Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


Mswinup.exe, Rk.exe

  • Please log in to reply
8 replies to this topic

#1 Ron M

Ron M

  • Members
  • 10 posts
  • Local time:12:29 AM

Posted 03 April 2007 - 12:50 PM

Logfile of HijackThis v1.99.1
Scan saved at 12:33:34 PM, on 4/3/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\WinFax\WFXMOD32.EXE
C:\Program Files\Intel Audio Studio\IntelAudioStudio.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\Program Files\Roxio\Easy Media Creator 8\Drag to Disc\DrgToDsc.exe
C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatchTray.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatch.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE
C:\Program Files\Common Files\Roxio Shared\SharedCOM8\CPSHelpRunner.exe
C:\Program Files\OpenOffice.org 2.1\program\soffice.exe
C:\Program Files\OpenOffice.org 2.1\program\soffice.BIN
c:\program files\mcafee\msc\mcuimgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\program files\mcafee\virusscan\scriptcl.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [IntelAudioStudio] "C:\Program Files\Intel Audio Studio\IntelAudioStudio.exe" TRAY
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy Media Creator 8\Drag to Disc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatchTray.exe"
O4 - HKLM\..\Run: [BCWipeTM Startup] "C:\Program Files\Jetico\BCWipe\BCWipeTM.exe" startup
O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [WinFaxAppPortStarter] wfxsnt40.exe
O4 - HKLM\..\Run: [WFXSwtch] C:\PROGRA~1\WinFax\WFXSWTCH.exe
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Kleptomania] C:\PROGRA~1\KLEPTO~1\k-mania.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: OpenOffice.org 2.1.lnk = C:\Program Files\OpenOffice.org 2.1\program\quickstart.exe
O4 - Global Startup: Logitech SetPoint.lnk = ?
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Log Manager (McLogManagerService) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mclogsrv.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Task Scheduler (mctskshd.exe) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mctskshd.exe
O23 - Service: McAfee User Manager (mcusrmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcusrmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: OmniForm Printer - Unknown owner - C:\WINDOWS\system32\ofps.exe
O23 - Service: LiveShare P2P Server (RoxLiveShare) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxLiveShare.exe
O23 - Service: RoxMediaDB - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe
O23 - Service: RoxUpnpRenderer (RoxUPnPRenderer) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCom\RoxUpnpRenderer.exe
O23 - Service: RoxUpnpServer - Sonic Solutions - C:\Program Files\Roxio\Easy Media Creator 8\Digital Home\RoxUpnpServer.exe
O23 - Service: Roxio Hard Drive Watcher (RoxWatch) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatch.exe
O23 - Service: WinFax PRO (wfxsvc) - Symantec Corporation - C:\WINDOWS\system32\WFXSVC.EXE

I have also ran SDFix, and here is the report from that:

SDFix: Version 1.76

Run by Administrator - Tue 04/03/2007 - 11:20:09.57

Microsoft Windows XP [Version 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:

Restoring Windows Registry Entries
Restoring Default Hosts File


Normal Mode:
Checking Files:

Below files will be copied to Backups folder then removed:

C:\WINDOWS\system32\winsecurityxp\mswinup.exe - Deleted

ADS Check:

No streams found.

Final Check:

Remaining Services:

Authorized Application Key Export:

"C:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"="C:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe:*:Enabled:McAfee Network Agent"
"C:\\Program Files\\BitTorrent\\bittorrent.exe"="C:\\Program Files\\BitTorrent\\bittorrent.exe:*:Enabled:BitTorrent"
"%SystemDir%\\winsecurityxp\\mswinup.exe"="%SystemDir%\\winsecurityxp\\mswinup.exe:*:Enabled:Internet Explorer"
"C:\\Program Files\\Common Files\\Roxio Shared\\SharedCOM8\\RoxWatchTray.exe"="C:\\Program Files\\Common Files\\Roxio Shared\\SharedCOM8\\RoxWatchTray.exe:*:Enabled:test1 Module"
"C:\\Program Files\\ScanSoft\\OmniForm 5.0\\EReg\\NAVBrowser.exe"="C:\\Program Files\\ScanSoft\\OmniForm 5.0\\EReg\\NAVBrowser.exe:*:Enabled:NAVBrowser"
"C:\\Program Files\\iCall\\iCall.exe"="C:\\Program Files\\iCall\\iCall.exe:*:Enabled:iCall"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\TurboTax\\Deluxe 2006\\32bit\\ttax.exe"="C:\\Program Files\\TurboTax\\Deluxe 2006\\32bit\\ttax.exe:LocalSubNet:Enabled:TurboTax"
"C:\\Program Files\\TurboTax\\Deluxe 2006\\32bit\\updatemgr.exe"="C:\\Program Files\\TurboTax\\Deluxe 2006\\32bit\\updatemgr.exe:LocalSubNet:Enabled:TurboTax Update Manager"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\Program Files\\Roxio\\Easy Media Creator 8\\Digital Home\\RoxUpnpServer.exe"="C:\\Program Files\\Roxio\\Easy Media Creator 8\\Digital Home\\RoxUpnpServer.exe:*:Enabled:Roxio Upnp Service"

"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

Remaining Files:

Backups Folder: - C:\SDFix\backups\backups.zip

Checking For Files with Hidden Attributes :

C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp
C:\Documents and Settings\Ron\Desktop\Mary\Palestine and Israel 2007\Ken's pictures\~WRL2542.tmp


After SDFix, I downloaded and ran in the safe mode, AVG Anti-Spyware 7.5 and here is the report file from that:

AVG Anti-Spyware - Scan Report

+ Created at: 12:03:49 PM 4/3/2007

+ Scan result:

C:\System Volume Information\_restore{0D77F941-B5ED-45E1-903C-E4DBF2E1B3C3}\RP93\A0010118.exe -> Backdoor.Ncx.a : Cleaned with backup (quarantined).
C:\WINDOWS\system32\drivers\etc\al\pnc.exe -> Backdoor.Ncx.a : Cleaned with backup (quarantined).
C:\SDFix\backups\backups.zip/backups/mswinup.exe -> Backdoor.Pakes : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0D77F941-B5ED-45E1-903C-E4DBF2E1B3C3}\RP93\A0010121.exe -> Backdoor.Pakes : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0D77F941-B5ED-45E1-903C-E4DBF2E1B3C3}\RP94\A0011401.exe -> Backdoor.Pakes : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0D77F941-B5ED-45E1-903C-E4DBF2E1B3C3}\RP94\A0011405.exe -> Backdoor.Pakes : Cleaned with backup (quarantined).
C:\Documents and Settings\Ron\agony.sys -> Rootkit.Agony : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0D77F941-B5ED-45E1-903C-E4DBF2E1B3C3}\RP93\A0010119.sys -> Rootkit.Agony : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0D77F941-B5ED-45E1-903C-E4DBF2E1B3C3}\RP93\A0010120.sys -> Rootkit.Agony : Cleaned with backup (quarantined).
C:\WINDOWS\system32\agony.sys -> Rootkit.Agony : Cleaned with backup (quarantined).
C:\Documents and Settings\Ron\Cookies\ron@adjuggler[1].txt -> TrackingCookie.Adjuggler : Cleaned.
C:\Documents and Settings\Ron\Cookies\ron@search.live[2].txt -> TrackingCookie.Live : Cleaned.
C:\Documents and Settings\Ron\Cookies\ron@search.msn[1].txt -> TrackingCookie.Msn : Cleaned.
C:\Documents and Settings\Ron\Cookies\ron@m.webtrends[2].txt -> TrackingCookie.Webtrends : Cleaned.

::Report end

I had noticed that the disk activity light was on and off constantly, and the McAfee Security Center software said nothing.

