll
2008-09-26 22:07 . 2008-09-26 22:07 28,672 --a------ C:\WINDOWS\lfavi10n.dll
2008-09-26 14:37 . 2008-09-26 14:37 2,658 --a------ C:\WINDOWS\system32\tmp.reg
2008-09-24 14:24 . 2008-09-24 14:24 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-09-24 14:24 . 2008-09-24 14:54 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-09-21 16:59 . 2008-09-27 21:57 <DIR> d-------- C:\WINDOWS\regedit BACKUP 9-26-08
2008-09-06 14:13 . 2008-09-30 15:15 23,880 --a------ C:\WINDOWS\system32\BMXStateBkp-{00000004-00000000-00000000-00001102-00000008-20011102}.rfx
2008-09-06 14:13 . 2008-09-30 15:15 23,880 --a------ C:\WINDOWS\system32\BMXState-{00000004-00000000-00000000-00001102-00000008-20011102}.rfx
2008-09-06 14:13 . 2008-09-30 15:15 11,564 --a------ C:\WINDOWS\system32\DVCState-{00000004-00000000-00000000-00001102-00000008-20011102}.rfx
2008-09-06 14:13 . 2008-09-30 15:15 7,884 --a------ C:\WINDOWS\system32\BMXCtrlState-{00000004-00000000-00000000-00001102-00000008-20011102}.rfx
2008-09-06 14:13 . 2008-09-30 15:15 7,884 --a------ C:\WINDOWS\system32\BMXBkpCtrlState-{00000004-00000000-00000000-00001102-00000008-20011102}.rfx
2008-09-06 14:12 . 2008-09-30 15:15 4,958,588 --a------ C:\WINDOWS\{00000004-00000000-00000000-00001102-00000008-20011102}.BAK
2008-09-06 14:12 . 2000-05-22 01:58 647,872 --------- C:\WINDOWS\system32\Mscomct2.ocx
2008-09-06 14:10 . 2008-09-30 15:15 4,958,588 --a------ C:\WINDOWS\{00000004-00000000-00000000-00001102-00000008-20011102}.CDF
2008-09-05 22:21 . 1999-11-17 18:00 25,088 --------- C:\WINDOWS\system32\CTSVCCTL.EXE
2008-09-05 22:02 . 2008-09-05 22:02 347 --a------ C:\WINDOWS\CTWave32.INI
2008-09-05 22:00 . 2008-09-05 22:00 29 --a------ C:\WINDOWS\sfbm.INI
2008-09-04 21:13 . 2008-09-30 11:21 <DIR> d-------- C:\Documents and Settings\Locutus\Application Data\SUPERAntiSpyware.com
2008-09-04 21:13 . 2008-09-04 21:13 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-09-04 17:42 . 2008-09-04 17:42 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\bubypufs
2008-09-04 15:14 . 2003-06-25 16:05 266,360 --a------ C:\WINDOWS\system32\TweakUI.exe
2008-09-04 15:14 . 2002-06-21 15:09 160,217 --a------ C:\WINDOWS\system32\PowerToysLicense.rtf
2008-09-04 11:51 . 1996-06-12 13:44 4,711 --------- C:\WINDOWS\system32\dmouse.vxd
2008-09-02 21:15 . 2008-09-02 21:15 <DIR> d-------- C:\Program Files\Sigmatel
2008-08-31 22:46 . 2008-08-31 22:48 <DIR> d-------- C:\Documents and Settings\Locutus\Application Data\Media Player Classic
2008-08-30 15:07 . 2008-09-02 13:27 43,520 --a------ C:\WINDOWS\system32\CmdLineExt03.dll
2008-08-29 22:02 . 2008-08-29 22:02 <DIR> d-------- C:\Program Files\1964
2008-08-29 19:19 . 2008-08-29 19:19 <DIR> d-------- C:\WINDOWS\system32\Wtablet
2008-08-29 19:19 . 2008-08-29 19:19 <DIR> d-------- C:\Program Files\Tablet
2008-08-29 19:19 . 2008-09-30 11:37 15,647 --a------ C:\WINDOWS\system32\tablet.dat
2008-08-29 16:34 . 2008-08-29 16:34 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01001_Coinstaller_Critical.Wdf
2008-08-29 16:34 . 2008-08-29 16:34 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_xusb20_01001.Wdf
2008-08-29 16:33 . 2008-08-29 16:33 <DIR> d-------- C:\Program Files\Microsoft Xbox 360 Accessories
2008-08-29 16:32 . 2006-09-28 16:04 68,888 --a------ C:\WINDOWS\system32\xinput1_3.dll
2008-08-27 22:49 . 2004-02-23 21:42 1,386,496 --a------ C:\WINDOWS\system32\msvbvm60.dll
2008-08-27 22:49 . 2004-03-09 01:00 1,081,616 --a------ C:\WINDOWS\system32\MSCOMCTL.OCX
2008-08-27 20:51 . 2008-08-27 20:57 <DIR> d-------- C:\Program Files\MSECACHE

