Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Explorer.exe infected?


  • This topic is locked This topic is locked
1 reply to this topic

#1 Holographic93

Holographic93

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:12:53 PM

Posted 17 March 2009 - 05:35 PM

Have been trying to remove viruses for 4 days. Tried to use Malwarebytes, Microsofte Onecare(which finds 4 files it cannot delete) , Mcafee, windows defender, and then finally after not finding anything on any of the except Onecare I ran combofix and it told me that explorer.exe is infected. How do I go about fixing this? Here is the log just in case.




ComboFix 09-03-15.01 - Melody 2009-03-17 18:06:42.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1535.1062 [GMT -4:00]
Running from: c:\documents and settings\Daddy\Desktop\combofix.exe
AV: McAfee VirusScan *On-access scanning disabled* (Updated)
FW: McAfee Personal Firewall *enabled*
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\explorer.exe . . . is infected!!

.
((((((((((((((((((((((((( Files Created from 2009-02-17 to 2009-03-17 )))))))))))))))))))))))))))))))
.

2009-03-16 16:44 . 2009-03-16 16:51 <DIR> d-------- c:\program files\Spybot - Search & Destroy
2009-03-16 16:44 . 2009-03-16 16:51 <DIR> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-03-14 23:05 . 2009-03-14 23:05 <DIR> d--h----- c:\windows\system32\GroupPolicy
2009-03-14 20:35 . 2009-01-09 15:19 1,089,593 -----c--- c:\windows\system32\dllcache\ntprint.cat
2009-03-14 18:24 . 2009-03-14 22:41 <DIR> d-------- c:\program files\Windows Defender
2009-03-14 15:16 . 2009-03-14 15:42 <DIR> d-------- c:\program files\RegCure
2009-03-14 14:46 . 2009-03-14 14:46 <DIR> d-------- c:\windows\SxsCaPendDel
2009-03-14 14:46 . 2009-03-14 14:46 <DIR> d-------- C:\1fc46db40cde5b8d18dd4bff5569e9b3
2009-03-14 02:59 . 2009-03-14 02:59 <DIR> d-------- c:\documents and settings\Daddy\Application Data\McAfee
2009-03-14 02:12 . 2009-03-14 14:45 <DIR> d-------- c:\windows\system32\XPSViewer
2009-03-14 02:12 . 2009-03-14 02:12 <DIR> d-------- c:\program files\Reference Assemblies
2009-03-14 02:10 . 2008-07-06 08:06 1,676,288 --------- c:\windows\system32\xpssvcs.dll
2009-03-14 02:10 . 2008-07-06 08:06 1,676,288 -----c--- c:\windows\system32\dllcache\xpssvcs.dll
2009-03-14 02:10 . 2009-03-14 18:55 597,504 --a--c--- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-03-14 02:10 . 2008-07-06 08:06 575,488 --------- c:\windows\system32\xpsshhdr.dll
2009-03-14 02:10 . 2008-07-06 08:06 575,488 -----c--- c:\windows\system32\dllcache\xpsshhdr.dll
2009-03-14 02:10 . 2008-07-06 08:06 117,760 --------- c:\windows\system32\prntvpt.dll
2009-03-14 02:10 . 2008-07-06 08:06 89,088 -----c--- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-03-14 02:00 . 2009-03-17 12:35 <DIR> d-------- c:\program files\Windows Live Safety Center
2009-03-13 17:13 . 2009-03-13 19:39 182,656 --a--c--- c:\windows\system32\dllcache\ndis.sys
2009-03-13 17:10 . 2009-03-13 17:10 <DIR> d-------- c:\windows\system32\zh3
2009-03-13 17:10 . 2009-03-13 19:42 <DIR> d-------- c:\windows\system32\om5
2009-03-13 17:10 . 2009-03-14 14:46 <DIR> d-------- c:\windows\system32\gt
2009-03-13 17:10 . 2009-03-13 17:10 <DIR> d-------- c:\temp\atmp8
2009-03-13 17:09 . 2009-03-17 17:45 <DIR> d-------- c:\windows\system32\inf
2009-03-13 17:09 . 2009-03-13 19:30 389,120 --a------ c:\windows\system32\OLD57B.tmp
2009-03-13 17:09 . 2009-03-14 18:56 26,112 --a--c--- c:\windows\system32\dllcache\userinit.exe
2009-03-13 17:09 . 2009-03-13 19:30 11,776 --a------ c:\windows\system32\OLD57F.tmp
2009-03-13 17:08 . 2009-03-13 18:09 78,336 --a------ c:\windows\system32\MPh.exe
2009-03-13 17:08 . 2009-03-13 17:09 2 --a------ C:\544478243
2009-03-13 17:07 . 2009-03-13 17:54 45,056 --a------ C:\lwvjuv.exe
2009-03-11 22:12 . 2009-03-11 22:12 54,156 --ah----- c:\windows\QTFont.qfn
2009-03-11 22:12 . 2009-03-11 22:12 1,409 --a------ c:\windows\QTFont.for

