Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Infected with WiniGuard Virus


  • Please log in to reply
7 replies to this topic

#1 Dawgs

Dawgs

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:07:25 PM

Posted 09 May 2009 - 09:26 PM

My PC is infected with the WiniGuard Virus. I have updated my Symantec Anti Virus program and it still cant get rid of it. Can you help?

Here is my HijackThis Log. Thanks

Dawgs



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:18:35 PM, on 5/9/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Symantec Client Security\Symantec Client Firewall\CfgWzSvc.exe
C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe
c:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
c:\sdwork\issimsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\PROGRA~1\AT&TNE~1\NetCfgSv.EXE
c:\Program Files\Symantec Client Security\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\IBM\Messages By IBM\ibmmessages.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\IBMTOOLS\UTILS\ibmprc.exe
C:\WINDOWS\system32\ICO.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\HCWemMON.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe
C:\WINDOWS\system32\FSRremoS.EXE
C:\WINDOWS\system32\Pelmiced.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\WISPTIS.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\Nick\LOCALS~1\Temp\Rar$EX00.719\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [UC_Start] C:\Program Files\IBM\Updater\\ucstartup.exe
O4 - HKLM\..\Run: [ibmmessages] C:\Program Files\IBM\Messages By IBM\\ibmmessages.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [UpdateManager] "c:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [IBMPRC] c:\IBMTOOLS\UTILS\ibmprc.exe
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [emMON] HCWemMON.exe
O4 - HKLM\..\Run: [ISSI EZUpdate Service] "c:\sdwork\issimsvc.exe"
O4 - HKLM\..\Run: [stgclean] c:\sdwork\w32main2.exe /cleanup
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe
O4 - HKLM\..\Run: [w32msgr] C:\sdwork\w32main2.exe /log c:\sdwork\msgr.txt ospdb.pok.ibm.com
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [promo.exe] C:\WINDOWS\system32\promo.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [antivirus-2008pro.exe] C:\Program Files\Antivirus 2008 PRO\antivirus-2008pro.exe
O4 - HKCU\..\Run: [Erqva] "C:\Program Files\Common Files\s?curity\?hkdsk.exe"
O4 - HKCU\..\Run: [Sakora] C:\Program Files\Sakora\Sakora.exe
O4 - HKCU\..\Run: [mjc] C:\Program Files\mjc\mjc.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ibmmessages] C:\Program Files\IBM\Messages By IBM\ibmmessages.exe
O4 - Global Startup: Microsoft Broadband Networking.lnk = ?
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 5.0\resources\en-US\local\search.html
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [JAVA_IBM] Java (IBM)
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab55579.cab
O16 - DPF: {08EE4BCE-527E-4760-B11A-B829415E9103} (MaxisGolfTeleX Control) - http://simgolf.ea.com/teleport/simgolf/MaxisGolfTeleX.cab
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (MSN Games Buddy Invite) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab55579.cab
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - https://www-secure.symantec.com/techsupp/as...abs/tgctlsr.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab55579.cab
O16 - DPF: {639658F3-B141-4D6B-B936-226F75A5EAC3} (CPlayFirstDinerDash2Control Object) - http://zone.msn.com/bingame/dsh2/default/D...h2.1.0.0.68.cab
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://zone.msn.com/bingame/chnz/default/mjolauncher.cab
O16 - DPF: {9BDF4724-10AA-43D5-BD15-AEA0D2287303} (ZPA_TexasHoldem Object) - http://zone.msn.com/bingame/zpagames/zpa_txhe.cab55579.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/...ro.cab56649.cab
O16 - DPF: {BAE1D8DF-0B35-47E3-A1E7-EEB3FF2ECD19} (CPlayFirstddfotgControl Object) - http://www.freeworldgroup.com/games6/diner...tg.1.0.0.33.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/vir...l/installer.exe
O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} (TikGames Online Control) - http://zone.msn.com/bingame/cnma/default/ct.cab
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (MSN Games Game Communicator) - http://zone.msn.com/binframework/v10/StProxy.cab55579.cab
O16 - DPF: {DC75FEF6-165D-4D25-A518-C8C4BDA7BAA6} (CPlayFirstDinerDashControl Object) - http://zone.msn.com/bingame/dash/default/D...sh.1.0.0.94.cab
O16 - DPF: {EA6246B4-F380-443F-8727-9AEA3371146C} (CPlayFirstWeddingDashControl Object) - http://www.freeworldgroup.com/games6/weddi...sh.1.0.0.47.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{17A8B81E-0C49-4451-A469-7FD97E1DDAC8}: NameServer = 85.255.112.207;85.255.112.68
O17 - HKLM\System\CCS\Services\Tcpip\..\{826E810A-0C4F-4E56-A346-1B5E35C2E4D2}: NameServer = 85.255.112.207;85.255.112.68
O17 - HKLM\System\CCS\Services\Tcpip\..\{B67DD6B7-1AED-4AF2-8961-723E05FDE696}: NameServer = 85.255.112.207;85.255.112.68
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec Client Firewall Configuration (CfgWzSvc) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec Client Firewall\CfgWzSvc.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: IBM Rapid Restore Ultra Service - Unknown owner - c:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISSI EZUpdate (ISSIMon) - IBM Global Services - c:\sdwork\issimsvc.exe
O23 - Service: IS Service (ISSVC) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Unknown owner - C:\Program Files\Norton AntiVirus\navapsvc.exe (file missing)
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Network Configuration Service (NetCfgSvr) - AT&T - C:\PROGRA~1\AT&TNE~1\NetCfgSv.EXE
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe (file missing)
O23 - Service: SAVRoam (SavRoam) - symantec - c:\Program Files\Symantec Client Security\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Symantec SecurePort (SymSecurePort) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe

--
End of file - 13078 bytes

BC AdBot (Login to Remove)

 


#2 Maurice Naggar

Maurice Naggar

    Eradicator de malware


  • Malware Response Team
  • 1,088 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:06:25 PM

Posted 09 May 2009 - 11:32 PM

Hello Dawgs.

This has a cluster of infectors. Start with the following.

You will want to print out or copy these instructions to Notepad for Safe Mode/offline reference!
These steps are for member Dawgs only. If you are a lurker, do NOT try this on your system!
If you are not Dawgs and have a similar problem, do NOT post here; start your own topic


Do not run or start any other programs while these utilities and tools are in use!
Do NOT run any other tools on your own or do any fixes other than what is listed here.
If you have questions, please ask before you do something on your own.
But it is important that you get going on these following steps.
=
Close any of your open programs while you run these tools.
=

Set Windows to show all files and all folders.
On your Desktop, double click My Computer, from the menu options, select tools, then Folder Options, and then select VIEW Tab and look at all of settings listed.

"CHECK" (turn on) Display the contents of system folders.

Under column, Hidden files and folders----choose ( *select* ) Show hidden files and folders.
Next, un-check Hide extensions for known file types.
Next un-check Hide protected operating system files.
=

Download The Avenger by Swandog46 from here.
  • Unzip/extract it to a folder on your desktop.
  • Double click on avenger.exe to run The Avenger.
  • Click OK.
  • Make sure that the box next to Scan for rootkits has a tick in it and that the box next to Automatically disable any rootkits found does not have a tick in it.
  • Copy all of the text in the below textbox to the clibpboard by highlighting it and then pressing Ctrl+C.
    Files to delete:
    C:\WINDOWS\system32\promo.exe
    C:\Program Files\Antivirus 2008 PRO\antivirus-2008pro.exe
    C:\Program Files\Sakora\Sakora.exe
    C:\Program Files\Common Files\s?curity\?hkdsk.exe
    C:\Program Files\mjc\mjc.exe
    c:\windows\sysguard.exe
    c:\windows\system32\sdra64.exe
    c:\windows\system32\drivers\msqpdxserv.sys 
    C:\WINDOWS\system32\drivers\TDSSmqlt.sys 
    C:\windows\system32\drivers\tdssserv.sys
    C:\WINDOWS\system32\drivers\TDSSmact.sys
    
    Drivers to delete:
    ovfsthx
    UACd.sys
    UACd
    gaopdxserv.sys
    gaopdxserv
    gaopdxl
    tdss
    tdssserv
    TDSSserv.SYS
    Service_TDSSSERV.SYS
    Legacy_TDSSSERV.SYS
    msqpdxserv.sys
    msqpdxserv
    
    Folders to delete:
    C:\Program Files\Antivirus 2008 PRO
    C:\Program Files\Sakora
    C:\Program Files\Common Files\s?curity
    C:\Program Files\mjc
    C:\recycler
    D:\recycler
    e:\recycler
    f:\recycler
    g:\recycler
    h:\recycler
  • In the avenger window, click the Paste Script from Clipboard icon, Posted Image button.
  • :!: Make sure that what appears in Avenger matches exactly what you were asked to Copy/Paste from the Code box above.
  • Click the Execute button.
  • You will be asked Are you sure you want to execute the current script?.
  • Click Yes.
  • You will now be asked First step completed --- The Avenger has been successfully set up to run on next boot. Reboot now?.
  • Click Yes.
  • Your PC will now be rebooted.
  • Note: If the above script contains Drivers to delete: or Drivers to disable:, then The Avenger will require two reboots to complete its operation.
  • If that is the case, it will force a BSOD on the first reboot. This is normal & expected behaviour.
  • After your PC has completed the necessary reboots, a log should automatically open. Please copy/paste the contents of c:\avenger.txt into your next reply.
Not all the items will be found; so do not worry. Hopefully enough of the rootkit will be removed so that we can continue forward with more cleaning.
If you get a blue screen abort when it reboots, please write down all the information, STOP codes and description.
and then reboot the system again.

=

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools

If you have a prior copy of Combofix, delete it now !

Download Combofix from any of the links below. You must rename it before saving it. Save it to your Desktop.

Link 1
Link 2
Link 3

Posted Image


Posted Image


* IMPORTANT !!! SAVE AS Combo-Fix.exe to your Desktop
If your I.E. browser shows a warning message at the top, do a Right-Click on the bar and select Download, saving it to the Desktop.
  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools

  • Double click on Combo-Fix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


Posted Image


Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Posted Image


Click on Yes, to continue scanning for malware.

Please watch Combofix as it runs, as you may see messages which require your response, or the pressing of OK button.

IF you should see a message like this:
Posted Image
then, be sure to write down fully and also copy that into your next reply here and then await for my response.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
-------------------------------------------------------

A caution - Do not run Combofix more than once.
Do not touch your mouse/keyboard until the scan has completed, as this may cause the process to stall or your computer to lock.