I found this forum, and noticed others mentioning the same file names, so I ran the SDFix and AVG after reading their descriptions of fixing the problems. I ran the AVG in the "Quarantine" mode, did I do right?

If so, how can I make sure this is fixed?

Thanks in advance!

Ron McLeod

Moved from the "XP" Forum. ~acklan~

Edited by acklan, 03 April 2007 - 01:31 PM.

BC AdBot (Login to Remove)



#2 sjpritch25


  • Security Colleague
  • 893 posts
  • Gender:Male
  • Location:West Coast of Florida, USA
  • Local time:12:29 AM

Posted 06 April 2007 - 09:27 AM

Welcome to BC!!!! :thumbsup:

Go to Start > Run > enter notepad and copy/paste the following into the blank document...



...then close/save it as type All Files and as type Ron M.REG and then open the file by clicking it, confirming the prompt to merge with the Registry.


Download Combofix and save it to your desktop.

Note: It is important that it is saved directly to your desktop

Close any open browsers.

Double click on combofix.exe & follow the prompts.
When finished, it shall produce a log for you.

Post the ComboFix.txt in your next reply.

Do not mouseclick combofix's window whilst it's running. That may cause it to stall
Microsoft MVP Consumer Security--2007-2010

#3 Ron M

Ron M
  • Topic Starter

  • Members
  • 10 posts
  • Local time:12:29 AM

Posted 06 April 2007 - 03:42 PM


Here is the ComboFix text file:

"Ron" - 07-04-06 15:29:52 Service Pack 2
ComboFix 07-04-05 - Running from: "C:\Documents and Settings\Ron\Desktop"

((((((((((((((((((((((((((((((( Files Created from 2007-03-06 to 2007-04-06 ))))))))))))))))))))))))))))))))))

