Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Lots Of Spyware And Adware Problems On My Comp, Maybe A Trojan Too -_-


  • Please log in to reply
11 replies to this topic

#1 Hylianfalcon

Hylianfalcon

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:01:21 AM

Posted 29 April 2007 - 04:12 PM

Ever since i was infected last year, it has been getting progressively worse, going from winantivirus pro to other things like jack9 just a few days ago. I've scanned with Spybot, spysweeper, ad-aware, symantec corporate edition, etc., but nothing works, so here is the hijackthis log.

Logfile of HijackThis v1.99.1
Scan saved at 4:55:10 PM, on 4/29/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\{9CD3E346-0BB0-1033-0115-040322060001}\Update.exe
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AIM\aim.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows NT\Accessories\wordpad.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\jess\LOCALS~1\Temp\Rar$EX00.687\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://cnn.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://cnn.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: (no name) - {00DBDAC8-4691-4797-8E6A-7C6AB89BC441} - C:\WINDOWS\system32\mllmn.dll (file missing)
O2 - BHO: (no name) - {182B90A3-F372-438A-800C-6814B4DE417B} - C:\WINDOWS\system32\pmnljhf.dll
O2 - BHO: (no name) - {59B8B1CD-32E8-469D-90EE-691D41473F7e} - C:\WINDOWS\system32\lkahlpvv.dll
O2 - BHO: (no name) - {5CA05BA3-6981-4EF3-8905-F92DB1BB06Ca} - C:\WINDOWS\system32\lkahlpvv.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: (no name) - {7B3AA180-1074-4CF1-8001-BB61340ED130} - C:\WINDOWS\system32\lkahlpvv.dll
O2 - BHO: (no name) - {873eb32d-ae1a-4183-89bd-45a77f761be4} - C:\WINDOWS\system32\ixt6.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {AE79C668-9686-43BF-91DF-D1541D566928} - C:\WINDOWS\system32\NtmsData\entact.dll
O2 - BHO: (no name) - {D351FEF0-2898-4155-B160-17912AFDA29a} - C:\WINDOWS\system32\lkahlpvv.dll
O2 - BHO: (no name) - {D651AFF4-9590-424d-BD1E-8E33E090DFB3} - C:\WINDOWS\system32\ddlxfywp.dll
O2 - BHO: (no name) - {FC7E82EA-B674-401F-A2B8-73C948D7B3Df} - C:\WINDOWS\system32\lkahlpvv.dll
O3 - Toolbar: (no name) - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - (no file)
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [{9CD3E346-0BB0-1033-0115-040322060001}] "C:\Program Files\Common Files\{9CD3E346-0BB0-1033-0115-040322060001}\Update.exe" te-110-12-0000213
O4 - HKLM\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKLM\..\Run: [InfoData] rundll32.exe "C:\WINDOWS\system32\mhchlyhr.dll",realset
O4 - HKLM\..\RunServices: [scvhost.exe] scvhost.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe -quiet
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra button: ±ĚÁÄ - {4B87EE01-82ED-4030-A372-B3BEF4829ED5} - http://chat.yinsha.com/ (file missing)
O9 - Extra 'Tools' menuitem: ÁÄĚě - {4B87EE01-82ED-4030-A372-B3BEF4829ED5} - http://chat.yinsha.com/ (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: http://locator.cdn.imageservr.com
O15 - Trusted Zone: http://locator1.cdn.imagesrvr.com
O15 - Trusted Zone: http://scanner.sysprotect.com
O15 - Trusted Zone: http://*.systemdoctor.com
O15 - Trusted Zone: http://*.turbotax.com
O15 - Trusted Zone: http://www.winantivirus.com
O15 - Trusted Zone: http://www.winantiviruspro.com
O15 - Trusted Zone: http://download.cdn.winsoftware.com
O15 - Trusted IP range: http://202.67.220.225
O15 - Trusted IP range: http://59.148.220.121
O15 - Trusted IP range: http://62.4.84.53
O15 - Trusted IP range: http://82.98.235.58
O15 - Trusted IP range: http://85.12.25.90
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwe...etup1.0.0.8.cab
O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F98} - http://www.miniclip.com/platypus/miniclipGameLoader.dll
O16 - DPF: {2EA6D939-4445-43F1-A12B-8CB3DDA8B855} (BlueskyVideo Control) - http://www.bluesky.cn/download/v2_60.cab
O16 - DPF: {6924091F-CD97-41E1-B1D4-D9079409D413} (IMCv1 Control) - http://61.152.160.40:1995/talk.cab
O16 - DPF: {7D177A14-2BC4-46C4-A91F-9894273DD4A8} (BlueskyAudio Class) - http://202.96.140.88/vchat/blueskyvoicee.cab
O16 - DPF: {88734439-46D0-42C0-A13F-7E881EE550CF} (Filetran Control) - http://www.bluesky.cn/download/filetran.cab
O16 - DPF: {991481A7-4669-4E15-8C24-100404E1F5CB} (Blueskyvoice Control) - http://www.bluesky.cn/download/blueskyvoice_60.cab
O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real.com/gameconsole/Bundl...ArcadeRdxIE.cab
O16 - DPF: {BA0F088C-72C1-475A-92F8-42391DEF6961} (Blueskyvoice Control) - http://www.bluesky.cn/download/blueskyvoice_26.cab
O16 - DPF: {BAA07C31-16C7-4E8B-BC40-5096ADA26C03} (VTPlug Class) - http://61.152.160.40:1995/VTrans.cab
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab
O16 - DPF: {F660FB87-9378-4A91-AC8C-4B33A56BC2C3} (V2 Control) - http://202.96.140.88/vchat1/v2e.ocx
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs:
O20 - Winlogon Notify: entact - C:\WINDOWS\system32\NtmsData\entact.dll
O20 - Winlogon Notify: mllmn - mllmn.dll (file missing)
O20 - Winlogon Notify: MT4173a0 - C:\WINDOWS\SYSTEM32\MT4173a0.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\
O20 - Winlogon Notify: pmnljhf - C:\WINDOWS\SYSTEM32\pmnljhf.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: yxankxtr - C:\WINDOWS\SYSTEM32\yxankxtr.dll
O21 - SSODL: incestuously - {03413bf7-e34c-445b-bfc0-a2b127255871} - C:\WINDOWS\system32\urroxtl.dll (file missing)
O23 - Service: COM+ Messages - Unknown owner - C:\WINDOWS\system32\svchosts.exe" -e te-110-12-0000213 (file missing)
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

