Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Virtumonde or Vundo


  • This topic is locked This topic is locked
16 replies to this topic

#1 wannabecomputergeek

wannabecomputergeek

  • Members
  • 16 posts
  • OFFLINE
  •  
  • Local time:07:10 PM

Posted 05 January 2009 - 10:53 PM

Hello,

I really need help. My Computer is infected with Virtumonde. I've run every Vundo/virtumonde fix or whatever that I could google and this thing keeps coming back. Help me. Please!

I hope that I did this correctly.

Any help would be greatly appreciated.

Thanks


DDS (Version 1.1.0) - NTFSx86 NETWORK
Run by Thomas Jarrett at 22:12:49.06 on Mon 01/05/2009
Internet Explorer: 6.0.2900.5512
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1983.1569 [GMT -5:00]

AV: CA Anti-Virus *On-access scanning enabled* (Updated)

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\system32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Thomas Jarrett\Local Settings\Temporary Internet Files\Content.IE5\KKZU8CX6\dds[1].scr

============== Pseudo HJT Report ===============

mStart Page = hxxp://www.google.com
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: NoExplorer - No File
BHO: {47591F98-5E71-4ABB-8B64-195DFB787ECC} - No File
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: {782bcc78-5206-40cf-b289-dc29e54c70f4} - No File
BHO: {D2EAFCA6-1A53-44A7-B5DC-F96EF8BAAE86} - No File
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [TaskScheduler] c:\prowin08\32bit\TaskSch.exe
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs"
uRunOnce: [TSClientAXDisabler] cmd.exe /C "%systemroot%\Installer\TSClientMsiTrans\tscdsbl.bat"
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [RemoteControl] "c:\program files\cyberlink\powerdvd\PDVDServ.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [SSBkgdUpdate] "c:\program files\common files\scansoft shared\ssbkgdupdate\SSBkgdupdate.exe" -Embedding -boot
mRun: [PaperPort PTD] c:\program files\scansoft\paperport\pptd40nt.exe
mRun: [IndexSearch] c:\program files\scansoft\paperport\IndexSearch.exe
mRun: [Szijexaquv] rundll32.exe "c:\windows\Yrabivodukeqoda.dll",e
mRun: [Vcuyeguk] rundll32.exe "c:\windows\avifokel.dll",e
mRun: [cctray] "c:\program files\ca\ca internet security suite\cctray\cctray.exe"
mRun: [QOELOADER] "c:\program files\ca\ca internet security suite\ca anti-spam\qsp-5.1.18.0\QOELoader.exe"
mRun: [CAVRID] "c:\program files\ca\ca internet security suite\ca anti-virus\CAVRID.exe"
StartupFolder: c:\docume~1\thomas~1\startm~1\programs\startup\onenot~1.lnk - c:\program files\microsoft office\office12\ONENOTEM.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\quickb~1.lnk - c:\program files\common files\intuit\quickbooks\qbupdate\qbupdate.exe
uPolicies-explorer: ForceClassicControlPanel = 1 (0x1)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
LSP: c:\windows\system32\VetRedir.dll
Handler: intu-help-qb1 - {9B0F96C7-2E4B-433e-ABF3-043BA1B54AE3} - c:\program files\intuit\quickbooks 2008\HelpAsyncPluggableProtocol.dll
Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - c:\windows\system32\mscoree.dll

============= SERVICES / DRIVERS ===============

R1 VETFDDNT;VET Floppy Boot Sector Monitor;c:\windows\system32\drivers\vetfddnt.sys [2009-1-5 21512]
R4 aawservice;Ad-Aware 2007 Service;c:\program files\lavasoft\ad-aware 2007\aawservice.exe [2007-6-5 561152]
S1 VET-FILT;VET File System Filter;c:\windows\system32\drivers\vet-filt.sys [2009-1-5 26376]
S1 VET-REC;VET File System Recognizer;c:\windows\system32\drivers\vet-rec.sys [2009-1-5 21128]
S1 VETEFILE;VET File Scan Engine;c:\windows\system32\drivers\vetefile.sys [2009-1-5 880560]
S1 VETMONNT;VET File Monitor;c:\windows\system32\drivers\vetmonnt.sys [2009-1-5 32264]
S3 ADM8511;ADMtek ADM8511/AN986 USB To Fast Ethernet Converter;c:\windows\system32\drivers\ADM8511.SYS [2008-6-5 20160]
S3 Intuit Fuse Service;Intuit Fuse Service;c:\program files\common files\intuit\fuse\service\Intuit Fuse Service.exe [2008-6-27 72704]
S3 PPCtlPriv;PPCtlPriv;c:\program files\ca\ca internet security suite\ca anti-spyware\PPCtlPriv.exe [2007-8-16 189704]
S3 VETEBOOT;VET Boot Scan Engine;c:\windows\system32\drivers\veteboot.sys [2009-1-5 108368]
S4 CAISafe;CAISafe;c:\program files\ca\ca internet security suite\ca anti-virus\isafe.exe [2009-1-5 144960]
S4 spupdsvc;Windows Service Pack Installer update service;c:\windows\system32\spupdsvc.exe [2006-9-28 26488]
S4 VETMSGNT;VET Message Service;c:\program files\ca\ca internet security suite\ca anti-virus\vetmsg.exe [2009-1-5 242952]

=============== Created Last 30 ================

2009-01-05 21:43 <DIR> --d----- c:\windows\LastGood.Tmp
2009-01-05 21:43 2,973 a------- c:\windows\system32\spupdsvc.inf
2009-01-05 21:35 0 a------t c:\windows\006814_.tmp
2009-01-05 20:19 <DIR> --d----- c:\program files\Trend Micro
2009-01-05 19:42 880,560 a------- c:\windows\system32\drivers\vetefile.sys
2009-01-05 19:42 108,368 a------- c:\windows\system32\drivers\veteboot.sys
2009-01-05 19:41 99,592 a------- c:\windows\system32\isafeif.dll
2009-01-05 19:41 79,424 a------- c:\windows\system32\vetredir.dll
2009-01-05 19:41 75,016 a------- c:\windows\system32\isafprod.dll
2009-01-05 19:41 32,264 a------- c:\windows\system32\drivers\vetmonnt.sys
2009-01-05 19:41 26,376 a------- c:\windows\system32\drivers\vet-filt.sys
2009-01-05 19:41 21,512 a------- c:\windows\system32\drivers\vetfddnt.sys
2009-01-05 19:41 21,128 a------- c:\windows\system32\drivers\vet-rec.sys
2009-01-05 19:41 <DIR> --d----- c:\program files\common files\Scanner
2009-01-05 19:41 <DIR> --d----- c:\docume~1\alluse~1\applic~1\CA
2009-01-05 19:41 <DIR> --d----- c:\program files\CA
2009-01-05 16:33 <DIR> --d----- C:\ComboFix
2009-01-05 16:28 161,792 a------- c:\windows\SWREG.exe
2009-01-05 16:28 98,816 a------- c:\windows\sed.exe
2009-01-05 13:43 <DIR> --d----- C:\VundoFix Backups
2009-01-05 12:28 339 a------- c:\windows\wininit.ini
2009-01-05 12:12 <DIR> --d----- c:\program files\Spybot - Search & Destroy
2009-01-05 12:12 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2009-01-03 10:07 134,656 a------- c:\windows\avifokel.dll
2009-01-01 12:01 40,448 a------- c:\windows\Yrabivodukeqoda.dll
2009-01-01 12:01 40,448 a------- c:\windows\system32\k9261108.exe
2008-12-31 10:17 72,192 a------- c:\windows\system32\khfCrPhg.dll
2008-12-26 14:50 35 a------- c:\windows\Blink.ini
2008-12-09 11:22 <DIR> --d----- C:\qrnt

==================== Find3M ====================

2008-12-02 20:34 48,640 a------- c:\windows\system32\smbmngr.dll
2008-11-10 18:32 27,136 a------- c:\documents and settings\thomas jarrett\xrt_temp1.exe
2008-11-06 09:57 165 a------- c:\documents and settings\thomas jarrett\xrt_log.dat
2008-10-16 14:13 1,809,944 a------- c:\windows\system32\dllcache\wuaueng.dll
2008-10-16 14:13 202,776 a------- c:\windows\system32\dllcache\wuweb.dll
2008-10-16 14:12 323,608 a------- c:\windows\system32\dllcache\wucltui.dll
2008-10-16 14:12 561,688 a------- c:\windows\system32\dllcache\wuapi.dll
2008-10-16 14:09 92,696 a------- c:\windows\system32\dllcache\cdm.dll
2008-10-16 14:09 51,224 a------- c:\windows\system32\dllcache\wuauclt.exe
2008-10-16 14:08 34,328 a------- c:\windows\system32\dllcache\wups.dll
2008-10-16 14:06 268,648 a------- c:\windows\system32\mucltui.dll
2008-10-16 14:06 208,744 a------- c:\windows\system32\muweb.dll
2008-10-16 07:54 12,109 ac------ c:\windows\idyqizoju.bat
2008-10-16 07:54 11,730 ac------ c:\windows\agigazaf.com
2008-10-16 07:54 12,992 a------- c:\docume~1\alluse~1\applic~1\alamak.pif
2008-10-16 07:54 11,701 a------- c:\docume~1\alluse~1\applic~1\gypugun.bat
2008-10-16 07:54 11,344 a------- c:\docume~1\thomas~1\applic~1\edymosyvo.vbs
2008-10-16 07:54 18,097 ac------ c:\windows\bexojeqasi.exe
2008-10-16 07:54 16,827 ac------ c:\program files\common files\ybugokyry.sys
2008-10-16 07:54 14,877 ac------ c:\windows\qenyd.sys
2008-10-16 07:54 17,934 a------- c:\docume~1\thomas~1\applic~1\ywinuti.bat
2008-10-16 07:54 13,786 a------- c:\windows\system32\yfesud.dat
2008-10-15 08:01 18,043 ac------ c:\program files\common files\rygaciq.inf
2008-10-15 08:01 12,802 ac------ c:\windows\idyko.dat
2008-10-15 08:01 12,639 ac------ c:\windows\modo.sys
2008-10-15 08:01 19,029 a------- c:\docume~1\alluse~1\applic~1\lyqijilizu.bat
2008-10-15 08:01 16,462 a------- c:\docume~1\thomas~1\applic~1\xotywomah.reg
2008-10-15 08:01 14,706 a------- c:\windows\system32\vywepu.dat
2008-10-15 08:01 11,267 a------- c:\windows\system32\rifa.dll

============= FINISH: 22:13:01.00 ===============

Attached Files



BC AdBot (Login to Remove)

 


#2 fenzodahl512

fenzodahl512

  • Members
  • 6,738 posts
  • OFFLINE
  •  
  • Local time:08:10 AM

Posted 06 January 2009 - 11:34 AM

Please download Malwarebytes' Anti-Malware from HERE or HERE

Note: If you already have Malwarebytes' Anti-Malware, just run and update it.. Then do a "Perform Full Scan"

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Full Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.




NEXT


Please download RSIT by random/random and save it to your Desktop.
  • Double click on RSIT.exe to run RSIT
  • Before you click "Continue", make sure you change the List files/folders created or modified in the last 3 months
  • Click Continue at the disclaimer screen.
  • Once it has finished, two logs will open. Please post the contents of both log.txt and info.txt in your next reply.



NEXT


Please download GMER and unzip it to your Desktop.
  • Open the program and click on the Rootkit tab.
  • Make sure all the boxes on the right of the screen are checked, EXCEPT for ‘Show All’.
  • Click on Scan.
  • When the scan has run click Copy and paste the results into a Notepad >> save it and attach in this thread.


Post me these logs in your next reply.. Post each log in separate post..