2007-04-03 18:03 <DIR> d--h----- C:\BJPrinter
2007-04-03 18:02 <DIR> d--h----- C:\CanonMP
2007-04-03 16:54 <DIR> d-------- C:\DOCUME~1\Ron\APPLIC~1\Ahead
2007-04-03 14:07 <DIR> d-------- C:\Program Files\FileASSASSIN
2007-04-03 13:56 <DIR> d-------- C:\Autoruns
2007-04-03 11:27 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-04-02 23:14 <DIR> d-------- C:\DOCUME~1\Ron\.housecall6.6
2007-04-01 17:04 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-03-27 18:59 <DIR> d-------- C:\Program Files\MSECache
2007-03-24 13:20 <DIR> d-------- C:\Program Files\OpenSource Flash Video Splitter
2007-03-24 13:20 <DIR> d-------- C:\Program Files\ffdshow
2007-03-24 13:20 <DIR> d-------- C:\Program Files\DScaler5
2007-03-24 13:20 <DIR> d-------- C:\Program Files\DS-MP3 Source
2007-03-24 13:18 <DIR> d-------- C:\Program Files\Zoom Player
2007-03-19 15:44 <DIR> d-------- C:\DOCUME~1\Ron\APPLIC~1\ICAClient
2007-03-19 15:42 <DIR> d-------- C:\Program Files\Citrix
2007-03-18 18:26 <DIR> d-------- C:\Program Files\PowerISO
2007-03-17 10:55 <DIR> d-------- C:\Program Files\support.com
2007-03-17 10:55 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Support.com
2007-03-15 19:10 <DIR> d-------- C:\WINDOWS\speech
2007-03-15 19:10 <DIR> d-------- C:\Program Files\ReadPlease 2003
2007-03-15 16:32 <DIR> d--hs---- C:\WINDOWS\CSC
2007-03-15 16:16 871,388 --a------ C:\WINDOWS\system32\drivers\BCMDM.sys
2007-03-15 16:16 54,271 --a------ C:\WINDOWS\system32\drivers\bcm42xx5.sys
2007-03-15 13:32 <DIR> d-------- C:\Program Files\Common Files\Concord Shared
2007-03-15 13:31 45,568 --a------ C:\WINDOWS\system32\WFXSNT40.EXE
2007-03-15 13:31 136,192 -ra------ C:\WINDOWS\system32\WFXMNTHQ.DLL
2007-03-15 13:31 135,680 -ra------ C:\WINDOWS\system32\WFXMNT40.DLL
2007-03-15 13:31 129,536 --a------ C:\WINDOWS\system32\WFXSVC.EXE
2007-03-15 13:31 <DIR> d-------- C:\Program Files\Symantec
2007-03-15 13:30 41 --a------ C:\WINDOWS\WFXDEL.BAT
2007-03-15 13:30 <DIR> d-------- C:\Program Files\WinFax
2007-03-15 12:04 <DIR> d-------- C:\DOCUME~1\Ron\APPLIC~1\Symantec
2007-03-15 12:03 5,350,912 --a------ C:\WINDOWS\system32\Crpe32.dll
2007-03-15 12:03 37,888 --a------ C:\WINDOWS\system32\DCCWFP32.DLL
2007-03-15 12:03 229,888 --a------ C:\WINDOWS\system32\Crpaig32.dll
2007-03-15 12:03 17,920 --a------ C:\WINDOWS\system32\IMPLODE.DLL
2007-03-15 12:03 159,744 --a------ C:\WINDOWS\system32\MFCANS32.DLL
2007-03-15 12:03 144,384 --a------ C:\WINDOWS\system32\DCCMSP32.DLL
2007-03-15 12:03 104,960 --a------ C:\WINDOWS\system32\DCCEXT32.DLL
2007-03-15 12:03 <DIR> d-------- C:\Program Files\Common Files\Novell Shared
2007-03-14 17:35 <DIR> d-------- C:\Program Files\iTunes
2007-03-14 17:35 <DIR> d-------- C:\Program Files\iPod
2007-03-14 17:34 <DIR> d-------- C:\Program Files\QuickTime
2007-03-11 10:54 <DIR> d-------- C:\DOCUME~1\Ron\APPLIC~1\Logitech
2007-03-11 10:53 69,632 --a------ C:\WINDOWS\system32\KemXML.dll
2007-03-11 10:53 34,576 --a------ C:\WINDOWS\system32\drivers\LHidFilt.Sys
2007-03-11 10:53 33,296 --a------ C:\WINDOWS\system32\drivers\LMouFilt.Sys
2007-03-11 10:53 28,176 --a------ C:\WINDOWS\system32\drivers\LUsbFilt.sys
2007-03-11 10:53 20,496 --a------ C:\WINDOWS\system32\drivers\L8042Kbd.sys
2007-03-11 10:53 163,840 --a------ C:\WINDOWS\system32\kemutb.dll
2007-03-11 10:53 135,168 --a------ C:\WINDOWS\system32\KemUtil.dll
2007-03-11 10:53 110,592 --a------ C:\WINDOWS\system32\KemWnd.dll
2007-03-11 10:53 101,136 --a------ C:\WINDOWS\KHALMNPR.Exe
2007-03-11 10:53 1,419,024 --a------ C:\WINDOWS\system32\WdfCoInstaller01005.dll
2007-03-11 10:53 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2007-03-11 10:53 <DIR> d-------- C:\Program Files\Logitech
2007-03-11 10:53 <DIR> d-------- C:\Program Files\Common Files\Logitech
2007-03-11 10:53 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Logitech
2007-03-10 21:31 <DIR> d-------- C:\WINDOWS\network diagnostic
2007-03-06 18:10 132 --a------ C:\ping.bat