The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled.
If this occurs, please reboot to restore the desktop.
Even when ComboFix appears to be doing nothing, look at your Drive light.
If it is flashing, Combofix is still at work.
=

Next, Download and save to your Dekstop: PrevX CSI: http://www.prevx.com/freescan.asp

Run Prevx CSI.
If it wants to reboot when finished, do so.

=

You will want to print out or copy these instructions to Notepad for Safe Mode/offline reference! Perhaps also save the file on your pc.

Close all browsers and all open windows & programs.

1. Please download SmitfraudFix (by S!Ri) and SAVE it to your Desktop.
Posted ImageIt's very important that you be using the most recent version (v2.416 as of this post).

2. Reboot into Safe Mode (Restart your computer, then continually tap F8 until a menu appears. Use your up arrow key to highlight Safe Mode, then hit enter. More at http://service1.symantec.com/SUPPORT/tsgen...001052409420406.)

3. Once in Safe Mode:
Double click the SmitFruadfix.exe file. It will create a folder named SmitfraudFix) on your Desktop.

Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Have plenty of patience as a Command prompt window opens. You'll eventually see a message and a "press any key to continue".
Press the space bar or any other key on the keyboard.

4. Select option #2 - Clean by typing 2 and pressing Enter to delete infected files.

5. You will be prompted: "Registry cleaning - Do you want to clean the registry ?" Answer "Yes" by typing Y and pressing Enter in order to remove the desktop background and clean registry keys associated with the infection.

6. The tool will then check if wininet.dll is infected. If prompted to replace the infected file (if found), answer "Yes" by typing Y and pressing Enter.

7. The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart it into Normal Windows.

8. A text file will appear onscreen with results from the cleaning process. Please copy/paste the content of that report into your next reply.

The report also may be found at the root of the system drive, usually at C:\rapport.txt

Notes:
  • process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user. More on this at http://www.beyondlogic.org/consulting/proc...processutil.htm
  • Running option #2 on a non-infected computer will remove your Desktop background. No need to worry, you were infected
=

Place your USB flash drives in-place so that some of these programs will be able to find them.

I'm going to have you get and run two utilities.
The first stops automatic use of the AutoRun feature of XP. The second will write to any connected devices a Read-only, System protected Autorun.inf file on all of your hard drives, and all connected removable storage devices.

Download and Install Microsoft's TweakUI:
http://www.microsoft.com/windowsxp/downloa...ppowertoys.mspx
Obtain and install TweakUI (part of the PowerToys for Windows XP package), and then start TweakUI.
Expand the My Computer branch, then the AutoPlay branch, and then select Drives.
Turn off the checkbox next to every drive letter to disable AutoPlay -- except your CD/DVD drive letters.

Download and run "Flash Drive Disinfector" by sUBs. It will do a cleanup of removable storage devices, and write a protected Autorun.inf file to help prevent re-infection.
http://download.bleepingcomputer.com/sUBs/...Disinfector.exe
There is no GUI interface or log file produced.
=

Please download DrWeb-CureIt & save it to your desktop. DO NOT perform a scan yet.

Reboot your computer in "SAFE MODE" using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode".

Scan with DrWeb-CureIt as follows:
  • Double-click on cureit.exe to start the program. An "Express Scan of your PC" notice will appear.
  • Under "Start the Express Scan Now", Click "OK" to start. This is a short scan that will scan the files currently running in memory and when something is found, click the Yes button when it asks you if you want to cure it.
  • Once the short scan has finished, Click Options > Change settings
  • Choose the "Scan tab" and UNcheck "Heuristic analysis"
  • Back at the main window, click "Select drives" (a red dot will show which drives have been chosen)
  • Then click the "Start/Stop Scanning" button (green arrow on the right) and the scan will start.
  • When done, a message will be displayed at the bottom advising if any viruses were found.
  • Click "Yes to all" if it asks if you want to cure/move the file.
  • When the scan has finished, look if you can see the icon next to the files found. If so, click it, then click the next icon right below and select "Move incurable". (This will move it to the C:\Documents and Settings\userprofile\DoctorWeb\Quarantine folder if it can't be cured)
  • Next, in the Dr.Web CureIt menu on top, click file and choose save report list.
  • Save the DrWeb.csv report to your desktop.
  • Exit Dr.Web Cureit when done.
  • Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.
  • After reboot, post the contents of the log from Dr.Web in your next reply. (You can use Notepad to open the DrWeb.cvs report)
RE-Enable your AntiVirus and AntiSpyware applications.

Reply back with copy of
  • C:\Avenger.txt log
  • C:\Combofix.txt,
  • C:\rapport.txt from SmitFraudFix run,
  • the DrWeb.csv report
  • and, Tell me, How is your system now :?:
Be sure to do a Preview prior to pressing Submit because all reports may not fit into 1 single reply. You'll likely have to do more than 1 reply.
~Maurice Naggar
MS-MVP (Oct 2002 - Sept 2010)

#3 Dawgs

Dawgs
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:07:25 PM

Posted 11 May 2009 - 11:28 AM

Maurice,
Thanks for all of your help.
I ran Avenger, ComboFix and Smit FraudFix. When I tried to run DrWeb-CureIt, the program aborted 3/4 thru the scan. I tried it again and the same thing happened.

Here are the logs. What do you think? Thanks

Dawgs



AVENGER.TXT LOG:
*******************************************************************************8

<Logfile of The Avenger Version 2.0, © by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File "C:\WINDOWS\system32\promo.exe" deleted successfully.

Error: could not open file "C:\Program Files\Antivirus 2008 PRO\antivirus-2008pro.exe"
Deletion of file "C:\Program Files\Antivirus 2008 PRO\antivirus-2008pro.exe" failed!
Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)
--> bad path / the parent directory does not exist


Error: could not open file "C:\Program Files\Sakora\Sakora.exe"
Deletion of file "C:\Program Files\Sakora\Sakora.exe" failed!
Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)
--> bad path / the parent directory does not exist


Error: could not open file "C:\Program Files\Common Files\s?curity\?hkdsk.exe"
Deletion of file "C:\Program Files\Common Files\s?curity\?hkdsk.exe" failed!
Status: 0xc0000033 (STATUS_OBJECT_NAME_INVALID)
--> an object cannot have this name


Error: could not open file "C:\Program Files\mjc\mjc.exe"
Deletion of file "C:\Program Files\mjc\mjc.exe" failed!
Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)
--> bad path / the parent directory does not exist


Error: file "c:\windows\sysguard.exe" not found!
Deletion of file "c:\windows\sysguard.exe" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "c:\windows\system32\sdra64.exe" not found!
Deletion of file "c:\windows\system32\sdra64.exe" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "c:\windows\system32\drivers\msqpdxserv.sys" not found!
Deletion of file "c:\windows\system32\drivers\msqpdxserv.sys" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "C:\WINDOWS\system32\drivers\TDSSmqlt.sys" not found!
Deletion of file "C:\WINDOWS\system32\drivers\TDSSmqlt.sys" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "C:\windows\system32\drivers\tdssserv.sys" not found!
Deletion of file "C:\windows\system32\drivers\tdssserv.sys" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "C:\WINDOWS\system32\drivers\TDSSmact.sys" not found!
Deletion of file "C:\WINDOWS\system32\drivers\TDSSmact.sys" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\ovfsthx" not found!
Deletion of driver "ovfsthx" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\UACd.sys" not found!
Deletion of driver "UACd.sys" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\UACd" not found!
Deletion of driver "UACd" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\gaopdxserv.sys" not found!
Deletion of driver "gaopdxserv.sys" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\gaopdxserv" not found!
Deletion of driver "gaopdxserv" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\gaopdxl" not found!
Deletion of driver "gaopdxl" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\tdss" not found!
Deletion of driver "tdss" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\tdssserv" not found!
Deletion of driver "tdssserv" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\TDSSserv.SYS" not found!
Deletion of driver "TDSSserv.SYS" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\Service_TDSSSERV.SYS" not found!
Deletion of driver "Service_TDSSSERV.SYS" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\Legacy_TDSSSERV.SYS" not found!
Deletion of driver "Legacy_TDSSSERV.SYS" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\msqpdxserv.sys" not found!
Deletion of driver "msqpdxserv.sys" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\msqpdxserv" not found!
Deletion of driver "msqpdxserv" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: folder "C:\Program Files\Antivirus 2008 PRO" not found!
Deletion of folder "C:\Program Files\Antivirus 2008 PRO" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: folder "C:\Program Files\Sakora" not found!
Deletion of folder "C:\Program Files\Sakora" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: could not open folder "C:\Program Files\Common Files\s?curity"
Deletion of folder "C:\Program Files\Common Files\s?curity" failed!
Status: 0xc0000033 (STATUS_OBJECT_NAME_INVALID)
--> an object cannot have this name


Error: folder "C:\Program Files\mjc" not found!
Deletion of folder "C:\Program Files\mjc" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist

Folder "C:\recycler" deleted successfully.

Error: could not open folder "D:\recycler"
Deletion of folder "D:\recycler" failed!
Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)
--> bad path / the parent directory does not exist

Folder "e:\recycler" deleted successfully.

Error: could not open folder "f:\recycler"
Deletion of folder "f:\recycler" failed!
Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)
--> bad path / the parent directory does not exist


Error: could not open folder "g:\recycler"
Deletion of folder "g:\recycler" failed!
Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)
--> bad path / the parent directory does not exist


Error: could not open folder "h:\recycler"
Deletion of folder "h:\recycler" failed!
Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)
--> bad path / the parent directory does not exist


Completed script processing.

*******************

Finished! Terminate.



COMBOFIX.TXT LOG:
*****************************************************************************

ComboFix 09-05-09.05 - Nick 05/10/2009 19:25.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2550.1940 [GMT -4:00]
Running from: c:\documents and settings\Nick\Desktop\Combo-Fix.exe
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated)
FW: Norton Internet Worm Protection *enabled*
FW: Symantec Client Firewall *enabled*
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\documents and settings\Nick\Application Data\inst.exe
c:\documents and settings\Nick\Start Menu\Programs\Pornovid
c:\documents and settings\Nick\Start Menu\Programs\Pornovid\Uninstall.lnk
C:\resycled
c:\windows\system32\nScan
c:\windows\system32\nScan\em000_32.dat
c:\windows\system32\nScan\em001_32.dat
c:\windows\system32\nScan\em002_32.dat
c:\windows\system32\nScan\em003_32.dat
c:\windows\system32\nScan\em004_32.dat
c:\windows\system32\nScan\em005_32.dat
c:\windows\system32\nScan\em006_32.dat
c:\windows\system32\nScan\mod_comp.dat
E:\Autorun.inf
E:\resycled

----- BITS: Possible infected sites -----

hxxp://www.graboid.com
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_OULTRAF
-------\Service_oUltraf


((((((((((((((((((((((((( Files Created from 2009-04-10 to 2009-05-10 )))))))))))))))))))))))))))))))
.