1. Malwarebytes'
2. RSIT log.txt
3. RSIT info.txt
4. Attach GMER result..

Keep calm, make it simple, use your brain, don't freak out, and you'll be just fine..
Awesomeness: When I get sad, I stop being sad and be awesome instead.. True story - Barney Stinson
Posted Image Posted Image
Its gonna be legen.. wait for it.. dary! Cherish the pain, it means you're still alive


#3 wannabecomputergeek

wannabecomputergeek
  • Topic Starter

  • Members
  • 16 posts
  • OFFLINE
  •  
  • Local time:07:10 PM

Posted 06 January 2009 - 02:20 PM

OK here is the MBAM Log. The rest is coming up. Thanks once again.


Malwarebytes' Anti-Malware 1.32
Database version: 1624
Windows 5.1.2600 Service Pack 2

1/6/2009 2:14:29 PM
mbam-log-2009-01-06 (14-14-29).txt

Scan type: Full Scan (C:\|E:\|)
Objects scanned: 237799
Time elapsed: 1 hour(s), 25 minute(s), 26 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 3
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 19

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\xpreapp (Malware.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vcuyeguk (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\xrt_patch (Backdoor.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\xrt_control_crc (Backdoor.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Qoobox\Quarantine\C\Documents and Settings\All Users\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\msas2009.exe.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\Program Files\XP_AntiSpyware\htmlayout.dll.vir (Rogue.AntivirusPro2009) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\senekakylcogkr.dll.vir (Trojan.Seneka) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{6742B4A6-3600-42DD-A01B-B908D2B25349}\RP149\A0053923.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{6742B4A6-3600-42DD-A01B-B908D2B25349}\RP151\A0054008.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{6742B4A6-3600-42DD-A01B-B908D2B25349}\RP151\A0054019.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{6742B4A6-3600-42DD-A01B-B908D2B25349}\RP153\A0054134.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{6742B4A6-3600-42DD-A01B-B908D2B25349}\RP153\A0054151.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{6742B4A6-3600-42DD-A01B-B908D2B25349}\RP153\A0054152.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{6742B4A6-3600-42DD-A01B-B908D2B25349}\RP153\A0054153.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{6742B4A6-3600-42DD-A01B-B908D2B25349}\RP154\A0054197.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{6742B4A6-3600-42DD-A01B-B908D2B25349}\RP154\A0054198.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{6742B4A6-3600-42DD-A01B-B908D2B25349}\RP154\A0054199.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{6742B4A6-3600-42DD-A01B-B908D2B25349}\RP167\A0054690.exe (Rogue.MSAntiSpyware2009) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{6742B4A6-3600-42DD-A01B-B908D2B25349}\RP169\A0055810.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{6742B4A6-3600-42DD-A01B-B908D2B25349}\RP169\A0055811.dll (Rogue.AntivirusPro2009) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{6742B4A6-3600-42DD-A01B-B908D2B25349}\RP174\A0066768.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\avifokel.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Thomas Jarrett\xrt_temp1.exe (Trojan.Agent) -> Quarantined and deleted successfully.

#4 wannabecomputergeek

wannabecomputergeek
  • Topic Starter

  • Members
  • 16 posts
  • OFFLINE
  •  
  • Local time:07:10 PM

Posted 06 January 2009 - 02:24 PM

Here is log.txt

Logfile of random's system information tool 1.05 (written by random/random)
Run by Thomas Jarrett at 2009-01-06 14:21:55
Microsoft Windows XP Professional Service Pack 2
System drive C: has 218 GB (91%) free of 238 GB
Total RAM: 1983 MB (66% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:22:09 PM, on 1/6/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\CAPPActiveProtection.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe
C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe
C:\Documents and Settings\Thomas Jarrett\Desktop\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Thomas Jarrett.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/def...//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [cctray] "C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe"
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [TaskScheduler] C:\ProWin08\32bit\TaskSch.exe
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1206018920343
O18 - Protocol: intu-help-qb1 - {9B0F96C7-2E4B-433E-ABF3-043BA1B54AE3} - C:\Program Files\Intuit\QuickBooks 2008\HelpAsyncPluggableProtocol.dll
O18 - Protocol: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - mscoree.dll (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: CaCCProvSP - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
O23 - Service: Intuit Fuse Service - Intuit - C:\Program Files\Common Files\Intuit\Fuse\Service\Intuit Fuse Service.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PPCtlPriv - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe
O23 - Service: QBCFMonitorService - Intuit - C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe
O23 - Service: VET Message Service (VETMSGNT) - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe

--
End of file - 7037 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\CAAntiSpywareScan_Daily as Thomas Jarrett at 7 41 PM.job
C:\WINDOWS\tasks\lvfqyvcl.job
C:\WINDOWS\tasks\XoftSpySE 2.job
C:\WINDOWS\tasks\XoftSpySE.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
&Yahoo! Toolbar Helper - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [2007-05-30 808472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2008-09-15 1562960]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{EF99BD32-C1FB-11D2-892F-0090271D4F88} - Yahoo! Toolbar - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [2007-05-30 808472]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2006-08-16 7630848]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2006-08-16 86016]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2008-01-29 16859648]
"RemoteControl"=C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [2003-10-31 32768]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792]
"SSBkgdUpdate"=C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [2003-10-14 155648]
"PaperPort PTD"=C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe [2004-04-14 57393]
"IndexSearch"=C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe [2004-04-14 40960]
"cctray"=C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe [2007-08-16 177416]
"CAVRID"=C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe [2007-08-20 230664]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Malwarebytes' Anti-Malware"=C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe [2009-01-04 399504]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2004-10-13 1694208]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2006-03-15 15360]
"TaskScheduler"=C:\ProWin08\32bit\TaskSch.exe [2008-12-19 393216]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
QuickBooks Update Agent.lnk - C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe

C:\Documents and Settings\Thomas Jarrett\Start Menu\Programs\Startup
OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"ForceClassicControlPanel"=1
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Intuit\QuickBooks 2008\QBDBMgrN.exe"="C:\Program Files\Intuit\QuickBooks 2008\QBDBMgrN.exe:*:Enabled:QuickBooks 2008 Data Manager"
"C:\ProWin07\32bit\protax07.exe"="C:\ProWin07\32bit\protax07.exe:*:Enabled:ProSeries 2007"
"C:\ProWin07\32bit\ProSeriesUpdate.exe"="C:\ProWin07\32bit\ProSeriesUpdate.exe:*:Enabled:ProSeries Update"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\WINDOWS\system32\spoolsv.exe"="C:\WINDOWS\system32\spoolsv.exe:*:Enabled:spoolsv"
"C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe"="C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe:*:Enabled:aawservice"
"C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe"="C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe:*:Enabled:QBCFMonitorService"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======List of files/folders created in the last 3 months======

2009-01-06 14:21:55 ----D---- C:\rsit
2009-01-06 12:18:42 ----D---- C:\WINDOWS\temp
2009-01-06 12:18:40 ----A---- C:\ComboFix.txt
2009-01-06 12:12:22 ----RASHD---- C:\cmdcons
2009-01-06 12:10:59 ----D---- C:\ComboFix
2009-01-06 04:03:49 ----D---- C:\WINDOWS\Prefetch
2009-01-06 04:00:43 ----D---- C:\Config.Msi
2009-01-06 03:58:12 ----D---- C:\WINDOWS\system32\CatRoot_bak
2009-01-06 03:56:31 ----A---- C:\WINDOWS\ntbtlog.txt
2009-01-06 03:53:03 ----DC---- C:\WINDOWS\$NtUninstallKB960714$(2)
2009-01-06 03:52:41 ----DC---- C:\WINDOWS\$NtUninstallKB958644$(2)
2009-01-06 03:52:18 ----DC---- C:\WINDOWS\$NtUninstallKB958215$(2)
2009-01-06 03:51:56 ----DC---- C:\WINDOWS\$NtUninstallKB957097$(2)
2009-01-06 03:51:35 ----DC---- C:\WINDOWS\$NtUninstallKB957095$(3)
2009-01-06 03:51:13 ----DC---- C:\WINDOWS\$NtUninstallKB956841$(3)
2009-01-06 03:50:52 ----DC---- C:\WINDOWS\$NtUninstallKB956803$(3)
2009-01-06 03:50:31 ----DC---- C:\WINDOWS\$NtUninstallKB956802$(2)
2009-01-06 03:50:07 ----DC---- C:\WINDOWS\$NtUninstallKB956390$(3)
2009-01-06 03:49:45 ----DC---- C:\WINDOWS\$NtUninstallKB955069$(2)
2009-01-06 03:49:24 ----DC---- C:\WINDOWS\$NtUninstallKB954600$(2)
2009-01-06 03:49:04 ----DC---- C:\WINDOWS\$NtUninstallKB954211$(3)
2009-01-06 03:48:39 ----DC---- C:\WINDOWS\$NtUninstallKB915800-v4$(3)
2009-01-06 03:47:17 ----A---- C:\WINDOWS\setuplog.txt
2009-01-06 03:40:40 ----AT---- C:\WINDOWS\006808_.tmp
2009-01-06 03:12:37 ----DC---- C:\WINDOWS\$NtUninstallKB952069_WM9$
2009-01-06 03:12:32 ----DC---- C:\WINDOWS\$NtUninstallKB955839$
2009-01-06 03:12:17 ----DC---- C:\WINDOWS\$NtUninstallKB958215$
2009-01-06 03:10:04 ----DC---- C:\WINDOWS\$NtUninstallKB960714$
2009-01-06 03:09:18 ----DC---- C:\WINDOWS\$NtUninstallKB957097$
2009-01-06 03:09:11 ----DC---- C:\WINDOWS\$NtUninstallKB954600$
2009-01-06 03:09:04 ----DC---- C:\WINDOWS\$NtUninstallKB958644$
2009-01-06 03:08:57 ----DC---- C:\WINDOWS\$NtUninstallKB955069$
2009-01-06 03:08:49 ----DC---- C:\WINDOWS\$NtUninstallKB956802$
2009-01-06 03:06:30 ----D---- C:\RECYCLER(2)
2009-01-06 02:42:16 ----D---- C:\WINDOWS\pss
2009-01-06 02:36:14 ----D---- C:\Program Files\XoftSpySE
2009-01-06 00:10:35 ----D---- C:\Program Files\SUPERAntiSpyware
2009-01-06 00:10:35 ----D---- C:\Documents and Settings\Thomas Jarrett\Application Data\SUPERAntiSpyware.com
2009-01-05 23:55:39 ----A---- C:\Boot.bak
2009-01-05 21:45:18 ----DC---- C:\WINDOWS\$NtUninstallKB957095$(2)
2009-01-05 21:44:56 ----DC---- C:\WINDOWS\$NtUninstallKB956841$(2)
2009-01-05 21:44:34 ----DC---- C:\WINDOWS\$NtUninstallKB956803$(2)
2009-01-05 21:44:10 ----DC---- C:\WINDOWS\$NtUninstallKB956390$(2)
2009-01-05 21:43:48 ----DC---- C:\WINDOWS\$NtUninstallKB954211$(2)
2009-01-05 21:43:23 ----DC---- C:\WINDOWS\$NtUninstallKB915800-v4$(2)
2009-01-05 21:35:01 ----AT---- C:\WINDOWS\006814_.tmp
2009-01-05 20:19:55 ----D---- C:\Program Files\Trend Micro
2009-01-05 19:41:33 ----A---- C:\WINDOWS\system32\vetredir.dll
2009-01-05 19:41:33 ----A---- C:\WINDOWS\system32\isafprod.dll
2009-01-05 19:41:33 ----A---- C:\WINDOWS\system32\isafeif.dll
2009-01-05 19:41:20 ----D---- C:\Program Files\Common Files\Scanner
2009-01-05 19:41:09 ----D---- C:\Documents and Settings\All Users\Application Data\CA
2009-01-05 19:41:08 ----D---- C:\Program Files\CA
2009-01-05 16:28:24 ----A---- C:\WINDOWS\zip.exe
2009-01-05 16:28:24 ----A---- C:\WINDOWS\VFIND.exe
2009-01-05 16:28:24 ----A---- C:\WINDOWS\SWXCACLS.exe
2009-01-05 16:28:24 ----A---- C:\WINDOWS\SWSC.exe
2009-01-05 16:28:24 ----A---- C:\WINDOWS\SWREG.exe
2009-01-05 16:28:24 ----A---- C:\WINDOWS\sed.exe
2009-01-05 16:28:24 ----A---- C:\WINDOWS\NIRCMD.exe
2009-01-05 16:28:24 ----A---- C:\WINDOWS\grep.exe
2009-01-05 16:28:24 ----A---- C:\WINDOWS\fdsv.exe
2009-01-05 16:28:19 ----D---- C:\WINDOWS\ERDNT
2009-01-05 16:28:19 ----D---- C:\Qoobox
2009-01-05 13:43:03 ----D---- C:\VundoFix Backups
2009-01-05 13:43:03 ----A---- C:\VundoFix.txt
2009-01-05 12:28:02 ----A---- C:\WINDOWS\wininit.ini
2009-01-05 12:12:24 ----D---- C:\Program Files\Spybot - Search & Destroy
2009-01-05 12:12:24 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2009-01-01 11:52:00 ----A---- C:\WINDOWS\system32\2325946a-.txt
2008-12-28 21:53:48 ----D---- C:\Documents and Settings\All Users\Application Data\NVIDIA
2008-12-26 14:50:00 ----A---- C:\WINDOWS\Blink.ini
2008-12-09 11:22:02 ----D---- C:\qrnt
2008-12-02 20:34:31 ----A---- C:\WINDOWS\system32\smbmngr.dll
2008-11-19 17:13:58 ----D---- C:\ProWin08
2008-10-16 07:54:50 ----AC---- C:\WINDOWS\idyqizoju.bat
2008-10-16 07:54:50 ----AC---- C:\WINDOWS\agigazaf.com
2008-10-16 07:54:50 ----A---- C:\Documents and Settings\Thomas Jarrett\Application Data\edymosyvo.vbs
2008-10-16 07:54:50 ----A---- C:\Documents and Settings\All Users\Application Data\gypugun.bat
2008-10-16 07:54:48 ----AC---- C:\WINDOWS\bexojeqasi.exe
2008-10-16 07:54:48 ----A---- C:\Documents and Settings\Thomas Jarrett\Application Data\ywinuti.bat
2008-10-15 08:01:44 ----A---- C:\WINDOWS\system32\rifa.dll
2008-10-15 08:01:44 ----A---- C:\Documents and Settings\All Users\Application Data\lyqijilizu.bat
2008-10-15 07:09:49 ----D---- C:\Program Files\srhmoxc
2008-10-15 07:09:48 ----D---- C:\Documents and Settings\All Users\Application Data\bqhcvkbw
2008-10-14 21:43:55 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$
2008-10-14 21:43:49 ----HDC---- C:\WINDOWS\$NtUninstallKB956391$
2008-10-14 21:43:43 ----HDC---- C:\WINDOWS\$NtUninstallKB957095$
2008-10-14 21:43:36 ----HDC---- C:\WINDOWS\$NtUninstallKB954211$
2008-10-14 21:43:26 ----HDC---- C:\WINDOWS\$NtUninstallKB956841$
2008-10-14 21:42:13 ----HDC---- C:\WINDOWS\$NtUninstallKB956390$
2008-10-14 21:30:39 ----D---- C:\Program Files\Anti Tracks
2008-10-14 21:26:17 ----A---- C:\WINDOWS\system32\cc3250mt.dll
2008-10-14 21:26:17 ----A---- C:\WINDOWS\system32\BORLNDMM.DLL
2008-10-14 21:11:07 ----D---- C:\Program Files\Lavasoft
2008-10-14 21:11:07 ----D---- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-10-14 21:10:44 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2008-10-14 21:10:31 ----D---- C:\Documents and Settings\Thomas Jarrett\Application Data\WinRAR
2008-10-14 21:10:00 ----D---- C:\Program Files\WinRAR
2008-10-14 20:56:43 ----D---- C:\306575868733228836
2008-10-14 18:24:45 ----ACT---- C:\WINDOWS\006813_.tmp
2008-10-12 12:32:31 ----D---- C:\Program Files\Windows Desktop Search
2008-10-12 12:32:30 ----D---- C:\WINDOWS\system32\GroupPolicy
2008-10-12 12:32:23 ----HDC---- C:\WINDOWS\$NtUninstallKB940157$
2008-10-12 12:32:15 ----HDC---- C:\WINDOWS\$NtUninstallKB915800-v4$
2008-10-12 12:31:53 ----A---- C:\WINDOWS\system32\xmllite(2).dll
2008-10-09 08:26:31 ----D---- C:\Documents and Settings\Thomas Jarrett\Application Data\Help
2008-10-08 11:44:11 ----RD---- C:\Documents and Settings\Thomas Jarrett\Application Data\Brother