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-04-06 15:23 -------- d-------- C:\DOCUME~1\Ron\APPLIC~1\mailwasherpro
2007-04-05 21:03 -------- d-------- C:\Program Files\quicken
2007-04-05 21:02 -------- d-------- C:\Program Files\newsrover
2007-04-03 20:11 -------- d-------- C:\DOCUME~1\Ron\APPLIC~1\openoffice.org2
2007-04-03 18:05 -------- d-------- C:\DOCUME~1\Ron\APPLIC~1\canon
2007-04-03 18:02 -------- d--h----- C:\Program Files\installshield installation information
2007-04-02 22:32 -------- d-------- C:\Program Files\divx
2007-04-02 22:32 -------- d-------- C:\DOCUME~1\Ron\APPLIC~1\officeupdate12
2007-04-02 22:31 -------- d-------- C:\DOCUME~1\Ron\APPLIC~1\newsoft
2007-03-19 16:43 -------- d-------- C:\DOCUME~1\Ron\APPLIC~1\roxio
2007-03-15 13:34 -------- d-------- C:\Program Files\Common Files\symantec shared
2007-03-08 10:36 577536 --a------ C:\WINDOWS\system32\user32.dll
2007-03-08 10:36 40960 --a------ C:\WINDOWS\system32\mf3216.dll
2007-03-08 10:36 281600 --a------ C:\WINDOWS\system32\gdi32.dll
2007-03-08 08:47 1843584 --a------ C:\WINDOWS\system32\win32k.sys
2007-03-07 10:54 -------- d-------- C:\DOCUME~1\Ron\APPLIC~1\real
2007-03-05 13:34 676224 --a------ C:\WINDOWS\system32\ogacheckcontrol.dll
2007-02-25 21:22 -------- d-------- C:\Program Files\lavasoft
2007-02-25 21:22 -------- d-------- C:\DOCUME~1\Ron\APPLIC~1\lavasoft
2007-02-25 21:21 -------- d-------- C:\Program Files\Common Files\wise installation wizard
2007-02-25 16:21 -------- d-------- C:\Program Files\cyberlink
2007-02-11 11:59 -------- d-------- C:\DOCUME~1\Ron\APPLIC~1\intuit
2007-02-11 11:57 -------- d-------- C:\Program Files\turbotax
2007-02-11 11:56 -------- d-------- C:\DOCUME~1\Ron\APPLIC~1\installshield
2007-01-31 23:56 823296 --a------ C:\WINDOWS\system32\divx_xx0c.dll
2007-01-31 23:56 823296 --a------ C:\WINDOWS\system32\divx_xx07.dll
2007-01-31 23:56 802816 --a------ C:\WINDOWS\system32\divx_xx11.dll
2007-01-31 23:56 639066 --a------ C:\WINDOWS\system32\divx.dll
2007-01-31 16:27 524288 --a------ C:\WINDOWS\system32\divxsm.exe
2007-01-30 18:15 118784 --a------ C:\WINDOWS\system32\divxcodecupdatechecker.exe
2007-01-29 23:56 73728 --a------ C:\WINDOWS\system32\dpl100.dll
2007-01-25 20:19 129784 --------- C:\WINDOWS\system32\pxafs.dll
2007-01-25 20:19 118520 --------- C:\WINDOWS\system32\pxinsi64.exe
2007-01-25 20:19 116472 --------- C:\WINDOWS\system32\pxcpyi64.exe
2007-01-25 20:18 200704 --a------ C:\WINDOWS\system32\ssldivx.dll
2007-01-25 20:18 1044480 --a------ C:\WINDOWS\system32\libdivx.dll
2007-01-25 20:13 593920 --a------ C:\WINDOWS\system32\dpugui11.dll
2007-01-25 20:13 57344 --a------ C:\WINDOWS\system32\dpv11.dll
2007-01-25 20:13 53248 --a------ C:\WINDOWS\system32\dpugui10.dll
2007-01-25 20:13 344064 --a------ C:\WINDOWS\system32\dpus11.dll
2007-01-25 20:13 294912 --a------ C:\WINDOWS\system32\dpu11.dll
2007-01-25 20:13 294912 --a------ C:\WINDOWS\system32\dpu10.dll
2007-01-25 20:13 196608 --a------ C:\WINDOWS\system32\dtu100.dll
2007-01-16 11:16 4112 --a------ C:\WINDOWS\mozver.dat
2007-01-15 20:36 5 --ahs---- C:\WINDOWS\system32\fcecbd5_d.dll
2007-01-15 16:51 0 --a------ C:\WINDOWS\nsreg.dat
2007-01-08 20:01 17408 --a------ C:\WINDOWS\system32\corpol.dll