2009-05-10 23:06 . 2009-05-10 23:06 574 ----a-w C:\cleanup.bat
2009-05-10 23:06 . 2009-05-10 23:06 19286 ----a-w C:\cleanup.exe
2009-05-10 23:06 . 2009-05-10 23:06 135168 ----a-w C:\zip.exe
2009-05-10 02:15 . 2009-05-10 23:11 -------- d-----w C:\hijackthis
2009-05-09 01:17 . 2009-05-09 01:17 -------- d-----w c:\documents and settings\Administrator\Application Data\Share-to-Web Upload Folder
2009-04-25 14:14 . 2009-05-01 20:40 43520 ----a-w c:\windows\system32\CmdLineExt03.dll
2009-04-25 14:06 . 2009-04-25 14:06 -------- d-----w c:\program files\Enlight
2009-04-14 17:52 . 2009-04-14 17:52 -------- d-----w c:\program files\iPod
2009-04-14 17:51 . 2009-04-14 17:52 -------- d-----w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2009-04-14 17:51 . 2009-04-14 17:52 -------- d-----w c:\program files\iTunes

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-10 23:28 . 2007-05-25 23:08 40 ----a-w c:\windows\system32\profile.dat
2009-05-10 23:25 . 2005-08-31 12:30 -------- d-----w c:\program files\Common Files\Symantec Shared
2009-04-25 14:06 . 2005-08-31 12:19 -------- d--h--w c:\program files\InstallShield Installation Information
2009-04-14 17:51 . 2007-07-13 19:56 -------- d-----w c:\program files\Common Files\Apple
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Erqva"="c:\program files\Common Files\s?curity\?hkdsk.exe" [?]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-04-01 486856]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-28 152872]
"ibmmessages"="c:\program files\IBM\Messages By IBM\ibmmessages.exe" [2004-12-11 446464]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-07-27 1388544]
"UC_Start"="c:\program files\IBM\Updater\\ucstartup.exe" [2004-07-14 36864]
"ibmmessages"="c:\program files\IBM\Messages By IBM\\ibmmessages.exe" [2004-12-11 446464]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-09-02 127035]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592]
"IBMPRC"="c:\ibmtools\UTILS\ibmprc.exe" [2004-12-16 90112]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-08-24 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-08-24 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-08-24 114688]
"ISSI EZUpdate Service"="c:\sdwork\issimsvc.exe" [2006-03-20 195584]
"stgclean"="c:\sdwork\w32main2.exe" [2008-09-09 271360]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-11-07 111936]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2006-11-21 52840]
"vptray"="c:\progra~1\SYMANT~1\SYMANT~2\VPTray.exe" [2006-09-28 125168]
"w32msgr"="c:\sdwork\w32main2.exe" [2008-09-09 271360]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"Mouse Suite 98 Daemon"="ICO.EXE" - c:\windows\system32\ico.exe [2004-07-14 57344]
"emMON"="HCWemMON.exe" - c:\windows\HCWemMON.exe [2006-05-31 61440]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Broadband Networking.lnk - c:\windows\Installer\{2C84BB95-1DB9-4AC4-8750-F979BBCDD859}\_18be6784.exe [2005-9-15 25214]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\IBM\\Updater\\jre\\bin\\java.exe"=
"c:\\Program Files\\IBM\\Updater\\jre\\bin\\javaw.exe"=
"c:\\Program Files\\IBM\\Updater\\ucsmb.exe"=
"c:\\Program Files\\Microsoft Broadband Networking\\MSBNCfg.exe"=
"c:\\Program Files\\Microsoft Broadband Networking\\MSBNUpdate.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Common Files\\AOL\\1147987455\\ee\\aolsoftware.exe"=
"c:\\Program Files\\Common Files\\AOL\\1147987455\\ee\\aim6.exe"=
"c:\\WINDOWS\\system32\\LEXPPS.EXE"=
"c:\\Program Files\\Windows Media Player\\wmplayer.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\AT&T Network client\\NetClient.exe"=
"c:\\sdwork\\W32MAIN2.EXE"=
"c:\\Program Files\\Joost\\xulrunner\\tvprunner.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"58402:TCP"= 58402:TCP:Pando Media Booster
"58402:UDP"= 58402:UDP:Pando Media Booster

R1 SSHDRV65;SSHDRV65;c:\windows\system32\drivers\SSHDRV65.sys [6/27/2008 5:45 PM 120320]
R2 ibmfilter;ibmfilter;c:\windows\system32\drivers\ibmfilter.sys [12/16/2004 7:12 AM 63616]
R2 SavRoam;SAVRoam;c:\program files\Symantec Client Security\Symantec AntiVirus\SavRoam.exe [9/27/2006 8:33 PM 116464]
R3 ABVPN2K;Net Firewall Miniport Interface;c:\windows\system32\drivers\abvpn2k.sys [5/25/2007 6:42 PM 171508]
R3 avpnnic;AGN Virtual Network Adapter;c:\windows\system32\drivers\avpnnic.sys [5/25/2007 6:42 PM 13952]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2/26/2009 3:46 PM 101936]
R3 MSFT43XX;Microsoft Wireless Notebook Adapter Driver;c:\windows\system32\drivers\mn720-50.sys [7/18/2003 3:05 AM 254208]
R3 pelmouse;Mouse Suite Driver;c:\windows\system32\drivers\PELMOUSE.SYS [8/31/2005 8:41 AM 16384]
R3 pelusblf;USB Mouse Low Filter Driver;c:\windows\system32\drivers\PELUSBLF.SYS [8/31/2005 8:41 AM 9216]
S3 Ndisprot;ArcNet NDIS Protocol Driver;c:\windows\system32\drivers\ndisprot.sys [10/21/2008 9:24 PM 27904]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - EGATHDRV
*Deregistered* - EGATHDRV

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{707d8058-389a-11dd-8366-000d3a286f73}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
\Shell\Open(&0)\command - Recycled\ctfmon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{998810f8-ebb0-11dc-8333-000d3a286f73}]
\Shell\AutoRun\command - H:\WDSetup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cb1e6882-35b6-11de-8518-000d3a286f73}]
\Shell\AutoRun\command - G:\setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ec34815e-e774-11da-b503-000d3a286f73}]
\Shell\AutoRun\command - e:\system\viewer\Viewer.exe
\Shell\View your videos\command - e:\system\viewer\Viewer.exe
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-Sakora - c:\program files\Sakora\Sakora.exe
HKCU-Run-mjc - c:\program files\mjc\mjc.exe
HKLM-Run-promo.exe - c:\windows\system32\promo.exe


.
------- Supplementary Scan -------
.
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
IE: &AOL Toolbar Search - c:\program files\aol\aol toolbar 5.0\resources\en-US\local\search.html
DPF: {08EE4BCE-527E-4760-B11A-B829415E9103} - hxxp://simgolf.ea.com/teleport/simgolf/MaxisGolfTeleX.cab
FF - ProfilePath - c:\documents and settings\Nick\Application Data\Mozilla\Firefox\Profiles\fd5b53wm.default\
FF - plugin: c:\program files\Mozilla Firefox\plugins\npPandoWebInst.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\Unity\WebPlayer\loader\npUnity3D32.dll

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-10 19:30
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3784)
c:\windows\system32\pelscrll.dll
c:\windows\system32\PELCOMM.dll
c:\windows\system32\PELHOOKS.dll
c:\windows\system32\browselc.dll
c:\program files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
c:\program files\Microsoft Office\OFFICE11\msohev.dll
c:\program files\Common Files\Ahead\Lib\NeroDigitalExt.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Symantec Shared\ccSetMgr.exe
c:\program files\Common Files\Symantec Shared\ccEvtMgr.exe
c:\program files\Common Files\Symantec Shared\ccProxy.exe
c:\program files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe
c:\program files\Common Files\Symantec Shared\SNDSrvc.exe
c:\program files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
c:\windows\system32\LEXBCES.EXE
c:\windows\system32\LEXPPS.EXE
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Symantec Client Security\Symantec Client Firewall\CfgWzSvc.exe
c:\program files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe
c:\program files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\progra~1\AT&TNE~1\NetCfgSv.EXE
c:\program files\Analog Devices\SoundMAX\SMAgent.exe
c:\program files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe
c:\program files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe
c:\windows\system32\wdfmgr.exe
c:\windows\system32\PELMICED.EXE
c:\program files\Common Files\Ahead\Lib\NMIndexingService.exe
c:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2009-05-10 19:36 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-10 23:35

Pre-Run: 3,804,831,744 bytes free
Post-Run: 6,430,400,512 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect

221 --- E O F --- 2008-10-15 02:17



RAPPORT.TXT LOG:
*****************************************************************************

SmitFraudFix v2.416

Scan done at 21:12:30.73, Sun 05/10/2009
Run from C:\Documents and Settings\Nick\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

Killing process


hosts

127.0.0.1 localhost

VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


Generic Renos Fix

GenericRenosFix by S!Ri


Deleting infected files


IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



Agent.OMZ.Fix

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


RK


DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{826E810A-0C4F-4E56-A346-1B5E35C2E4D2}: DhcpNameServer=192.168.2.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{826E810A-0C4F-4E56-A346-1B5E35C2E4D2}: DhcpNameServer=192.168.2.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{826E810A-0C4F-4E56-A346-1B5E35C2E4D2}: DhcpNameServer=192.168.2.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.2.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.2.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.2.1


Deleting Temp Files


Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

"System"=""


RK.2



Registry Cleaning

Registry Cleaning done.

SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


End

#4 Maurice Naggar

Maurice Naggar

    Eradicator de malware


  • Malware Response Team
  • 1,088 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:06:25 PM

Posted 11 May 2009 - 12:31 PM

When I tried to run DrWeb-CureIt, the program aborted 3/4 thru the scan. I tried it again and the same thing happened.

Did you run it in Safe mode? If you did, then do not run it again.
If and only if you tried running it in Normal mode, then get to Safe mode (as per prior response) and run DrWEb-CureIt.