Thanks a lot, any help would be greatly appreciated.

BC AdBot (Login to Remove)

 


#2 Aaflac

Aaflac

    Doin' Dis 'n Dat...


  • Malware Response Team
  • 2,307 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:USA
  • Local time:01:21 AM

Posted 01 May 2007 - 07:14 PM

First, make sure HijackThis is run from its own folder, so the backups it creates are secure. Backups allow the restoring of fixed entries when necessary.

On the Desktop, right click an empty area, select New > Folder, and name the folder Hijack This. place the HijackThis.exe file in it, and then run the program from its own folder from now on...

~~~~
Next, please download the following to the Desktop:
VundoFix.exe
* Double-click VundoFix.exe to run it
* Click: Scan for Vundo
* Once done scanning, click: Remove Vundo
* A prompt asking if you want to remove the files appears, click: Yes
* The Desktop goes blank as it starts removing Vundo.
* When completed, a prompt to shutdown the computer appears, click OK
* Turn the computer back on.

A log is created and found in C:\vundofix.txt!

~~~~
Also download SmitfraudFix (by S!Ri) to the Desktop.
http://siri.urz.free.fr/Fix/SmitfraudFix.zip
Extract the files to the Desktop
A folder named SmitfraudFix is created.
We will use this program later.

~~~~
Download SDFix and save it to the Desktop.

Right click the SDFix.zip folder
Select: Extract All to extract it to its own folder on the Desktop.
Leave it there for now.