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

"NBJ"="\"C:\\Program Files\\Ahead\\Nero BackItUp\\NBJ.exe\""

"IntelAudioStudio"="\"C:\\Program Files\\Intel Audio Studio\\IntelAudioStudio.exe\" TRAY"
"IAAnotif"="C:\\Program Files\\Intel\\Intel Matrix Storage Manager\\iaanotif.exe"
"SunJavaUpdateSched"="C:\\Program Files\\Java\\j2re1.4.2_04\\bin\\jusched.exe"
"RoxioDragToDisc"="\"C:\\Program Files\\Roxio\\Easy Media Creator 8\\Drag to Disc\\DrgToDsc.exe\""
"RoxWatchTray"="\"C:\\Program Files\\Common Files\\Roxio Shared\\SharedCOM8\\RoxWatchTray.exe\""
"BCWipeTM Startup"="\"C:\\Program Files\\Jetico\\BCWipe\\BCWipeTM.exe\" startup"
"OpwareSE2"="\"C:\\Program Files\\ScanSoft\\OmniPageSE2.0\\OpwareSE2.exe\""
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE"
"!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"






[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent]
"command"="\"C:\\Program Files\\BitTorrent\\bittorrent.exe\" --force_start_minimized"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"command"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Power2GoExpress]
"command"="\"C:\\Program Files\\CyberLink\\Power2Go\\Power2GoExpress.exe\" /Startup"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"command"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
"command"="\"C:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe\""

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"command"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"

"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"


"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

Authentication Packages REG_MULTI_SZ msv1_0\0\0
Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0
Notification Packages REG_MULTI_SZ scecli\0\0


[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0

Shell\AutoRun\command C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe folder.htt 480 480

Shell\AutoRun\command C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe folder.htt 480 480

Contents of the 'Scheduled Tasks' folder


catchme 0.2 W2K/XP/Vista - userland rootkit detector by Gmer, 17 October 2006

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Completion time: 07-04-06 15:31:14
C:\ComboFix-quarantined-files.txt ... 07-04-06 15:31

#4 sjpritch25


  • Security Colleague
  • 893 posts
  • Gender:Male
  • Location:West Coast of Florida, USA
  • Local time:12:29 AM

Posted 06 April 2007 - 04:12 PM

How is everything running????
Microsoft MVP Consumer Security--2007-2010

#5 Ron M

Ron M
  • Topic Starter

  • Members
  • 10 posts
  • Local time:12:29 AM

Posted 06 April 2007 - 08:06 PM

Everything seems to be running fine. I have this worthless McAFee on my PC and still get hit. But things seem to run smoother now.

Thank you very much for the help!


#6 sjpritch25


  • Security Colleague
  • 893 posts
  • Gender:Male
  • Location:West Coast of Florida, USA
  • Local time:12:29 AM

Posted 06 April 2007 - 10:10 PM

Just want to make sure your clean

Panda Activescan
  • Once you are on the Panda site click the Scan your PC button
  • A new window will open...click the Check Now button
  • Enter your Country
  • Enter your State/Province
  • Enter your e-mail address and click send
  • Select either Home User or Company
  • Click the big Scan Now button
  • If it wants to install an ActiveX component allow it
  • It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
  • When download is complete, click on Local Disks to start the scan
  • When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location.

Microsoft MVP Consumer Security--2007-2010

#7 Ron M

Ron M
  • Topic Starter

  • Members
  • 10 posts
  • Local time:12:29 AM

Posted 07 April 2007 - 11:08 AM

I have a question, Panda has identified one of the files in "SDFix" as unwanted.