Otherwise, I'd like to have you scan your system (a full scan) with your Symantec AV (after first getting it updated) in both Safe mode, and then again in Normal mode. And save the result logs.
And post those if possible.

Meantime, kindly await my review of your other logs and I plan to get back to you here this evening.
~Maurice Naggar
MS-MVP (Oct 2002 - Sept 2010)

#5 Dawgs

Dawgs
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:07:25 PM

Posted 11 May 2009 - 08:32 PM

Maurice,
I ran the Dr Web CureIt in Safe mode, both times. I updated Symantec and ran it in Safe Mode. Will run it in normal mode later. Didn't find any viruses. Where is the log file stored, I couldn't find it. Thanks
Dawgs

#6 Maurice Naggar

Maurice Naggar

    Eradicator de malware


  • Malware Response Team
  • 1,088 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:06:25 PM

Posted 11 May 2009 - 09:26 PM

Sorry, I'm not familiar enough with Symantec to know where your log is.
To follow up on more cleanups, please do the following.

You will want to print out or copy these instructions to Notepad for Safe Mode/offline reference!

These steps are for member Dawgs only. If you are not this member, do NOT try this on your system!
If you are not Dawgs and have a similar problem, do NOT post here; start your own topic


Do not run or start any other programs while these utilities and tools are in use!
Posted Image Do NOT run any other tools on your own or do any fixes other than what is listed here.
If you have questions, please ask before you do something on your own.
But it is important that you get going on these following steps.
=
Close any of your open programs while you run these tools.

Please download & save Malwarebytes Anti-Malware to your Desktop from
http://www.download.com/Malwarebytes-Anti-..._4-10804572.htm or
http://www.besttechie.net/tools/mbam-setup.exe or
http://malwarebytes.gt500.org/mbam.jsp

Posted Image Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform Quick Scan, then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy & Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.

=

Next, I need for you to do a scripted run of Combofix:
1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open Notepad and copy/paste the text in between the *** stars *** below into it:

********************************************************************************
File::
c:\program files\Common Files\s?curity\?hkdsk.exe
c:\program files\Sakora\Sakora.exe

Folder::
c:\program files\Common Files\s?curity
c:\program files\Sakora
C:\recycler
D:\recycler
e:\recycler
f:\recycler
g:\recycler
h:\recycler

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{707d8058-389a-11dd-8366-000d3a286f73}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Erqva"=-

*******************************************************************************

Save this as CFScript.txt, in the same location as ComboFix.exe -- to the Desktop


Posted Image


Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

=

Next, Close all applications and windows.
If you have an older copy of SDFix, delete it now.
Download SDFix and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in Safe Mode by doing the following :
  • Restart your computer
  • After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
  • Instead of Windows loading as normal, the Advanced Options Menu should appear;
  • Select the first option, to run Windows in Safe Mode, then press Enter.
  • Choose your usual user account.
  • Open the extracted SDFix folder and double click RunThis.bat to start the script.
  • Type Y to begin the cleanup process.
  • It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
  • Press any Key and it will restart the PC.
  • When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
  • Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
    (Report.txt will also be copied to Clipboard ready for posting back on the forum).
  • Finally paste the contents of the Report.txt back in a Reply here.
Reply with copy of the MBAM scan log
C:\Combofix.txt
Report.txt
and tell me, How is your system now ?

Edited by Maurice Naggar, 11 May 2009 - 09:28 PM.

~Maurice Naggar
MS-MVP (Oct 2002 - Sept 2010)

#7 Dawgs

Dawgs
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:07:25 PM

Posted 13 May 2009 - 02:49 PM

Hi Maurice, Here are the 3 logs, it appears to be running better, no sign of the virus. Thanks
Dawgs

MBAM LOG
-------------------------

Scan type: Quick Scan
Objects scanned: 111588
Time elapsed: 19 minute(s), 7 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 1
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Webtools (Malware.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\Extensions\{59a40ac9-e67d-4155-b31d-4b7330fcd2d6} (Adware.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Documents and Settings\Nick\Desktop\Internet Security Suite.url (Rogue.Link) -> Quarantined and deleted successfully.



combofix.txt
----------------------------
ComboFix 09-05-13.01 - Nick 05/13/2009 15:10.5 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2550.1948 [GMT -4:00]
Running from: c:\documents and settings\Nick\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\Nick\Desktop\CFScript.txt
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}
FW: Norton Internet Worm Protection *enabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}
FW: Symantec Client Firewall *enabled* {5CB76A43-5FAD-476B-B9FF-26FA61F13187}

FILE ::
c:\program files\Sakora\Sakora.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\recycler
c:\recycler\S-1-5-21-1683056158-2375859278-3124077611-1009\desktop.ini
c:\recycler\S-1-5-21-1683056158-2375859278-3124077611-1009\INFO2
c:\recycler\S-1-5-21-1683056158-2375859278-3124077611-500\desktop.ini
c:\recycler\S-1-5-21-1683056158-2375859278-3124077611-500\INFO2
c:\windows\system32\tmp.reg
e:\recycler
e:\recycler\S-1-5-21-1683056158-2375859278-3124077611-1009\desktop.ini
e:\recycler\S-1-5-21-1683056158-2375859278-3124077611-1009\INFO2
e:\recycler\S-1-5-21-1683056158-2375859278-3124077611-500\desktop.ini
e:\recycler\S-1-5-21-1683056158-2375859278-3124077611-500\INFO2

.
((((((((((((((((((((((((( Files Created from 2009-04-13 to 2009-05-13 )))))))))))))))))))))))))))))))
.

2009-05-13 18:36 . 2009-05-13 18:36 -------- d-----w c:\documents and settings\Nick\Application Data\Malwarebytes
2009-05-12 02:34 . 2009-03-11 02:18 453512 ----a-w c:\windows\system32\KB905474\wgasetup.exe
2009-05-12 02:34 . 2009-05-12 02:34 -------- d-----w c:\windows\system32\KB905474
2009-05-12 02:34 . 2009-03-11 02:26 1403264 ----a-w c:\windows\system32\KB905474\wganotifypackageinner.exe
2009-05-11 16:16 . 2009-03-06 14:44 283648 ------w c:\windows\system32\dllcache\pdh.dll
2009-05-11 16:16 . 2005-07-26 04:39 60416 ------w c:\windows\system32\dllcache\colbact.dll
2009-05-11 16:16 . 2009-02-09 10:20 399360 ------w c:\windows\system32\dllcache\rpcss.dll
2009-05-11 16:16 . 2009-02-06 17:14 110592 ------w c:\windows\system32\dllcache\services.exe
2009-05-11 16:16 . 2009-02-09 10:20 473088 ------w c:\windows\system32\dllcache\fastprox.dll
2009-05-11 16:16 . 2009-02-06 16:39 227840 ------w c:\windows\system32\dllcache\wmiprvse.exe
2009-05-11 16:16 . 2009-02-09 10:20 453120 ------w c:\windows\system32\dllcache\wmiprvsd.dll
2009-05-11 16:16 . 2009-02-09 10:20 616960 ------w c:\windows\system32\dllcache\advapi32.dll
2009-05-11 16:16 . 2009-02-09 10:20 714752 ------w c:\windows\system32\dllcache\ntdll.dll
2009-05-11 16:14 . 2008-04-21 10:02 215552 ------w c:\windows\system32\dllcache\wordpad.exe
2009-05-11 01:44 . 2009-05-11 02:39 -------- d-----w c:\documents and settings\Administrator\DoctorWeb
2009-05-11 01:29 . 2003-06-25 20:05 266360 ----a-w c:\windows\system32\TweakUI.exe
2009-05-11 00:50 . 2009-05-11 00:50 22024 ----a-w c:\windows\system32\drivers\pxscan.sys
2009-05-11 00:50 . 2009-05-11 00:50 27656 ----a-w c:\windows\system32\drivers\pxsec.sys
2009-05-11 00:50 . 2009-05-11 00:50 -------- d-----w c:\program files\Prevx
2009-05-11 00:50 . 2009-05-11 00:55 -------- d-----w c:\documents and settings\All Users\Application Data\PrevxCSI
2009-05-10 23:06 . 2009-05-10 23:06 574 ----a-w C:\cleanup.bat
2009-05-10 23:06 . 2009-05-10 23:06 19286 ----a-w C:\cleanup.exe
2009-05-10 23:06 . 2009-05-10 23:06 135168 ----a-w C:\zip.exe
2009-05-10 02:15 . 2009-05-13 18:57 -------- d-----w C:\hijackthis
2009-05-09 01:17 . 2009-05-09 01:17 -------- d-----w c:\documents and settings\Administrator\Application Data\Share-to-Web Upload Folder
2009-04-25 14:14 . 2009-05-01 20:40 43520 ----a-w c:\windows\system32\CmdLineExt03.dll
2009-04-25 14:06 . 2009-04-25 14:06 -------- d-----w c:\program files\Enlight
2009-04-14 17:52 . 2009-04-14 17:52 -------- d-----w c:\program files\iPod
2009-04-14 17:51 . 2009-04-14 17:52 -------- d-----w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2009-04-14 17:51 . 2009-04-14 17:52 -------- d-----w c:\program files\iTunes