~~~~
Start > Run, and type in the following commands one at a time and hit Enter after each line:
sc stop “COM+ Messages”
sc delete “COM+ Messages”


~~~~
Next, run HijackThis, Scan
Check box for the following entries if still showing on the log:

R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)

O2 - BHO: (no name) - {00DBDAC8-4691-4797-8E6A-7C6AB89BC441} - C:\WINDOWS\system32\mllmn.dll (file missing)
O2 - BHO: (no name) - {182B90A3-F372-438A-800C-6814B4DE417B} - C:\WINDOWS\system32\pmnljhf.dll
O2 - BHO: (no name) - {59B8B1CD-32E8-469D-90EE-691D41473F7e} - C:\WINDOWS\system32\lkahlpvv.dll
O2 - BHO: (no name) - {5CA05BA3-6981-4EF3-8905-F92DB1BB06Ca} - C:\WINDOWS\system32\lkahlpvv.dll
O2 - BHO: (no name) - {7B3AA180-1074-4CF1-8001-BB61340ED130} - C:\WINDOWS\system32\lkahlpvv.dll
O2 - BHO: (no name) - {873eb32d-ae1a-4183-89bd-45a77f761be4} - C:\WINDOWS\system32\ixt6.dll
O2 - BHO: (no name) - {AE79C668-9686-43BF-91DF-D1541D566928} - C:\WINDOWS\system32\NtmsData\entact.dll
O2 - BHO: (no name) - {D351FEF0-2898-4155-B160-17912AFDA29a} - C:\WINDOWS\system32\lkahlpvv.dll
O2 - BHO: (no name) - {D651AFF4-9590-424d-BD1E-8E33E090DFB3} - C:\WINDOWS\system32\ddlxfywp.dll
O2 - BHO: (no name) - {FC7E82EA-B674-401F-A2B8-73C948D7B3Df} - C:\WINDOWS\system32\lkahlpvv.dll

O3 - Toolbar: (no name) - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - (no file)
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)

O4 - HKLM\..\Run: [{9CD3E346-0BB0-1033-0115-040322060001}] "C:\Program Files\Common Files\{9CD3E346-0BB0-1033-0115-040322060001}\Update.exe" te-110-12-0000213
O4 - HKLM\..\Run: [InfoData] rundll32.exe "C:\WINDOWS\system32\mhchlyhr.dll",realset
O4 - HKLM\..\RunServices: [scvhost.exe] scvhost.exe

O15 - Trusted Zone: http://locator.cdn.imageservr.com
O15 - Trusted Zone: http://locator1.cdn.imagesrvr.com
O15 - Trusted Zone: http://scanner.sysprotect.com
O15 - Trusted Zone: http://*.systemdoctor.com
O15 - Trusted Zone: http://*.turbotax.com
O15 - Trusted Zone: http://www.winantivirus.com
O15 - Trusted Zone: http://www.winantiviruspro.com
O15 - Trusted Zone: http://download.cdn.winsoftware.com
O15 - Trusted IP range: http://202.67.220.225
O15 - Trusted IP range: http://59.148.220.121
O15 - Trusted IP range: http://62.4.84.53
O15 - Trusted IP range: http://82.98.235.58
O15 - Trusted IP range: http://85.12.25.90

O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwe...etup1.0.0.8.cab

O20 - AppInit_DLLs:
O20 - Winlogon Notify: entact - C:\WINDOWS\system32\NtmsData\entact.dll
O20 - Winlogon Notify: mllmn - mllmn.dll (file missing)
O20 - Winlogon Notify: MT4173a0 - C:\WINDOWS\SYSTEM32\MT4173a0.dll
O20 - Winlogon Notify: pmnljhf - C:\WINDOWS\SYSTEM32\pmnljhf.dll
O20 - Winlogon Notify: yxankxtr - C:\WINDOWS\SYSTEM32\yxankxtr.dll

O21 - SSODL: incestuously - {03413bf7-e34c-445b-bfc0-a2b127255871} - C:\WINDOWS\system32\urroxtl.dll (file missing)

O23 - Service: COM+ Messages - Unknown owner - C:\WINDOWS\system32\svchosts.exe" -e te-110-12-0000213 (file missing)

Select: Fix checked

~~~~
Start the computer in Safe Mode :
-When the machine first starts again, tap the F8 key before Windows starts
-You are presented with a Windows XP Advanced Options menu.
-Select the option for Safe Mode using the arrow keys.
-Press Enter to boot into Safe Mode.

~~~~
Open SmitfraudFix
Double-click smitfraudfix.cmd
Select Option 2 - Clean by typing 2 and press Enter (Deletes infected files)
You are prompted: Do you want to clean the registry? answer Y (yes) and hit Enter in order to remove the Desktop background and clean registry keys associated with the infection.

The tool also checks if a relevant file, wininet.dll, is infected.
You may be prompted to replace the infected file (if found).
Replace infected file? Answer Y (yes) and hit Enter to restore a clean file.

~~~~
Restart the computer to complete the removal process, but do so once again to Safe Mode!

~~~~
Open the SDFix folder on the Desktop, and double click RunThis.bat to start the script.
Type Y to begin the cleanup process.
The process removes any Trojan Services or Registry Entries found, and then prompts you to press any key to Reboot.

Press any key to restart the PC.
When the PC restarts the SDFix will run again and complete the removal process
It then displays Finished
Press any key to end the script and load the Desktop icons.

Once the Desktop icons load, the SDFix report opens on screen and saves itself in the SDFix folder as Report.txt.

~~~~
Please download ComboFix to the Desktop:
http://www.techsupportforum.com/sectools/sUBs/ComboFix.exe

Double-click combofix.exe
Follow the prompts.
(Don't click on the window while the program is running, it may cause your system to hang.)

