Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

browser hijacker, corrupt file, and possible hidden keylogger


  • This topic is locked This topic is locked
16 replies to this topic

#1 james3434

james3434

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:02:15 AM

Posted 06 October 2009 - 12:03 AM

hey whats up,

ive been having a little trouble with my computer for the past 2 weeks. it started with the windows police virus which i removed with a program. then later on whenever i put in a search there is like a 50% chance that when i click on the link to any website that i will be redirected to some bootleg search engine or some website trying to sell me something irrelevant to what i typed in. i play the online game world of warcraft and i was just hacked a few days ago i am not entirely sure if its related to what i have going on here. it seems after a few days of web browsing and turning on my spyhunter that i will have quite the amount of these adtrackers, web browsing habits trackers and other little things similar to that. so i am assuming it is reapplying itself to my computer. i also ran a AVG scan and it was only able to heal 2/4 threats due to the other 2 threats being located on a "non-local hard drive". i also get a message every so often asking me to run a CHKDSK. this is the message that pops up on my toolbar. i also tried to run the "rootrepeal" program but it gives me this message "windows cannot access the specified device, path, or file. you may not have the appropriate permissions to access the item".

the file or directory C:/documents and settings/compaq_owner/local settings/application date/apple computer/quick time/quicktime.qtp.bak is corrupt and unreadable. please run the chkdsk utility.

i appreciate any help and thank you in advance.

these are the 2 that cannot be healed

"\\?\globalroot\systemroot\system32\kbiwkmnywohumk.dll" ;"Virus identified Packed.Monder";"Infected"
"C:\WINDOWS\explorer.exe (1732)" ;"Virus identified Packed.Monder";"Infected"

and here is my DDS report

DDS (Ver_09-09-29.01) - NTFSx86
Run by Compaq_Owner at 0:22:35.85 on Tue 10/06/2009
Internet Explorer: 7.0.5730.11 BrowserJavaVersion: 1.6.0_11
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1790.881 [GMT -7:00]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

============== Running Processes ===============

C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\system32\svchost -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\SteelSeries\World of Warcraft MMO Gaming Mouse\WoWMHID.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\TrojanHunter 5.2\THGuard.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe
C:\Program Files\NETGEAR WG311v2 Adapter\wlancfg5.exe
C:\Program Files\Xfire\xfire.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\WINDOWS\ALCXMNTR.EXE
c:\windows\system\hpsysdrv.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\AVG\AVG8\avgui.exe
C:\Program Files\AVG\AVG8\avgscanx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Documents and Settings\Compaq_Owner\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q405&bd=presario&pf=desktop&parm1=seconduser
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q405&bd=presario&pf=desktop&parm1=seconduser
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mDefault_Page_URL = hxxp://www.yahoo.com
mDefault_Search_URL = hxxp://www.google.com/ie
mSearch Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q405&bd=presario&pf=desktop&parm1=seconduser
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://as.starware.com/dp/search?x=wKX1ILEOi+UdWpSlz2q9Dzn13Emww/YwQpPqaywhO+9aQX24uDUGBd/Qh1n99F63CHDmKA2KK6gVu+V1+EvZVhGZ/aJfrSrrLCQ0cZJBMXxiJK7b73nWLbW8z033dftG
mSearchAssistant = hxxp://www.google.com
uURLSearchHooks: H - No File
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar1.dll
TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File
TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
mRun: [PCDrProfiler]
mRun: [HPBootOp] "c:\program files\hewlett-packard\hp boot optimizer\HPBootOp.exe" /run
mRun: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
mRun: [Desksite CMA] c:\program files\desksite\bin\cma.exe
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [BearShare] "c:\program files\bearshare\BearShare.exe" /pause
mRun: [SpyHunter Security Suite] c:\program files\enigma software group\spyhunter\SpyHunter3.exe
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
mRun: [SteelSeries World of Warcraft MMO Gaming Mouse] c:\program files\steelseries\world of warcraft mmo gaming mouse\WoWMHID.exe
mRun: [nwiz] c:\program files\nvidia corporation\nview\nwiz.exe /install
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [ISTray] "c:\program files\spyware doctor\pctsTray.exe"
mRun: [THGuard] "c:\program files\trojanhunter 5.2\THGuard.exe"
mRun: [xml10] RUNDLL32.EXE c:\windows\system32\xml_inc.dll,i
StartupFolder: c:\docume~1\compaq~1\startm~1\programs\startup\xfire.lnk - c:\program files\xfire\xfire.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\compaq~1.lnk - c:\program files\compaq connections\5577497\program\Compaq Connections.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\netgea~1.lnk - c:\program files\netgear wg311v2 adapter\wlancfg5.exe
uPolicies-explorer: NoActiveDesktop = 1 (0x1)
IE: &Google Search - c:\program files\google\GoogleToolbar1.dll/cmsearch.html
IE: &Translate English Word - c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
IE: Add To Compaq Organize... - c:\progra~1\hewlet~1\compaq~1\bin/module.main/favorites\ie_add_to.html
IE: Backward Links - c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
IE: Cached Snapshot of Page - c:\program files\google\GoogleToolbar1.dll/cmcache.html
IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office11\EXCEL.EXE/3000
IE: Similar Pages - c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
IE: Translate Page into English - c:\program files\google\GoogleToolbar1.dll/cmtrans.html
IE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - c:\program files\aim\aim.exe
IE: {E2D4D26B-0180-43a4-B05F-462D6D54C789} - c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\iebutton\support.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/8/b/d/8bd77752-5704-4d68-a152-f7252adaa4f2/LegitCheckControl.cab
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} - hxxp://www.srtest.com/srl_bin/sysreqlab3.cab
DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} - hxxp://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
DPF: {2E28242B-A689-11D4-80F2-0040266CBB8D} - hxxp://www.cherrytreeinn.com:8080/kxhcm10.ocx
DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\yinsthelper.dll
DPF: {5D6F45B3-9043-443D-A792-115447494D24} - hxxp://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - hxxp://messenger.zone.msn.com/binary/ZIntro.cab47946.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: {DA758BB1-5F89-4465-975F-8D7179A4BCF3} - hxxp://messenger.zone.msn.com/binary/WoF.cab31267.cab
DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} - hxxp://messenger.zone.msn.com/binary/Chess.cab31267.cab
TCP: {E3FE6EC7-6AA0-4C85-BBCD-330327A09983} = 192.168.1.114,192.168.1.130
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Notify: AtiExtEvent - Ati2evxx.dll
Notify: avgrsstarter - avgrsstx.dll
AppInit_DLLs: karna.dat
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: {E60A0B68-353A-81DD-ED09-2A8101A6DFBA} - No File

================= FIREFOX ===================

FF - ProfilePath -
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}

============= SERVICES / DRIVERS ===============


=============== Created Last 30 ================


==================== Find3M ====================

2006-12-24 17:35 22 a--sh--- c:\windows\sminst\HPCD.sys

============= FINISH: 0:25:17.56 ===============

Attached Files


Edited by james3434, 06 October 2009 - 12:04 AM.


BC AdBot (Login to Remove)

 


#2 Blade81

Blade81

    Bleepin' Rocker


  • Malware Response Team
  • 6,465 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:10:15 AM

Posted 15 October 2009 - 12:54 PM

Hi,

Sorry for delayed response. Forums have been really busy. If you still need help with this do following steps:

Please save this file to your desktop. Double-click on it to run a scan. When it's finished, there will be a log called Win32kDiag.txt on your desktop. Please open it with notepad and post the contents here with a fresh dds log.

Microsoft Windows Insider MVP 2016-2017

Microsoft MVP Consumer Security 2008-2015
UNITE member since 2006
unite_blue.png

Provided malware removal related instructions are meant to be used in the correspondent user's case only. If you have similar symptoms create own topic instead of following instructions given to some other, please.


#3 james3434

james3434
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:02:15 AM

Posted 16 October 2009 - 04:12 PM

WIN32k Diag
Running from: C:\Documents and Settings\Compaq_Owner\Desktop\Win32kDiag.exe

Log file at : C:\Documents and Settings\Compaq_Owner\Desktop\Win32kDiag.txt

WARNING: Could not get backup privileges!

Searching 'C:\WINDOWS'...





Finished!

Fresh DDS log
DDS (Ver_09-09-29.01) - NTFSx86
Run by Compaq_Owner at 16:53:54.79 on Fri 10/16/2009
Internet Explorer: 7.0.5730.11 BrowserJavaVersion: 1.6.0_11
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1790.975 [GMT -7:00]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

============== Running Processes ===============

C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\system32\svchost -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\SteelSeries\World of Warcraft MMO Gaming Mouse\WoWMHID.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\TrojanHunter 5.2\THGuard.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe
C:\Program Files\NETGEAR WG311v2 Adapter\wlancfg5.exe
C:\Program Files\Xfire\xfire.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\ALCXMNTR.EXE
c:\windows\system\hpsysdrv.exe
C:\Program Files\Java\jre6\bin\jucheck.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Compaq_Owner\Desktop\dds.scr
C:\WINDOWS\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q405&bd=presario&pf=desktop&parm1=seconduser
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q405&bd=presario&pf=desktop&parm1=seconduser
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mDefault_Page_URL = hxxp://www.yahoo.com
mDefault_Search_URL = hxxp://www.google.com/ie
mSearch Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q405&bd=presario&pf=desktop&parm1=seconduser
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://as.starware.com/dp/search?x=wKX1ILEOi+UdWpSlz2q9Dzn13Emww/YwQpPqaywhO+9aQX24uDUGBd/Qh1n99F63CHDmKA2KK6gVu+V1+EvZVhGZ/aJfrSrrLCQ0cZJBMXxiJK7b73nWLbW8z033dftG
mSearchAssistant = hxxp://www.google.com
uURLSearchHooks: H - No File
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar1.dll
TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File
TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
mRun: [PCDrProfiler]
mRun: [HPBootOp] "c:\program files\hewlett-packard\hp boot optimizer\HPBootOp.exe" /run
mRun: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
mRun: [Desksite CMA] c:\program files\desksite\bin\cma.exe
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [BearShare] "c:\program files\bearshare\BearShare.exe" /pause
mRun: [SpyHunter Security Suite] c:\program files\enigma software group\spyhunter\SpyHunter3.exe
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
mRun: [SteelSeries World of Warcraft MMO Gaming Mouse] c:\program files\steelseries\world of warcraft mmo gaming mouse\WoWMHID.exe
mRun: [nwiz] c:\program files\nvidia corporation\nview\nwiz.exe /install
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [ISTray] "c:\program files\spyware doctor\pctsTray.exe"
mRun: [THGuard] "c:\program files\trojanhunter 5.2\THGuard.exe"
mRun: [xml10] RUNDLL32.EXE c:\windows\system32\xml_inc.dll,i
StartupFolder: c:\docume~1\compaq~1\startm~1\programs\startup\xfire.lnk - c:\program files\xfire\xfire.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\compaq~1.lnk - c:\program files\compaq connections\5577497\program\Compaq Connections.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\netgea~1.lnk - c:\program files\netgear wg311v2 adapter\wlancfg5.exe
uPolicies-explorer: NoActiveDesktop = 1 (0x1)
IE: &Google Search - c:\program files\google\GoogleToolbar1.dll/cmsearch.html
IE: &Translate English Word - c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
IE: Add To Compaq Organize... - c:\progra~1\hewlet~1\compaq~1\bin/module.main/favorites\ie_add_to.html
IE: Backward Links - c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
IE: Cached Snapshot of Page - c:\program files\google\GoogleToolbar1.dll/cmcache.html
IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office11\EXCEL.EXE/3000
IE: Similar Pages - c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
IE: Translate Page into English - c:\program files\google\GoogleToolbar1.dll/cmtrans.html
IE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - c:\program files\aim\aim.exe
IE: {E2D4D26B-0180-43a4-B05F-462D6D54C789} - c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\iebutton\support.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/8/b/d/8bd77752-5704-4d68-a152-f7252adaa4f2/LegitCheckControl.cab
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} - hxxp://www.srtest.com/srl_bin/sysreqlab3.cab
DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} - hxxp://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
DPF: {2E28242B-A689-11D4-80F2-0040266CBB8D} - hxxp://www.cherrytreeinn.com:8080/kxhcm10.ocx
DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\yinsthelper.dll
DPF: {5D6F45B3-9043-443D-A792-115447494D24} - hxxp://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - hxxp://messenger.zone.msn.com/binary/ZIntro.cab47946.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: {DA758BB1-5F89-4465-975F-8D7179A4BCF3} - hxxp://messenger.zone.msn.com/binary/WoF.cab31267.cab
DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} - hxxp://messenger.zone.msn.com/binary/Chess.cab31267.cab
TCP: {E3FE6EC7-6AA0-4C85-BBCD-330327A09983} = 192.168.1.114,192.168.1.130
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Notify: AtiExtEvent - Ati2evxx.dll
Notify: avgrsstarter - avgrsstx.dll
AppInit_DLLs: karna.dat
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: {E60A0B68-353A-81DD-ED09-2A8101A6DFBA} - No File