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-17 20:56 --------- d-----w c:\program files\Realtek AC97
2009-03-17 09:48 --------- d-----w c:\documents and settings\All Users\Application Data\Google Updater
2009-03-15 13:23 33,280 ----a-w c:\windows\system32\rundll32.exe
2009-03-15 02:42 --------- d-----w c:\program files\PC VGA Camer@ Plus
2009-03-15 02:41 --------- d-----w c:\program files\Lexmark 7100 Series
2009-03-14 22:40 --------- d-----w c:\program files\Digital Photo Software
2009-03-14 22:31 57,344 ----a-w c:\windows\system32\gpupdate.exe
2009-03-14 22:31 120,832 ----a-w c:\windows\system32\gpresult.exe
2009-03-14 22:19 126,976 ----a-w c:\windows\system32\mshearts.exe
2009-03-14 22:18 99,840 -c--a-w c:\windows\pchealth\helpctr\binaries\HelpHost.exe
2009-03-14 22:18 769,024 -c--a-w c:\windows\pchealth\helpctr\binaries\helpctr.exe
2009-03-14 22:18 35,328 -c--a-w c:\windows\pchealth\helpctr\binaries\notiflag.exe
2009-03-14 22:18 18,432 -c--a-w c:\windows\pchealth\helpctr\binaries\hscupd.exe
2009-03-14 22:18 169,984 -c--a-w c:\windows\pchealth\helpctr\binaries\msconfig.exe
2009-03-14 22:18 150,528 -c--a-w c:\windows\pchealth\UploadLB\Binaries\uploadm.exe
2009-03-14 22:16 26,112 ----a-w c:\windows\system32\userinit.exe
2009-03-14 06:37 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2009-03-14 06:12 --------- d-----w c:\program files\MSBuild
2009-03-14 01:18 87,040 ----a-w c:\windows\system32\diantz.exe
2009-03-14 01:18 83,456 ----a-w c:\windows\system32\dpvsetup.exe
2009-03-14 01:16 98,304 ----a-w c:\windows\system32\ahui.exe
2009-03-14 01:15 82,944 ----a-w c:\windows\system32\dfrgfat.exe
2009-03-14 01:14 82,944 ----a-w c:\windows\system32\eventtriggers.exe
2009-03-14 01:02 45,568 ----a-w c:\windows\system32\mshta.exe
2009-03-14 00:51 69,120 ----a-w c:\windows\system32\notepad.exe
2009-03-13 23:41 182,656 ----a-w c:\windows\system32\drivers\ndis.sys
2009-03-13 23:37 5,632 ----a-w c:\windows\system32\write.exe
2009-03-13 23:37 32,256 ----a-w c:\windows\system32\wupdmgr.exe
2009-03-13 23:37 32,256 ----a-w c:\windows\system32\wpabaln.exe
2009-03-13 23:37 293,376 ----a-w c:\windows\system32\WISPTIS.EXE
2009-03-13 23:37 17,408 ----a-w c:\windows\system32\wpdshextautoplay.exe
2009-03-13 23:37 165,888 ----a-w c:\windows\system32\wuauclt1.exe
2009-03-13 23:37 155,648 ----a-w c:\windows\system32\wscript.exe
2009-03-13 23:37 146,432 ----a-w c:\windows\system32\WudfHost.exe
2009-03-13 23:37 13,824 ----a-w c:\windows\system32\wscntfy.exe
2009-03-13 23:37 119,808 ----a-w c:\windows\system32\winmine.exe
2009-03-13 23:37 11,776 ----a-w c:\windows\system32\winmsd.exe
2009-03-13 23:37 11,264 ----a-w c:\windows\system32\wpnpinst.exe
2009-03-13 23:35 93,699 ----a-w c:\windows\system32\taskkill.exe
2009-03-13 23:34 89,600 ----a-w c:\windows\system32\smlogsvc.exe
2009-03-13 23:33 95,744 ----a-w c:\windows\system32\scardsvr.exe
2009-03-13 23:32 9,216 ----a-w c:\windows\system32\proxycfg.exe
2009-03-13 23:31 438,272 ----a-w c:\windows\system32\plusmcry.scr
2009-03-13 23:31 417,792 ----a-w c:\windows\system32\plussand.scr
2009-03-13 23:31 3,325,952 ----a-w c:\windows\system32\plusnatr.scr
2009-03-13 23:31 1,687,552 ----a-w c:\windows\system32\plusmpix.scr
2009-03-13 23:29 208,896 ----a-w c:\windows\system32\nvudisp.exe