======List of files/folders modified in the last 3 months======

2009-01-06 14:14:29 ----D---- C:\WINDOWS
2009-01-06 14:14:28 ----D---- C:\WINDOWS\system32\CatRoot2
2009-01-06 12:35:43 ----D---- C:\WINDOWS\system32\drivers
2009-01-06 12:35:43 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2009-01-06 12:21:09 ----D---- C:\WINDOWS\system32
2009-01-06 12:16:57 ----A---- C:\WINDOWS\system.ini
2009-01-06 12:14:13 ----RSHD---- C:\WINDOWS\system32\dllcache
2009-01-06 12:14:08 ----D---- C:\WINDOWS\system32\CatRoot
2009-01-06 12:13:14 ----D---- C:\WINDOWS\AppPatch
2009-01-06 12:13:14 ----D---- C:\Program Files\Common Files
2009-01-06 12:12:25 ----RASH---- C:\boot.ini
2009-01-06 12:11:50 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-01-06 04:03:17 ----RSD---- C:\WINDOWS\Fonts
2009-01-06 04:03:17 ----D---- C:\WINDOWS\system32\wbem
2009-01-06 04:02:00 ----D---- C:\WINDOWS\system32\config
2009-01-06 04:01:42 ----D---- C:\WINDOWS\Registration
2009-01-06 04:01:20 ----SHD---- C:\WINDOWS\Installer
2009-01-06 04:00:59 ----HD---- C:\WINDOWS\inf
2009-01-06 04:00:55 ----D---- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2009-01-06 04:00:51 ----D---- C:\Program Files\Internet Explorer
2009-01-06 04:00:35 ----D---- C:\WINDOWS\ehome
2009-01-06 04:00:34 ----D---- C:\WINDOWS\system32\ReinstallBackups
2009-01-06 03:58:48 ----D---- C:\WINDOWS\system32\usmt
2009-01-06 03:58:48 ----D---- C:\WINDOWS\system32\oobe
2009-01-06 03:58:48 ----D---- C:\WINDOWS\system
2009-01-06 03:58:47 ----D---- C:\WINDOWS\system32\Setup
2009-01-06 03:58:44 ----D---- C:\WINDOWS\Help
2009-01-06 03:58:44 ----D---- C:\Program Files\Outlook Express
2009-01-06 03:58:44 ----D---- C:\Program Files\Common Files\System
2009-01-06 03:58:43 ----D---- C:\WINDOWS\system32\Com
2009-01-06 03:58:43 ----D---- C:\Program Files\Windows NT
2009-01-06 03:58:43 ----D---- C:\Program Files\NetMeeting
2009-01-06 03:58:41 ----D---- C:\WINDOWS\srchasst
2009-01-06 03:58:41 ----D---- C:\WINDOWS\msagent
2009-01-06 03:58:41 ----D---- C:\WINDOWS\ime
2009-01-06 03:58:40 ----D---- C:\WINDOWS\system32\Restore
2009-01-06 03:58:40 ----D---- C:\WINDOWS\system32\npp
2009-01-06 03:58:40 ----D---- C:\WINDOWS\mui
2009-01-06 03:58:39 ----D---- C:\Program Files\Movie Maker
2009-01-06 03:58:30 ----D---- C:\WINDOWS\PeerNet
2009-01-06 03:58:29 ----D---- C:\WINDOWS\system32\bits
2009-01-06 03:58:24 ----D---- C:\WINDOWS\system32\inetsrv
2009-01-06 03:58:18 ----D---- C:\Program Files\Messenger
2009-01-06 03:46:41 ----D---- C:\WINDOWS\network diagnostic
2009-01-06 03:46:33 ----D---- C:\WINDOWS\system32\en
2009-01-06 03:42:25 ----D---- C:\WINDOWS\security
2009-01-06 03:42:14 ----HDC---- C:\WINDOWS\$NtServicePackUninstall$
2009-01-06 03:17:05 ----D---- C:\WINDOWS\Debug
2009-01-06 03:12:14 ----HD---- C:\WINDOWS\$hf_mig$
2009-01-06 03:08:43 ----D---- C:\WINDOWS\WinSxS
2009-01-06 02:49:40 ----A---- C:\WINDOWS\win.ini
2009-01-06 02:36:15 ----SD---- C:\WINDOWS\Tasks
2009-01-06 02:36:14 ----RD---- C:\Program Files
2009-01-06 02:12:42 ----D---- C:\WINDOWS\CAVTemp
2009-01-05 19:44:19 ----A---- C:\caisslog.txt
2009-01-05 19:41:33 ----A---- C:\caavsetupLog.txt
2009-01-05 11:50:53 ----D---- C:\Program Files\Mozilla Firefox
2009-01-02 12:44:43 ----A---- C:\WINDOWS\ProWin06.INI
2008-12-29 08:41:40 ----D---- C:\Program Files\MSN
2008-12-27 09:36:15 ----A---- C:\WINDOWS\brwmark.ini
2008-11-26 11:17:48 ----A---- C:\WINDOWS\ProWin05.INI
2008-11-19 17:15:20 ----D---- C:\Program Files\Common Files\AnswerWorks 4.0
2008-11-19 17:15:16 ----D---- C:\Program Files\Common Files\Microsoft Shared
2008-11-19 17:14:58 ----D---- C:\ProPDF
2008-11-19 17:14:52 ----D---- C:\Program Files\Common Files\Intuit
2008-11-19 17:14:46 ----HD---- C:\Program Files\InstallShield Installation Information
2008-10-31 08:05:56 ----D---- C:\ProWin06
2008-10-30 09:53:03 ----D---- C:\WINDOWS\system32\FxsTmp
2008-10-16 14:13:40 ----A---- C:\WINDOWS\system32\wuweb.dll
2008-10-16 14:13:40 ----A---- C:\WINDOWS\system32\wuaueng.dll
2008-10-16 14:12:22 ----A---- C:\WINDOWS\system32\wucltui.dll
2008-10-16 14:12:20 ----A---- C:\WINDOWS\system32\wuapi.dll
2008-10-16 14:09:44 ----A---- C:\WINDOWS\system32\wups2.dll
2008-10-16 14:09:44 ----A---- C:\WINDOWS\system32\wuauclt.exe
2008-10-16 14:09:44 ----A---- C:\WINDOWS\system32\cdm.dll
2008-10-16 14:09:40 ----A---- C:\WINDOWS\system32\wucltui.dll.mui
2008-10-16 14:08:58 ----A---- C:\WINDOWS\system32\wups.dll
2008-10-16 14:07:44 ----A---- C:\WINDOWS\system32\wuapi.dll.mui
2008-10-16 14:07:14 ----A---- C:\WINDOWS\system32\wuaueng.dll.mui
2008-10-16 14:06:48 ----A---- C:\WINDOWS\system32\muweb.dll
2008-10-16 14:06:48 ----A---- C:\WINDOWS\system32\mucltui.dll.mui
2008-10-16 14:06:48 ----A---- C:\WINDOWS\system32\mucltui.dll
2008-10-16 07:59:15 ----D---- C:\ProWin07
2008-10-16 05:20:53 ----A---- C:\WINDOWS\system32\urlmon(8).dll
2008-10-16 05:20:53 ----A---- C:\WINDOWS\system32\urlmon(7).dll
2008-10-16 05:20:53 ----A---- C:\WINDOWS\system32\urlmon(6).dll
2008-10-16 05:20:52 ----A---- C:\WINDOWS\system32\browseui(4).dll
2008-10-16 05:20:51 ----A---- C:\WINDOWS\system32\shlwapi(5).dll
2008-10-16 05:20:50 ----A---- C:\WINDOWS\system32\jsproxy(3).dll
2008-10-16 05:20:49 ----A---- C:\WINDOWS\system32\wininet(8).dll
2008-10-16 05:20:49 ----A---- C:\WINDOWS\system32\wininet(7).dll
2008-10-16 05:20:49 ----A---- C:\WINDOWS\system32\wininet(6).dll
2008-10-15 11:57:55 ----A---- C:\WINDOWS\system32\netapi32(6).dll
2008-10-15 11:57:55 ----A---- C:\WINDOWS\system32\netapi32(5).dll
2008-10-14 21:36:53 ----SD---- C:\WINDOWS\Downloaded Program Files
2008-10-14 20:53:55 ----D---- C:\WINDOWS\system32\appmgmt
2008-10-12 12:32:40 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft
2008-10-12 12:32:33 ----D---- C:\WINDOWS\system32\en-us