================= FIREFOX ===================

FF - ProfilePath -
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}

============= SERVICES / DRIVERS ===============


=============== Created Last 30 ================


==================== Find3M ====================

2006-12-24 17:35 22 a--sh--- c:\windows\sminst\HPCD.sys

============= FINISH: 16:56:00.87 ===============

Attached Files



#4 Blade81

Blade81

    Bleepin' Rocker


  • Malware Response Team
  • 6,465 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:10:15 AM

Posted 16 October 2009 - 05:09 PM

Please visit this webpage for download links, and instructions for running ComboFix tool:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Please ensure you read this guide carefully first.


Please continue as follows:
  • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix, link
    Remember to re-enable them afterwards.

  • Click Yes to allow ComboFix to continue scanning for malware.
When the tool is finished, it will produce a report for you.

Please include the following reports for further review, and so we may continue cleansing the system:

C:\ComboFix.txt
New dds.txt log.


A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix. This tool is not a toy and not for everyday use.

Microsoft Windows Insider MVP 2016-2017

Microsoft MVP Consumer Security 2008-2015
UNITE member since 2006
unite_blue.png

Provided malware removal related instructions are meant to be used in the correspondent user's case only. If you have similar symptoms create own topic instead of following instructions given to some other, please.


#5 james3434

james3434
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:02:15 AM

Posted 17 October 2009 - 06:31 AM

DDS (Ver_09-09-29.01) - NTFSx86
Run by Compaq_Owner at 7:11:17.15 on Sat 10/17/2009
Internet Explorer: 7.0.5730.11 BrowserJavaVersion: 1.6.0_11
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1790.1098 [GMT -7:00]

AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

============== Running Processes ===============

C:\WINDOWS\system32\savedump.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\system32\svchost -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\SteelSeries\World of Warcraft MMO Gaming Mouse\WoWMHID.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\TrojanHunter 5.2\THGuard.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe
C:\Program Files\NETGEAR WG311v2 Adapter\wlancfg5.exe
C:\Program Files\Xfire\xfire.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\ALCXMNTR.EXE
c:\windows\system\hpsysdrv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Compaq_Owner\Desktop\dds.scr
C:\WINDOWS\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q405&bd=presario&pf=desktop&parm1=seconduser
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mStart Page = hxxp://www.google.com
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q405&bd=presario&pf=desktop&parm1=seconduser
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://as.starware.com/dp/search?x=wKX1ILEOi+UdWpSlz2q9Dzn13Emww/YwQpPqaywhO+9aQX24uDUGBd/Qh1n99F63CHDmKA2KK6gVu+V1+EvZVhGZ/aJfrSrrLCQ0cZJBMXxiJK7b73nWLbW8z033dftG
uURLSearchHooks: H - No File
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar1.dll
TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File
TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
mRun: [PCDrProfiler]
mRun: [HPBootOp] "c:\program files\hewlett-packard\hp boot optimizer\HPBootOp.exe" /run
mRun: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
mRun: [Desksite CMA] c:\program files\desksite\bin\cma.exe
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [BearShare] "c:\program files\bearshare\BearShare.exe" /pause
mRun: [SpyHunter Security Suite] c:\program files\enigma software group\spyhunter\SpyHunter3.exe
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
mRun: [SteelSeries World of Warcraft MMO Gaming Mouse] c:\program files\steelseries\world of warcraft mmo gaming mouse\WoWMHID.exe
mRun: [nwiz] c:\program files\nvidia corporation\nview\nwiz.exe /install
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [ISTray] "c:\program files\spyware doctor\pctsTray.exe"
mRun: [THGuard] "c:\program files\trojanhunter 5.2\THGuard.exe"
mRun: [xml10] RUNDLL32.EXE c:\windows\system32\xml_inc.dll,i
mRun: [71614423] c:\docume~1\alluse~1\applic~1\71614423\71614423.exe
mRun: [combofix] c:\windows\system32\cf21387.exe /c c:\combofix\Combobatch.bat
StartupFolder: c:\docume~1\compaq~1\startm~1\programs\startup\xfire.lnk - c:\program files\xfire\xfire.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\compaq~1.lnk - c:\program files\compaq connections\5577497\program\Compaq Connections.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\netgea~1.lnk - c:\program files\netgear wg311v2 adapter\wlancfg5.exe
IE: &Google Search - c:\program files\google\GoogleToolbar1.dll/cmsearch.html
IE: &Translate English Word - c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
IE: Add To Compaq Organize... - c:\progra~1\hewlet~1\compaq~1\bin/module.main/favorites\ie_add_to.html
IE: Backward Links - c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
IE: Cached Snapshot of Page - c:\program files\google\GoogleToolbar1.dll/cmcache.html
IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office11\EXCEL.EXE/3000
IE: Similar Pages - c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
IE: Translate Page into English - c:\program files\google\GoogleToolbar1.dll/cmtrans.html
IE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - c:\program files\aim\aim.exe
IE: {E2D4D26B-0180-43a4-B05F-462D6D54C789} - c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\iebutton\support.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/8/b/d/8bd77752-5704-4d68-a152-f7252adaa4f2/LegitCheckControl.cab
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} - hxxp://www.srtest.com/srl_bin/sysreqlab3.cab
DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} - hxxp://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
DPF: {2E28242B-A689-11D4-80F2-0040266CBB8D} - hxxp://www.cherrytreeinn.com:8080/kxhcm10.ocx
DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\yinsthelper.dll
DPF: {5D6F45B3-9043-443D-A792-115447494D24} - hxxp://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - hxxp://messenger.zone.msn.com/binary/ZIntro.cab47946.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: {DA758BB1-5F89-4465-975F-8D7179A4BCF3} - hxxp://messenger.zone.msn.com/binary/WoF.cab31267.cab
DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} - hxxp://messenger.zone.msn.com/binary/Chess.cab31267.cab
TCP: {E3FE6EC7-6AA0-4C85-BBCD-330327A09983} = 192.168.1.114,192.168.1.130
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Notify: AtiExtEvent - Ati2evxx.dll
Notify: avgrsstarter - avgrsstx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: {E60A0B68-353A-81DD-ED09-2A8101A6DFBA} - No File

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\compaq~1\applic~1\mozilla\firefox\profiles\p89swnuz.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - component: c:\program files\avg\avg8\firefox\components\avgssff.dll
FF - plugin: c:\documents and settings\compaq_owner\application data\mozilla\firefox\profiles\p89swnuz.default\extensions\npdyyno@dyyno.com\plugins\npDyyno.dll
FF - plugin: c:\documents and settings\compaq_owner\application data\mozilla\plugins\npoctoshape.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}

============= SERVICES / DRIVERS ===============

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-9-8 130936]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-5-11 335240]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-5-11 27784]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-5-11 108552]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2009-5-11 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-5-11 297752]
R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\spyware doctor\pctsAuxs.exe [2009-9-8 348752]
S2 OneStepSrch Service;OneStepSrch Service;c:\documents and settings\all users\application data\onestepsrch\onestep210.exe [2009-8-25 4608]
S2 otywkjbwlni;otywkjbwlni;\??\c:\windows\system32\drivers\aposagtrsf.sys --> c:\windows\system32\drivers\aposagtrsf.sys [?]
S2 sdCoreService;PC Tools Security Service;c:\program files\spyware doctor\pctsSvc.exe [2009-9-8 1097096]
S3 Mo3Fltr;MMO Mouse;c:\windows\system32\drivers\Mo3Fltr.sys [2009-6-28 11136]
S3 zsi_fmw;Stiletto Firmware Recovery;c:\windows\system32\drivers\zsi_fmw.sys --> c:\windows\system32\drivers\zsi_fmw.sys [?]
S3 zsi_zap;Stiletto ZAP Recovery Driver;c:\windows\system32\drivers\zsi_zap.sys --> c:\windows\system32\drivers\zsi_zap.sys [?]