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-13 19:00 . 2005-08-31 12:30 -------- d-----w c:\program files\Common Files\Symantec Shared
2009-05-13 18:36 . 2008-08-05 02:46 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-05-13 02:32 . 2007-05-25 23:08 40 ----a-w c:\windows\system32\profile.dat
2009-04-25 14:06 . 2005-08-31 12:19 -------- d--h--w c:\program files\InstallShield Installation Information
2009-04-14 17:51 . 2007-07-13 19:56 -------- d-----w c:\program files\Common Files\Apple
2009-04-06 19:32 . 2008-08-05 02:46 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-06 19:32 . 2008-08-05 02:46 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-03-06 14:44 . 1980-01-01 07:00 283648 ----a-w c:\windows\system32\pdh.dll
2009-02-20 08:30 . 1980-01-01 07:00 81920 ----a-w c:\windows\system32\ieencode.dll
2009-02-20 08:30 . 1980-01-01 07:00 659456 ----a-w c:\windows\system32\wininet.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-05-10_23.31.11 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-09-30 20:45 . 2008-09-30 20:45 91656 c:\windows\WinSxS\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.1.0_x-ww_2a41bceb\msxml4r.dll
+ 2009-05-13 19:00 . 2009-05-13 19:00 16384 c:\windows\temp\Perflib_Perfdata_3f4.dat
+ 2005-05-26 11:16 . 2008-10-16 18:09 43544 c:\windows\system32\wups2.dll
+ 2004-08-09 17:52 . 2008-10-16 18:08 34328 c:\windows\system32\wups.dll
+ 2004-08-09 17:52 . 2008-10-16 18:09 51224 c:\windows\system32\wuauclt.exe
- 2007-01-29 08:58 . 2008-07-14 11:09 62976 c:\windows\system32\tzchange.exe
+ 2007-01-29 08:58 . 2008-10-22 09:47 62976 c:\windows\system32\tzchange.exe
+ 2005-09-16 06:29 . 2008-07-09 07:38 26488 c:\windows\system32\spupdsvc.exe
- 2005-08-31 12:19 . 2007-11-30 11:18 17272 c:\windows\system32\spmsg.dll
+ 2005-08-31 12:19 . 2007-11-30 12:39 17272 c:\windows\system32\spmsg.dll
+ 2009-05-11 16:12 . 2008-10-16 18:09 43544 c:\windows\system32\SoftwareDistribution\Setup\ServiceStartup\wups2.dll\7.2.6001.788\wups2.dll
+ 2009-05-11 16:12 . 2008-10-16 18:08 34328 c:\windows\system32\SoftwareDistribution\Setup\ServiceStartup\wups.dll\7.2.6001.788\wups.dll
+ 1980-01-01 07:00 . 2009-02-03 20:08 55808 c:\windows\system32\secur32.dll
- 1980-01-01 07:00 . 2004-08-04 12:00 55808 c:\windows\system32\secur32.dll
+ 1980-01-01 07:00 . 2009-02-06 16:54 35328 c:\windows\system32\sc.exe
- 1980-01-01 07:00 . 2008-08-20 05:38 39424 c:\windows\system32\pngfilt.dll
+ 1980-01-01 07:00 . 2009-02-20 08:30 39424 c:\windows\system32\pngfilt.dll
- 1980-01-01 07:00 . 2009-03-28 00:01 64576 c:\windows\system32\perfc009.dat
+ 1980-01-01 07:00 . 2009-05-12 15:34 64576 c:\windows\system32\perfc009.dat
+ 2004-08-09 17:51 . 2008-06-12 14:16 91648 c:\windows\system32\mtxoci.dll
- 1980-01-01 07:00 . 2006-03-01 19:42 66560 c:\windows\system32\mtxclu.dll
+ 1980-01-01 07:00 . 2008-06-12 14:16 66560 c:\windows\system32\mtxclu.dll
- 2004-08-09 17:51 . 2004-08-04 12:00 58880 c:\windows\system32\msdtclog.dll
+ 2004-08-09 17:51 . 2008-06-12 14:16 58880 c:\windows\system32\msdtclog.dll
+ 1980-01-01 07:00 . 2008-06-10 13:17 96768 c:\windows\system32\logagent.exe
- 1980-01-01 07:00 . 2004-08-11 08:45 96768 c:\windows\system32\logagent.exe
- 1980-01-01 07:00 . 2008-08-20 05:38 16384 c:\windows\system32\jsproxy.dll
+ 1980-01-01 07:00 . 2009-02-20 08:30 16384 c:\windows\system32\jsproxy.dll
+ 1980-01-01 07:00 . 2009-02-20 08:30 96256 c:\windows\system32\inseng.dll
- 1980-01-01 07:00 . 2008-08-20 05:38 96256 c:\windows\system32\inseng.dll
- 1980-01-01 07:00 . 2008-08-20 05:38 55808 c:\windows\system32\extmgr.dll
+ 1980-01-01 07:00 . 2009-02-20 08:30 55808 c:\windows\system32\extmgr.dll
+ 2004-08-09 17:52 . 2008-10-16 18:08 34328 c:\windows\system32\dllcache\wups.dll
+ 2004-08-09 17:52 . 2008-10-16 18:09 51224 c:\windows\system32\dllcache\wuauclt.exe
+ 2009-02-03 20:08 . 2009-02-03 20:08 55808 c:\windows\system32\dllcache\secur32.dll
+ 1980-01-01 07:00 . 2009-02-06 16:54 35328 c:\windows\system32\dllcache\sc.exe
+ 2006-05-10 05:23 . 2009-02-20 08:30 39424 c:\windows\system32\dllcache\pngfilt.dll
- 2006-05-10 05:23 . 2008-08-20 05:38 39424 c:\windows\system32\dllcache\pngfilt.dll
+ 2004-08-09 17:51 . 2008-06-12 14:16 91648 c:\windows\system32\dllcache\mtxoci.dll
+ 2008-06-12 14:16 . 2008-06-12 14:16 66560 c:\windows\system32\dllcache\mtxclu.dll
- 2004-08-09 17:51 . 2004-08-04 12:00 58880 c:\windows\system32\dllcache\msdtclog.dll
+ 2004-08-09 17:51 . 2008-06-12 14:16 58880 c:\windows\system32\dllcache\msdtclog.dll
+ 1980-01-01 07:00 . 2008-06-10 13:17 96768 c:\windows\system32\dllcache\logagent.exe
- 1980-01-01 07:00 . 2004-08-11 08:45 96768 c:\windows\system32\dllcache\logagent.exe
+ 2006-05-10 05:22 . 2009-02-20 08:30 16384 c:\windows\system32\dllcache\jsproxy.dll
- 2006-05-10 05:22 . 2008-08-20 05:38 16384 c:\windows\system32\dllcache\jsproxy.dll
- 2006-05-10 05:22 . 2008-08-20 05:38 96256 c:\windows\system32\dllcache\inseng.dll
+ 2006-05-10 05:22 . 2009-02-20 08:30 96256 c:\windows\system32\dllcache\inseng.dll
+ 1980-01-01 07:00 . 2009-02-20 08:30 81920 c:\windows\system32\dllcache\ieencode.dll
- 1980-01-01 07:00 . 2004-08-04 12:00 81920 c:\windows\system32\dllcache\ieencode.dll
- 2006-05-09 11:00 . 2008-08-19 09:30 18432 c:\windows\system32\dllcache\iedw.exe
+ 2006-05-09 11:00 . 2009-02-19 09:58 18432 c:\windows\system32\dllcache\iedw.exe
- 1980-01-01 07:00 . 2008-08-20 05:38 55808 c:\windows\system32\dllcache\extmgr.dll
+ 1980-01-01 07:00 . 2009-02-20 08:30 55808 c:\windows\system32\dllcache\extmgr.dll
+ 1980-01-01 07:00 . 2008-10-16 18:09 92696 c:\windows\system32\dllcache\cdm.dll
+ 1980-01-01 07:00 . 2008-10-16 18:09 92696 c:\windows\system32\cdm.dll
- 2006-01-22 16:43 . 2006-01-25 03:05 23040 c:\windows\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
+ 2006-01-22 16:43 . 2009-05-11 16:37 23040 c:\windows\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
+ 2006-01-25 03:05 . 2009-05-11 16:37 61440 c:\windows\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\pubs.exe
- 2006-01-25 03:05 . 2006-01-25 03:05 61440 c:\windows\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\pubs.exe
- 2006-01-25 03:05 . 2006-01-25 03:05 27136 c:\windows\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
+ 2006-01-25 03:05 . 2009-05-11 16:37 27136 c:\windows\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
- 2006-01-25 03:05 . 2006-01-25 03:05 11264 c:\windows\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
+ 2006-01-25 03:05 . 2009-05-11 16:37 11264 c:\windows\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
- 2006-01-25 03:05 . 2006-01-25 03:05 12288 c:\windows\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
+ 2006-01-25 03:05 . 2009-05-11 16:37 12288 c:\windows\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
+ 2009-05-12 02:29 . 2009-05-12 02:29 32768 c:\windows\Installer\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}\icon.exe
- 2006-01-25 03:05 . 2006-01-25 03:05 4096 c:\windows\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
+ 2006-01-25 03:05 . 2009-05-11 16:37 4096 c:\windows\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
+ 2005-05-17 00:25 . 2009-02-19 09:47 351744 c:\windows\system32\xpsp3res.dll
- 2005-05-17 00:25 . 2008-08-19 09:20 351744 c:\windows\system32\xpsp3res.dll
+ 2004-08-09 17:52 . 2008-10-16 18:13 202776 c:\windows\system32\wuweb.dll
+ 2004-08-09 17:52 . 2008-10-16 18:12 323608 c:\windows\system32\wucltui.dll
+ 2004-08-09 17:52 . 2008-10-16 18:12 561688 c:\windows\system32\wuapi.dll
- 1980-01-01 07:00 . 2004-08-04 12:00 351232 c:\windows\system32\winhttp.dll
+ 1980-01-01 07:00 . 2008-12-16 12:47 351232 c:\windows\system32\winhttp.dll
+ 2004-08-09 17:51 . 2009-02-06 16:39 227840 c:\windows\system32\wbem\wmiprvse.exe
+ 2004-08-09 17:51 . 2009-02-09 10:20 453120 c:\windows\system32\wbem\wmiprvsd.dll
+ 2004-08-09 17:51 . 2009-02-09 10:20 473088 c:\windows\system32\wbem\fastprox.dll
+ 1980-01-01 07:00 . 2009-02-20 08:30 616448 c:\windows\system32\urlmon.dll
+ 1980-01-01 07:00 . 2008-10-03 10:15 247326 c:\windows\system32\strmdll.dll
- 1980-01-01 07:00 . 2008-08-20 05:38 474112 c:\windows\system32\shlwapi.dll
+ 1980-01-01 07:00 . 2009-02-20 08:30 474112 c:\windows\system32\shlwapi.dll
+ 1980-01-01 07:00 . 2009-02-06 17:14 110592 c:\windows\system32\services.exe
+ 1980-01-01 07:00 . 2008-12-05 07:12 144896 c:\windows\system32\schannel.dll
- 1980-01-01 07:00 . 2007-04-25 14:21 144896 c:\windows\system32\schannel.dll
+ 1980-01-01 07:00 . 2009-02-09 10:20 399360 c:\windows\system32\rpcss.dll
- 1980-01-01 07:00 . 2009-03-28 00:01 409562 c:\windows\system32\perfh009.dat
+ 1980-01-01 07:00 . 2009-05-12 15:34 409562 c:\windows\system32\perfh009.dat
+ 1980-01-01 07:00 . 2009-02-09 10:20 714752 c:\windows\system32\ntdll.dll
+ 1980-01-01 07:00 . 2008-10-15 16:57 332800 c:\windows\system32\netapi32.dll
+ 1980-01-01 07:00 . 2009-02-20 08:30 532480 c:\windows\system32\mstime.dll
- 1980-01-01 07:00 . 2008-08-20 05:38 532480 c:\windows\system32\mstime.dll
+ 1980-01-01 07:00 . 2009-02-20 08:30 146432 c:\windows\system32\msrating.dll
- 1980-01-01 07:00 . 2008-08-20 05:38 146432 c:\windows\system32\msrating.dll
+ 1980-01-01 07:00 . 2009-02-20 08:30 449024 c:\windows\system32\mshtmled.dll
- 1980-01-01 07:00 . 2008-08-20 05:38 449024 c:\windows\system32\mshtmled.dll
+ 2004-08-09 17:51 . 2008-06-12 14:16 161792 c:\windows\system32\msdtcuiu.dll
+ 2004-08-09 17:51 . 2008-06-12 14:16 956928 c:\windows\system32\msdtctm.dll
+ 2004-08-09 17:51 . 2008-06-12 14:16 428032 c:\windows\system32\msdtcprx.dll
+ 1980-01-01 07:00 . 2009-02-09 10:20 723456 c:\windows\system32\lsasrv.dll
+ 1980-01-01 07:00 . 2009-03-21 14:18 986112 c:\windows\system32\kernel32.dll
- 1980-01-01 07:00 . 2008-08-20 05:38 251392 c:\windows\system32\iepeers.dll
+ 1980-01-01 07:00 . 2009-02-20 08:30 251392 c:\windows\system32\iepeers.dll
+ 1980-01-01 07:00 . 2008-10-23 13:01 283648 c:\windows\system32\gdi32.dll
+ 1980-01-01 07:00 . 2009-02-20 08:30 205312 c:\windows\system32\dxtrans.dll
- 1980-01-01 07:00 . 2008-08-20 05:38 205312 c:\windows\system32\dxtrans.dll
- 1980-01-01 07:00 . 2008-08-20 05:38 357888 c:\windows\system32\dxtmsft.dll
+ 1980-01-01 07:00 . 2009-02-20 08:30 357888 c:\windows\system32\dxtmsft.dll
+ 1980-01-01 07:00 . 2008-12-11 11:57 333184 c:\windows\system32\drivers\srv.sys
+ 1980-01-01 07:00 . 2008-10-24 11:10 453632 c:\windows\system32\drivers\mrxsmb.sys
+ 2004-08-09 17:52 . 2008-10-16 18:13 202776 c:\windows\system32\dllcache\wuweb.dll
+ 2004-08-09 17:52 . 2008-10-16 18:12 323608 c:\windows\system32\dllcache\wucltui.dll
+ 2004-08-09 17:52 . 2008-10-16 18:12 561688 c:\windows\system32\dllcache\wuapi.dll
+ 2006-05-10 05:23 . 2009-02-20 08:30 659456 c:\windows\system32\dllcache\wininet.dll
- 2006-05-10 05:23 . 2008-08-20 05:38 659456 c:\windows\system32\dllcache\wininet.dll
+ 2008-12-16 12:47 . 2008-12-16 12:47 351232 c:\windows\system32\dllcache\winhttp.dll
+ 2006-05-10 05:23 . 2009-02-20 08:30 616448 c:\windows\system32\dllcache\urlmon.dll