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AmdK8;AMD Processor Driver; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2005-03-09 36352]
R1 VETEFILE;VET File Scan Engine; C:\WINDOWS\system32\drivers\VETEFILE.sys [2009-01-05 880560]
R1 VETFDDNT;VET Floppy Boot Sector Monitor; C:\WINDOWS\system32\drivers\VETFDDNT.sys [2007-08-20 21512]
R1 VET-FILT;VET File System Filter; C:\WINDOWS\system32\drivers\VET-FILT.sys [2007-08-20 26376]
R1 VETMONNT;VET File Monitor; C:\WINDOWS\system32\drivers\VETMONNT.sys [2007-08-20 32264]
R1 VET-REC;VET File System Recognizer; C:\WINDOWS\system32\drivers\VET-REC.sys [2007-08-20 21128]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2005-01-07 138752]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2008-01-30 4725760]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2006-08-16 3959712]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2006-07-11 57856]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2006-07-11 20480]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2006-03-15 26624]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2006-03-15 57600]
R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2006-03-15 17024]
R3 VETEBOOT;VET Boot Scan Engine; C:\WINDOWS\system32\drivers\VETEBOOT.sys [2009-01-05 108368]
S1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys []
S3 ADM8511;ADMtek ADM8511/AN986 USB To Fast Ethernet Converter; C:\WINDOWS\system32\DRIVERS\ADM8511.SYS [2001-08-17 20160]
S3 AN983;ADMtek AN983/AN985/ADM951X 10/100Mbps Fast Ethernet Adapter; C:\WINDOWS\system32\DRIVERS\AN983.sys [2002-04-03 36224]
S3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2004-08-03 701440]
S3 EL90XBC;3Com EtherLink XL 90XB/C Adapter Driver; C:\WINDOWS\system32\DRIVERS\el90xbc5.sys [2001-08-17 66591]
S3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
S3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-03 20480]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aawservice;Ad-Aware 2007 Service; C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe [2007-06-05 561152]
R2 CAISafe;CAISafe; C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe [2007-08-20 144960]
R2 ITMRTSVC;CA Pest Patrol Realtime Protection Service; C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe [2007-01-04 280080]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2006-08-16 155715]
R2 QBCFMonitorService;QBCFMonitorService; C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe [2008-10-22 20480]
R2 VETMSGNT;VET Message Service; C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe [2007-08-20 242952]
R3 CaCCProvSP;CaCCProvSP; C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe [2007-08-16 214280]
R3 PPCtlPriv;PPCtlPriv; C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe [2007-08-16 189704]
R3 QBFCService;Intuit QuickBooks FCS; C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe [2007-05-24 61440]
S2 Fax;Fax; C:\WINDOWS\system32\fxssvc.exe [2006-03-15 267776]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [2007-10-09 36864]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2007-10-11 864256]
S3 Intuit Fuse Service;Intuit Fuse Service; C:\Program Files\Common Files\Intuit\Fuse\Service\Intuit Fuse Service.exe [2008-06-27 72704]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2007-08-24 443776]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2004-08-11 38912]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2007-10-11 122880]