=============== Created Last 30 ================

2009-10-17 06:31 236,544 a------- c:\windows\PEV.exe
2009-10-17 06:31 161,792 a------- c:\windows\SWREG.exe
2009-10-17 06:31 98,816 a------- c:\windows\sed.exe
2009-10-17 06:31 <DIR> --ds---- C:\ComboFix
2009-10-17 06:31 388,608 a------- c:\windows\system32\CF21387.exe
2009-09-27 03:13 65,536 a------- c:\windows\system32\xml_inc.dll
2009-09-25 15:20 41,872 a------- c:\windows\system32\xfcodec.dll

==================== Find3M ====================

2009-08-18 09:47 335,240 a------- c:\windows\system32\drivers\avgldx86.sys
2009-08-18 09:47 11,952 a------- c:\windows\system32\avgrsstx.dll
2009-08-13 08:16 512,000 a------- c:\windows\system32\dllcache\jscript.dll
2009-08-06 19:24 327,896 a------- c:\windows\system32\dllcache\wucltui.dll
2009-08-06 19:24 209,632 a------- c:\windows\system32\dllcache\wuweb.dll
2009-08-06 19:24 35,552 a------- c:\windows\system32\dllcache\wups.dll
2009-08-06 19:24 53,472 a------- c:\windows\system32\dllcache\wuauclt.exe
2009-08-06 19:24 96,480 a------- c:\windows\system32\dllcache\cdm.dll
2009-08-06 19:23 575,704 a------- c:\windows\system32\dllcache\wuapi.dll
2009-08-06 19:23 1,929,952 a------- c:\windows\system32\dllcache\wuaueng.dll
2009-08-05 02:11 204,800 a------- c:\windows\system32\mswebdvd.dll
2009-08-05 02:11 204,800 a------- c:\windows\system32\dllcache\mswebdvd.dll
2008-11-16 10:57 30 a------- c:\documents and settings\compaq_owner\jagex_runescape_preferences.dat
2004-07-02 13:19 40,960 a------- c:\windows\inf\wg311v2\imdinst.exe
2004-06-18 00:41 386,688 a------- c:\windows\inf\wg311v2\netwg311_XP.sys
2004-04-04 14:07 84,912 a------- c:\windows\inf\wg311v2\FwRad17.bin
2004-04-04 14:07 83,320 a------- c:\windows\inf\wg311v2\FwRad16.bin
2004-02-04 13:53 62,865 a------- c:\windows\inf\wg311v2\odysseyIM3.sys
2004-02-04 13:53 12,739 a------- c:\windows\inf\wg311v2\odNetInstall.dll
2006-12-24 17:35 22 a--sh--- c:\windows\sminst\HPCD.sys

============= FINISH: 7:12:30.15 ===============

it did not give me the option to save a .txt for combofix

Attached Files



#6 Blade81

Blade81

    Bleepin' Rocker


  • Malware Response Team
  • 6,465 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:10:15 AM

Posted 17 October 2009 - 06:34 AM

Kindly make sure all your protection software is disabled and then run ComboFix again. If it still doesn't create a report, run in safe mode.

Microsoft Windows Insider MVP 2016-2017

Microsoft MVP Consumer Security 2008-2015
UNITE member since 2006
unite_blue.png

Provided malware removal related instructions are meant to be used in the correspondent user's case only. If you have similar symptoms create own topic instead of following instructions given to some other, please.


#7 james3434

james3434
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:02:15 AM

Posted 17 October 2009 - 06:32 PM

sorry about that,



ComboFix 09-10-16.09 - Compaq_Owner 10/17/2009 18:57.2.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1790.1266 [GMT -7:00]
Running from: c:\documents and settings\Compaq_Owner\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\COMPAQ~1\LOCALS~1\Temp\IadHide5.dll
c:\documents and settings\Compaq_Owner\Local Settings\Temp\IadHide5.dll
.
---- Previous Run -------
.
c:\documents and settings\All Users\Application Data\71614423
c:\documents and settings\All Users\Application Data\71614423\71614423.exe
c:\recycler\S-1-5-21-117609710-484061587-682003330-1003
c:\windows\system32\config\systemprofile\Start Menu\Programs\Windows Police Pro
c:\windows\system32\drivers\kbiwkmivkmpvwm.sys
c:\windows\system32\images
c:\windows\system32\images\i1.gif
c:\windows\system32\images\i2.gif
c:\windows\system32\images\i3.gif
c:\windows\system32\images\j1.gif
c:\windows\system32\images\j2.gif
c:\windows\system32\images\j3.gif
c:\windows\system32\images\jj1.gif
c:\windows\system32\images\jj2.gif
c:\windows\system32\images\jj3.gif
c:\windows\system32\images\l1.gif
c:\windows\system32\images\l2.gif
c:\windows\system32\images\l3.gif
c:\windows\system32\images\pix.gif
c:\windows\system32\images\t1.gif
c:\windows\system32\images\t2.gif
c:\windows\system32\images\up1.gif
c:\windows\system32\images\up2.gif
c:\windows\system32\images\w1.gif
c:\windows\system32\images\w11.gif
c:\windows\system32\images\w2.gif
c:\windows\system32\images\w3.gif
c:\windows\system32\images\w3.jpg
c:\windows\system32\images\wt1.gif
c:\windows\system32\images\wt2.gif
c:\windows\system32\images\wt3.gif
c:\windows\system32\kbiwkmaeylvarv.dat
c:\windows\system32\kbiwkmndorgrkl.dll
c:\windows\system32\kbiwkmnywohumk.dll
c:\windows\system32\kbiwkmqgidoroc.dll
c:\windows\system32\kbiwkmqiircxeu.dat
c:\windows\system32\kbiwkmqjxjyijk.dll
c:\windows\system32\kbiwkmqojecwya.dll
c:\windows\viassary-hp.reg

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_kbiwkmjlaboesb
-------\Legacy_kbiwkmjlaboesb
-------\Legacy_TDSSSERV.SYS
-------\Legacy_ANTIPPRO2009_100
-------\Service_AntipPro2009_100


((((((((((((((((((((((((( Files Created from 2009-09-18 to 2009-10-18 )))))))))))))))))))))))))))))))
.

2009-09-27 10:13 . 2009-09-27 10:13 65536 ----a-w- c:\windows\system32\xml_inc.dll
2009-09-25 22:20 . 2009-09-25 22:20 41872 ----a-w- c:\windows\system32\xfcodec.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-16 03:52 . 2008-02-11 23:01 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\Xfire
2009-10-15 04:59 . 2008-02-11 23:01 -------- d-----w- c:\program files\Xfire
2009-10-13 15:43 . 2009-05-03 00:42 -------- d-----w- c:\program files\World of Warcraft
2009-10-11 00:44 . 2005-12-18 16:08 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\LimeWire
2009-10-06 19:13 . 2006-06-20 00:25 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment
2009-10-06 19:00 . 2007-12-15 02:14 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\Fast Torrent
2009-10-06 17:57 . 2008-04-23 21:30 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-09-12 03:06 . 2009-08-26 02:00 -------- d-----w- c:\program files\Fast Torrent
2009-09-10 22:41 . 2009-09-10 22:41 102560 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-09-09 16:36 . 2009-09-09 16:36 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\TrojanHunter
2009-09-09 13:11 . 2009-09-09 12:24 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-09-09 12:27 . 2009-09-09 12:27 -------- d-----w- c:\program files\TrojanHunter 5.2
2009-09-09 12:27 . 2009-09-09 12:27 -------- d-----w- c:\program files\SpywareBlaster
2009-09-09 12:24 . 2009-09-09 12:24 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-09-09 12:17 . 2009-09-09 12:17 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\Uniblue
2009-09-09 02:57 . 2009-09-09 02:40 -------- d-----w- c:\program files\Spyware Doctor
2009-09-09 02:42 . 2009-09-09 02:40 -------- d-----w- c:\program files\Common Files\PC Tools
2009-09-09 02:40 . 2009-09-09 02:40 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\PC Tools
2009-09-09 02:40 . 2009-09-09 02:40 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools
2009-09-05 04:16 . 2009-09-05 04:16 -------- d-----w- c:\program files\Red Kawa
2009-08-31 00:35 . 2009-05-12 03:39 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2009-08-31 00:35 . 2009-08-31 00:33 -------- d-sh--w- c:\documents and settings\NetworkService\Application Data\lowsec
2009-08-30 04:24 . 2009-08-30 04:24 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\Octoshape
2009-08-30 04:17 . 2008-10-31 04:04 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-08-26 02:03 . 2009-08-26 02:03 -------- d-----w- c:\documents and settings\All Users\Application Data\OneStepSrch
2009-08-19 23:36 . 2009-08-19 23:36 -------- d-----w- c:\documents and settings\All Users\Application Data\Blizzard Entertainment
2009-08-18 16:47 . 2009-05-12 03:40 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-08-18 16:47 . 2009-05-12 03:40 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-08-18 16:47 . 2009-05-12 03:40 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-08-09 16:23 . 2005-11-24 21:06 32800 ----a-w- c:\documents and settings\Compaq_Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-07 02:24 . 2004-08-04 05:00 327896 ----a-w- c:\windows\system32\wucltui.dll
2009-08-07 02:24 . 2004-08-04 05:00 209632 ----a-w- c:\windows\system32\wuweb.dll
2009-08-07 02:24 . 2005-05-26 12:16 44768 ----a-w- c:\windows\system32\wups2.dll
2009-08-07 02:24 . 2004-08-04 05:00 35552 ----a-w- c:\windows\system32\wups.dll
2009-08-07 02:24 . 2004-08-04 05:00 53472 ----a-w- c:\windows\system32\wuauclt.exe
2009-08-07 02:24 . 2004-08-04 05:00 96480 ----a-w- c:\windows\system32\cdm.dll
2009-08-07 02:23 . 2004-08-04 05:00 575704 ----a-w- c:\windows\system32\wuapi.dll
2009-08-07 02:23 . 2004-08-04 05:00 1929952 ----a-w- c:\windows\system32\wuaueng.dll
2009-08-05 09:11 . 2004-08-04 05:00 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-04 13:58 . 2004-08-04 12:00 2136064 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-08-04 13:13 . 2004-08-04 12:00 2015744 ----a-w- c:\windows\system32\ntkrnlpa.exe
2009-08-03 20:36 . 2008-10-31 04:04 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-03 20:36 . 2008-10-31 04:04 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2006-12-25 00:35 . 2006-12-25 00:35 22 --sha-w- c:\windows\SMINST\HPCD.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2005-02-25 245760]
"LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2005-05-10 253952]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-12 49152]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-01-17 185872]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-06 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-01-06 290088]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-18 136600]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-10-17 2025752]
"SteelSeries World of Warcraft MMO Gaming Mouse"="c:\program files\SteelSeries\World of Warcraft MMO Gaming Mouse\WoWMHID.exe" [2009-05-13 414720]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2009-07-09 1657376]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-07-14 13877248]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-07-14 86016]
"ISTray"="c:\program files\Spyware Doctor\pctsTray.exe" [2009-07-23 1181064]
"THGuard"="c:\program files\TrojanHunter 5.2\THGuard.exe" [2009-08-27 1063072]
"xml10"="c:\windows\system32\xml_inc.dll" [2009-09-27 65536]

c:\documents and settings\Compaq_Owner\Start Menu\Programs\Startup\
Xfire.lnk - c:\program files\Xfire\xfire.exe [2009-9-25 3266448]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Compaq Connections.lnk - c:\program files\Compaq Connections\5577497\Program\Compaq Connections.exe [2005-8-26 36903]
NETGEAR WG311v2 Smart Configuration.lnk - c:\program files\NETGEAR WG311v2 Adapter\wlancfg5.exe [2004-10-14 450560]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-08-18 16:47 11952 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Compaq Connections\\5577497\\Program\\Compaq Connections.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Documents and Settings\\Compaq_Owner\\My Documents\\filelib\\jamesz47\\TibiCam\\TibiCAM.exe"=
"c:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\AIM\\aim.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Documents and Settings\\Compaq_Owner\\Local Settings\\Application Data\\Dyyno Receiver\\DPPM.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\Program Files\\Xfire\\xfire.exe"=
"c:\\Program Files\\World of Warcraft\\Launcher.exe"=
"c:\\My Downloads\\World of Warcraft Public Test\\WoW-0.3.0.10522-enUS-ptr-downloader.exe"=
"c:\\My Downloads\\World of Warcraft Public Test\\Launcher.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\My Downloads\\World of Warcraft Public Test\\WoW-0.3.0.10522-to-0.3.0.10554-enUS-ptr-downloader.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"38416:TCP"= 38416:TCP:limeiwre

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [9/8/2009 7:40 PM 130936]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [5/11/2009 8:40 PM 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [5/11/2009 8:40 PM 108552]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [5/11/2009 8:39 PM 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [5/11/2009 8:39 PM 297752]
R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [9/8/2009 7:40 PM 348752]
S2 OneStepSrch Service;OneStepSrch Service;c:\documents and settings\All Users\Application Data\OneStepSrch\onestep210.exe [8/25/2009 7:03 PM 4608]
S2 otywkjbwlni;otywkjbwlni;\??\c:\windows\system32\drivers\aposagtrsf.sys --> c:\windows\system32\drivers\aposagtrsf.sys [?]
S3 Mo3Fltr;MMO Mouse;c:\windows\system32\drivers\Mo3Fltr.sys [6/28/2009 8:38 PM 11136]
S3 zsi_fmw;Stiletto Firmware Recovery;c:\windows\system32\Drivers\zsi_fmw.sys --> c:\windows\system32\Drivers\zsi_fmw.sys [?]
S3 zsi_zap;Stiletto ZAP Recovery Driver;c:\windows\system32\Drivers\zsi_zap.sys --> c:\windows\system32\Drivers\zsi_zap.sys [?]