A log, combofix.txt is produced.

~~~~
Please post the following:
From VundoFix: C:\vundofix.txt
From SmitFraudFix: C:\rapport.txt
The contents of the SDFix Report.txt
The ComboFix.txt
A new HijackThis log

Old duck...


#3 Hylianfalcon

Hylianfalcon
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:01:21 AM

Posted 04 May 2007 - 03:00 PM

Yeah, i fail at reading directions, but i've done all the scans now, i'll get those things to you asap

#4 Aaflac

Aaflac

    Doin' Dis 'n Dat...


  • Malware Response Team
  • 2,307 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:USA
  • Local time:01:21 AM

Posted 04 May 2007 - 03:53 PM

i fail at reading directions


No way, you can do it!! :thumbsup:

Old duck...


#5 Hylianfalcon

Hylianfalcon
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:01:21 AM

Posted 04 May 2007 - 04:08 PM

Ok, here are the text files

VundoFix
VundoFix V6.3.21

Checking Java version...

Java version is 1.5.0.8
Old versions of java are exploitable and should be removed.

Scan started at 3:38:54 PM 5/3/2007

Listing files found while scanning....

C:\WINDOWS\system32\asajwoin.dll
C:\WINDOWS\SYSTEM32\atyjynjj.dll
C:\WINDOWS\SYSTEM32\avbfhcmy.dll
C:\WINDOWS\system32\bdiflqsi.dll
C:\WINDOWS\SYSTEM32\cdtqucqg.dll
C:\WINDOWS\SYSTEM32\ddlxfywp.dll
C:\WINDOWS\SYSTEM32\dhgfcpje.dll
C:\WINDOWS\SYSTEM32\flrdpvva.dll
C:\WINDOWS\SYSTEM32\focweyot.ini
C:\WINDOWS\system32\iaancygy.dll
C:\WINDOWS\system32\iatgjhtf.dll
C:\WINDOWS\SYSTEM32\ivxevisa.dll
C:\WINDOWS\SYSTEM32\lvxvoaft.dll
C:\WINDOWS\SYSTEM32\mhchlyhr.dll
C:\WINDOWS\SYSTEM32\njuwpjva.dll
C:\WINDOWS\system32\NtmsData\entact.dll
C:\WINDOWS\system32\NtmsData\tcatne.bak1
C:\WINDOWS\system32\NtmsData\tcatne.bak2
C:\WINDOWS\system32\NtmsData\tcatne.ini
C:\WINDOWS\system32\NtmsData\tcatne.ini2
C:\WINDOWS\system32\NtmsData\tcatne.tmp
C:\WINDOWS\SYSTEM32\oqlibdbn.dll
C:\WINDOWS\SYSTEM32\pmahiwvb.dll
C:\WINDOWS\SYSTEM32\pmnljhf.dll
C:\WINDOWS\SYSTEM32\qijtynqx.dll
C:\WINDOWS\system32\qsxibufn.dll
C:\WINDOWS\SYSTEM32\rhylhchm.ini
C:\WINDOWS\SYSTEM32\toyewcof.dll
C:\WINDOWS\SYSTEM32\ttwpqrjy.dll
C:\WINDOWS\SYSTEM32\vmufccjo.dll
C:\WINDOWS\SYSTEM32\xqnytjiq.ini
C:\WINDOWS\system32\xrphwncu.dll

Beginning removal...

Attempting to delete C:\WINDOWS\SYSTEM32\atyjynjj.dll
C:\WINDOWS\SYSTEM32\atyjynjj.dll Has been deleted!

Attempting to delete C:\WINDOWS\SYSTEM32\avbfhcmy.dll
C:\WINDOWS\SYSTEM32\avbfhcmy.dll Has been deleted!

Attempting to delete C:\WINDOWS\SYSTEM32\cdtqucqg.dll
C:\WINDOWS\SYSTEM32\cdtqucqg.dll Has been deleted!

Attempting to delete C:\WINDOWS\SYSTEM32\ddlxfywp.dll
C:\WINDOWS\SYSTEM32\ddlxfywp.dll Has been deleted!

Attempting to delete C:\WINDOWS\SYSTEM32\dhgfcpje.dll
C:\WINDOWS\SYSTEM32\dhgfcpje.dll Has been deleted!

Attempting to delete C:\WINDOWS\SYSTEM32\flrdpvva.dll
C:\WINDOWS\SYSTEM32\flrdpvva.dll Has been deleted!

Attempting to delete C:\WINDOWS\SYSTEM32\focweyot.ini
C:\WINDOWS\SYSTEM32\focweyot.ini Has been deleted!

Attempting to delete C:\WINDOWS\SYSTEM32\ivxevisa.dll
C:\WINDOWS\SYSTEM32\ivxevisa.dll Has been deleted!

Attempting to delete C:\WINDOWS\SYSTEM32\lvxvoaft.dll
C:\WINDOWS\SYSTEM32\lvxvoaft.dll Has been deleted!

Attempting to delete C:\WINDOWS\SYSTEM32\mhchlyhr.dll
C:\WINDOWS\SYSTEM32\mhchlyhr.dll Has been deleted!

Attempting to delete C:\WINDOWS\SYSTEM32\njuwpjva.dll
C:\WINDOWS\SYSTEM32\njuwpjva.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\NtmsData\entact.dll
C:\WINDOWS\system32\NtmsData\entact.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\NtmsData\tcatne.bak1
C:\WINDOWS\system32\NtmsData\tcatne.bak1 Has been deleted!

Attempting to delete C:\WINDOWS\system32\NtmsData\tcatne.bak2
C:\WINDOWS\system32\NtmsData\tcatne.bak2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\NtmsData\tcatne.ini
C:\WINDOWS\system32\NtmsData\tcatne.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\NtmsData\tcatne.ini2
C:\WINDOWS\system32\NtmsData\tcatne.ini2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\NtmsData\tcatne.tmp
C:\WINDOWS\system32\NtmsData\tcatne.tmp Has been deleted!

Attempting to delete C:\WINDOWS\SYSTEM32\oqlibdbn.dll
C:\WINDOWS\SYSTEM32\oqlibdbn.dll Has been deleted!

Attempting to delete C:\WINDOWS\SYSTEM32\pmahiwvb.dll
C:\WINDOWS\SYSTEM32\pmahiwvb.dll Has been deleted!

Attempting to delete C:\WINDOWS\SYSTEM32\pmnljhf.dll
C:\WINDOWS\SYSTEM32\pmnljhf.dll Could not be deleted.

Attempting to delete C:\WINDOWS\SYSTEM32\qijtynqx.dll
C:\WINDOWS\SYSTEM32\qijtynqx.dll Has been deleted!

Attempting to delete C:\WINDOWS\SYSTEM32\rhylhchm.ini
C:\WINDOWS\SYSTEM32\rhylhchm.ini Has been deleted!

Attempting to delete C:\WINDOWS\SYSTEM32\toyewcof.dll
C:\WINDOWS\SYSTEM32\toyewcof.dll Has been deleted!

Attempting to delete C:\WINDOWS\SYSTEM32\ttwpqrjy.dll
C:\WINDOWS\SYSTEM32\ttwpqrjy.dll Has been deleted!

Attempting to delete C:\WINDOWS\SYSTEM32\vmufccjo.dll
C:\WINDOWS\SYSTEM32\vmufccjo.dll Has been deleted!

Attempting to delete C:\WINDOWS\SYSTEM32\xqnytjiq.ini
C:\WINDOWS\SYSTEM32\xqnytjiq.ini Has been deleted!

Performing Repairs to the registry.
Done!

Beginning removal...

Attempting to delete C:\WINDOWS\SYSTEM32\pmnljhf.dll
C:\WINDOWS\SYSTEM32\pmnljhf.dll Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V6.3.21