-----------------EOF-----------------

#5 wannabecomputergeek

wannabecomputergeek
  • Topic Starter

  • Members
  • 16 posts
  • OFFLINE
  •  
  • Local time:07:10 PM

Posted 06 January 2009 - 02:27 PM

here isinfo.txt

info.txt logfile of random's system information tool 1.05 2009-01-06 14:22:11

======Uninstall list======

-->MsiExec.exe /I{8A42F680-2DD6-11D4-9A8C-0040F6982C20}
-->MsiExec.exe /I{8ED4E82B-8CEA-40DE-826C-37AC7B941F81}
-->MsiExec.exe /I{A2529672-574A-4A99-86A5-C1770A0E31FE}
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {3EC77D26-799B-4CD8-914F-C1565E796173}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {430971B1-C31E-45DA-81E0-72C095BAB72C}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {F7A31780-33C4-4E39-951A-5EC9B91D7BF1}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {FAD8A83E-9BAC-4179-9268-A35948034D85}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-00A1-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0115-0409-0000-0000000FF1CE} /uninstall {FAD8A83E-9BAC-4179-9268-A35948034D85}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {BEE75E01-DD3F-4D5F-B96C-609E6538D419}
Ad-Aware 2007-->MsiExec.exe /X{0E6AB9FC-76C2-431B-9C06-6C1CFFFEA8EB}
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)-->MsiExec.exe /X{6846389C-BAC0-4374-808E-B120F86AF5D7}
Adobe Flash Player 9 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\UninstFl.exe -q
Adobe Flash Player ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Reader 8.1.2-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81200000003}
Adobe Shockwave Player-->C:\WINDOWS\system32\MACROMED\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\MACROMED\SHOCKW~1\INSTALL.LOG
AnswerWorks 4.0 Runtime - English-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7DD9A065-2C86-4A9F-A5FF-796EC1B99DCA}\setup.exe" -l0x9 -removeonly
Anti Tracks 5.9.3-->"C:\Program Files\Anti Tracks\unins000.exe"
CA Internet Security Suite-->"C:\Program Files\CA\CA Internet Security Suite\caunst.exe" /u
Document eSort Components-->MsiExec.exe /X{585AD9D9-3CDC-4099-AC5F-077142883D5A}
EntlClnt-->MsiExec.exe /I{C9052439-99E8-4A4C-9C81-49776DDFA969}
High Definition Audio Driver Package - KB888111-->"C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe"
HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.0 (KB932471)-->C:\WINDOWS\system32\msiexec.exe /promptrestart /uninstall {ECD292A0-0347-4244-8C24-5DBCE990FB40} /package {BAF78226-3200-4DB4-BE33-4D922A799840}
Hotfix for Windows XP (KB896344)-->"C:\WINDOWS\$NtUninstallKB896344$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB915800-v4)-->"C:\WINDOWS\$NtUninstallKB915800-v4$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
Intuit Entitlement Client-->MsiExec.exe /I{FA0092C2-C0FE-40DA-A79E-E4C0FCA129F9}
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins001.exe"
MediaShow 3.0-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D5A9B7C0-8751-11D8-9D75-000129760D75}\setup.exe" -uninstall
Microsoft .NET Framework 1.1 Hotfix (KB928366)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0 Service Pack 1-->MsiExec.exe /I{B508B3F1-A24A-32C0-B310-85786919EF28}
Microsoft .NET Framework 3.0 Service Pack 1-->MsiExec.exe /I{2BA00471-0328-3743-93BD-FA813353A783}
Microsoft Base Smart Card Cryptographic Service Provider Package-->"C:\WINDOWS\$NtUninstallbasecsp$\spuninst\spuninst.exe"
Microsoft Office Excel MUI (English) 2007-->MsiExec.exe /X{90120000-0016-0409-0000-0000000FF1CE}
Microsoft Office Home and Student 2007-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall HOMESTUDENTR /dll OSETUP.DLL
Microsoft Office Home and Student 2007-->MsiExec.exe /X{91120000-002F-0000-0000-0000000FF1CE}
Microsoft Office OneNote MUI (English) 2007-->MsiExec.exe /X{90120000-00A1-0409-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (English) 2007-->MsiExec.exe /X{90120000-0018-0409-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (English) 2007-->MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE}
Microsoft Office Shared MUI (English) 2007-->MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE}
Microsoft Office Shared Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE}
Microsoft Office Word MUI (English) 2007-->MsiExec.exe /X{90120000-001B-0409-0000-0000000FF1CE}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
MSN-->C:\Program Files\MSN\MsnInstaller\msninst.exe /Action:ARP
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 Parser and SDK-->MsiExec.exe /I{716E0306-8318-4364-8B8F-0CC4E9376BAC}
MSXML 6.0 Parser (KB933579)-->MsiExec.exe /I{0A869A65-8C94-4F7C-A5C7-972D3C8CED9E}
NVIDIA Drivers-->C:\WINDOWS\system32\nvuide.exe UninstallGUI
PaperPort-->MsiExec.exe /I{A17EABB6-D0C6-44E5-820C-72DC7F495064}
Power2Go 4.0-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{40BF1E83-20EB-11D8-97C5-0009C5020658}\Setup.exe" -uninstall
PowerDVD-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\setup.exe" -uninstall
PowerProducer-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B7A0CE06-068E-11D6-97FD-0050BACBF861}\setup.exe" -uninstall
PowerStarter-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}\setup.exe" -uninstall
ProSeries 2005-->C:\ProWin05\TaxUnst.EXE "C:\ProWin05\Uninstall.log"
ProSeries 2006-->C:\ProWin06\TaxUnst.EXE "C:\ProWin06\Uninstall.log"
ProSeries 2007-->C:\ProWin07\TaxUnst.EXE "C:\ProWin07\Uninstall.log"
ProSeries 2008-->C:\ProWin08\TaxUnst.EXE "C:\ProWin08\Uninstall.log"
ProSeries User's Guide 2006-->C:\Program Files\InstallShield Installation Information\{05546067-6DB4-48C2-83C5-BB87A608B5B8}\setup.exe -runfromtemp -l0x0009 -eliminate -removeonly
QuickBooks Pro 2008-->msiexec.exe /I {8ED4E82B-8CEA-40DE-826C-37AC7B941F81} UNIQUE_NAME="pro" QBFULLNAME="QuickBooks Pro 2008" ADDREMOVE=1
Realtek High Definition Audio Driver-->RtlUpd.exe -r -m
Security Update for 2007 Microsoft Office System (KB951944)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {797AE457-BA17-4BBC-B501-25FB3A0103C7}
Security Update for 2007 Microsoft Office System (KB955936)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {1D94099C-2BBA-440E-BD5E-093BBDF8F028}
Security Update for Microsoft Office Excel 2007 (KB955470)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {6E8637D8-10D6-4568-AA06-E2706F31685E}
Security Update for Microsoft Office OneNote 2007 (KB950130)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {F1B2401C-B610-4BF2-AA1C-52C55827A8F4}
Security Update for Microsoft Office PowerPoint 2007 (KB951338)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {558B709B-821B-4FC5-90FC-9A8890641E77}
Security Update for Microsoft Office system 2007 (KB951808)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {8F375E11-4FD6-4B89-9E2B-A76D48B51E00}
Security Update for Microsoft Office system 2007 (KB954326)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {5F7F6FFF-395D-480E-8450-64F385D82C5F}
Security Update for Microsoft Office Word 2007 (KB950113)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {AD72BABE-C733-4FCF-9674-4314466191B9}
Security Update for Windows Media Player 10 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP10$\spuninst\spuninst.exe"
Security Update for Windows Media Player 6.4 (KB925398)-->"C:\WINDOWS\$NtUninstallKB925398_WMP64$\spuninst\spuninst.exe"
Security Update for Windows XP (KB918118)-->"C:\WINDOWS\$NtUninstallKB918118$\spuninst\spuninst.exe"
Security Update for Windows XP (KB918899)-->"C:\WINDOWS\$NtUninstallKB918899$\spuninst\spuninst.exe"
Security Update for Windows XP (KB920213)-->"C:\WINDOWS\$NtUninstallKB920213$\spuninst\spuninst.exe"
Security Update for Windows XP (KB921503)-->"C:\WINDOWS\$NtUninstallKB921503$\spuninst\spuninst.exe"
Security Update for Windows XP (KB922819)-->"C:\WINDOWS\$NtUninstallKB922819$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923191)-->"C:\WINDOWS\$NtUninstallKB923191$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923414)-->"C:\WINDOWS\$NtUninstallKB923414$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923689)-->"C:\WINDOWS\$NtUninstallKB923689$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923980)-->"C:\WINDOWS\$NtUninstallKB923980$\spuninst\spuninst.exe"
Security Update for Windows XP (KB924270)-->"C:\WINDOWS\$NtUninstallKB924270$\spuninst\spuninst.exe"
Security Update for Windows XP (KB924496)-->"C:\WINDOWS\$NtUninstallKB924496$\spuninst\spuninst.exe"
Security Update for Windows XP (KB924667)-->"C:\WINDOWS\$NtUninstallKB924667$\spuninst\spuninst.exe"
Security Update for Windows XP (KB925902)-->"C:\WINDOWS\$NtUninstallKB925902$\spuninst\spuninst.exe"
Security Update for Windows XP (KB926255)-->"C:\WINDOWS\$NtUninstallKB926255$\spuninst\spuninst.exe"
Security Update for Windows XP (KB926436)-->"C:\WINDOWS\$NtUninstallKB926436$\spuninst\spuninst.exe"
Security Update for Windows XP (KB927779)-->"C:\WINDOWS\$NtUninstallKB927779$\spuninst\spuninst.exe"
Security Update for Windows XP (KB927802)-->"C:\WINDOWS\$NtUninstallKB927802$\spuninst\spuninst.exe"
Security Update for Windows XP (KB928255)-->"C:\WINDOWS\$NtUninstallKB928255$\spuninst\spuninst.exe"
Security Update for Windows XP (KB928843)-->"C:\WINDOWS\$NtUninstallKB928843$\spuninst\spuninst.exe"
Security Update for Windows XP (KB929123)-->"C:\WINDOWS\$NtUninstallKB929123$\spuninst\spuninst.exe"
Security Update for Windows XP (KB930178)-->"C:\WINDOWS\$NtUninstallKB930178$\spuninst\spuninst.exe"
Security Update for Windows XP (KB931261)-->"C:\WINDOWS\$NtUninstallKB931261$\spuninst\spuninst.exe"
Security Update for Windows XP (KB931784)-->"C:\WINDOWS\$NtUninstallKB931784$\spuninst\spuninst.exe"
Security Update for Windows XP (KB932168)-->"C:\WINDOWS\$NtUninstallKB932168$\spuninst\spuninst.exe"
Security Update for Windows XP (KB933729)-->"C:\WINDOWS\$NtUninstallKB933729$\spuninst\spuninst.exe"
Security Update for Windows XP (KB935839)-->"C:\WINDOWS\$NtUninstallKB935839$\spuninst\spuninst.exe"
Security Update for Windows XP (KB935840)-->"C:\WINDOWS\$NtUninstallKB935840$\spuninst\spuninst.exe"
Security Update for Windows XP (KB936021)-->"C:\WINDOWS\$NtUninstallKB936021$\spuninst\spuninst.exe"
Security Update for Windows XP (KB937143)-->"C:\WINDOWS\$NtUninstallKB937143$\spuninst\spuninst.exe"
Security Update for Windows XP (KB937894)-->"C:\WINDOWS\$NtUninstallKB937894$\spuninst\spuninst.exe"
Security Update for Windows XP (KB938127)-->"C:\WINDOWS\$NtUninstallKB938127$\spuninst\spuninst.exe"
Security Update for Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Security Update for Windows XP (KB938829)-->"C:\WINDOWS\$NtUninstallKB938829$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941202)-->"C:\WINDOWS\$NtUninstallKB941202$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941568)-->"C:\WINDOWS\$NtUninstallKB941568$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941644)-->"C:\WINDOWS\$NtUninstallKB941644$\spuninst\spuninst.exe"
Security Update for Windows XP (KB943055)-->"C:\WINDOWS\$NtUninstallKB943055$\spuninst\spuninst.exe"
Security Update for Windows XP (KB943460)-->"C:\WINDOWS\$NtUninstallKB943460$\spuninst\spuninst.exe"
Security Update for Windows XP (KB943485)-->"C:\WINDOWS\$NtUninstallKB943485$\spuninst\spuninst.exe"
Security Update for Windows XP (KB944533)-->"C:\WINDOWS\$NtUninstallKB944533$\spuninst\spuninst.exe"
Security Update for Windows XP (KB944653)-->"C:\WINDOWS\$NtUninstallKB944653$\spuninst\spuninst.exe"
Security Update for Windows XP (KB946026)-->"C:\WINDOWS\$NtUninstallKB946026$\spuninst\spuninst.exe"
Security Update for Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950749)-->"C:\WINDOWS\$NtUninstallKB950749$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950759)-->"C:\WINDOWS\$NtUninstallKB950759$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950760)-->"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951376)-->"C:\WINDOWS\$NtUninstallKB951376$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Security Update for Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Security Update for Windows XP (KB953838)-->"C:\WINDOWS\$NtUninstallKB953838$\spuninst\spuninst.exe"
Security Update for Windows XP (KB953839)-->"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"
Security Update for Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956390)-->"C:\WINDOWS\$NtUninstallKB956390$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
Security Update for Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"
Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
SupportSoft Assisted Service-->MsiExec.exe /I{5A3F6A80-7913-475E-8B96-477A952CFA43}
Tax Forms Helper 2007 8.0-->"C:\Program Files\Adams Business Forms\Tax Forms Helper 2007\unins000.exe"
Update for Office 2007 (KB946691)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {A420F522-7395-4872-9882-C591B4B92278}
Update for Windows XP (KB904942)-->"C:\WINDOWS\$NtUninstallKB904942$\spuninst\spuninst.exe"
Update for Windows XP (KB920342)-->"C:\WINDOWS\$NtUninstallKB920342$\spuninst\spuninst.exe"
Update for Windows XP (KB925720)-->"C:\WINDOWS\$NtUninstallKB925720$\spuninst\spuninst.exe"
Update for Windows XP (KB925876)-->"C:\WINDOWS\$NtUninstallKB925876$\spuninst\spuninst.exe"
Update for Windows XP (KB927891)-->"C:\WINDOWS\$NtUninstallKB927891$\spuninst\spuninst.exe"
Update for Windows XP (KB930916)-->"C:\WINDOWS\$NtUninstallKB930916$\spuninst\spuninst.exe"
Update for Windows XP (KB931836)-->"C:\WINDOWS\$NtUninstallKB931836$\spuninst\spuninst.exe"
Update for Windows XP (KB936357)-->"C:\WINDOWS\$NtUninstallKB936357$\spuninst\spuninst.exe"
Update for Windows XP (KB938828)-->"C:\WINDOWS\$NtUninstallKB938828$\spuninst\spuninst.exe"
Update for Windows XP (KB942763)-->"C:\WINDOWS\$NtUninstallKB942763$\spuninst\spuninst.exe"
Update for Windows XP (KB942840)-->"C:\WINDOWS\$NtUninstallKB942840$\spuninst\spuninst.exe"
Update for Windows XP (KB951072-v2)-->"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
WexTech AnswerWorks-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EA2BEBD6-87B9-41E5-95AC-7E4C165A9475}\SETUP.EXE" -l0x9 -eliminate
Windows Imaging Component-->"C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
Windows Presentation Foundation-->MsiExec.exe /X{BAF78226-3200-4DB4-BE33-4D922A799840}
Windows Search 4.0-->"C:\WINDOWS\$NtUninstallKB940157$\spuninst\spuninst.exe"
Windows XP Hotfix - KB873339-->C:\WINDOWS\$NtUninstallKB873339$\spuninst\spuninst.exe
Windows XP Hotfix - KB885835-->C:\WINDOWS\$NtUninstallKB885835$\spuninst\spuninst.exe
Windows XP Hotfix - KB885836-->C:\WINDOWS\$NtUninstallKB885836$\spuninst\spuninst.exe
Windows XP Hotfix - KB886185-->C:\WINDOWS\$NtUninstallKB886185$\spuninst\spuninst.exe
WinRAR archiver-->C:\Program Files\WinRAR\uninstall.exe
Yahoo! Toolbar-->C:\PROGRA~1\Yahoo!\Common\unyt.exe

=====HijackThis Backups=====

O4 - HKLM\..\Run: [Szijexaquv] rundll32.exe "C:\WINDOWS\Yrabivodukeqoda.dll",e
O4 - HKLM\..\Run: [Szijexaquv] rundll32.exe "C:\WINDOWS\Yrabivodukeqoda.dll",e
O4 - HKLM\..\Run: [Szijexaquv] rundll32.exe "C:\WINDOWS\Yrabivodukeqoda.dll",e
O4 - HKLM\..\Run: [Szijexaquv] rundll32.exe "C:\WINDOWS\Yrabivodukeqoda.dll",e
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [Szijexaquv] rundll32.exe "C:\WINDOWS\Yrabivodukeqoda.dll",e
O18 - Protocol: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - mscoree.dll (file missing)
O4 - HKLM\..\Run: [Szijexaquv] rundll32.exe "C:\WINDOWS\Yrabivodukeqoda.dll",e

======Security center information======

AV: CA Anti-Virus

System event log

Computer Name: PREFERRE-FD220E
Event Code: 6004
Message: A driver packet received from the I/O subsystem was invalid. The data is the
packet.

Record Number: 13660
Source Name: EventLog
Time Written: 20081230082343.000000-300
Event Type: error
User:

Computer Name: PREFERRE-FD220E
Event Code: 6004
Message: A driver packet received from the I/O subsystem was invalid. The data is the
packet.

Record Number: 13659
Source Name: EventLog
Time Written: 20081230082343.000000-300
Event Type: error
User:

Computer Name: PREFERRE-FD220E
Event Code: 6004
Message: A driver packet received from the I/O subsystem was invalid. The data is the
packet.

Record Number: 13658
Source Name: EventLog
Time Written: 20081230082343.000000-300
Event Type: error
User:

Computer Name: PREFERRE-FD220E
Event Code: 6004
Message: A driver packet received from the I/O subsystem was invalid. The data is the
packet.

Record Number: 13657
Source Name: EventLog
Time Written: 20081230082343.000000-300
Event Type: error
User:

Computer Name: PREFERRE-FD220E
Event Code: 6004
Message: A driver packet received from the I/O subsystem was invalid. The data is the
packet.

Record Number: 13656
Source Name: EventLog
Time Written: 20081230082343.000000-300
Event Type: error
User:

Application event log

Computer Name: PREFERRE-FD220E
Event Code: 11728
Message: Product: Microsoft Office Home and Student 2007 -- Configuration completed successfully.

Record Number: 1610
Source Name: MsiInstaller
Time Written: 20081014224207.000000-240
Event Type: information
User: NT AUTHORITY\SYSTEM

Computer Name: PREFERRE-FD220E
Event Code: 1022
Message: Product: Microsoft Office Home and Student 2007 - Update 'Security Update for Microsoft Office Excel 2007 (KB955470)' installed successfully.

Record Number: 1609
Source Name: MsiInstaller
Time Written: 20081014224207.000000-240
Event Type: information
User: NT AUTHORITY\SYSTEM

Computer Name: PREFERRE-FD220E
Event Code: 1517
Message: Windows saved user PREFERRE-FD220E\Thomas Jarrett registry while an application or service was still using the registry during log off. The memory used by the user's registry has not been freed. The registry will be unloaded when it is no longer in use.