--- Other Services/Drivers In Memory ---

*Deregistered* - mchInjDrv
.
Contents of the 'Scheduled Tasks' folder
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q405&bd=presario&pf=desktop&parm1=seconduser
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mStart Page = hxxp://www.google.com
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q405&bd=presario&pf=desktop&parm1=seconduser
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://as.starware.com/dp/search?x=wKX1ILEOi+UdWpSlz2q9Dzn13Emww/YwQpPqaywhO+9aQX24uDUGBd/Qh1n99F63CHDmKA2KK6gVu+V1+EvZVhGZ/aJfrSrrLCQ0cZJBMXxiJK7b73nWLbW8z033dftG
IE: &Google Search - c:\program files\Google\GoogleToolbar1.dll/cmsearch.html
IE: &Translate English Word - c:\program files\Google\GoogleToolbar1.dll/cmwordtrans.html
IE: Add To Compaq Organize... - c:\progra~1\HEWLET~1\COMPAQ~1\bin/module.main/favorites\ie_add_to.html
IE: Backward Links - c:\program files\Google\GoogleToolbar1.dll/cmbacklinks.html
IE: Cached Snapshot of Page - c:\program files\Google\GoogleToolbar1.dll/cmcache.html
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
IE: Similar Pages - c:\program files\Google\GoogleToolbar1.dll/cmsimilar.html
IE: Translate Page into English - c:\program files\Google\GoogleToolbar1.dll/cmtrans.html
TCP: {E3FE6EC7-6AA0-4C85-BBCD-330327A09983} = 192.168.1.114,192.168.1.130
DPF: {2E28242B-A689-11D4-80F2-0040266CBB8D} - hxxp://www.cherrytreeinn.com:8080/kxhcm10.ocx
FF - ProfilePath - c:\documents and settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\p89swnuz.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - plugin: c:\documents and settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\p89swnuz.default\extensions\NPDyyno@dyyno.com\plugins\npDyyno.dll
FF - plugin: c:\documents and settings\Compaq_Owner\Application Data\Mozilla\plugins\npoctoshape.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-Desksite CMA - c:\program files\desksite\bin\cma.exe
HKLM-Run-BearShare - c:\program files\BearShare\BearShare.exe
HKLM-Run-71614423 - c:\docume~1\ALLUSE~1\APPLIC~1\71614423\71614423.exe
HKLM-Run-PCDrProfiler - (no file)
ShellExecuteHooks-{E60A0B68-353A-81DD-ED09-2A8101A6DFBA} - (no file)
AddRemove-OneStepSrch - c:\program files\OneStepSrch\uninstall.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-17 19:05
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-2945444318-3431521472-842641818-1009\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{63189709-DA5A-0EC1-CBFA-94BB7FB126CA}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"abalnllekpakdgeckiiejkcccjbmhbhmch"=hex:61,61,00,00
"bbalnllekpakdgeckijeijdihehmhpepajkj"=hex:61,61,00,00
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1020)
c:\windows\system32\Ati2evxx.dll
c:\program files\Enigma Software Group\SpyHunter\SpyHunterMonitor.dll

- - - - - - - > 'lsass.exe'(1076)
c:\program files\Enigma Software Group\SpyHunter\SpyHunterMonitor.dll

- - - - - - - > 'explorer.exe'(3508)
c:\windows\system32\WININET.dll
c:\program files\Enigma Software Group\SpyHunter\SpyHunterMonitor.dll
c:\program files\Xfire\xfire_toucan_39439.dll
c:\windows\system32\ieframe.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCR80.dll
c:\windows\system32\mshtml.dll
c:\windows\system32\xml_inc.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\browselc.dll
c:\program files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\HPZipm12.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\program files\AVG\AVG8\avgcsrvx.exe
c:\windows\system32\wscntfy.exe
c:\program files\Enigma Software Group\SpyHunter\SpyHunter3.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\rundll32.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\ALCXMNTR.EXE
c:\windows\system\hpsysdrv.exe
c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
.
**************************************************************************
.
Completion time: 2009-10-18 19:17 - machine was rebooted
ComboFix-quarantined-files.txt 2009-10-18 02:17

Pre-Run: 3,923,333,120 bytes free
Post-Run: 3,824,832,512 bytes free

286 --- E O F --- 2009-10-17 21:44

#8 Blade81

Blade81

    Bleepin' Rocker


  • Malware Response Team
  • 6,465 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:10:15 AM

Posted 18 October 2009 - 04:53 AM

Hi,

I recommend to uninstall Limewire and other possible p2p file sharing programs installed there. Those with dubious downloads cause risk to your system.


Ad-Aware SE is not supported anymore and should be replaced with Ad-Aware AE.


Open notepad and copy/paste the text in the quotebox below into it:

http://www.bleepingcomputer.com/forums/t/262478/browser-hijacker-corrupt-file-and-possible-hidden-keylogger/?p=1462782
Driver::
otywkjbwlni
File::
c:\windows\system32\drivers\aposagtrsf.sys
DDS::
uSearchURL,(Default) = hxxp://as.starware.com/dp/search?x=wKX1ILEOi+UdWpSlz2q9Dzn13Emww/YwQpPqaywhO+9aQX24uDUGBd/Qh1n99F63CHDmKA2KK6gVu+V1+EvZVhGZ/aJfrSrrLCQ0cZJBMXxiJK7b73nWLbW8z033dftG
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File
TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
SEH: {E60A0B68-353A-81DD-ED09-2A8101A6DFBA} - No File
Collect::
c:\windows\system32\xml_inc.dll
Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"xml10"=-
Regnull::
[HKEY_USERS\S-1-5-21-2945444318-3431521472-842641818-1009\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{63189709-DA5A-0EC1-CBFA-94BB7FB126CA}*]


Save this as
CFScript

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine. This tool is not a toy and not for everyday use.

Posted Image

Close all browser windows and refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log.


Uninstall old Adobe Reader versions and get the latest one (9.2) here or get Foxit Reader here. Make sure you don't install toolbar if choose Foxit Reader! You may also check free readers introduced here.


Uninstall your current Adobe shockwave player and get the fresh one here if needed.

Uninstall vulnerable Flash versions by following instructions here. Fresh version can be obtained here.


Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update to the latest version...

Updating Java:
  • Download the latest version of Java Runtime Environment (JRE) 6 Update 16.
  • Click the
    Download
    button to the right.
  • Select Windows on platform combobox and check the box that says:
    Accept License Agreement. Click continue.
  • The page will refresh.
  • Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
  • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u16-windows-i586-p.exe to install the newest version. Uncheck Carbonite online backup trial if it's offered there.


Download ATF (Atribune Temp File) Cleanerę by Atribune to your desktop.

Double-click ATF Cleaner.exe to open it

Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache

*The other boxes are optional*
Then click the Empty Selected button.

If you use Firefox:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

If you use Opera:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Click Exit on the Main menu to close the program.


Please run an online scan with Kaspersky Online Scanner as instructed in the screenshot here.


Post back its report, a fresh dds.txt log and above mentioned ComboFix resultant log.

Microsoft Windows Insider MVP 2016-2017

Microsoft MVP Consumer Security 2008-2015
UNITE member since 2006
unite_blue.png

Provided malware removal related instructions are meant to be used in the correspondent user's case only. If you have similar symptoms create own topic instead of following instructions given to some other, please.


#9 james3434

james3434
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:02:15 AM

Posted 19 October 2009 - 12:00 AM

the kaspersky scanner keeps giving me an error message saying my key is expired

#10 Blade81

Blade81

    Bleepin' Rocker


  • Malware Response Team
  • 6,465 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:10:15 AM

Posted 19 October 2009 - 08:17 AM

Hi,

Let's try other scanner.

* Go here to run an online scanner from ESET.
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • Make sure that the option Remove found threats is not checked.
  • Click Scan
  • Wait for the scan to finish
  • Use notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
  • Post back its report.

Microsoft Windows Insider MVP 2016-2017

Microsoft MVP Consumer Security 2008-2015
UNITE member since 2006
unite_blue.png

Provided malware removal related instructions are meant to be used in the correspondent user's case only. If you have similar symptoms create own topic instead of following instructions given to some other, please.