Checking Java version...

Java version is 1.5.0.8
Old versions of java are exploitable and should be removed.

Scan started at 4:01:32 PM 5/3/2007

Listing files found while scanning....

No infected files were found.

SmitFraudFix
SmitFraudFix v2.174

Scan done at 16:28:40.10, Fri 05/04/2007
Run from C:\Documents and Settings\peter\Desktop\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» hosts

127.0.0.1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files


»»»»»»»»»»»»»»»»»»»»»»»» DNS



»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End

SDFix
SmitFraudFix v2.174

Scan done at 16:28:40.10, Fri 05/04/2007
Run from C:\Documents and Settings\peter\Desktop\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» hosts

127.0.0.1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files


»»»»»»»»»»»»»»»»»»»»»»»» DNS



»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End

ComboFix
"peter" - 2007-05-04 16:55:04 Service Pack 2
ComboFix 07-05.04.V - Running from: "C:\Documents and Settings\peter\Desktop\"


(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~
Folders Quarantined:
C:\qoobox\purity\C\DOCUME~1
C:\qoobox\purity\C\DOCUME~1\peter
C:\qoobox\purity\C\DOCUME~1\peter\APPLIC~1
C:\qoobox\purity\C\DOCUME~1\peter\APPLIC~1\FNTS~1
C:\qoobox\purity\C\DOCUME~1\peter\APPLIC~1\SCURIT~1
C:\qoobox\purity\C\DOCUME~1\peter\APPLIC~1\FNTS~1\s?chost.exe


((((((((((((((((((((((((((((((( Files Created from 2007-04-04 to 2007-05-04 ))))))))))))))))))))))))))))))))))


2007-05-04 16:26 360 --a------ C:\WINDOWS\SYSTEM32\tmp.reg
2007-05-04 16:08 53,248 --a------ C:\WINDOWS\SYSTEM32\Process.exe
2007-05-04 16:08 51,200 --a------ C:\WINDOWS\SYSTEM32\dumphive.exe
2007-05-04 16:08 288,417 --a------ C:\WINDOWS\SYSTEM32\SrchSTS.exe
2007-05-03 17:04 49,152 --a------ C:\WINDOWS\nircmd.exe
2007-05-03 16:42 <DIR> d-------- C:\!KillBox
2007-05-03 15:38 <DIR> d-------- C:\VundoFix Backups
2007-05-02 22:58 76,560 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\tmcomm.sys
2007-05-02 20:10 <DIR> d-------- C:\DOCUME~1\peter\APPLIC~1\Viewpoint
2007-05-02 18:25 <DIR> d-------- C:\DOCUME~1\peter\.housecall6.6
2007-05-02 17:28 <DIR> d-------- C:\DOCUME~1\peter\APPLIC~1\Lavasoft
2007-05-02 17:27 <DIR> d-------- C:\Program Files\Lavasoft
2007-05-02 17:26 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-05-01 16:18 <DIR> d-------- C:\Program Files\NEXON
2007-04-28 12:40 135,168 --a------ C:\WINDOWS\SYSTEM32\DSKernel2.dll
2007-04-28 12:40 1,936,528 --a------ C:\WINDOWS\SYSTEM32\ltmm15.dll
2007-04-28 12:37 <DIR> d-------- C:\Program Files\Replay Converter
2007-04-27 17:59 <DIR> d-------- C:\Program Files\CCleaner
2007-04-24 19:53 <DIR> d-------- C:\Program Files\Common Files\Merge Modules
2007-04-24 18:33 <DIR> d-------- C:\Temp\tn3
2007-04-19 22:59 <DIR> d-------- C:\Program Files\Microsoft Visual Studio 8
2007-04-19 22:59 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft Help
2007-04-10 18:33 1,630,447 ---hs---- C:\WINDOWS\SYSTEM32\njemakve.ini2
2007-04-10 17:24 786,432 --ah----- C:\DOCUME~1\TEMP\NTUSER.DAT
2007-04-10 17:24 <DIR> d-------- C:\DOCUME~1\TEMP\APPLIC~1\Sonic
2007-04-10 17:24 <DIR> d-------- C:\DOCUME~1\TEMP\APPLIC~1\Real
2007-04-10 17:24 <DIR> d-------- C:\DOCUME~1\TEMP\APPLIC~1\Jasc Software Inc
2007-04-10 17:24 <DIR> d-------- C:\DOCUME~1\TEMP\APPLIC~1\Gtek
2007-04-09 23:22 <DIR> d-------- C:\DOCUME~1\peter\APPLIC~1\Uniblue
2007-04-09 23:21 <DIR> d-------- C:\Program Files\Uniblue
2007-04-09 23:15 324,384 --ahs---- C:\WINDOWS\SYSTEM32\DRIVERS\fidbox.dat
2007-04-09 23:15 15,648 --ahs---- C:\WINDOWS\SYSTEM32\DRIVERS\fidbox2.dat
2007-04-09 23:08 <DIR> d-------- C:\WINDOWS\SYSTEM32\ZoneLabs


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2007-05-03 22:03:28 -------- d-----w C:\DOCUME~1\peter\APPLIC~1.\Hamachi
2007-05-03 22:02:25 -------- d-----w C:\DOCUME~1\peter\APPLIC~1.\foobar2000
2007-05-03 00:10:29 -------- d-----w C:\DOCUME~1\peter\APPLIC~1.\Viewpoint
2007-05-02 21:28:25 -------- d-----w C:\DOCUME~1\peter\APPLIC~1.\Lavasoft
2007-05-01 02:34:36 -------- d-----w C:\Program Files\Windows Live Safety Center
2007-04-28 16:37:40 737,280 ----a-w C:\WINDOWS\iun6002.exe
2007-04-27 20:19:28 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-04-27 20:08:40 -------- d-----w C:\Program Files\Garfield's Typing Pal
2007-04-15 22:57:27 -------- d-----w C:\Program Files\Common Files\Symantec Shared
2007-04-15 22:57:19 -------- d-----w C:\Program Files\Symantec
2007-04-11 01:24:21 -------- d-----w C:\Program Files\Common Files\wimq
2007-04-10 20:38:45 -------- d-----w C:\DOCUME~1\peter\APPLIC~1.\Azureus
2007-04-10 03:22:03 -------- d-----w C:\DOCUME~1\peter\APPLIC~1.\Uniblue
2007-04-10 03:09:34 4,212 ---h--w C:\WINDOWS\system32\zllictbl.dat
2007-03-31 02:48:09 -------- d-----w C:\Program Files\Alcohol Toolbar
2007-03-29 21:20:19 639,224 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-03-17 13:43:01 292,864 ----a-w C:\WINDOWS\system32\winsrv.dll
2007-03-08 15:36:28 577,536 ----a-w C:\WINDOWS\system32\user32.dll
2007-03-08 15:36:28 40,960 ----a-w C:\WINDOWS\system32\mf3216.dll
2007-03-08 15:36:28 281,600 ----a-w C:\WINDOWS\system32\gdi32.dll
2007-03-08 13:47:48 1,843,584 ----a-w C:\WINDOWS\system32\win32k.sys