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-29 02:44 --------- d-----w C:\Program Files\Valve
2008-09-28 17:35 --------- d-----w C:\Program Files\Creative
2008-09-27 20:02 34,120 ----a-w C:\Documents and Settings\Locutus\Application Data\wklnhst.dat
2008-09-26 22:09 --------- d-----w C:\Program Files\NetWaiting
2008-09-26 22:09 --------- d-----w C:\Program Files\Modem Helper
2008-09-26 22:09 --------- d-----w C:\Program Files\Apoint
2008-09-19 19:26 82,944 ----a-w C:\WINDOWS\system32\o4Patch.exe
2008-09-19 19:26 82,944 ----a-w C:\WINDOWS\system32\IEDFix.C.exe
2008-09-09 06:38 88,576 ----a-w C:\WINDOWS\system32\AntiXPVSTFix.exe
2008-09-08 20:14 --------- d-----w C:\Program Files\epson
2008-09-07 21:00 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-07 20:59 --------- d-----w C:\Documents and Settings\All Users\Application Data\EPSON
2008-09-07 20:32 --------- d-----w C:\Documents and Settings\Locutus\Application Data\Hewlett-Packard
2008-09-06 05:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Creative
2008-09-05 21:10 --------- d-----w C:\Program Files\Uniblue
2008-09-05 21:03 --------- d-----w C:\Documents and Settings\Locutus\Application Data\Uniblue
2008-09-05 00:40 57,344 ----a-w C:\WINDOWS\system32\userinit.exe
2008-09-02 23:51 86,528 ----a-w C:\WINDOWS\system32\VACFix.exe
2008-08-29 23:26 --------- d-----w C:\Program Files\VideoraiPodConverter
2008-08-29 21:48 --------- d-----w C:\Documents and Settings\Locutus\Application Data\Creative
2008-08-29 01:27 --------- d-----w C:\Program Files\Java
2008-08-28 04:59 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-08-28 04:41 --------- d-----w C:\Program Files\Common Files\Real
2008-08-27 23:54 --------- d-----w C:\Program Files\WinMPG Video Convert
2008-08-27 23:50 --------- d-----w C:\Program Files\Dell
2008-08-27 23:40 --------- d-----w C:\Program Files\Sony
2008-08-27 23:40 --------- d-----w C:\Documents and Settings\Locutus\Application Data\Sony
2008-08-18 19:19 82,432 ----a-w C:\WINDOWS\system32\404Fix.exe
2008-08-06 21:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\FLEXnet
2008-07-29 16:52 --------- d-----w C:\Documents and Settings\Locutus\Application Data\BitTorrent
2006-11-23 04:32 24,192 ----a-w C:\Documents and Settings\Locutus\usbsermptxp.sys
2006-11-23 04:32 22,768 ----a-w C:\Documents and Settings\Locutus\usbsermpt.sys
.

------- Sigcheck -------

2008-09-04 17:40 57344 b5bfcf3c4dfe120d2bb0f9736a17c065 C:\WINDOWS\system32\userinit.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]
"ApiHlpStr"="C:\WINDOWS\system32\utixinyz.exe" [2008-09-28 90112]
"msgwebcfg"="C:\WINDOWS\system32\gnmdunqt.exe" [2008-09-28 90112]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2004-09-13 155648]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2004-10-30 385024]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 344064]
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2005-03-04 606208]
"ImgTask"="C:\WINDOWS\Imgtask.exe" [2006-12-12 20480]
"MSConfig"="C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE" [2004-08-04 158208]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]
"1yHIkQHWqQ"="C:\Documents and Settings\All Users\Application Data\bubypufs\rshurqte.exe" [2008-09-04 73728]

C:\Documents and Settings\Locutus\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-06-01 113664]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2005-05-26 24576]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]
TabUserW.exe.lnk - C:\WINDOWS\system32\Wtablet\TabUserW.exe [2003-12-04 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
2004-09-07 14:08 110592 C:\Program Files\Intel\Wireless\Bin\LgNotify.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Antivirus
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uniblue RegistryBooster 2009

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative Detector]
--------- 2004-12-02 18:23 102400 C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2007-12-11 13:10 267048 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2004-10-13 09:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2007-12-11 11:56 286720 C:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--a------ 2004-11-02 20:24 32768 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioDragToDisc]
--a------ 2004-01-27 23:39 1179648 C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\XboxStat]
--a------ 2006-10-17 16:24 277352 C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTHelper]
--a------ 2005-08-29 03:54 16384 C:\WINDOWS\CTHELPER.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=