+ 2006-08-21 14:52 . 2008-10-03 10:15 247326 c:\windows\system32\dllcache\strmdll.dll
+ 2006-04-21 06:12 . 2008-12-11 11:57 333184 c:\windows\system32\dllcache\srv.sys
- 2006-05-10 05:23 . 2008-08-20 05:38 474112 c:\windows\system32\dllcache\shlwapi.dll
+ 2006-05-10 05:23 . 2009-02-20 08:30 474112 c:\windows\system32\dllcache\shlwapi.dll
+ 2007-04-25 14:21 . 2008-12-05 07:12 144896 c:\windows\system32\dllcache\schannel.dll
- 2007-04-25 14:21 . 2007-04-25 14:21 144896 c:\windows\system32\dllcache\schannel.dll
+ 2006-07-14 15:31 . 2008-10-15 16:57 332800 c:\windows\system32\dllcache\netapi32.dll
- 1980-01-01 07:00 . 2008-08-20 05:38 532480 c:\windows\system32\dllcache\mstime.dll
+ 1980-01-01 07:00 . 2009-02-20 08:30 532480 c:\windows\system32\dllcache\mstime.dll
+ 2006-05-10 05:23 . 2009-02-20 08:30 146432 c:\windows\system32\dllcache\msrating.dll
- 2006-05-10 05:23 . 2008-08-20 05:38 146432 c:\windows\system32\dllcache\msrating.dll
- 2006-05-10 05:23 . 2008-08-20 05:38 449024 c:\windows\system32\dllcache\mshtmled.dll
+ 2006-05-10 05:23 . 2009-02-20 08:30 449024 c:\windows\system32\dllcache\mshtmled.dll
+ 2004-08-09 17:51 . 2008-06-12 14:16 161792 c:\windows\system32\dllcache\msdtcuiu.dll
+ 2004-08-09 17:51 . 2008-06-12 14:16 956928 c:\windows\system32\dllcache\msdtctm.dll
+ 2004-08-09 17:51 . 2008-06-12 14:16 428032 c:\windows\system32\dllcache\msdtcprx.dll
+ 2006-05-05 09:41 . 2008-10-24 11:10 453632 c:\windows\system32\dllcache\mrxsmb.sys
+ 2006-08-17 12:28 . 2009-02-09 10:20 723456 c:\windows\system32\dllcache\lsasrv.dll
+ 2006-07-05 10:55 . 2009-03-21 14:18 986112 c:\windows\system32\dllcache\kernel32.dll
- 2006-05-10 05:22 . 2008-08-20 05:38 251392 c:\windows\system32\dllcache\iepeers.dll
+ 2006-05-10 05:22 . 2009-02-20 08:30 251392 c:\windows\system32\dllcache\iepeers.dll
+ 2007-03-08 15:36 . 2008-10-23 13:01 283648 c:\windows\system32\dllcache\gdi32.dll
- 2006-05-10 05:22 . 2008-08-20 05:38 205312 c:\windows\system32\dllcache\dxtrans.dll
+ 2006-05-10 05:22 . 2009-02-20 08:30 205312 c:\windows\system32\dllcache\dxtrans.dll
+ 2006-05-10 05:22 . 2009-02-20 08:30 357888 c:\windows\system32\dllcache\dxtmsft.dll
- 2006-05-10 05:22 . 2008-08-20 05:38 357888 c:\windows\system32\dllcache\dxtmsft.dll
+ 2006-05-10 05:22 . 2009-02-20 08:30 151040 c:\windows\system32\dllcache\cdfview.dll
- 2006-05-10 05:22 . 2008-08-20 05:38 151040 c:\windows\system32\dllcache\cdfview.dll
+ 1980-01-01 07:00 . 2009-02-20 08:30 151040 c:\windows\system32\cdfview.dll
- 1980-01-01 07:00 . 2008-08-20 05:38 151040 c:\windows\system32\cdfview.dll
+ 1980-01-01 07:00 . 2009-02-09 10:20 616960 c:\windows\system32\advapi32.dll
- 1980-01-01 07:00 . 2004-08-04 12:00 616960 c:\windows\system32\advapi32.dll
+ 2006-01-25 03:05 . 2009-05-11 16:37 409600 c:\windows\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
- 2006-01-25 03:05 . 2006-01-25 03:05 409600 c:\windows\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
+ 2006-01-25 03:05 . 2009-05-11 16:37 286720 c:\windows\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
- 2006-01-25 03:05 . 2006-01-25 03:05 286720 c:\windows\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
- 2006-01-25 03:05 . 2006-01-25 03:05 249856 c:\windows\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\pptico.exe
+ 2006-01-25 03:05 . 2009-05-11 16:37 249856 c:\windows\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\pptico.exe
- 2006-01-22 16:43 . 2006-01-25 03:05 794624 c:\windows\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\outicon.exe
+ 2006-01-22 16:43 . 2009-05-11 16:37 794624 c:\windows\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\outicon.exe
- 2006-01-25 03:05 . 2006-01-25 03:05 135168 c:\windows\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\misc.exe
+ 2006-01-25 03:05 . 2009-05-11 16:37 135168 c:\windows\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\misc.exe
- 2006-01-25 03:05 . 2006-01-25 03:05 593920 c:\windows\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\accicons.exe
+ 2006-01-25 03:05 . 2009-05-11 16:37 593920 c:\windows\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\accicons.exe
+ 2005-08-31 12:22 . 2008-10-24 11:10 453632 c:\windows\Driver Cache\i386\mrxsmb.sys
+ 2008-09-30 20:42 . 2008-09-30 20:42 1286152 c:\windows\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9870.0_x-ww_a32d74cf\msxml4.dll
+ 2004-08-09 17:52 . 2008-10-16 18:13 1809944 c:\windows\system32\wuaueng.dll
+ 1980-01-01 07:00 . 2008-06-10 15:57 2364472 c:\windows\system32\WMVCore.dll
+ 1980-01-01 07:00 . 2008-06-10 15:37 1026048 c:\windows\system32\WMNetmgr.dll
+ 1980-01-01 07:00 . 2009-02-09 10:19 1846272 c:\windows\system32\win32k.sys
+ 1980-01-01 07:00 . 2008-07-03 13:16 8454656 c:\windows\system32\shell32.dll
- 1980-01-01 07:00 . 2007-10-26 03:36 8454656 c:\windows\system32\shell32.dll
+ 1980-01-01 07:00 . 2009-03-02 23:52 1495552 c:\windows\system32\shdocvw.dll
- 1980-01-01 07:00 . 2008-05-07 05:18 1287680 c:\windows\system32\quartz.dll
+ 1980-01-01 07:00 . 2008-12-20 22:43 1287680 c:\windows\system32\quartz.dll
+ 1980-01-01 07:00 . 2009-02-06 17:24 2180480 c:\windows\system32\ntoskrnl.exe
+ 2004-08-04 05:59 . 2009-02-06 16:49 2057728 c:\windows\system32\ntkrnlpa.exe
- 2004-08-04 05:59 . 2008-08-14 09:22 2057728 c:\windows\system32\ntkrnlpa.exe
+ 2008-09-30 20:43 . 2008-09-30 20:43 1286152 c:\windows\system32\msxml4.dll
+ 1980-01-01 07:00 . 2008-09-04 16:42 1106944 c:\windows\system32\msxml3.dll
+ 1980-01-01 07:00 . 2009-02-20 08:30 3059712 c:\windows\system32\mshtml.dll
- 2004-08-09 17:45 . 2008-10-15 15:42 1526864 c:\windows\system32\FNTCACHE.DAT
+ 2004-08-09 17:45 . 2009-05-12 15:29 1526864 c:\windows\system32\FNTCACHE.DAT
+ 2004-08-09 17:52 . 2008-10-16 18:13 1809944 c:\windows\system32\dllcache\wuaueng.dll
+ 1980-01-01 07:00 . 2008-06-10 15:57 2364472 c:\windows\system32\dllcache\WMVCore.dll
+ 1980-01-01 07:00 . 2008-06-10 15:37 1026048 c:\windows\system32\dllcache\WMNetmgr.dll
+ 2007-03-08 13:47 . 2009-02-09 10:19 1846272 c:\windows\system32\dllcache\win32k.sys
- 2006-07-13 13:33 . 2007-10-26 03:36 8454656 c:\windows\system32\dllcache\shell32.dll
+ 2006-07-13 13:33 . 2008-07-03 13:16 8454656 c:\windows\system32\dllcache\shell32.dll
+ 2006-05-29 15:30 . 2009-03-02 23:52 1495552 c:\windows\system32\dllcache\shdocvw.dll
+ 2007-10-29 22:43 . 2008-12-20 22:43 1287680 c:\windows\system32\dllcache\quartz.dll
- 2007-10-29 22:43 . 2008-05-07 05:18 1287680 c:\windows\system32\dllcache\quartz.dll
+ 2006-12-19 14:17 . 2009-02-06 17:24 2180480 c:\windows\system32\dllcache\ntoskrnl.exe
+ 2006-12-19 12:55 . 2009-02-06 16:49 2015744 c:\windows\system32\dllcache\ntkrpamp.exe
- 2006-12-19 12:55 . 2008-08-14 09:22 2015744 c:\windows\system32\dllcache\ntkrpamp.exe
+ 2006-12-19 12:55 . 2009-02-06 16:49 2057728 c:\windows\system32\dllcache\ntkrnlpa.exe
- 2006-12-19 12:55 . 2008-08-14 09:22 2057728 c:\windows\system32\dllcache\ntkrnlpa.exe
+ 2006-12-19 14:15 . 2009-02-06 17:22 2136064 c:\windows\system32\dllcache\ntkrnlmp.exe
- 2006-12-19 14:15 . 2008-08-14 09:58 2136064 c:\windows\system32\dllcache\ntkrnlmp.exe
+ 2006-09-13 05:01 . 2008-09-04 16:42 1106944 c:\windows\system32\dllcache\msxml3.dll
+ 2006-05-19 15:08 . 2009-02-20 08:30 3059712 c:\windows\system32\dllcache\mshtml.dll
+ 1980-01-01 07:00 . 2009-02-20 08:30 1054208 c:\windows\system32\dllcache\danim.dll
- 1980-01-01 07:00 . 2008-08-20 05:38 1054208 c:\windows\system32\dllcache\danim.dll
+ 2006-05-10 05:22 . 2009-02-20 08:30 1023488 c:\windows\system32\dllcache\browseui.dll
- 2006-05-10 05:22 . 2008-08-20 05:38 1023488 c:\windows\system32\dllcache\browseui.dll
- 1980-01-01 07:00 . 2008-08-20 05:38 1054208 c:\windows\system32\danim.dll
+ 1980-01-01 07:00 . 2009-02-20 08:30 1054208 c:\windows\system32\danim.dll
- 1980-01-01 07:00 . 2008-08-20 05:38 1023488 c:\windows\system32\browseui.dll
+ 1980-01-01 07:00 . 2009-02-20 08:30 1023488 c:\windows\system32\browseui.dll
+ 2005-03-02 00:59 . 2009-02-06 17:24 2180480 c:\windows\Driver Cache\i386\ntoskrnl.exe
+ 2005-03-02 00:34 . 2009-02-06 16:49 2015744 c:\windows\Driver Cache\i386\ntkrpamp.exe
- 2005-03-02 00:34 . 2008-08-14 09:22 2015744 c:\windows\Driver Cache\i386\ntkrpamp.exe
+ 2005-03-02 00:34 . 2009-02-06 16:49 2057728 c:\windows\Driver Cache\i386\ntkrnlpa.exe
- 2005-03-02 00:34 . 2008-08-14 09:22 2057728 c:\windows\Driver Cache\i386\ntkrnlpa.exe
+ 2005-03-02 00:57 . 2009-02-06 17:22 2136064 c:\windows\Driver Cache\i386\ntkrnlmp.exe
- 2005-03-02 00:57 . 2008-08-14 09:58 2136064 c:\windows\Driver Cache\i386\ntkrnlmp.exe
+ 2005-11-13 21:45 . 2009-04-06 11:57 24921544 c:\windows\system32\MRT.exe
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-04-01 486856]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-28 152872]
"ibmmessages"="c:\program files\IBM\Messages By IBM\ibmmessages.exe" [2004-12-11 446464]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-07-27 1388544]
"UC_Start"="c:\program files\IBM\Updater\\ucstartup.exe" [2004-07-14 36864]
"ibmmessages"="c:\program files\IBM\Messages By IBM\\ibmmessages.exe" [2004-12-11 446464]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-09-02 127035]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592]
"IBMPRC"="c:\ibmtools\UTILS\ibmprc.exe" [2004-12-16 90112]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-08-24 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-08-24 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-08-24 114688]
"stgclean"="c:\sdwork\w32main2.exe" [2008-09-09 271360]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-11-07 111936]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2006-11-21 52840]
"vptray"="c:\progra~1\SYMANT~1\SYMANT~2\VPTray.exe" [2006-09-28 125168]
"w32msgr"="c:\sdwork\w32main2.exe" [2008-09-09 271360]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"Mouse Suite 98 Daemon"="ICO.EXE" - c:\windows\system32\ico.exe [2004-07-14 57344]
"emMON"="HCWemMON.exe" - c:\windows\HCWemMON.exe [2006-05-31 61440]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Broadband Networking.lnk - c:\windows\Installer\{2C84BB95-1DB9-4AC4-8750-F979BBCDD859}\_18be6784.exe [2005-9-15 25214]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\IBM\\Updater\\jre\\bin\\java.exe"=
"c:\\Program Files\\IBM\\Updater\\jre\\bin\\javaw.exe"=
"c:\\Program Files\\IBM\\Updater\\ucsmb.exe"=
"c:\\Program Files\\Microsoft Broadband Networking\\MSBNCfg.exe"=
"c:\\Program Files\\Microsoft Broadband Networking\\MSBNUpdate.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Common Files\\AOL\\1147987455\\ee\\aolsoftware.exe"=
"c:\\Program Files\\Common Files\\AOL\\1147987455\\ee\\aim6.exe"=
"c:\\WINDOWS\\system32\\LEXPPS.EXE"=
"c:\\Program Files\\Windows Media Player\\wmplayer.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\AT&T Network client\\NetClient.exe"=
"c:\\sdwork\\W32MAIN2.EXE"=
"c:\\Program Files\\Joost\\xulrunner\\tvprunner.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"58402:TCP"= 58402:TCP:Pando Media Booster
"58402:UDP"= 58402:UDP:Pando Media Booster