#11 james3434

james3434
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:02:15 AM

Posted 19 October 2009 - 05:57 PM

alright thanks, here it is the DDS report and the ESET


DDS report
DDS (Ver_09-09-29.01) - NTFSx86
Run by Compaq_Owner at 18:43:51.06 on Mon 10/19/2009
Internet Explorer: 7.0.5730.11 BrowserJavaVersion: 1.6.0_16
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1790.1176 [GMT -7:00]

AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

============== Running Processes ===============

C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\SteelSeries\World of Warcraft MMO Gaming Mouse\WoWMHID.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe
C:\Program Files\NETGEAR WG311v2 Adapter\wlancfg5.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\ALCXMNTR.EXE
c:\windows\system\hpsysdrv.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\Xfire\Xfire.exe
C:\Documents and Settings\Compaq_Owner\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q405&bd=presario&pf=desktop&parm1=seconduser
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mStart Page = hxxp://www.google.com
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q405&bd=presario&pf=desktop&parm1=seconduser
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://as.starware.com/dp/search?x=wKX1ILEOi+UdWpSlz2q9Dzn13Emww/YwQpPqaywhO+9aQX24uDUGBd/Qh1n99F63CHDmKA2KK6gVu+V1+EvZVhGZ/aJfrSrrLCQ0cZJBMXxiJK7b73nWLbW8z033dftG
uURLSearchHooks: H - No File
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar1.dll
mRun: [HPBootOp] "c:\program files\hewlett-packard\hp boot optimizer\HPBootOp.exe" /run
mRun: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
mRun: [SteelSeries World of Warcraft MMO Gaming Mouse] c:\program files\steelseries\world of warcraft mmo gaming mouse\WoWMHID.exe
mRun: [nwiz] c:\program files\nvidia corporation\nview\nwiz.exe /install
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [ISTray] "c:\program files\spyware doctor\pctsTray.exe"
mRun: [THGuard] "c:\program files\trojanhunter 5.2\THGuard.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
StartupFolder: c:\docume~1\compaq~1\startm~1\programs\startup\xfire.lnk - c:\program files\xfire\xfire.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\compaq~1.lnk - c:\program files\compaq connections\5577497\program\Compaq Connections.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\netgea~1.lnk - c:\program files\netgear wg311v2 adapter\wlancfg5.exe
IE: &Google Search - c:\program files\google\GoogleToolbar1.dll/cmsearch.html
IE: &Translate English Word - c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
IE: Add To Compaq Organize... - c:\progra~1\hewlet~1\compaq~1\bin/module.main/favorites\ie_add_to.html
IE: Backward Links - c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
IE: Cached Snapshot of Page - c:\program files\google\GoogleToolbar1.dll/cmcache.html
IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office11\EXCEL.EXE/3000
IE: Similar Pages - c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
IE: Translate Page into English - c:\program files\google\GoogleToolbar1.dll/cmtrans.html
IE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - c:\program files\aim\aim.exe
IE: {E2D4D26B-0180-43a4-B05F-462D6D54C789} - c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\iebutton\support.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/8/b/d/8bd77752-5704-4d68-a152-f7252adaa4f2/LegitCheckControl.cab
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} - hxxp://www.srtest.com/srl_bin/sysreqlab3.cab
DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} - hxxp://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
DPF: {2E28242B-A689-11D4-80F2-0040266CBB8D} - hxxp://www.cherrytreeinn.com:8080/kxhcm10.ocx
DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\yinsthelper.dll
DPF: {5D6F45B3-9043-443D-A792-115447494D24} - hxxp://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - hxxp://messenger.zone.msn.com/binary/ZIntro.cab47946.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: {DA758BB1-5F89-4465-975F-8D7179A4BCF3} - hxxp://messenger.zone.msn.com/binary/WoF.cab31267.cab
DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} - hxxp://messenger.zone.msn.com/binary/Chess.cab31267.cab
TCP: {E3FE6EC7-6AA0-4C85-BBCD-330327A09983} = 192.168.1.114,192.168.1.130
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Notify: AtiExtEvent - Ati2evxx.dll
Notify: avgrsstarter - avgrsstx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\compaq~1\applic~1\mozilla\firefox\profiles\p89swnuz.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - component: c:\program files\avg\avg8\firefox\components\avgssff.dll
FF - plugin: c:\documents and settings\compaq_owner\application data\mozilla\firefox\profiles\p89swnuz.default\extensions\npdyyno@dyyno.com\plugins\npDyyno.dll
FF - plugin: c:\documents and settings\compaq_owner\application data\mozilla\plugins\npoctoshape.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}

============= SERVICES / DRIVERS ===============

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-9-8 130936]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-5-11 335240]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-5-11 27784]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-5-11 108552]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2009-5-11 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-5-11 297752]
R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\spyware doctor\pctsAuxs.exe [2009-9-8 348752]
S2 OneStepSrch Service;OneStepSrch Service;c:\documents and settings\all users\application data\onestepsrch\onestep210.exe [2009-8-25 4608]
S2 sdCoreService;PC Tools Security Service;c:\program files\spyware doctor\pctsSvc.exe [2009-9-8 1097096]
S3 Mo3Fltr;MMO Mouse;c:\windows\system32\drivers\Mo3Fltr.sys [2009-6-28 11136]
S3 zsi_fmw;Stiletto Firmware Recovery;c:\windows\system32\drivers\zsi_fmw.sys --> c:\windows\system32\drivers\zsi_fmw.sys [?]
S3 zsi_zap;Stiletto ZAP Recovery Driver;c:\windows\system32\drivers\zsi_zap.sys --> c:\windows\system32\drivers\zsi_zap.sys [?]

=============== Created Last 30 ================

2009-10-19 13:12 <DIR> --d----- c:\program files\ESET
2009-10-18 14:57 73,728 a------- c:\windows\system32\javacpl.cpl
2009-10-17 06:31 236,544 a------- c:\windows\PEV.exe
2009-10-17 06:31 161,792 a------- c:\windows\SWREG.exe
2009-10-17 06:31 98,816 a------- c:\windows\sed.exe
2009-10-14 16:58 41,872 a------- c:\windows\system32\xfcodec.dll
2009-09-27 03:13 65,536 a------- c:\windows\system32\xml_inc.dll

==================== Find3M ====================

2009-10-18 14:57 411,368 a------- c:\windows\system32\deploytk.dll
2009-09-11 07:33 133,632 a------- c:\windows\system32\msv1_0.dll
2009-09-11 07:33 133,632 a------- c:\windows\system32\dllcache\msv1_0.dll
2009-09-04 13:45 58,880 a------- c:\windows\system32\msasn1.dll
2009-09-04 13:45 58,880 a------- c:\windows\system32\dllcache\msasn1.dll
2009-08-26 01:16 247,326 a------- c:\windows\system32\strmdll.dll
2009-08-26 01:16 247,326 a------- c:\windows\system32\dllcache\strmdll.dll
2009-08-18 09:47 11,952 a------- c:\windows\system32\avgrsstx.dll
2009-08-13 08:16 512,000 a------- c:\windows\system32\dllcache\jscript.dll
2009-08-06 19:24 327,896 a------- c:\windows\system32\dllcache\wucltui.dll
2009-08-06 19:24 209,632 a------- c:\windows\system32\dllcache\wuweb.dll
2009-08-06 19:24 35,552 a------- c:\windows\system32\dllcache\wups.dll
2009-08-06 19:24 53,472 a------- c:\windows\system32\dllcache\wuauclt.exe
2009-08-06 19:24 96,480 a------- c:\windows\system32\dllcache\cdm.dll
2009-08-06 19:23 575,704 a------- c:\windows\system32\dllcache\wuapi.dll
2009-08-06 19:23 1,929,952 a------- c:\windows\system32\dllcache\wuaueng.dll
2009-08-05 02:11 204,800 a------- c:\windows\system32\mswebdvd.dll
2009-08-05 02:11 204,800 a------- c:\windows\system32\dllcache\mswebdvd.dll
2009-08-04 07:00 2,180,352 a------- c:\windows\system32\dllcache\ntoskrnl.exe
2009-08-04 06:58 2,136,064 a------- c:\windows\system32\dllcache\ntkrnlmp.exe
2009-08-04 06:58 2,136,064 -------- c:\windows\system32\ntoskrnl.exe
2009-08-04 06:13 2,015,744 a------- c:\windows\system32\dllcache\ntkrpamp.exe
2009-08-04 06:13 2,015,744 -------- c:\windows\system32\ntkrnlpa.exe
2009-08-04 06:13 2,057,728 a------- c:\windows\system32\dllcache\ntkrnlpa.exe
2008-11-16 10:57 30 a------- c:\documents and settings\compaq_owner\jagex_runescape_preferences.dat
2004-07-02 13:19 40,960 a------- c:\windows\inf\wg311v2\imdinst.exe
2004-06-18 00:41 386,688 a------- c:\windows\inf\wg311v2\netwg311_XP.sys
2004-04-04 14:07 84,912 a------- c:\windows\inf\wg311v2\FwRad17.bin
2004-04-04 14:07 83,320 a------- c:\windows\inf\wg311v2\FwRad16.bin
2004-02-04 13:53 62,865 a------- c:\windows\inf\wg311v2\odysseyIM3.sys
2004-02-04 13:53 12,739 a------- c:\windows\inf\wg311v2\odNetInstall.dll
2006-12-24 17:35 22 a--sh--- c:\windows\sminst\HPCD.sys

============= FINISH: 18:44:26.34 ===============

ESET scan

ESETSmartInstaller@High as downloader log:
all ok
# version=6
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6050
# api_version=3.0.2
# EOSSerial=be21946810fd7e4a8f691c90030e17dd
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2009-10-19 09:14:43
# local_time=2009-10-19 02:14:43 (-0800, Pacific Daylight Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 2
# compatibility_mode=1026 37 83 95 1935900000000
# scanned=83995
# found=15
# cleaned=0
# scan_time=3303
C:\Documents and Settings\All Users\Application Data\OneStepSrch\onestep210.exe a variant of Win32/Adware.OneStep application 00000000000000000000000000000000 I
C:\Documents and Settings\Compaq_Owner\Incomplete\T-3209657-breath machine momentary sound.mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan 00000000000000000000000000000000 I
C:\Documents and Settings\Compaq_Owner\Incomplete\T-3409352-my own little world 2009.mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan 00000000000000000000000000000000 I
C:\Documents and Settings\Compaq_Owner\Incomplete\T-3545426-dont wanna be your enemy.mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan 00000000000000000000000000000000 I
C:\Documents and Settings\Compaq_Owner\Incomplete\T-3545427-make you freak plus system (high bitrate).mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan 00000000000000000000000000000000 I
C:\Documents and Settings\Compaq_Owner\Incomplete\T-3571623-en la boca de tantos porta.mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan 00000000000000000000000000000000 I
C:\Documents and Settings\Compaq_Owner\Incomplete\T-3870556-historia juanes CD quality.mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan 00000000000000000000000000000000 I
C:\Documents and Settings\Compaq_Owner\Incomplete\T-3877634-theme jurgen vries.mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan 00000000000000000000000000000000 I
C:\Documents and Settings\Compaq_Owner\Incomplete\T-5745425-camera phone game [unreleased rare track].mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan 00000000000000000000000000000000 I
C:\Documents and Settings\Compaq_Owner\Incomplete\T-5745425-historia juanes [unreleased rare track].mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan 00000000000000000000000000000000 I
C:\Documents and Settings\Compaq_Owner\My Documents\LimeWire\Saved\01-dead_poetic-new_medicines.wma WMA/TrojanDownloader.Wimad.NAA trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\Documents and Settings\All Users\Application Data\71614423\71614423.exe.vir a variant of Win32/Kryptik.AVX trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\kbiwkmivkmpvwm.sys.vir a variant of Win32/Olmarik.LR trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{A2578CBA-012A-4EE9-9E3D-27D3F494A2B6}\RP1221\A0307412.sys a variant of Win32/Olmarik.LR trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{A2578CBA-012A-4EE9-9E3D-27D3F494A2B6}\RP1221\A0307440.exe a variant of Win32/Kryptik.AVX trojan 00000000000000000000000000000000 I

Edited by james3434, 19 October 2009 - 06:02 PM.


#12 Blade81

Blade81

    Bleepin' Rocker


  • Malware Response Team
  • 6,465 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:10:15 AM

Posted 20 October 2009 - 04:00 AM

Hi,

Did you ran ComboFix with the script yet? Please post back its resultant log too.

Microsoft Windows Insider MVP 2016-2017

Microsoft MVP Consumer Security 2008-2015
UNITE member since 2006
unite_blue.png

Provided malware removal related instructions are meant to be used in the correspondent user's case only. If you have similar symptoms create own topic instead of following instructions given to some other, please.