R0 PenClass;Pen Class;C:\WINDOWS\system32\Drivers\penclass.sys [2001-04-09 8138]
S2 WUSB54GSCSVC;WUSB54GSCSVC;C:\Program Files\Compact Wireless-G USB Network Adapter with SpeedBooster\WLService.exe WUSB54GSC.exe [ ]
S3 PNDIS5;PNDIS5 NDIS Protocol Driver;D:\PNDIS5.SYS [ ]
S3 pwi_bus;Curitel PC Card Composite Device driver (WDM);C:\WINDOWS\system32\DRIVERS\pwi_bus.sys [2005-05-04 55344]
S3 pwi_mdfl;Curitel PC Card Filter;C:\WINDOWS\system32\DRIVERS\pwi_mdfl.sys [2005-05-04 9200]
S3 pwi_mdm;Curitel PC Card Drivers;C:\WINDOWS\system32\DRIVERS\pwi_mdm.sys [2005-05-04 89936]
S3 pwi_oflt;Curitel PC Card OHCI Filter;C:\WINDOWS\system32\DRIVERS\pwi_oflt.sys [2005-05-04 9472]
S3 pwi_serd;Curitel PC Card Diagnostic Serial Port (WDM);C:\WINDOWS\system32\DRIVERS\pwi_serd.sys [2005-05-04 69632]
S3 usbprint;Microsoft USB PRINTER Class;C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-04 25856]
S3 xusb20;Xbox 360 Wireless Receiver for Windows Driver Service;C:\WINDOWS\system32\DRIVERS\xusb20.sys [2006-10-13 50048]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{84075030-b3d5-11dc-8095-0012f0740842}]
\Shell\AutoRun\command - E:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{95e21fb4-b0b3-11dc-8093-0012f0740842}]
\Shell\AutoRun\command - F:\Imageviewer.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c1877510-cb6f-11db-bec9-00123fd19acb}]
\Shell\AutoRun\command - rundll32.exe url.dll,FileProtocolHandler LapNetWizard.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ee8f6de5-d31c-11d9-b790-806d6172696f}]
\shell\play\Command - "C:\Program Files\Windows Media Player\wmplayer.exe" /prefetch:3 /device:AudioCD "%L"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fb248215-13e3-11dc-bf7a-0012f0740842}]
\Shell\AutoRun\command - E:\Installer.exe
.
- - - - ORPHANS REMOVED - - - -

URLSearchHooks-(Default) - (no file)


.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Locutus\Application Data\Mozilla\Firefox\Profiles\7knpskyk.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - www.google.com
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-30 15:23:39
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-09-30 15:29:03
ComboFix-quarantined-files.txt 2008-09-30 22:28:18
ComboFix2.txt 2008-09-30 18:33:06

Pre-Run: 52,803,903,488 bytes free
Post-Run: 52,779,827,200 bytes free

201
---------------------------------



And here is my HIJACK THIS! LOG:

---------------------------------
Logfile of HijackThis v1.99.1
Scan saved at 07:41:59, on 9/30/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\Tablet.exe
C:\Documents and Settings\All Users\Application Data\bubypufs\rshurqte.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\WINDOWS\Imgtask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\utixinyz.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\WINDOWS\system32\Wtablet\TabUserW.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Locutus\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [ImgTask] C:\WINDOWS\Imgtask.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ApiHlpStr] C:\WINDOWS\system32\utixinyz.exe
O4 - HKCU\..\Run: [msgwebcfg] C:\WINDOWS\system32\gnmdunqt.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\Wtablet\TabUserW.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1196796841140
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
O20 - Winlogon Notify: IntelWireless - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Version Cue CS3 - Unknown owner - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe" -win32service (file missing)
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
O23 - Service: WUSB54GSCSVC - Unknown owner - C:\Program Files\Compact Wireless-G USB Network Adapter with SpeedBooster\WLService.exe" "WUSB54GSC.exe (file missing)
-----------------------------

I appreciate any help that can be lent to me.
"There must be someway out of here, Said the joker to the thief."

BC AdBot (Login to Remove)

 


#2 TMacK

TMacK

  • Members
  • 4,672 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:B.C. Canada
  • Local time:12:28 AM

Posted 01 October 2008 - 12:59 AM

Welcome to Bleeping Computer, All Meshed Up.

ComboFix logs should not to be posted outside the HijackThis forums. It is an extremely powerful tool which should only be used when instructed to do so by someone who has been properly trained. ComboFix is intended by its creator to be "used under the guidance and supervision of an expert", NOT for private use. Please read Combofix's Disclaimer. Using this tool incorrectly could lead to disastrous problems with your operating system such as preventing it from ever starting again.

Please create a new topic in the Am I infected? What do I do? forum, explaining the nature of your problem. Describe pop-ups and system tray or desktop icons that have appeared. Explain what is "going wrong" with your computer. Note any tools you have used and their respective results.

If needed, we will direct you to our HJT Preparation Guide.

Thank you for using BleepingComputer as your malware removal source.

This topic is now closed.
The BC Staff/TMacK
Chaos reigns within.
Reflect, repent, and reboot.
Order shall return.

aaaaaaaa a~Suzie Wagner




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users