2007-03-08 13:47:48 1,843,584 ----a-w C:\WINDOWS\system32\win32k(2).sys
2007-03-06 03:20:18 -------- d-----w C:\Program Files\QuickTime
2007-02-05 20:17:02 185,344 ----a-w C:\WINDOWS\system32\upnphost.dll
2007-02-04 02:13:13 90,537 ----a-w C:\WINDOWS\War3Unin.dat


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
"{53707962-6F74-2D53-2644-206D7942484F}"="C:\PROGRA~1\SPYBOT~1\SDHelper.dll"
"{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}"="C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll"
"{9030D464-4C02-4ABF-8ECC-5164760863C6}"="C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background"
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"AllowLegacyWebView"=dword:00000001
"AllowUnhashedWebView"=dword:00000001
"NoCDBurning"=dword:00000000

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]


HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
Authentication Packages msv1_0\0\0
Security Packages kerberos\0msv1_0\0schannel\0wdigest\0\0
Notification Packages scecli\0\0


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^peter^Start Menu^Programs^Startup^BitTorrent.lnk]
"path"="C:\\Documents and Settings\\peter\\Start Menu\\Programs\\Startup\\BitTorrent.lnk"
"backup"="C:\\WINDOWS\\pss\\BitTorrent.lnkStartup"
"location"="Startup"
"command"="C:\\PROGRA~1\\BITTOR~1\\BITTOR~1.EXE "
"item"="BitTorrent"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\2chkdsk]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="tpyptixc"
"hkey"="HKLM"
"command"="rundll32.exe \"C:\\WINDOWS\\system32\\tpyptixc.dll\",setvm"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aida]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="spoolsv"
"hkey"="HKCU"
"command"="\"C:\\DOCUME~1\\peter\\MYDOCU~1\\ASKS~1\\spoolsv.exe\" -vt tzt"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AIM]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="aim"
"hkey"="HKCU"
"command"="C:\\Program Files\\AIM\\aim.exe -cnetwait.odl"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BJCFD]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="CFD"
"hkey"="HKLM"
"command"="C:\\Program Files\\BroadJump\\Client Foundation\\CFD.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Bnwaiv]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="s?chost"
"hkey"="HKCU"
"command"="C:\\Documents and Settings\\peter\\Application Data\\F?nts\\s?chost.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ccApp"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative Detector]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="CTDetect"
"hkey"="HKCU"
"command"="C:\\Program Files\\Creative\\MediaSource\\Detector\\CTDetect.exe /R"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ctfmon"
"hkey"="HKCU"
"command"="C:\\WINDOWS\\system32\\ctfmon.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="DSAgnt"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\Dell Support\\DSAgnt.exe\" /startup"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="tfswctrl"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\system32\\dla\\tfswctrl.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DllRunning]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="rcihimoa"
"hkey"="HKLM"
"command"="rundll32.exe \"C:\\WINDOWS\\system32\\rcihimoa.dll\",setvm"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DownloadAccelerator]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="DAP"
"hkey"="HKLM"
"command"="C:\\PROGRA~1\\DAP\\DAP.EXE /STARTUP"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDSentry]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="DSentry"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\System32\\DSentry.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HXIUL.EXE]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="HXIUL"
"hkey"="HKCU"
"command"="C:\\Program Files\\Alset\\HelpExpress\\baohuili\\HXIUL.EXE"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IpWins]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ipwins"
"hkey"="HKCU"
"command"="C:\\Program Files\\Ipwindows\\ipwins.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="iTunesHelper"
"hkey"="HKLM"
"command"="C:\\Program Files\\iTunes\\iTunesHelper.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="mmtask"
"hkey"="HKLM"
"command"="C:\\Program Files\\MUSICMATCH\\MUSICMATCH Jukebox\\mmtask.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="msnmsgr"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NeroCheck"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NvCpl"
"hkey"="HKLM"
"command"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="PCMService"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Dell\\Media Experience\\PCMService.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ppgrzh]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="WNLOGO~1"
"hkey"="HKCU"
"command"="C:\\DOCUME~1\\peter\\APPLIC~1\\SCURIT~1\\WNLOGO~1.EXE"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="qttask"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\scvhost.exe]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="scvhost"
"hkey"="HKLM"
"command"="scvhost.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sonic RecordNow!]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"=""