#13 james3434

james3434
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:02:15 AM

Posted 22 October 2009 - 05:38 AM

alright here it is with the script, thanks in advance for going out of your way to help me out with this thing

ComboFix 09-10-17.01 - Compaq_Owner 10/22/2009 5:54.4.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1790.1288 [GMT -7:00]
Running from: c:\documents and settings\Compaq_Owner\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Compaq_Owner\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

FILE ::
"c:\windows\system32\drivers\aposagtrsf.sys"

file zipped: c:\windows\system32\xml_inc.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\COMPAQ~1\LOCALS~1\Temp\IadHide5.dll
c:\documents and settings\Compaq_Owner\Local Settings\temp\IadHide5.dll
c:\windows\system32\xml_inc.dll

.
((((((((((((((((((((((((( Files Created from 2009-09-22 to 2009-10-22 )))))))))))))))))))))))))))))))
.

2009-10-19 20:12 . 2009-10-19 20:12 -------- d-----w- c:\program files\ESET
2009-10-18 21:20 . 2009-10-18 21:21 -------- d-----w- c:\program files\Common Files\Adobe
2009-10-14 23:58 . 2009-10-14 23:58 41872 ----a-w- c:\windows\system32\xfcodec.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-22 09:25 . 2008-02-11 23:01 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\Xfire
2009-10-22 09:02 . 2008-02-11 23:01 -------- d-----w- c:\program files\Xfire
2009-10-18 21:57 . 2009-05-18 03:25 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-10-18 21:57 . 2005-08-26 21:41 -------- d-----w- c:\program files\Java
2009-10-18 21:11 . 2006-06-01 00:18 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\Lavasoft
2009-10-13 15:43 . 2009-05-03 00:42 -------- d-----w- c:\program files\World of Warcraft
2009-10-11 00:44 . 2005-12-18 16:08 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\LimeWire
2009-10-06 19:13 . 2006-06-20 00:25 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment
2009-10-06 19:00 . 2007-12-15 02:14 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\Fast Torrent
2009-10-06 17:57 . 2008-04-23 21:30 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-09-12 03:06 . 2009-08-26 02:00 -------- d-----w- c:\program files\Fast Torrent
2009-09-11 14:33 . 2004-08-04 05:00 133632 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-10 22:41 . 2009-09-10 22:41 102560 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-09-09 16:36 . 2009-09-09 16:36 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\TrojanHunter
2009-09-09 13:11 . 2009-09-09 12:24 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-09-09 12:27 . 2009-09-09 12:27 -------- d-----w- c:\program files\TrojanHunter 5.2
2009-09-09 12:27 . 2009-09-09 12:27 -------- d-----w- c:\program files\SpywareBlaster
2009-09-09 12:24 . 2009-09-09 12:24 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-09-09 12:17 . 2009-09-09 12:17 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\Uniblue
2009-09-09 02:57 . 2009-09-09 02:40 -------- d-----w- c:\program files\Spyware Doctor
2009-09-09 02:42 . 2009-09-09 02:40 -------- d-----w- c:\program files\Common Files\PC Tools
2009-09-09 02:40 . 2009-09-09 02:40 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\PC Tools
2009-09-09 02:40 . 2009-09-09 02:40 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools
2009-09-05 04:16 . 2009-09-05 04:16 -------- d-----w- c:\program files\Red Kawa
2009-09-04 20:45 . 2004-08-04 05:00 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-08-31 00:35 . 2009-05-12 03:39 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2009-08-31 00:35 . 2009-08-31 00:33 -------- d-sh--w- c:\documents and settings\NetworkService\Application Data\lowsec
2009-08-30 04:24 . 2009-08-30 04:24 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\Octoshape
2009-08-30 04:17 . 2008-10-31 04:04 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-08-29 07:36 . 2004-08-04 05:00 832512 ----a-w- c:\windows\system32\wininet.dll
2009-08-29 07:36 . 2004-08-04 05:00 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-08-29 07:36 . 2004-08-04 05:00 17408 ----a-w- c:\windows\system32\corpol.dll
2009-08-26 08:16 . 2004-08-04 05:00 247326 ----a-w- c:\windows\system32\strmdll.dll
2009-08-26 02:03 . 2009-08-26 02:03 -------- d-----w- c:\documents and settings\All Users\Application Data\OneStepSrch
2009-08-18 16:47 . 2009-05-12 03:40 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-08-18 16:47 . 2009-05-12 03:40 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-08-18 16:47 . 2009-05-12 03:40 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-08-09 16:23 . 2005-11-24 21:06 32800 ----a-w- c:\documents and settings\Compaq_Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-07 02:24 . 2004-08-04 05:00 327896 ----a-w- c:\windows\system32\wucltui.dll
2009-08-07 02:24 . 2004-08-04 05:00 209632 ----a-w- c:\windows\system32\wuweb.dll
2009-08-07 02:24 . 2005-05-26 12:16 44768 ----a-w- c:\windows\system32\wups2.dll
2009-08-07 02:24 . 2004-08-04 05:00 35552 ----a-w- c:\windows\system32\wups.dll
2009-08-07 02:24 . 2004-08-04 05:00 53472 ------w- c:\windows\system32\wuauclt.exe
2009-08-07 02:24 . 2004-08-04 05:00 96480 ----a-w- c:\windows\system32\cdm.dll
2009-08-07 02:23 . 2004-08-04 05:00 575704 ----a-w- c:\windows\system32\wuapi.dll
2009-08-07 02:23 . 2004-08-04 05:00 1929952 ----a-w- c:\windows\system32\wuaueng.dll
2009-08-05 09:11 . 2004-08-04 05:00 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-04 13:58 . 2004-08-04 12:00 2136064 ------w- c:\windows\system32\ntoskrnl.exe
2009-08-04 13:13 . 2004-08-04 12:00 2015744 ------w- c:\windows\system32\ntkrnlpa.exe
2009-08-03 20:36 . 2008-10-31 04:04 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-03 20:36 . 2008-10-31 04:04 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2006-12-25 00:35 . 2006-12-25 00:35 22 --sha-w- c:\windows\SMINST\HPCD.sys
.