This is often caused by services running as a user account, try configuring the services to run in either the LocalService or NetworkService account.

Record Number: 1608
Source Name: Userenv
Time Written: 20081014224142.000000-240
Event Type: warning
User: NT AUTHORITY\SYSTEM

Computer Name: PREFERRE-FD220E
Event Code: 1000
Message: Faulting application firefox.exe, version 1.8.20080.40413, faulting module xpcom_core.dll, version 1.8.20080.40413, fault address 0x00040009.

Record Number: 1607
Source Name: Application Error
Time Written: 20081014223045.000000-240
Event Type: error
User:

Computer Name: PREFERRE-FD220E
Event Code: 1000
Message: Faulting application firefox.exe, version 1.8.20080.40413, faulting module xpcom_core.dll, version 1.8.20080.40413, fault address 0x0003fc51.

Record Number: 1606
Source Name: Application Error
Time Written: 20081014222536.000000-240
Event Type: error
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%systemroot%\system32;%systemroot%;%systemroot%\system32\wbem;C:\Program Files\Common Files\Intuit\QBPOSSDKRuntime
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 107 Stepping 2, AuthenticAMD
"PROCESSOR_REVISION"=6b02
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP

-----------------EOF-----------------

#6 wannabecomputergeek

wannabecomputergeek
  • Topic Starter

  • Members
  • 16 posts
  • OFFLINE
  •  
  • Local time:07:10 PM

Posted 06 January 2009 - 02:50 PM

And here are the GMER results

Attached Files



#7 fenzodahl512

fenzodahl512

  • Members
  • 6,738 posts
  • OFFLINE
  •  
  • Local time:08:10 AM

Posted 07 January 2009 - 01:44 AM

I can see you run ComboFix on your own before.. It is not advisable to do that.. Run it again and post the log here..

Keep calm, make it simple, use your brain, don't freak out, and you'll be just fine..
Awesomeness: When I get sad, I stop being sad and be awesome instead.. True story - Barney Stinson
Posted Image Posted Image
Its gonna be legen.. wait for it.. dary! Cherish the pain, it means you're still alive


#8 wannabecomputergeek

wannabecomputergeek
  • Topic Starter

  • Members
  • 16 posts
  • OFFLINE
  •  
  • Local time:07:10 PM

Posted 07 January 2009 - 11:23 AM

Yes. Sorry about that. I was following some other directions that I found on Wikipedia. Here's the COmbofix log.

ComboFix 09-01-06.02 - Thomas Jarrett 2009-01-07 11:16:56.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1983.1434 [GMT -5:00]
Running from: c:\documents and settings\Thomas Jarrett\Desktop\ComboFix.exe
AV: CA Anti-Virus *On-access scanning disabled* (Updated)
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2008-12-07 to 2009-01-07 )))))))))))))))))))))))))))))))
.

2009-01-06 14:29 . 2009-01-06 14:29 250 --a------ c:\windows\gmer.ini
2009-01-06 14:21 . 2009-01-06 14:22 <DIR> d-------- C:\rsit
2009-01-06 12:35 . 2009-01-04 18:41 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-06 03:58 . 2009-01-06 03:58 <DIR> d-------- c:\windows\system32\CatRoot_bak
2009-01-06 03:40 . 2009-01-06 03:40 0 --a----t- c:\windows\006808_.tmp
2009-01-06 03:07 . 2009-01-06 03:07 <DIR> d-------- c:\documents and settings\Andrea Jarrett\Application Data\Intuit
2009-01-06 03:06 . 2009-01-06 04:00 <DIR> d-------- C:\RECYCLER(2)
2009-01-06 02:36 . 2009-01-06 04:01 <DIR> d-------- c:\program files\XoftSpySE
2009-01-06 00:10 . 2009-01-06 04:03 <DIR> d-------- c:\program files\SUPERAntiSpyware
2009-01-06 00:10 . 2009-01-06 00:10 <DIR> d-------- c:\documents and settings\Thomas Jarrett\Application Data\SUPERAntiSpyware.com
2009-01-05 21:35 . 2009-01-05 21:35 0 --a----t- c:\windows\006814_.tmp
2009-01-05 20:19 . 2009-01-05 20:19 <DIR> d-------- c:\program files\Trend Micro
2009-01-05 19:42 . 2009-01-05 19:42 880,560 --a------ c:\windows\system32\drivers\vetefile.sys
2009-01-05 19:42 . 2009-01-05 19:42 108,368 --a------ c:\windows\system32\drivers\veteboot.sys
2009-01-05 19:41 . 2009-01-05 19:41 <DIR> d-------- c:\program files\Common Files\Scanner
2009-01-05 19:41 . 2009-01-05 19:41 <DIR> d-------- c:\program files\CA
2009-01-05 19:41 . 2009-01-05 19:44 <DIR> d-------- c:\documents and settings\All Users\Application Data\CA
2009-01-05 19:41 . 2007-08-20 13:37 99,592 --a------ c:\windows\system32\isafeif.dll
2009-01-05 19:41 . 2007-08-20 13:26 79,424 --a------ c:\windows\system32\vetredir.dll
2009-01-05 19:41 . 2007-08-20 13:37 75,016 --a------ c:\windows\system32\isafprod.dll
2009-01-05 19:41 . 2007-08-20 13:38 32,264 --a------ c:\windows\system32\drivers\vetmonnt.sys
2009-01-05 19:41 . 2007-08-20 13:38 26,376 --a------ c:\windows\system32\drivers\vet-filt.sys
2009-01-05 19:41 . 2007-08-20 13:38 21,512 --a------ c:\windows\system32\drivers\vetfddnt.sys
2009-01-05 19:41 . 2007-08-20 13:38 21,128 --a------ c:\windows\system32\drivers\vet-rec.sys
2009-01-05 13:43 . 2009-01-05 13:43 <DIR> d-------- C:\VundoFix Backups
2009-01-05 12:28 . 2009-01-05 12:28 339 --a------ c:\windows\wininit.ini
2009-01-05 12:12 . 2009-01-05 12:30 <DIR> d-------- c:\program files\Spybot - Search & Destroy
2009-01-05 12:12 . 2009-01-06 04:01 <DIR> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-12-28 21:53 . 2008-12-28 21:53 <DIR> d-------- c:\documents and settings\All Users\Application Data\NVIDIA
2008-12-26 14:50 . 2008-12-26 14:50 35 --a------ c:\windows\Blink.ini
2008-12-09 11:22 . 2008-12-15 06:53 <DIR> d-------- C:\qrnt

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-06 17:35 --------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-01-06 09:00 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2009-01-06 05:10 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-01-04 23:41 15,504 ----a-w c:\windows\system32\drivers\mbam.sys
2008-12-03 01:34 48,640 ----a-w c:\windows\system32\smbmngr.dll
2008-11-19 22:15 --------- d-----w c:\program files\Common Files\AnswerWorks 4.0
2008-11-19 22:14 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-19 22:14 --------- d-----w c:\program files\Common Files\Intuit
2008-11-06 14:57 165 ----a-w c:\documents and settings\Thomas Jarrett\xrt_log.dat
2008-10-16 19:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 19:13 202,776 ----a-w c:\windows\system32\dllcache\wuweb.dll
2008-10-16 19:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 19:13 1,809,944 ----a-w c:\windows\system32\dllcache\wuaueng.dll
2008-10-16 19:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 19:12 561,688 ----a-w c:\windows\system32\dllcache\wuapi.dll
2008-10-16 19:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 19:12 323,608 ----a-w c:\windows\system32\dllcache\wucltui.dll
2008-10-16 19:09 92,696 ----a-w c:\windows\system32\dllcache\cdm.dll
2008-10-16 19:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 19:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 19:09 51,224 ----a-w c:\windows\system32\dllcache\wuauclt.exe
2008-10-16 19:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 19:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 19:08 34,328 ----a-w c:\windows\system32\dllcache\wups.dll
2008-10-16 19:06 268,648 ----a-w c:\windows\system32\mucltui.dll
2008-10-16 19:06 208,744 ----a-w c:\windows\system32\muweb.dll
2008-10-16 12:54 18,097 -c--a-w c:\windows\bexojeqasi.exe
2008-10-16 12:54 17,934 ----a-w c:\documents and settings\Thomas Jarrett\Application Data\ywinuti.bat
2008-10-16 12:54 16,827 -c--a-w c:\program files\Common Files\ybugokyry.sys
2008-10-16 12:54 14,877 -c--a-w c:\windows\qenyd.sys
2008-10-16 12:54 12,992 ----a-w c:\documents and settings\All Users\Application Data\alamak.pif
2008-10-16 12:54 12,109 -c--a-w c:\windows\idyqizoju.bat
2008-10-16 12:54 11,730 -c--a-w c:\windows\agigazaf.com
2008-10-16 12:54 11,701 ----a-w c:\documents and settings\All Users\Application Data\gypugun.bat
2008-10-16 12:54 11,344 ----a-w c:\documents and settings\Thomas Jarrett\Application Data\edymosyvo.vbs
2008-10-16 10:20 667,648 ----a-w c:\windows\system32\wininet(8).dll
2008-10-16 10:20 667,648 ----a-w c:\windows\system32\wininet(7).dll
2008-10-16 10:20 667,648 ----a-w c:\windows\system32\wininet(6).dll
2008-10-16 10:20 619,008 ----a-w c:\windows\system32\urlmon(8).dll
2008-10-16 10:20 619,008 ----a-w c:\windows\system32\urlmon(7).dll
2008-10-16 10:20 619,008 ----a-w c:\windows\system32\urlmon(6).dll
2008-10-16 10:20 474,112 ----a-w c:\windows\system32\shlwapi(5).dll
2008-10-16 10:20 16,384 ----a-w c:\windows\system32\jsproxy(3).dll
2008-10-16 10:20 1,024,000 ----a-w c:\windows\system32\browseui(4).dll
2008-10-15 16:57 332,800 ----a-w c:\windows\system32\netapi32(6).dll
2008-10-15 16:57 332,800 ----a-w c:\windows\system32\netapi32(5).dll
2008-10-15 13:01 19,029 ----a-w c:\documents and settings\All Users\Application Data\lyqijilizu.bat
2008-10-15 13:01 18,043 -c--a-w c:\program files\Common Files\rygaciq.inf
2008-10-15 13:01 16,462 ----a-w c:\documents and settings\Thomas Jarrett\Application Data\xotywomah.reg
2008-10-15 13:01 12,639 -c--a-w c:\windows\modo.sys
2008-10-15 13:01 11,267 ----a-w c:\windows\system32\rifa.dll
.