2009-03-13 23:29 176,128 ----a-w c:\windows\system32\nvusmb.exe
2009-03-13 23:29 176,128 ----a-w c:\windows\system32\nvunrm.exe
2009-03-13 23:29 176,128 ----a-w c:\windows\system32\NVUNINST.EXE
2009-03-13 23:29 176,128 ----a-w c:\windows\system32\nvuide.exe
2009-03-13 23:27 343,040 ----a-w c:\windows\system32\mspaint.exe
2009-03-13 23:26 28,170 ----a-w c:\windows\system32\dumprep.exe
2009-03-13 23:25 64,000 ----a-w c:\windows\system32\cleanmgr.exe
2009-03-13 23:25 184,320 ----a-w c:\windows\system32\accwiz.exe
2009-03-13 22:44 283,648 ----a-w c:\windows\winhlp32.exe
2009-03-13 22:44 25,600 ----a-w c:\windows\twunk_32.exe
2009-03-13 22:44 15,360 ----a-w c:\windows\TASKMAN.EXE
2009-03-13 22:44 146,432 ----a-w c:\windows\regedit.exe
2009-03-13 22:44 10,752 ----a-w c:\windows\hh.exe
2009-03-13 22:35 78,848 ----a-w c:\windows\system32\msiexec.exe
2009-03-13 22:34 1,033,728 ----a-w c:\windows\explorer.exe
2009-03-13 22:19 389,120 ----a-w c:\windows\system32\cmd.exe
2009-03-13 22:19 150,528 ----a-w c:\windows\system32\imapi.exe
2009-03-13 22:14 442,368 ----a-w c:\windows\system32\nvappbar.exe
2009-03-13 22:14 147,456 ----a-w c:\windows\system32\nvcolor.exe
2009-03-13 22:14 1,339,392 ----a-w c:\windows\system32\nvdspsch.exe
2009-03-13 22:11 1,200,640 ----a-w c:\windows\system32\ntbackup.exe
2009-03-13 22:10 677,888 ----a-w c:\windows\system32\mstsc.exe
2009-03-13 22:09 1,414,656 ----a-w c:\windows\system32\mmc.exe
2009-03-13 22:08 69,144 ----a-w c:\windows\system32\migpwd.exe
2009-03-13 22:08 425,984 ----a-w c:\windows\system32\keystone.exe
2009-03-13 22:08 372,736 ----a-w c:\windows\system32\lxbxcfg.exe
2009-03-13 22:08 356,352 ----a-w c:\windows\system32\lxbxih.exe
2009-03-13 22:07 622,592 ----a-w c:\windows\system32\HCPSMng.exe
2009-03-13 22:07 20,992 ----a-w c:\windows\system32\faxpatch.exe
2009-03-13 22:06 267,288 ----a-w c:\windows\system32\drmupgds.exe
2009-03-13 22:06 25,088 ----a-w c:\windows\system32\CTSVCCTL.EXE
2009-03-13 22:05 9,728 ----a-w c:\windows\system32\comsdupd.exe
2009-03-13 22:05 44,480 ----a-r c:\windows\system32\ChCfg.exe
2009-03-13 22:05 20,480 ----a-w c:\windows\system32\cliconfg.exe
2009-03-13 21:56 15,360 ----a-w c:\windows\system32\ctfmon.exe
2009-03-13 21:55 77,849 ----a-w c:\windows\ALCFDRTM.EXE
2009-03-13 21:55 68,096 ----a-w c:\windows\agrsmdel.exe
2009-03-13 21:55 49,152 ----a-w c:\windows\MIDIDEF.EXE
2009-03-13 21:55 41,984 ----a-w c:\windows\Ctregrun.exe
2009-03-13 21:55 217,088 ----a-r c:\windows\Alcrmv.exe
2009-03-13 21:55 20,480 ----a-w c:\windows\P17DEF.EXE
2009-03-13 21:55 1,945,600 ----a-w c:\windows\NuNinst.exe
2009-03-13 21:55 1,658,880 ----a-w c:\windows\UNMRW.exe
2009-03-13 21:54 44,032 ----a-w c:\windows\system32\CTSVCCDA.EXE
2009-03-13 21:53 90,112 ----a-w c:\windows\Updreg.EXE
2009-03-13 21:53 577,536 ----a-r c:\windows\soundman.exe
2009-03-13 21:53 155,648 ----a-w c:\windows\system32\NeroCheck.exe
2009-03-13 21:47 794,624 ----a-w c:\windows\system32\nvCplUI.exe
2009-03-13 21:47 28,672 ----a-w c:\windows\system32\verclsid.exe
2009-03-13 21:46 44,544 ----a-w c:\windows\system32\alg.exe
2009-03-13 20:21 --------- d-----w c:\documents and settings\Melody\Application Data\LimeWire
2009-02-18 11:05 --------- d-----w c:\program files\Lx_cats
2009-02-16 13:48 --------- d-----w c:\program files\Microsoft Small Business
.