((((((((((((((((((((((((((((( SnapShot_2009-10-18_21.45.26 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-10-22 13:01 . 2009-10-22 13:01 16384 c:\windows\temp\Perflib_Perfdata_258.dat
- 2009-06-08 03:39 . 2008-07-08 13:02 17272 c:\windows\system32\spmsg.dll
+ 2009-06-08 03:39 . 2009-05-26 11:40 17272 c:\windows\system32\spmsg.dll
- 2004-08-04 05:00 . 2009-06-29 16:12 44544 c:\windows\system32\pngfilt.dll
+ 2004-08-04 05:00 . 2009-08-29 07:36 44544 c:\windows\system32\pngfilt.dll
- 2006-11-08 05:03 . 2009-06-29 16:12 52224 c:\windows\system32\msfeedsbs.dll
+ 2006-11-08 05:03 . 2009-08-29 07:36 52224 c:\windows\system32\msfeedsbs.dll
+ 2009-10-18 21:57 . 2009-10-18 21:57 84661 c:\windows\system32\Macromed\Flash\uninstall_plugin.exe
+ 2004-08-04 05:00 . 2009-08-29 07:36 27648 c:\windows\system32\jsproxy.dll
- 2004-08-04 05:00 . 2009-06-29 16:12 27648 c:\windows\system32\jsproxy.dll
- 2006-11-07 11:26 . 2009-06-29 11:07 13824 c:\windows\system32\ieudinit.exe
+ 2006-11-07 11:26 . 2009-08-28 10:28 13824 c:\windows\system32\ieudinit.exe
- 2004-08-04 05:00 . 2009-06-29 16:12 44544 c:\windows\system32\iernonce.dll
+ 2004-08-04 05:00 . 2009-08-29 07:36 44544 c:\windows\system32\iernonce.dll
- 2004-08-04 05:00 . 2009-06-29 11:07 70656 c:\windows\system32\ie4uinit.exe
+ 2004-08-04 05:00 . 2009-08-28 10:28 70656 c:\windows\system32\ie4uinit.exe
- 2006-10-17 19:58 . 2009-06-29 16:12 63488 c:\windows\system32\icardie.dll
+ 2006-10-17 19:58 . 2009-08-29 07:36 63488 c:\windows\system32\icardie.dll
+ 2004-08-04 05:00 . 2009-08-29 07:36 44544 c:\windows\system32\dllcache\pngfilt.dll
- 2004-08-04 05:00 . 2009-06-29 16:12 44544 c:\windows\system32\dllcache\pngfilt.dll
- 2007-05-08 17:05 . 2009-06-29 16:12 52224 c:\windows\system32\dllcache\msfeedsbs.dll
+ 2007-05-08 17:05 . 2009-08-29 07:36 52224 c:\windows\system32\dllcache\msfeedsbs.dll
- 2004-08-04 05:00 . 2009-06-29 16:12 27648 c:\windows\system32\dllcache\jsproxy.dll
+ 2004-08-04 05:00 . 2009-08-29 07:36 27648 c:\windows\system32\dllcache\jsproxy.dll
- 2007-05-08 17:05 . 2009-06-29 11:07 13824 c:\windows\system32\dllcache\ieudinit.exe
+ 2007-05-08 17:05 . 2009-08-28 10:28 13824 c:\windows\system32\dllcache\ieudinit.exe
- 2004-08-04 05:00 . 2009-06-29 16:12 44544 c:\windows\system32\dllcache\iernonce.dll
+ 2004-08-04 05:00 . 2009-08-29 07:36 44544 c:\windows\system32\dllcache\iernonce.dll
- 2004-08-04 05:00 . 2009-06-29 16:12 78336 c:\windows\system32\dllcache\ieencode.dll
+ 2004-08-04 05:00 . 2009-08-29 07:36 78336 c:\windows\system32\dllcache\ieencode.dll
- 2004-08-04 05:00 . 2009-06-29 11:07 70656 c:\windows\system32\dllcache\ie4uinit.exe
+ 2004-08-04 05:00 . 2009-08-28 10:28 70656 c:\windows\system32\dllcache\ie4uinit.exe
- 2007-08-20 10:04 . 2009-06-29 16:12 63488 c:\windows\system32\dllcache\icardie.dll
+ 2007-08-20 10:04 . 2009-08-29 07:36 63488 c:\windows\system32\dllcache\icardie.dll
+ 2004-08-04 05:00 . 2009-08-29 07:36 17408 c:\windows\system32\dllcache\corpol.dll
- 2004-08-04 05:00 . 2009-06-29 16:12 17408 c:\windows\system32\dllcache\corpol.dll
+ 2009-10-22 10:12 . 2009-06-29 16:12 44544 c:\windows\ie7updates\KB974455-IE7\pngfilt.dll
+ 2009-10-22 10:12 . 2009-06-29 16:12 52224 c:\windows\ie7updates\KB974455-IE7\msfeedsbs.dll
+ 2009-10-22 10:12 . 2009-06-29 16:12 27648 c:\windows\ie7updates\KB974455-IE7\jsproxy.dll
+ 2009-10-22 10:12 . 2009-06-29 11:07 13824 c:\windows\ie7updates\KB974455-IE7\ieudinit.exe
+ 2009-10-22 10:12 . 2009-06-29 16:12 44544 c:\windows\ie7updates\KB974455-IE7\iernonce.dll
+ 2009-10-22 10:12 . 2009-06-29 16:12 78336 c:\windows\ie7updates\KB974455-IE7\ieencode.dll
+ 2009-10-22 10:12 . 2009-06-29 11:07 70656 c:\windows\ie7updates\KB974455-IE7\ie4uinit.exe
+ 2009-10-22 10:12 . 2009-06-29 16:12 63488 c:\windows\ie7updates\KB974455-IE7\icardie.dll
+ 2009-10-22 10:12 . 2009-06-29 16:12 17408 c:\windows\ie7updates\KB974455-IE7\corpol.dll
+ 2004-08-04 05:00 . 2009-08-29 07:36 233472 c:\windows\system32\webcheck.dll
- 2004-08-04 05:00 . 2009-06-29 16:12 233472 c:\windows\system32\webcheck.dll
+ 2004-08-04 05:00 . 2009-08-29 07:36 105984 c:\windows\system32\url.dll
- 2004-08-04 05:00 . 2009-06-29 16:12 105984 c:\windows\system32\url.dll
+ 2004-08-04 05:00 . 2009-08-29 07:36 102912 c:\windows\system32\occache.dll
- 2004-08-04 05:00 . 2009-06-29 16:12 102912 c:\windows\system32\occache.dll
+ 2004-08-04 05:00 . 2009-08-29 07:36 671232 c:\windows\system32\mstime.dll
- 2004-08-04 05:00 . 2009-06-29 16:12 671232 c:\windows\system32\mstime.dll
+ 2004-08-04 05:00 . 2009-08-29 07:36 193024 c:\windows\system32\msrating.dll
- 2004-08-04 05:00 . 2009-06-29 16:12 193024 c:\windows\system32\msrating.dll
- 2004-08-04 05:00 . 2009-06-29 16:12 477696 c:\windows\system32\mshtmled.dll
+ 2004-08-04 05:00 . 2009-08-29 07:36 477696 c:\windows\system32\mshtmled.dll
- 2006-11-08 05:03 . 2009-06-29 16:12 459264 c:\windows\system32\msfeeds.dll
+ 2006-11-08 05:03 . 2009-08-29 07:36 459264 c:\windows\system32\msfeeds.dll
+ 2009-07-18 03:21 . 2009-07-18 03:21 257440 c:\windows\system32\Macromed\Flash\NPSWF32_FlashUtil.exe
+ 2009-10-18 21:57 . 2009-10-18 21:57 149280 c:\windows\system32\javaws.exe
+ 2009-10-18 21:57 . 2009-10-18 21:57 145184 c:\windows\system32\javaw.exe
+ 2009-10-18 21:57 . 2009-10-18 21:57 145184 c:\windows\system32\java.exe
- 2006-10-17 19:57 . 2009-06-29 16:12 268288 c:\windows\system32\iertutil.dll
+ 2006-10-17 19:57 . 2009-08-29 07:36 268288 c:\windows\system32\iertutil.dll
- 2004-08-04 05:00 . 2009-06-29 16:12 385024 c:\windows\system32\iedkcs32.dll
+ 2004-08-04 05:00 . 2009-08-29 07:36 385024 c:\windows\system32\iedkcs32.dll
- 2006-10-17 19:27 . 2009-06-29 16:12 380928 c:\windows\system32\ieapfltr.dll
+ 2006-10-17 19:27 . 2009-08-29 07:36 380928 c:\windows\system32\ieapfltr.dll
- 2004-08-04 05:00 . 2009-06-29 08:33 161792 c:\windows\system32\ieakui.dll
+ 2004-08-04 05:00 . 2009-08-27 05:18 161792 c:\windows\system32\ieakui.dll
- 2004-08-04 05:00 . 2009-06-29 16:12 230400 c:\windows\system32\ieaksie.dll
+ 2004-08-04 05:00 . 2009-08-29 07:36 230400 c:\windows\system32\ieaksie.dll
- 2004-08-04 05:00 . 2009-06-29 16:12 153088 c:\windows\system32\ieakeng.dll
+ 2004-08-04 05:00 . 2009-08-29 07:36 153088 c:\windows\system32\ieakeng.dll
+ 2004-08-04 05:00 . 2009-08-29 07:36 133120 c:\windows\system32\extmgr.dll
- 2004-08-04 05:00 . 2009-06-29 16:12 133120 c:\windows\system32\extmgr.dll
- 2004-08-04 05:00 . 2009-06-29 16:12 214528 c:\windows\system32\dxtrans.dll
+ 2004-08-04 05:00 . 2009-08-29 07:36 214528 c:\windows\system32\dxtrans.dll
+ 2004-08-04 05:00 . 2009-08-29 07:36 347136 c:\windows\system32\dxtmsft.dll
- 2004-08-04 05:00 . 2009-06-29 16:12 347136 c:\windows\system32\dxtmsft.dll
+ 2004-08-04 05:00 . 2009-08-29 07:36 832512 c:\windows\system32\dllcache\wininet.dll
+ 2004-08-04 05:00 . 2009-08-29 07:36 233472 c:\windows\system32\dllcache\webcheck.dll
- 2004-08-04 05:00 . 2009-06-29 16:12 233472 c:\windows\system32\dllcache\webcheck.dll
- 2004-08-04 05:00 . 2009-06-29 16:12 105984 c:\windows\system32\dllcache\url.dll
+ 2004-08-04 05:00 . 2009-08-29 07:36 105984 c:\windows\system32\dllcache\url.dll
+ 2004-08-04 05:00 . 2009-08-29 07:36 102912 c:\windows\system32\dllcache\occache.dll
- 2004-08-04 05:00 . 2009-06-29 16:12 102912 c:\windows\system32\dllcache\occache.dll
- 2004-08-04 05:00 . 2009-06-29 16:12 671232 c:\windows\system32\dllcache\mstime.dll
+ 2004-08-04 05:00 . 2009-08-29 07:36 671232 c:\windows\system32\dllcache\mstime.dll
+ 2004-08-04 05:00 . 2009-08-29 07:36 193024 c:\windows\system32\dllcache\msrating.dll
- 2004-08-04 05:00 . 2009-06-29 16:12 193024 c:\windows\system32\dllcache\msrating.dll
- 2004-08-04 05:00 . 2009-06-29 16:12 477696 c:\windows\system32\dllcache\mshtmled.dll
+ 2004-08-04 05:00 . 2009-08-29 07:36 477696 c:\windows\system32\dllcache\mshtmled.dll
+ 2007-05-08 17:05 . 2009-08-29 07:36 459264 c:\windows\system32\dllcache\msfeeds.dll
- 2007-05-08 17:05 . 2009-06-29 16:12 459264 c:\windows\system32\dllcache\msfeeds.dll
+ 2004-08-04 05:00 . 2009-08-27 05:18 634648 c:\windows\system32\dllcache\iexplore.exe
- 2007-05-08 17:05 . 2009-06-29 16:12 268288 c:\windows\system32\dllcache\iertutil.dll
+ 2007-05-08 17:05 . 2009-08-29 07:36 268288 c:\windows\system32\dllcache\iertutil.dll
+ 2004-08-04 05:00 . 2009-08-29 07:36 385024 c:\windows\system32\dllcache\iedkcs32.dll
- 2004-08-04 05:00 . 2009-06-29 16:12 385024 c:\windows\system32\dllcache\iedkcs32.dll
+ 2007-05-08 17:05 . 2009-08-29 07:36 380928 c:\windows\system32\dllcache\ieapfltr.dll
- 2007-05-08 17:05 . 2009-06-29 16:12 380928 c:\windows\system32\dllcache\ieapfltr.dll
+ 2004-08-04 05:00 . 2009-08-27 05:18 161792 c:\windows\system32\dllcache\ieakui.dll
- 2004-08-04 05:00 . 2009-06-29 08:33 161792 c:\windows\system32\dllcache\ieakui.dll
- 2004-08-04 05:00 . 2009-06-29 16:12 230400 c:\windows\system32\dllcache\ieaksie.dll
+ 2004-08-04 05:00 . 2009-08-29 07:36 230400 c:\windows\system32\dllcache\ieaksie.dll
+ 2004-08-04 05:00 . 2009-08-29 07:36 153088 c:\windows\system32\dllcache\ieakeng.dll
- 2004-08-04 05:00 . 2009-06-29 16:12 153088 c:\windows\system32\dllcache\ieakeng.dll
+ 2004-08-04 05:00 . 2009-08-29 07:36 133120 c:\windows\system32\dllcache\extmgr.dll
- 2004-08-04 05:00 . 2009-06-29 16:12 133120 c:\windows\system32\dllcache\extmgr.dll
- 2004-08-04 05:00 . 2009-06-29 16:12 214528 c:\windows\system32\dllcache\dxtrans.dll
+ 2004-08-04 05:00 . 2009-08-29 07:36 214528 c:\windows\system32\dllcache\dxtrans.dll
- 2004-08-04 05:00 . 2009-06-29 16:12 347136 c:\windows\system32\dllcache\dxtmsft.dll
+ 2004-08-04 05:00 . 2009-08-29 07:36 347136 c:\windows\system32\dllcache\dxtmsft.dll
- 2004-08-04 05:00 . 2009-06-29 16:12 124928 c:\windows\system32\dllcache\advpack.dll
+ 2004-08-04 05:00 . 2009-08-29 07:36 124928 c:\windows\system32\dllcache\advpack.dll
- 2004-08-04 05:00 . 2009-06-29 16:12 124928 c:\windows\system32\advpack.dll
+ 2004-08-04 05:00 . 2009-08-29 07:36 124928 c:\windows\system32\advpack.dll
+ 2009-10-22 10:12 . 2009-06-29 16:12 827392 c:\windows\ie7updates\KB974455-IE7\wininet.dll
+ 2009-10-22 10:12 . 2009-06-29 16:12 233472 c:\windows\ie7updates\KB974455-IE7\webcheck.dll
+ 2009-10-22 10:12 . 2009-06-29 16:12 105984 c:\windows\ie7updates\KB974455-IE7\url.dll
+ 2009-10-22 10:12 . 2009-05-26 11:40 382840 c:\windows\ie7updates\KB974455-IE7\spuninst\updspapi.dll
+ 2009-10-22 10:12 . 2009-05-26 11:40 231288 c:\windows\ie7updates\KB974455-IE7\spuninst\spuninst.exe
+ 2009-10-22 10:12 . 2009-06-29 16:12 102912 c:\windows\ie7updates\KB974455-IE7\occache.dll
+ 2009-10-22 10:12 . 2009-06-29 16:12 671232 c:\windows\ie7updates\KB974455-IE7\mstime.dll
+ 2009-10-22 10:12 . 2009-06-29 16:12 193024 c:\windows\ie7updates\KB974455-IE7\msrating.dll
+ 2009-10-22 10:12 . 2009-06-29 16:12 477696 c:\windows\ie7updates\KB974455-IE7\mshtmled.dll
+ 2009-10-22 10:12 . 2009-06-29 16:12 459264 c:\windows\ie7updates\KB974455-IE7\msfeeds.dll
+ 2009-10-22 10:12 . 2009-06-29 08:35 634632 c:\windows\ie7updates\KB974455-IE7\iexplore.exe
+ 2009-10-22 10:12 . 2009-06-29 16:12 268288 c:\windows\ie7updates\KB974455-IE7\iertutil.dll
+ 2009-10-22 10:12 . 2009-06-29 16:12 385024 c:\windows\ie7updates\KB974455-IE7\iedkcs32.dll
+ 2009-10-22 10:12 . 2009-06-29 16:12 380928 c:\windows\ie7updates\KB974455-IE7\ieapfltr.dll
+ 2009-10-22 10:12 . 2009-06-29 08:33 161792 c:\windows\ie7updates\KB974455-IE7\ieakui.dll
+ 2009-10-22 10:12 . 2009-06-29 16:12 230400 c:\windows\ie7updates\KB974455-IE7\ieaksie.dll
+ 2009-10-22 10:12 . 2009-06-29 16:12 153088 c:\windows\ie7updates\KB974455-IE7\ieakeng.dll
+ 2009-10-22 10:12 . 2009-06-29 16:12 133120 c:\windows\ie7updates\KB974455-IE7\extmgr.dll
+ 2009-10-22 10:12 . 2009-06-29 16:12 214528 c:\windows\ie7updates\KB974455-IE7\dxtrans.dll
+ 2009-10-22 10:12 . 2009-06-29 16:12 347136 c:\windows\ie7updates\KB974455-IE7\dxtmsft.dll
+ 2009-10-22 10:12 . 2009-06-29 16:12 124928 c:\windows\ie7updates\KB974455-IE7\advpack.dll
+ 2004-08-04 05:00 . 2009-08-29 07:36 1168384 c:\windows\system32\urlmon.dll
+ 2004-08-04 05:00 . 2009-08-29 07:36 3598336 c:\windows\system32\mshtml.dll
+ 2009-07-18 03:21 . 2009-07-18 03:21 3883424 c:\windows\system32\Macromed\Flash\NPSWF32.dll
- 2006-11-08 05:03 . 2009-07-19 13:32 6067200 c:\windows\system32\ieframe.dll
+ 2006-11-08 05:03 . 2009-08-29 07:36 6067200 c:\windows\system32\ieframe.dll
+ 2004-08-04 05:00 . 2009-08-29 07:36 1168384 c:\windows\system32\dllcache\urlmon.dll
+ 2004-08-04 05:00 . 2009-08-29 07:36 3598336 c:\windows\system32\dllcache\mshtml.dll
- 2007-05-08 17:05 . 2009-07-19 13:32 6067200 c:\windows\system32\dllcache\ieframe.dll
+ 2007-05-08 17:05 . 2009-08-29 07:36 6067200 c:\windows\system32\dllcache\ieframe.dll
+ 2009-10-18 21:57 . 2009-10-18 21:57 1757696 c:\windows\Installer\bf8ad.msi
+ 2009-10-22 10:12 . 2009-06-29 16:12 1159680 c:\windows\ie7updates\KB974455-IE7\urlmon.dll
+ 2009-10-22 10:12 . 2009-07-19 13:33 3597824 c:\windows\ie7updates\KB974455-IE7\mshtml.dll
+ 2009-10-22 10:12 . 2009-07-19 13:32 6067200 c:\windows\ie7updates\KB974455-IE7\ieframe.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-07 3885408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2005-02-25 245760]
"LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2005-05-10 253952]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-12 49152]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-01-17 185872]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-06 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-01-06 290088]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-10-17 2025752]
"SteelSeries World of Warcraft MMO Gaming Mouse"="c:\program files\SteelSeries\World of Warcraft MMO Gaming Mouse\WoWMHID.exe" [2009-05-13 414720]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2009-07-09 1657376]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-07-14 13877248]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-07-14 86016]
"ISTray"="c:\program files\Spyware Doctor\pctsTray.exe" [2009-07-23 1181064]
"THGuard"="c:\program files\TrojanHunter 5.2\THGuard.exe" [2009-08-27 1063072]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-18 149280]