((((((((((((((((((((((((((((( snapshot_2009-01-06_12.17.58.42 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-01-06 19:29:08 884,736 ----a-w c:\windows\gmer.dll
+ 2008-04-18 02:13:02 811,008 ----a-w c:\windows\gmer.exe
+ 2009-01-06 19:29:08 85,969 ----a-w c:\windows\system32\drivers\gmer.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2006-03-15 15360]
"TaskScheduler"="c:\prowin08\32bit\TaskSch.exe" [2008-12-19 393216]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-08-16 7630848]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-08-16 86016]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 32768]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 155648]
"PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2004-04-14 57393]
"IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2004-04-14 40960]
"cctray"="c:\program files\CA\CA Internet Security Suite\cctray\cctray.exe" [2007-08-16 177416]
"CAVRID"="c:\program files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe" [2007-08-20 230664]
"nwiz"="nwiz.exe" [2006-08-16 c:\windows\system32\nwiz.exe]
"RTHDCPL"="RTHDCPL.EXE" [2008-01-29 c:\windows\RTHDCPL.EXE]

c:\documents and settings\Thomas Jarrett\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-07 101440]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2008-10-22 972064]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.clmp3enc"= c:\progra~1\CYBERL~1\Power2Go\CLMP3Enc.ACM

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0lsdelete

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ComputerAssociatesAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Intuit\\QuickBooks 2008\\QBDBMgrN.exe"=
"c:\\ProWin07\\32bit\\protax07.exe"=
"c:\\ProWin07\\32bit\\ProSeriesUpdate.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\WINDOWS\\system32\\spoolsv.exe"=
"c:\\Program Files\\Lavasoft\\Ad-Aware 2007\\aawservice.exe"=
"c:\\Program Files\\Common Files\\Intuit\\QuickBooks\\QBCFMonitorService.exe"=

R3 PPCtlPriv;PPCtlPriv;c:\program files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe [2007-08-16 189704]
S3 ADM8511;ADMtek ADM8511/AN986 USB To Fast Ethernet Converter;c:\windows\system32\drivers\ADM8511.SYS [2008-06-05 20160]
S3 Intuit Fuse Service;Intuit Fuse Service;c:\program files\Common Files\Intuit\Fuse\Service\Intuit Fuse Service.exe [2008-06-27 72704]
.
Contents of the 'Scheduled Tasks' folder

2009-01-06 c:\windows\Tasks\CAAntiSpywareScan_Daily as Thomas Jarrett at 7 41 PM.job
- c:\program files\CA\CA Internet Security Suite\CA Anti-Spyware\CAAntiSpyware.exe [2007-08-16 21:10]

2009-01-07 c:\windows\Tasks\lvfqyvcl.job
- c:\windows\system32\rundll32.exe [2006-03-15 04:00]

2009-01-07 c:\windows\Tasks\XoftSpySE 2.job
- c:\program files\XoftSpySE\XoftSpy.exe []

2009-01-06 c:\windows\Tasks\XoftSpySE.job
- c:\program files\XoftSpySE\XoftSpy.exe []
.
.
------- Supplementary Scan -------
.
mStart Page = hxxp://www.google.com
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
LSP: c:\windows\system32\VetRedir.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-07 11:18:07
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(608)
c:\program files\CA\SharedComponents\PPRT\bin\CACheck.dll
c:\program files\CA\SharedComponents\PPRT\bin\CAHook.dll
c:\program files\CA\SharedComponents\PPRT\bin\CAServer.dll

- - - - - - - > 'lsass.exe'(828)
c:\windows\system32\VetRedir.dll
c:\windows\system32\ISafeIf.dll
.
Completion time: 2009-01-07 11:19:04
ComboFix-quarantined-files.txt 2009-01-07 16:19:02
ComboFix2.txt 2009-01-06 17:18:40
ComboFix3.txt 2009-01-06 07:23:28
ComboFix4.txt 2009-01-06 05:07:50
ComboFix5.txt 2009-01-07 16:16:23

Pre-Run: 228,688,138,240 bytes free
Post-Run: 228,675,858,432 bytes free

195 --- E O F --- 2008-10-15 02:43:59

#9 fenzodahl512

fenzodahl512

  • Members
  • 6,738 posts
  • OFFLINE
  •  
  • Local time:08:10 AM

Posted 08 January 2009 - 12:05 AM

1. Please open Notepad
  • Click Start, then Run
  • Type notepad.exe in the Run Box.
2. Now copy/paste the entire content of the codebox below into the Notepad window:

KillAll::

File::
c:\windows\bexojeqasi.exe
c:\documents and settings\Thomas Jarrett\Application Data\ywinuti.bat
c:\program files\Common Files\ybugokyry.sys
c:\windows\qenyd.sys
c:\documents and settings\All Users\Application Data\alamak.pif
c:\windows\idyqizoju.bat
c:\windows\agigazaf.com
c:\documents and settings\All Users\Application Data\gypugun.bat
c:\documents and settings\Thomas Jarrett\Application Data\edymosyvo.vbs
c:\documents and settings\All Users\Application Data\lyqijilizu.bat
c:\program files\Common Files\rygaciq.inf
c:\documents and settings\Thomas Jarrett\Application Data\xotywomah.reg
c:\windows\modo.sys
c:\windows\system32\rifa.dll

3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

Posted Image


5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
  • Combofix.txt
  • A new HijackThis log.

Keep calm, make it simple, use your brain, don't freak out, and you'll be just fine..
Awesomeness: When I get sad, I stop being sad and be awesome instead.. True story - Barney Stinson
Posted Image Posted Image
Its gonna be legen.. wait for it.. dary! Cherish the pain, it means you're still alive


#10 wannabecomputergeek

wannabecomputergeek
  • Topic Starter

  • Members
  • 16 posts
  • OFFLINE
  •  
  • Local time:07:10 PM

Posted 08 January 2009 - 02:13 PM

here is the combo fix log

ComboFix 09-01-08.01 - Thomas Jarrett 2009-01-08 14:03:15.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1983.1373 [GMT -5:00]
Running from: c:\documents and settings\Thomas Jarrett\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Thomas Jarrett\Desktop\CFScript.txt
AV: CA Anti-Virus *On-access scanning disabled* (Updated)
* Created a new restore point

FILE ::
c:\documents and settings\All Users\Application Data\alamak.pif
c:\documents and settings\All Users\Application Data\gypugun.bat
c:\documents and settings\All Users\Application Data\lyqijilizu.bat
c:\documents and settings\Thomas Jarrett\Application Data\edymosyvo.vbs
c:\documents and settings\Thomas Jarrett\Application Data\xotywomah.reg
c:\documents and settings\Thomas Jarrett\Application Data\ywinuti.bat
c:\program files\Common Files\rygaciq.inf
c:\program files\Common Files\ybugokyry.sys
c:\windows\agigazaf.com
c:\windows\bexojeqasi.exe
c:\windows\idyqizoju.bat
c:\windows\modo.sys
c:\windows\qenyd.sys
c:\windows\system32\rifa.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\alamak.pif
c:\documents and settings\All Users\Application Data\gypugun.bat
c:\documents and settings\All Users\Application Data\lyqijilizu.bat
c:\documents and settings\Thomas Jarrett\Application Data\edymosyvo.vbs
c:\documents and settings\Thomas Jarrett\Application Data\xotywomah.reg
c:\documents and settings\Thomas Jarrett\Application Data\ywinuti.bat
c:\program files\Common Files\rygaciq.inf
c:\program files\Common Files\ybugokyry.sys
c:\windows\agigazaf.com
c:\windows\bexojeqasi.exe
c:\windows\idyqizoju.bat
c:\windows\modo.sys
c:\windows\qenyd.sys
c:\windows\system32\rifa.dll

.
((((((((((((((((((((((((( Files Created from 2008-12-08 to 2009-01-08 )))))))))))))))))))))))))))))))
.

2009-01-06 14:29 . 2009-01-06 14:29 250 --a------ c:\windows\gmer.ini
2009-01-06 14:21 . 2009-01-06 14:22 <DIR> d-------- C:\rsit
2009-01-06 12:35 . 2009-01-04 18:41 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-06 03:58 . 2009-01-06 03:58 <DIR> d-------- c:\windows\system32\CatRoot_bak
2009-01-06 03:40 . 2009-01-06 03:40 0 --a----t- c:\windows\006808_.tmp
2009-01-06 03:07 . 2009-01-06 03:07 <DIR> d-------- c:\documents and settings\Andrea Jarrett\Application Data\Intuit
2009-01-06 03:06 . 2009-01-06 04:00 <DIR> d-------- C:\RECYCLER(2)
2009-01-06 02:36 . 2009-01-06 04:01 <DIR> d-------- c:\program files\XoftSpySE
2009-01-06 00:10 . 2009-01-06 04:03 <DIR> d-------- c:\program files\SUPERAntiSpyware
2009-01-06 00:10 . 2009-01-06 00:10 <DIR> d-------- c:\documents and settings\Thomas Jarrett\Application Data\SUPERAntiSpyware.com
2009-01-05 21:35 . 2009-01-05 21:35 0 --a----t- c:\windows\006814_.tmp
2009-01-05 20:19 . 2009-01-05 20:19 <DIR> d-------- c:\program files\Trend Micro
2009-01-05 19:42 . 2009-01-05 19:42 880,560 --a------ c:\windows\system32\drivers\vetefile.sys
2009-01-05 19:42 . 2009-01-05 19:42 108,368 --a------ c:\windows\system32\drivers\veteboot.sys
2009-01-05 19:41 . 2009-01-05 19:41 <DIR> d-------- c:\program files\Common Files\Scanner
2009-01-05 19:41 . 2009-01-05 19:41 <DIR> d-------- c:\program files\CA
2009-01-05 19:41 . 2009-01-05 19:44 <DIR> d-------- c:\documents and settings\All Users\Application Data\CA
2009-01-05 19:41 . 2007-08-20 13:37 99,592 --a------ c:\windows\system32\isafeif.dll
2009-01-05 19:41 . 2007-08-20 13:26 79,424 --a------ c:\windows\system32\vetredir.dll
2009-01-05 19:41 . 2007-08-20 13:37 75,016 --a------ c:\windows\system32\isafprod.dll
2009-01-05 19:41 . 2007-08-20 13:38 32,264 --a------ c:\windows\system32\drivers\vetmonnt.sys
2009-01-05 19:41 . 2007-08-20 13:38 26,376 --a------ c:\windows\system32\drivers\vet-filt.sys
2009-01-05 19:41 . 2007-08-20 13:38 21,512 --a------ c:\windows\system32\drivers\vetfddnt.sys
2009-01-05 19:41 . 2007-08-20 13:38 21,128 --a------ c:\windows\system32\drivers\vet-rec.sys
2009-01-05 13:43 . 2009-01-05 13:43 <DIR> d-------- C:\VundoFix Backups
2009-01-05 12:28 . 2009-01-05 12:28 339 --a------ c:\windows\wininit.ini
2009-01-05 12:12 . 2009-01-05 12:30 <DIR> d-------- c:\program files\Spybot - Search & Destroy
2009-01-05 12:12 . 2009-01-06 04:01 <DIR> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-12-28 21:53 . 2008-12-28 21:53 <DIR> d-------- c:\documents and settings\All Users\Application Data\NVIDIA
2008-12-26 14:50 . 2008-12-26 14:50 35 --a------ c:\windows\Blink.ini
2008-12-09 11:22 . 2008-12-15 06:53 <DIR> d-------- C:\qrnt

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-06 17:35 --------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-01-06 09:00 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2009-01-06 05:10 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-01-04 23:41 15,504 ----a-w c:\windows\system32\drivers\mbam.sys
2008-11-19 22:15 --------- d-----w c:\program files\Common Files\AnswerWorks 4.0
2008-11-19 22:14 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-19 22:14 --------- d-----w c:\program files\Common Files\Intuit
2008-11-06 14:57 165 ----a-w c:\documents and settings\Thomas Jarrett\xrt_log.dat
.