------- Sigcheck -------

2009-03-13 18:34 1033728 b6d44ec7a205488927e19f0c96e11c88 c:\windows\explorer.exe
2009-03-14 23:47 1033216 24d0e1e8d06b8a76d91817a54ba6141b c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
2009-03-14 18:10 1050646 e6abbaa97386eab8e444aa4e57c87534 c:\windows\$NtServicePackUninstall$\explorer.exe
2009-03-14 18:07 1032192 3a81f9ee299bf94947484748dc46d277 c:\windows\$NtUninstallKB938828$\explorer.exe
2009-03-14 18:23 1033728 b6d44ec7a205488927e19f0c96e11c88 c:\windows\ServicePackFiles\i386\explorer.exe
2009-03-14 18:54 1033728 b6d44ec7a205488927e19f0c96e11c88 c:\windows\system32\dllcache\explorer.exe

2009-03-14 18:13 15360 ee89256b699e68d26670fabf13ef1f4b c:\windows\$NtServicePackUninstall$\ctfmon.exe
2009-03-14 18:22 15360 12f8ef43e4931b25fb6bc5f32729af71 c:\windows\ServicePackFiles\i386\ctfmon.exe
2009-03-13 17:56 15360 12f8ef43e4931b25fb6bc5f32729af71 c:\windows\system32\ctfmon.exe

2009-03-14 18:11 24576 a366be373263101f442d1da323749792 c:\windows\$NtServicePackUninstall$\userinit.exe
2009-03-14 18:48 26112 87a9c4b1b98e6366ceb770b43eecbc91 c:\windows\ServicePackFiles\i386\userinit.exe
2009-03-14 18:16 26112 87a9c4b1b98e6366ceb770b43eecbc91 c:\windows\system32\userinit.exe
2009-03-14 18:56 26112 87a9c4b1b98e6366ceb770b43eecbc91 c:\windows\system32\dllcache\userinit.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2009-03-13 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UpdReg"="c:\windows\UpdReg.EXE" [2009-03-13 90112]
"NVIDIA nTune"="c:\program files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2009-03-13 81920]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2009-03-13 155648]
"InCD"="c:\program files\Ahead\InCD\InCD.exe" [2004-05-26 1400944]
"lxbxmon.exe"="c:\program files\Lexmark 7100 Series\lxbxmon.exe" [2009-03-13 196608]
"EzPrint"="c:\program files\Lexmark 7100 Series\ezprint.exe" [2009-03-13 61440]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2007-11-01 582992]
"PAC7302_Monitor"="c:\windows\PixArt\PAC7302\Monitor.exe" [2009-03-13 319488]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-03-13 286720]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-04-28 7573504]
"SoundMan"="SOUNDMAN.EXE" [2009-03-13 c:\windows\soundman.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-08-24 437160]

c:\documents and settings\Tabatha\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-07 101440]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.JDCT"= jl_jdct.drv