c:\documents and settings\Compaq_Owner\Start Menu\Programs\Startup\
Xfire.lnk - c:\program files\Xfire\xfire.exe [2009-10-14 3141008]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Compaq Connections.lnk - c:\program files\Compaq Connections\5577497\Program\Compaq Connections.exe [2005-8-26 36903]
NETGEAR WG311v2 Smart Configuration.lnk - c:\program files\NETGEAR WG311v2 Adapter\wlancfg5.exe [2004-10-14 450560]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-08-18 16:47 11952 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Compaq Connections\\5577497\\Program\\Compaq Connections.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Documents and Settings\\Compaq_Owner\\My Documents\\filelib\\jamesz47\\TibiCam\\TibiCAM.exe"=
"c:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\AIM\\aim.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Documents and Settings\\Compaq_Owner\\Local Settings\\Application Data\\Dyyno Receiver\\DPPM.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\Program Files\\Xfire\\xfire.exe"=
"c:\\Program Files\\World of Warcraft\\Launcher.exe"=
"c:\\My Downloads\\World of Warcraft Public Test\\WoW-0.3.0.10522-enUS-ptr-downloader.exe"=
"c:\\My Downloads\\World of Warcraft Public Test\\Launcher.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\My Downloads\\World of Warcraft Public Test\\WoW-0.3.0.10522-to-0.3.0.10554-enUS-ptr-downloader.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"38416:TCP"= 38416:TCP:limeiwre

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [9/8/2009 7:40 PM 130936]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [5/11/2009 8:40 PM 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [5/11/2009 8:40 PM 108552]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [5/11/2009 8:39 PM 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [5/11/2009 8:39 PM 297752]
R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [9/8/2009 7:40 PM 348752]
S2 OneStepSrch Service;OneStepSrch Service;c:\documents and settings\All Users\Application Data\OneStepSrch\onestep210.exe [8/25/2009 7:03 PM 4608]
S3 Mo3Fltr;MMO Mouse;c:\windows\system32\drivers\Mo3Fltr.sys [6/28/2009 8:38 PM 11136]
S3 zsi_fmw;Stiletto Firmware Recovery;c:\windows\system32\Drivers\zsi_fmw.sys --> c:\windows\system32\Drivers\zsi_fmw.sys [?]
S3 zsi_zap;Stiletto ZAP Recovery Driver;c:\windows\system32\Drivers\zsi_zap.sys --> c:\windows\system32\Drivers\zsi_zap.sys [?]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q405&bd=presario&pf=desktop&parm1=seconduser
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mStart Page = hxxp://www.google.com
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q405&bd=presario&pf=desktop&parm1=seconduser
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://as.starware.com/dp/search?x=wKX1ILEOi+UdWpSlz2q9Dzn13Emww/YwQpPqaywhO+9aQX24uDUGBd/Qh1n99F63CHDmKA2KK6gVu+V1+EvZVhGZ/aJfrSrrLCQ0cZJBMXxiJK7b73nWLbW8z033dftG
IE: &Google Search - c:\program files\Google\GoogleToolbar1.dll/cmsearch.html
IE: &Translate English Word - c:\program files\Google\GoogleToolbar1.dll/cmwordtrans.html
IE: Add To Compaq Organize... - c:\progra~1\HEWLET~1\COMPAQ~1\bin/module.main/favorites\ie_add_to.html
IE: Backward Links - c:\program files\Google\GoogleToolbar1.dll/cmbacklinks.html
IE: Cached Snapshot of Page - c:\program files\Google\GoogleToolbar1.dll/cmcache.html
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
IE: Similar Pages - c:\program files\Google\GoogleToolbar1.dll/cmsimilar.html
IE: Translate Page into English - c:\program files\Google\GoogleToolbar1.dll/cmtrans.html
TCP: {E3FE6EC7-6AA0-4C85-BBCD-330327A09983} = 192.168.1.114,192.168.1.130
DPF: {2E28242B-A689-11D4-80F2-0040266CBB8D} - hxxp://www.cherrytreeinn.com:8080/kxhcm10.ocx
FF - ProfilePath - c:\documents and settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\p89swnuz.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - plugin: c:\documents and settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\p89swnuz.default\extensions\NPDyyno@dyyno.com\plugins\npDyyno.dll
FF - plugin: c:\documents and settings\Compaq_Owner\Application Data\Mozilla\plugins\npoctoshape.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-22 06:01
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1024)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(2704)
c:\windows\system32\WININET.dll
c:\docume~1\COMPAQ~1\LOCALS~1\Temp\IadHide5.dll
c:\program files\Xfire\xfire_toucan_39729.dll
c:\windows\system32\IEFRAME.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCR80.dll
c:\windows\system32\mshtml.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\HPZipm12.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\program files\AVG\AVG8\avgcsrvx.exe
c:\windows\system32\wscntfy.exe
c:\combofix\CF22613.exe
c:\windows\system32\rundll32.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Windows Live\Contacts\wlcomm.exe
.
**************************************************************************
.
Completion time: 2009-10-22 6:07 - machine was rebooted
ComboFix-quarantined-files.txt 2009-10-22 13:07
ComboFix2.txt 2009-10-18 21:50
ComboFix3.txt 2009-10-18 02:17

Pre-Run: 2,981,031,936 bytes free
Post-Run: 3,069,751,296 bytes free

385 --- E O F --- 2009-10-22 10:13

#14 Blade81

Blade81

    Bleepin' Rocker


  • Malware Response Team
  • 6,465 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:10:15 AM

Posted 22 October 2009 - 09:05 AM

Hi,

Please go to c:\qoobox\quarantine folder and search for zip file which name begins as [4]-Submit. Upload the file here. Kindly include a link to topic in the message.

Open notepad and then copy and paste the bolded lines below into it. Go to File > save as and name the file fixes.bat, change the Save as type to all files and save it to your desktop. (If you are still unsure on how to do this there is a little tutorial with pictures here)
regedit /a "c:\export.txt" "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl"
start c:\export.txt
del %0

Double-click on fixes.bat file to execute it. Post contents of notepad that opens up.

Microsoft Windows Insider MVP 2016-2017

Microsoft MVP Consumer Security 2008-2015
UNITE member since 2006
unite_blue.png

Provided malware removal related instructions are meant to be used in the correspondent user's case only. If you have similar symptoms create own topic instead of following instructions given to some other, please.


#15 james3434

james3434
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:02:15 AM

Posted 22 October 2009 - 05:53 PM

alright i sent the submit-4, and here are the fixes.bat results

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]
@="http://as.starware.com/dp/search?x=wKX1ILEOi+UdWpSlz2q9Dzn13Emww/YwQpPqaywhO+9aQX24uDUGBd/Qh1n99F63CHDmKA2KK6gVu+V1+EvZVhGZ/aJfrSrrLCQ0cZJBMXxiJK7b73nWLbW8z033dftG"




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users