((((((((((((((((((((((((((((( snapshot_2009-01-06_12.17.58.42 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-01-06 19:29:08 884,736 ----a-w c:\windows\gmer.dll
+ 2008-04-18 02:13:02 811,008 ----a-w c:\windows\gmer.exe
+ 2009-01-06 19:29:08 85,969 ----a-w c:\windows\system32\drivers\gmer.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2006-03-15 15360]
"TaskScheduler"="c:\prowin08\32bit\TaskSch.exe" [2008-12-19 393216]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-08-16 7630848]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-08-16 86016]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 32768]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 155648]
"PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2004-04-14 57393]
"IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2004-04-14 40960]
"cctray"="c:\program files\CA\CA Internet Security Suite\cctray\cctray.exe" [2007-08-16 177416]
"CAVRID"="c:\program files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe" [2007-08-20 230664]
"nwiz"="nwiz.exe" [2006-08-16 c:\windows\system32\nwiz.exe]
"RTHDCPL"="RTHDCPL.EXE" [2008-01-29 c:\windows\RTHDCPL.EXE]

c:\documents and settings\Thomas Jarrett\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-07 101440]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2008-10-22 972064]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.clmp3enc"= c:\progra~1\CYBERL~1\Power2Go\CLMP3Enc.ACM

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ComputerAssociatesAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Intuit\\QuickBooks 2008\\QBDBMgrN.exe"=
"c:\\ProWin07\\32bit\\protax07.exe"=
"c:\\ProWin07\\32bit\\ProSeriesUpdate.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\WINDOWS\\system32\\spoolsv.exe"=
"c:\\Program Files\\Lavasoft\\Ad-Aware 2007\\aawservice.exe"=
"c:\\Program Files\\Common Files\\Intuit\\QuickBooks\\QBCFMonitorService.exe"=

R3 PPCtlPriv;PPCtlPriv;c:\program files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe [2007-08-16 189704]
S3 ADM8511;ADMtek ADM8511/AN986 USB To Fast Ethernet Converter;c:\windows\system32\drivers\ADM8511.SYS [2008-06-05 20160]
S3 Intuit Fuse Service;Intuit Fuse Service;c:\program files\Common Files\Intuit\Fuse\Service\Intuit Fuse Service.exe [2008-06-27 72704]
.
Contents of the 'Scheduled Tasks' folder

2009-01-06 c:\windows\Tasks\CAAntiSpywareScan_Daily as Thomas Jarrett at 7 41 PM.job
- c:\program files\CA\CA Internet Security Suite\CA Anti-Spyware\CAAntiSpyware.exe [2007-08-16 21:10]

2009-01-08 c:\windows\Tasks\lvfqyvcl.job
- c:\windows\system32\rundll32.exe [2006-03-15 04:00]

2009-01-08 c:\windows\Tasks\XoftSpySE 2.job
- c:\program files\XoftSpySE\XoftSpy.exe []

2009-01-06 c:\windows\Tasks\XoftSpySE.job
- c:\program files\XoftSpySE\XoftSpy.exe []
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.rr.com/
mStart Page = hxxp://www.google.com
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
LSP: c:\windows\system32\VetRedir.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-08 14:05:40
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(732)
c:\program files\CA\SharedComponents\PPRT\bin\CACheck.dll
c:\program files\CA\SharedComponents\PPRT\bin\CAHook.dll
c:\program files\CA\SharedComponents\PPRT\bin\CAServer.dll

- - - - - - - > 'lsass.exe'(788)
c:\windows\system32\VetRedir.dll
c:\windows\system32\ISafeIf.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Lavasoft\Ad-Aware 2007\aawservice.exe
c:\program files\CA\CA Internet Security Suite\CA Anti-Virus\isafe.exe
c:\program files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
c:\program files\CA\CA Internet Security Suite\CA Anti-Spyware\CAPPActiveProtection.exe
c:\program files\CA\CA Internet Security Suite\CA Anti-Virus\vetmsg.exe
c:\program files\CA\CA Internet Security Suite\ccprovsp.exe
.
**************************************************************************
.
Completion time: 2009-01-08 14:07:43 - machine was rebooted
ComboFix-quarantined-files.txt 2009-01-08 19:07:41
ComboFix2.txt 2009-01-07 16:19:05
ComboFix3.txt 2009-01-06 17:18:40
ComboFix4.txt 2009-01-06 07:23:28
ComboFix5.txt 2009-01-08 19:01:54

Pre-Run: 229,465,718,784 bytes free
Post-Run: 229,386,211,328 bytes free

197 --- E O F --- 2008-10-15 02:43:59

#11 wannabecomputergeek

wannabecomputergeek
  • Topic Starter

  • Members
  • 16 posts
  • OFFLINE
  •  
  • Local time:07:10 PM

Posted 08 January 2009 - 02:17 PM

here is the hjt log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:15:13 PM, on 1/8/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\ProWin08\32bit\TaskSch.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\CAPPActiveProtection.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe
C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.rr.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/def...//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [cctray] "C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [TaskScheduler] C:\ProWin08\32bit\TaskSch.exe
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1206018920343
O18 - Protocol: intu-help-qb1 - {9B0F96C7-2E4B-433E-ABF3-043BA1B54AE3} - C:\Program Files\Intuit\QuickBooks 2008\HelpAsyncPluggableProtocol.dll
O18 - Protocol: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - mscoree.dll (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: CaCCProvSP - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
O23 - Service: Intuit Fuse Service - Intuit - C:\Program Files\Common Files\Intuit\Fuse\Service\Intuit Fuse Service.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PPCtlPriv - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe
O23 - Service: QBCFMonitorService - Intuit - C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe
O23 - Service: VET Message Service (VETMSGNT) - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe

--
End of file - 6891 bytes

#12 wannabecomputergeek

wannabecomputergeek
  • Topic Starter

  • Members
  • 16 posts
  • OFFLINE
  •  
  • Local time:07:10 PM

Posted 09 January 2009 - 01:09 AM

Hey,

I would like to thank you so much for the service that you provide, and your help in this particular situation. This computer contains a substantial amount of extremely sensitive data for a lot of people so security is a #1 priority for me. I have a couple of questions for you.

First off, is it ok for me, while I still have this problem, to stay connected to the internet. Is there a risk of comprimising the security of these files by being constantly connected?

Secondly, I tried to run windows updates. I tried to install sp3 and everything went well until the computer had to restart. Once it restarted, and after the SP3 uprade, it would blue screen every time before loading the desktop and I would have to do restore. Is that the effects of this virus?

Third, I have some software that I need to install that is imperative for me to use this time of year. Would the installation of this application hender you in anyway from assisting me with my vundo infection?

This is a pretty serious infection, I gather from some of the scans that I have run before consulting with this forum. Have you ever encountered an infection that was just so bad that it couldn't be repaired without performing a full restore?


Lastly, and I know that I said "a couple of questions" but this is the last one. Promise! :thumbsup:

As you can probably see, I am currently using windows firewall. I have the option to use Computer Associates firewall. Do you have any experience with CA's firewall and if so is it better than windows firewall? In other words, which would you suggest that I use? CA or windows?

Once again thanks so much for your time and help with this problem and I am anxiously awaiting your next instructions as to what to do about this Vundo infection.

#13 fenzodahl512

fenzodahl512

  • Members
  • 6,738 posts
  • OFFLINE
  •  
  • Local time:08:10 AM

Posted 09 January 2009 - 09:59 AM

Hello, I'm quite tight on my schedule today so I'm gonna answer your question hopefully tomorrow.. First lets do an online scan first.. :thumbsup:


Please manually find and delete this file..

c:\windows\Tasks\lvfqyvcl.job



Please run a free online scan with the ESET Online Scanner
Note: You will need to use Internet Explorer for this scan.
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the ActiveX control to install
  • Click Start
  • Make sure that the options Remove found threats and the option Scan unwanted applications is checked
  • Click Scan
    Wait for the scan to finish
  • Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
  • Copy and paste that log as a reply to this topic

Keep calm, make it simple, use your brain, don't freak out, and you'll be just fine..
Awesomeness: When I get sad, I stop being sad and be awesome instead.. True story - Barney Stinson
Posted Image Posted Image
Its gonna be legen.. wait for it.. dary! Cherish the pain, it means you're still alive


#14 wannabecomputergeek

wannabecomputergeek
  • Topic Starter

  • Members
  • 16 posts
  • OFFLINE
  •  
  • Local time:07:10 PM

Posted 09 January 2009 - 03:53 PM

Here is the Eset log

# version=4
# OnlineScanner.ocx=1.0.0.56
# OnlineScannerDLLA.dll=1, 0, 0, 51
# OnlineScannerDLLW.dll=1, 0, 0, 51
# OnlineScannerUninstaller.exe=1, 0, 0, 49
# vers_standard_module=3755 (20090109)
# vers_arch_module=1.064 (20080214)
# vers_adv_heur_module=1.064 (20070717)
# EOSSerial=1c1f2eecd0802c41ae802c34614269e4
# end=finished
# remove_checked=true
# unwanted_checked=true
# utc_time=2009-01-09 08:49:39
# local_time=2009-01-09 03:49:39 (-0500, Eastern Standard Time)
# country="United States"
# osver=5.1.2600 NT Service Pack 2
# scanned=534602
# found=10
# scan_time=5588
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\FraudAntiMalwares.zip Win32/Bagle.gen.zip worm (unable to clean - deleted) 00000000000000000000000000000000
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\FraudAntiMalwares1.zip Win32/Bagle.gen.zip worm (unable to clean - deleted) 00000000000000000000000000000000
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\FraudAntiVirusTrigger.zip Win32/Bagle.gen.zip worm (unable to clean - deleted) 00000000000000000000000000000000
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Speedrunner1.zip Win32/Bagle.gen.zip worm (unable to clean - deleted) 00000000000000000000000000000000
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WinAgentamwr2.zip Win32/Bagle.gen.zip worm (unable to clean - deleted) 00000000000000000000000000000000
C:\Documents and Settings\Thomas Jarrett\Desktop\a.exe a variant of Win32/Kryptik.DR trojan (unable to clean - deleted) 00000000000000000000000000000000
E:\Documents and Settings\Administrator\My Documents\TOYA\XPantivirus2008_v880011.exe probably a variant of Win32/TrojanDownloader.Agent trojan (unable to clean - deleted) 00000000000000000000000000000000
E:\Program Files\AWS\WeatherBug\MiniBugTransporter.dll Win32/Adware.WBug.A application (unable to clean - deleted) 00000000000000000000000000000000
E:\WINNT\Downloaded Program Files\SbCIe027.dll a variant of Win32/Adware.BHO.SideStep application (unable to clean - deleted) 00000000000000000000000000000000
E:\WINNT\Downloaded Program Files\ycomp5_0_2_7.dll Win32/Adware.Toolbar.Yahoo.A application (unable to clean - deleted) 00000000000000000000000000000000

#15 fenzodahl512

fenzodahl512

  • Members
  • 6,738 posts
  • OFFLINE
  •  
  • Local time:08:10 AM

Posted 10 January 2009 - 03:47 PM

First off, is it ok for me, while I still have this problem, to stay connected to the internet. Is there a risk of comprimising the security of these files by being constantly connected?


I believe you are good to go now..

Secondly, I tried to run windows updates. I tried to install sp3 and everything went well until the computer had to restart. Once it restarted, and after the SP3 uprade, it would blue screen every time before loading the desktop and I would have to do restore. Is that the effects of this virus?


It's hard to tell.. It could be anything from virus, to hardware issues, to perhaps corrupted Windows file.. Try to uninstall SP3 and observe the differences..

Third, I have some software that I need to install that is imperative for me to use this time of year. Would the installation of this application hender you in anyway from assisting me with my vundo infection?


What kind of software? :thumbsup:

This is a pretty serious infection, I gather from some of the scans that I have run before consulting with this forum. Have you ever encountered an infection that was just so bad that it couldn't be repaired without performing a full restore?


Yup.. I encountered that before quite a number of times.. I will just honestly recommend user to reformat their pc if I feel they need to do so :)

As you can probably see, I am currently using windows firewall. I have the option to use Computer Associates firewall. Do you have any experience with CA's firewall and if so is it better than windows firewall? In other words, which would you suggest that I use? CA or windows?


Third party firewall is always better than Windows Firewall, however, I never use any CA product.. So, I can't comment on that one :)

Once again thanks so much for your time and help with this problem and I am anxiously awaiting your next instructions as to what to do about this Vundo infection.


You're welcome :)



Looks good to me.. Lets do some cleanup...


Please download OTCleanIt and save it to Desktop.
  • Make sure you have internet connection..
  • Double-click OTCleanIt.exe
  • Click the CleanUp! button.
  • Select Yes when the "Begin cleanup Process?" prompt appears.
  • If you are prompted to Reboot during the cleanup, select Yes



Please read these excellent articles by miekiemoes :
Help! My computer is slow!
How to prevent Malware

Please reply to this thread once more and tell us about the computer behaviour before we can close this thread :)



Have a safe and happy computing day!


Regards
fenzodahl512

Keep calm, make it simple, use your brain, don't freak out, and you'll be just fine..
Awesomeness: When I get sad, I stop being sad and be awesome instead.. True story - Barney Stinson
Posted Image Posted Image
Its gonna be legen.. wait for it.. dary! Cherish the pain, it means you're still alive





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users