This seems to be common amongst the various anti-virus/malware programs I have tried. One identified a known good Microsoft file as possible spyware even though I had scanned with several different software programs.

I have McAFee on my PC simply because it is free through my cable service provider. I previously had Norton for quite a while, but both Norton and McAFee go back and forth between one seeming to be the best, then the other.

After finding this latest problem, the AVG anti-spyware I tried seems to be the most straight forward at finding problems and identifying them, rather then "suspecting" a possibly bad file.

Do you have a recommendation that I could look at?

Thanks again for all your help.


Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Ron\Desktop\elder geek\SDFix.exe[SDFix\apps\Process.exe]
Potentially unwanted tool:Application/Processor Not disinfected C:\SDFix\apps\Process.exe

#8 sjpritch25


  • Security Colleague
  • 893 posts
  • Gender:Male
  • Location:West Coast of Florida, USA
  • Local time:12:29 AM

Posted 07 April 2007 - 11:48 AM

That is a tough question, i use Avira AntiVir free version (does not have email scanner). You must purchase the product for that. Here are a few sites to visit. This will give you an overview of the most popular. I would go with any product that scores a Advanced + rating

You will need adobe reader!!!


Microsoft MVP Consumer Security--2007-2010

#9 sjpritch25


  • Security Colleague
  • 893 posts
  • Gender:Male
  • Location:West Coast of Florida, USA
  • Local time:12:29 AM

Posted 07 April 2007 - 11:50 AM

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

Updating Java:
  • Download the latest version of Java Runtime Environment (JRE) 6.
  • Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications".
  • Click the "Download" button to the right.
  • Check the box that says: "Accept License Agreement".
  • The page will refresh.
  • Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
  • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6-windowsi586-p.exe to install the newest version.
Now that your system is clean you should SET A NEW RESTORE POINT to prevent future reinfection from the old restore point AFTER cleaning your system of any malware infection. Any trojans or spyware you picked up could have been saved in System Restore and are waiting to re-infect you. Since System Restore is a protected directory, your tools can not access it to delete files, trapping viruses inside. Setting a new restore point should be done to prevent any future reinfection from the old restore point and enable your computer to "roll-back" in case there is a future problem.

1. Go to Start > Programs > Accessories > System Tools and click "System Restore".
2. Choose the radio button marked "Create a Restore Point" on the first screen then click "Next". Give the R.P. a name then click "Create". The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
3. Then go to Start > Run and type: Cleanmgr
4. Click "OK".
5. Click the "More Options" Tab.
6. Click "Clean Up" in the System Restore section to remove all previous restore points except the newly created one.

Graphics for doing this are in the following links if you need them.
How to Create a Restore Point.
How to use Cleanmgr.


Here is some useful information on keeping your computer clean:
  • Most important thing is to make sure Windows is kept up to date with the latest patches and updates from Windows Update.
  • If you don't have a Firewall installed, please choose from the following:
  • If you don't have a Anti-Virus installed, please download the following free program:
  • Here are two great Preventive programs:
    • SpywareBlaster protects you from malicious ActiveX controls and cookies. Make sure and check for updates twice a month.
    • IESpyads adds a long list of bad sites to your Restricted sites in Internet Explorer and protects against drive by downloads.
  • Surf Safe with McAfee's SiteAdisor. SiteAdisor will work with Internet Explorer and Mozilla Firefox. SiteAdisor is a browser plugin that assigns a safety rating to domains listed in your search engine. SiteAdvisor uses the following color codes to indicate the safety level of each site.
    • Red for Warning
    • Yellow for Use Caution
    • Green for Safe
    • Grey for Unknown
    Here are the link to install SiteAdisor in Internet Explorer and Firefox
  • Anti-Spyware Programs I Recommend:
  • For Even More Information On Securing Your Computer read Tony Klein's So How Did I Get Infected In The First Place]

Microsoft MVP Consumer Security--2007-2010

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users