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Daddy^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
--a--c--- 2007-03-09 11:09 63712 c:\program files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2007-10-10 19:51 39792 c:\program files\Adobe\Reader 8.0\Reader\Reader_SL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\apdproxy]
--a--c--- 2007-03-09 11:09 63712 c:\program files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative Detector]
--a------ 2009-03-13 20:00 102400 c:\program files\Creative\MediaSource\Detector\CTDetect.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTSysVol]
--a--c--- 2009-03-14 23:34 57344 c:\program files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
--a------ 2007-08-24 07:00 33648 c:\program files\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a--c--- 2007-11-15 14:11 267048 c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\jusched]
--a--c--- 2007-09-25 02:11 132496 c:\program files\Java\jre1.6.0_03\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LXBXCATS]
--a------ 2004-11-02 11:08 69632 c:\windows\system32\spool\drivers\w32x86\3\lxbxtime.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2009-03-13 18:03 1695232 c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCpl]
--a------ 2006-04-28 15:47 7573504 c:\windows\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 2006-04-28 15:47 7573504 c:\windows\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
--a------ 2006-04-28 15:47 86016 c:\windows\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDVDServ]
--a--c--- 2009-03-14 23:34 32768 c:\program files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\qttask]
--a------ 2009-03-13 17:53 286720 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2009-03-13 17:53 286720 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Reader_sl]
--a------ 2007-10-10 19:51 39792 c:\program files\Adobe\Reader 8.0\Reader\Reader_SL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--a--c--- 2009-03-14 23:34 32768 c:\program files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\rhc13aj0e98g]
--a--c--- 2009-03-14 23:34 32768 c:\program files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a--c--- 2007-09-25 02:11 132496 c:\program files\Java\jre1.6.0_03\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2009-03-13 19:30 1519616 c:\windows\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\P17Helper]
-ra------ 2005-05-02 23:38 64512 c:\windows\system32\P17.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"iPod Service"=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"c:\\Program Files\\Lexmark 7100 Series\\lxbxmon.exE"=

R2 MSSQL$MSSMLBIZ;SQL Server (MSSMLBIZ);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2008-02-26 29183504]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [2006-11-03 13592]
S3 DigiCellDriver;DigiCellDriver;c:\program files\MSI\DigiCell\NTGLM7X.sys [2006-06-07 28672]
S3 PAC7302;PC VGA Camer@ Plus;c:\windows\system32\drivers\PAC7302.SYS [2007-06-14 457856]
S3 PCAlertDriver;PCAlertDriver;c:\program files\MSI\Core Center\NTGLM7X.sys [2007-07-16 28160]
.
Contents of the 'Scheduled Tasks' folder

2009-03-15 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2007-12-04 13:32]

2009-03-16 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2007-12-04 13:32]

2009-03-17 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 19:20]

2009-03-17 c:\windows\Tasks\RegCure Program Check.job
- c:\program files\RegCure\RegCure.exe [2008-12-29 13:58]

2009-03-15 c:\windows\Tasks\RegCure.job
- c:\program files\RegCure\RegCure.exe [2008-12-29 13:58]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.comcast.net/
uInternet Connection Wizard,ShellNext = iexplore
Trusted Zone: internet
Trusted Zone: mcafee.com
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-17 18:07:55
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-03-17 18:10:25
ComboFix-quarantined-files.txt 2009-03-17 22:09:39
ComboFix2.txt 2009-03-17 22:01:07

Pre-Run: 49,581,928,448 bytes free
Post-Run: 49,563,922,432 bytes free

Current=2 Default=2 Failed=1 LastKnownGood=4 Sets=1,2,3,4
300 --- E O F --- 2009-03-16 16:52:26

BC AdBot (Login to Remove)

 


#2 Guest_The weatherman_*

Guest_The weatherman_*

  • Guests
  • OFFLINE
  •  

Posted 17 March 2009 - 05:40 PM

Hello Holographic93

Please note the message text in blue at the top of the Am I infected? What do I do? forum.

ComboFix logs should not to be posted outside the HijackThis forums and then only when requested by a HJT Team member. It is an extremely powerful tool which should only be used when instructed to do so by someone who has been properly trained. ComboFix is intended by its creator to be "used under the guidance and supervision of an expert", NOT for private use. Please read Combofix's Disclaimer. Using this tool incorrectly could lead to disastrous problems with your operating system such as preventing it from ever starting again.

Please create a new topic explaining the nature of your problem in the Am I infected? What do I do? forum. Describe pop-ups and system tray or desktop icons that have appeared. Explain what is "going wrong" with your computer. Note any tools you have used and their respective results.

If needed, we will direct you to our HJT Preparation Guide.

Thank you for using BleepingComputer as your malware removal source.

This topic is now closed. If you have any questions, please PM me or another Moderator.
The BC Staff




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users