R0 pxscan;pxscan;c:\windows\system32\drivers\pxscan.sys [5/10/2009 8:50 PM 22024]
R0 pxsec;pxsec;c:\windows\system32\drivers\pxsec.sys [5/10/2009 8:50 PM 27656]
R1 SSHDRV65;SSHDRV65;c:\windows\system32\drivers\SSHDRV65.sys [6/27/2008 5:45 PM 120320]
R2 CSIScanner;CSIScanner;c:\program files\Prevx\prevx.exe [5/10/2009 8:50 PM 4368952]
R2 ibmfilter;ibmfilter;c:\windows\system32\drivers\ibmfilter.sys [12/16/2004 7:12 AM 63616]
R2 SavRoam;SAVRoam;c:\program files\Symantec Client Security\Symantec AntiVirus\SavRoam.exe [9/27/2006 8:33 PM 116464]
R3 ABVPN2K;Net Firewall Miniport Interface;c:\windows\system32\drivers\abvpn2k.sys [5/25/2007 6:42 PM 171508]
R3 avpnnic;AGN Virtual Network Adapter;c:\windows\system32\drivers\avpnnic.sys [5/25/2007 6:42 PM 13952]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2/26/2009 3:46 PM 101936]
R3 MSFT43XX;Microsoft Wireless Notebook Adapter Driver;c:\windows\system32\drivers\mn720-50.sys [7/18/2003 3:05 AM 254208]
R3 pelmouse;Mouse Suite Driver;c:\windows\system32\drivers\PELMOUSE.SYS [8/31/2005 8:41 AM 16384]
R3 pelusblf;USB Mouse Low Filter Driver;c:\windows\system32\drivers\PELUSBLF.SYS [8/31/2005 8:41 AM 9216]
S3 Ndisprot;ArcNet NDIS Protocol Driver;c:\windows\system32\drivers\ndisprot.sys [10/21/2008 9:24 PM 27904]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - EGATHDRV
*Deregistered* - EGATHDRV