"hkey"="HKCU"
"command"=""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundService]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="evkamejn"
"hkey"="HKLM"
"command"="rundll32.exe \"C:\\WINDOWS\\system32\\evkamejn.dll\",setvm"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SsAAD.exe]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="SsAAD"
"hkey"="HKLM"
"command"="C:\\PROGRA~1\\Sony\\SONICS~1\\SsAAD.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StorageGuard]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="sgtray"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Common Files\\Sonic\\Update Manager\\sgtray.exe\" /r"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="jusched"
"hkey"="HKLM"
"command"="C:\\Program Files\\Java\\jre1.5.0_08\\bin\\jusched.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\tgcmdprovidersbc]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="tgcmd"
"hkey"="HKLM"
"command"="\"c:\\program files\\support.com\\bin\\tgcmd.exe\" /server /startmonitor /deaf /nosystray"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TotalRecorderScheduler]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="TotRecSched"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\HighCriteria\\TotalRecorder\\TotRecSched.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VoipStunt]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="VoipStunt"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\VoipStunt.com\\VoipStunt\\VoipStunt.exe\" -nosplash -minimized"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Weather]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Weather"
"hkey"="HKCU"
"command"="C:\\Program Files\\AWS\\WeatherBug\\Weather.exe 1"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="winampa"
"hkey"="HKLM"
"command"="C:\\Program Files\\Winamp\\winampa.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ypager"
"hkey"="HKCU"
"command"="C:\\PROGRA~1\\Yahoo!\\MESSEN~1\\ypager.exe -quiet"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YBrowser]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ybrwicon"
"hkey"="HKLM"
"command"="C:\\Program Files\\Yahoo!\\browser\\ybrwicon.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zone Labs Client]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="zlclient"
"hkey"="HKLM"
"command"="C:\\PROGRA~1\\ZONELA~1\\ZONEAL~1\\zlclient.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\{9CD3E346-0BAF-1033-0115-040322060001}]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Update"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Common Files\\{9CD3E346-0BAF-1033-0115-040322060001}\\Update.exe\" te-110-12-0000213"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\{9CD3E346-0BB0-1033-0115-040322060001}]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Update"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Common Files\\{9CD3E346-0BB0-1033-0115-040322060001}\\Update.exe\" te-110-12-0000213"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"YPCService"=dword:00000003
"WANMiniportService"=dword:00000002
"Symantec AntiVirus"=dword:00000002
"SSScsiSV"=dword:00000003
"SPTISRV"=dword:00000003
"SPBBCSvc"=dword:00000002
"SNDSrvc"=dword:00000003
"SETI@Home"=dword:00000002
"SavRoam"=dword:00000003
"PACSPTISVR"=dword:00000003
"MSCSPTISRV"=dword:00000003
"MDM"=dword:00000002
"LiveUpdate"=dword:00000003
"iPodService"=dword:00000003
"EPSONStatusAgent2"=dword:00000002
"DefWatch"=dword:00000002
"Creative Service for CDROM Access"=dword:00000002
"ccSetMgr"=dword:00000002
"ccEvtMgr"=dword:00000002
"Apache"=dword:00000002
"AOL ACS"=dword:00000002
"NetSvc"=dword:00000003

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService DnsCache\0\0
rpcss RpcSs\0\0
imgsvc StiSvc\0\0
termsvcs TermService\0\0
HTTPFilter HTTPFilter\0\0
DcomLaunch DcomLaunch\0TermService\0\0
Usnsvc usnsvc\0\0



Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\AE2C5013919BC11B.job

********************************************************************

catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-05-04 17:02:17
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


********************************************************************

Completion time: 2007-05-04 17:02:38
C:\ComboFix-quarantined-files.txt ... 2007-05-04 17:02
C:\ComboFix2.txt ... 2007-05-03 17:04

HijackThis
Logfile of HijackThis v1.99.1
Scan saved at 5:04:03 PM, on 5/4/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Documents and Settings\peter\Desktop\hijackthis\HijackThis.exe

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {BAA07C31-16C7-4E8B-BC40-5096ADA26C03} (VTPlug Class) - http://61.152.160.40:1995/VTrans.cab
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

There you go lol, thanks for all the help

#6 Aaflac

Aaflac

    Doin' Dis 'n Dat...


  • Malware Response Team
  • 2,307 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:USA
  • Local time:01:21 AM

Posted 04 May 2007 - 10:20 PM

Also do the following:

Please download FindAWF:
http://noahdfear.geekstogo.com/FindAWF.exe

Save the file to the Desktop
Double-click: FindAWF.exe

If a Security Alert shows, allow the program to run.

When done, a text file awf.txt is produced.