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{998810f8-ebb0-11dc-8333-000d3a286f73}]
\Shell\AutoRun\command - H:\WDSetup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cb1e6882-35b6-11de-8518-000d3a286f73}]
\Shell\AutoRun\command - G:\setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ec34815e-e774-11da-b503-000d3a286f73}]
\Shell\AutoRun\command - e:\system\viewer\Viewer.exe
\Shell\View your videos\command - e:\system\viewer\Viewer.exe
.
Contents of the 'Scheduled Tasks' folder

2009-05-13 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-05-12 02:18]
.
.
------- Supplementary Scan -------
.
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
IE: &AOL Toolbar Search - c:\program files\aol\aol toolbar 5.0\resources\en-US\local\search.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
DPF: {08EE4BCE-527E-4760-B11A-B829415E9103} - hxxp://simgolf.ea.com/teleport/simgolf/MaxisGolfTeleX.cab
FF - ProfilePath - c:\documents and settings\Nick\Application Data\Mozilla\Firefox\Profiles\fd5b53wm.default\
FF - plugin: c:\program files\Mozilla Firefox\plugins\npPandoWebInst.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\Unity\WebPlayer\loader\npUnity3D32.dll

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-13 15:13
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-05-13 15:15
ComboFix-quarantined-files.txt 2009-05-13 19:14
ComboFix2.txt 2009-05-10 23:36

Pre-Run: 7,725,420,544 bytes free
Post-Run: 7,727,243,264 bytes free

410 --- E O F --- 2009-05-12 02:34



REPORT.TXT
---------------------
SDFix: Version 1.240
Run by Nick on Wed 05/13/2009 at 03:27 PM

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix

Checking Services :


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


Checking Files :

No Trojan Files Found






Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-13 15:39:20
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools Lite\"
"h0"=dword:00000000
"khjeh"=hex:75,6a,be,0b,4c,3f,1f,d3,6f,30,93,b5,b3,97,8c,98,9c,e2,97,e6,da,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,3b,5d,9e,bb,71,8a,98,9d,3f,d4,71,d2,5d,52,92,dc,6d,..
"khjeh"=hex:c9,06,8b,6f,e4,1a,8c,4e,9f,c5,31,7e,53,78,e1,53,97,69,05,b4,9b,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:de,d6,02,69,80,d3,90,33,29,3a,95,7f,5b,dc,7e,bb,82,ce,16,08,6e,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools Lite\"
"h0"=dword:00000000
"khjeh"=hex:75,6a,be,0b,4c,3f,1f,d3,6f,30,93,b5,b3,97,8c,98,9c,e2,97,e6,da,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,3b,5d,9e,bb,71,8a,98,9d,3f,d4,71,d2,5d,52,92,dc,6d,..
"khjeh"=hex:c9,06,8b,6f,e4,1a,8c,4e,9f,c5,31,7e,53,78,e1,53,97,69,05,b4,9b,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:de,d6,02,69,80,d3,90,33,29,3a,95,7f,5b,dc,7e,bb,82,ce,16,08,6e,..

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\IBM\\Updater\\jre\\bin\\java.exe"="C:\\Program Files\\IBM\\Updater\\jre\\bin\\java.exe:*:Enabled:IBM Update Connector"
"C:\\Program Files\\IBM\\Updater\\jre\\bin\\javaw.exe"="C:\\Program Files\\IBM\\Updater\\jre\\bin\\javaw.exe:*:Enabled:IBM Update Connector"
"C:\\Program Files\\IBM\\Updater\\ucsmb.exe"="C:\\Program Files\\IBM\\Updater\\ucsmb.exe:*:Enabled:IBM Update Connector"
"C:\\Program Files\\Microsoft Broadband Networking\\MSBNCfg.exe"="C:\\Program Files\\Microsoft Broadband Networking\\MSBNCfg.exe:*:Enabled:Microsoft Broadband Networking Configuration"
"C:\\Program Files\\Microsoft Broadband Networking\\MSBNUpdate.exe"="C:\\Program Files\\Microsoft Broadband Networking\\MSBNUpdate.exe:*:Disabled:Microsoft Broadband Networking Update Utility"
"C:\\WINDOWS\\system32\\dpnsvr.exe"="C:\\WINDOWS\\system32\\dpnsvr.exe:*:Enabled:Microsoft DirectPlay8 Server"
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"="C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe:*:Enabled:AOL Loader"
"C:\\Program Files\\Common Files\\AOL\\1147987455\\ee\\aolsoftware.exe"="C:\\Program Files\\Common Files\\AOL\\1147987455\\ee\\aolsoftware.exe:*:Enabled:AOL Services"
"C:\\Program Files\\Common Files\\AOL\\1147987455\\ee\\aim6.exe"="C:\\Program Files\\Common Files\\AOL\\1147987455\\ee\\aim6.exe:*:Enabled:AIM"
"C:\\WINDOWS\\system32\\LEXPPS.EXE"="C:\\WINDOWS\\system32\\LEXPPS.EXE:*:Disabled:LEXPPS.EXE"
"C:\\Program Files\\Windows Media Player\\wmplayer.exe"="C:\\Program Files\\Windows Media Player\\wmplayer.exe:*:Enabled:Windows Media Player"
"C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:uTorrent"
"C:\\Program Files\\AT&T Network client\\NetClient.exe"="C:\\Program Files\\AT&T Network client\\NetClient.exe:*:Enabled:Network access client"
"C:\\sdwork\\W32MAIN2.EXE"="C:\\sdwork\\W32MAIN2.EXE:*:Enabled:OSP Windows 32-bit ESD API"
"C:\\Program Files\\Joost\\xulrunner\\tvprunner.exe"="C:\\Program Files\\Joost\\xulrunner\\tvprunner.exe:*:Enabled:tvprunner"
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"="C:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe:*:Enabled:Pando Media Booster"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\IBM\\Updater\\jre\\bin\\java.exe"="C:\\Program Files\\IBM\\Updater\\jre\\bin\\java.exe:*:Enabled:IBM Update Connector"
"C:\\Program Files\\IBM\\Updater\\jre\\bin\\javaw.exe"="C:\\Program Files\\IBM\\Updater\\jre\\bin\\javaw.exe:*:Enabled:IBM Update Connector"
"C:\\Program Files\\IBM\\Updater\\ucsmb.exe"="C:\\Program Files\\IBM\\Updater\\ucsmb.exe:*:Enabled:IBM Update Connector"

Remaining Files :



Files with Hidden Attributes :

Fri 30 Dec 2005 53,248 A..H. --- "C:\Documents and Settings\Chris\d_w.tmp"
Sat 31 Dec 2005 53,248 A..H. --- "C:\Program Files\Dofus\d_h11.tmp"
Sun 1 Jan 2006 53,248 A..H. --- "C:\Program Files\Dofus\d_h12.tmp"
Sun 1 Jan 2006 53,248 A..H. --- "C:\Program Files\Dofus\d_h16.tmp"
Mon 2 Jan 2006 53,248 A..H. --- "C:\Program Files\Dofus\d_h1B.tmp"
Fri 30 Dec 2005 53,248 A..H. --- "C:\Program Files\Dofus\d_h29.tmp"
Sun 1 Jan 2006 53,248 A..H. --- "C:\Program Files\Dofus\d_h31.tmp"
Sat 31 Dec 2005 1,003,654 A..H. --- "C:\Program Files\Dofus\d_p12.tmp"
Sun 1 Jan 2006 1,003,654 A..H. --- "C:\Program Files\Dofus\d_p13.tmp"
Sun 1 Jan 2006 1,003,654 A..H. --- "C:\Program Files\Dofus\d_p17.tmp"
Mon 2 Jan 2006 1,003,654 A..H. --- "C:\Program Files\Dofus\d_p1C.tmp"
Fri 30 Dec 2005 1,003,654 A..H. --- "C:\Program Files\Dofus\d_p2A.tmp"
Sun 1 Jan 2006 1,003,654 A..H. --- "C:\Program Files\Dofus\d_p32.tmp"
Mon 2 Jan 2006 53,248 A..H. --- "C:\Program Files\Dofus\d_w.tmp"
Tue 14 Feb 2006 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Tue 14 Feb 2006 401 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv13.bak"
Sat 23 Aug 2008 20,480 ...H. --- "C:\Documents and Settings\Nick\My Documents\~WRL0768.tmp"
Wed 13 Dec 2006 31,744 A..H. --- "C:\Documents and Settings\Nick\My Documents\Special\~WRL0004.tmp"
Thu 14 Dec 2006 32,768 A..H. --- "C:\Documents and Settings\Nick\My Documents\Special\~WRL0488.tmp"

Finished!

#8 Maurice Naggar

Maurice Naggar

    Eradicator de malware


  • Malware Response Team
  • 1,088 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:06:25 PM

Posted 14 May 2009 - 07:01 PM

Your logs showed some peer-to-peer filesharing apps. I do not recommend their use since such filesharing/downloading from unknown sources is one of the leading causes of transmission of malware.
"File-Sharing, otherwise known as Peer To Peer" and "Risks of File-Sharing Technology."

Good & bad P2P Programs
http://www.malwareremoval.com/p2pindex.php

=

Unless you have purchased Malwarebytes' Anti Malware {MBAM}, you need to un-install it. Go to Control Panel and Add-or-Remove programs.
Look for it and click the line for it. Select Change/Remove to de-install it.
OK & Exit out of Control Panel

=
Get and use MVP Mike Burgess' custom hosts file http://mvps.org/winhelp2002/hosts.htm

Steps to follow for the MVP Hosts file:
1) Download and SAVE the zip file to a temporary folder
2) Unzip (extract the contents) in the same folder
3) After extract is complete, run mvps.bat batch file. This copies your pre-existing Hosts file to Hosts.mvp in the folder where Windows' Hosts resides
typically, C:\WINDOWS\system32\drivers\etc

and after that copy is saved, it replaces the old Hosts with the new one.

And you should see (in the blue background command window) the following:

_________________________________________________
+---+
THE MVPS HOSTS FILE IS NOW UPDATED v
+---+



Previous version saved and renamed to HOSTS.MVP
Press any key to continue . . .


Find the folder where you saved the original download. Delete hosts.zip and a file folder there named hosts
The latter is the same folder that had mvps.bat
=

I see that you are clear of your original issues.
If you have a problem with these steps, or something does not quite work here, do let me know.

The following few steps will remove tools we used; followed by advice on staying safer.

We have to remove Combofix and all its associated folders. By whichever name you named it, ( you had named it combo-fix ), put that name in the RUN box stated just below. The "/u" in the Run line below is to start Combofix for it's cleanup & removal function.
The utility must be removed to prevent any un-intentional or accidental usage, PLUS, to free up much space on your hard disk.
  • Click Start, then click Run.

    In the command box that opens, type or copy/paste combo-fix /u and then click OK.
  • Download OTListIt by OldTimer to your desktop: http://oldtimer.geekstogo.com/OTListIt2.exe
  • Please double-click OTListIt2.exe to run it.
  • Click on the CleanUp! button. When you do this a text file named cleanup.txt will be downloaded from the internet. If you get a warning from your firewall or other security programs regarding OTListIt2 attempting to contact the internet you should allow it to do so. After the list has been download you'll be asked if you want to Begin cleanup process? Select Yes.
  • This step removes the files, folders, and shortcuts created by the tools I had you download and run.
We are finished here. Best regards.
~Maurice Naggar
MS-MVP (Oct 2002 - Sept 2010)




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users