~~~~
Please post the contents the awf.text in your reply.

Old duck...


#7 Hylianfalcon

Hylianfalcon
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:01:21 AM

Posted 04 May 2007 - 10:25 PM

FindAWF

Find AWF report by noahdfear ©2006


bak folders found
~~~~~~~~~~~



Duplicate files of bak directory contents
~~~~~~~~~~~~~~~~~~~~~~~



end of report

It didn't say much lol

Lol, thanks again, you've helped get rid of a lot of stuff.

#8 Aaflac

Aaflac

    Doin' Dis 'n Dat...


  • Malware Response Team
  • 2,307 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:USA
  • Local time:01:21 AM

Posted 05 May 2007 - 10:13 PM

We need to get rid of a few more entries in the ComboFix log, but first, we need a little more info.

Please run HijackThis
Select the following buttons in this order: Config > Misc Tools > Open Uninstall Manager

A list of programs in the Add/Remove Programs Manager area is shown
Click: Save, for Notepad to open with the contents of that list.

Provide the Uninstall List in your reply.

~~~~
Now, do the following:
Go to Start, select Run, and in the Open area type in: cmd

Now, at the black command window, copy the following next to the blinking cursor:
cd "C:\Documents and Settings\peter\My Documents"
Now, press: Enter

Once again at the blinking cursor, copy the following:
dir/p >> C:\Contents.txt
Press: Enter

Once again at the blinking cursor, copy the following:
Start Notepad C:\Contents.txt
Press: Enter

Notepad pops up with Contents.txt. Copy the text to post it in your reply.


~~~~


Now, once again at the blinking cursor, copy the following:
cd "C:\Documents and Settings\peter\Application Data"
Press: Enter

Again, at the blinking cursor, copy the following:
dir/p >> C:\Contents2.txt
Press: Enter

At the blinking cursor, copy the following:
Start Notepad C:\Contents2.txt
Press: Enter


Notepad pops up with some text once again. Copy the Contents2.txt to post it in your reply.


Now, at the blinking cursor, type: Exit
Press: Enter

~~~~
Need the Uninstall List from HijackThis, and both text files (Contents.txt and Contents2.txt) in your reply.

Edited by Aaflac, 06 May 2007 - 05:07 PM.

Old duck...


#9 Hylianfalcon

Hylianfalcon
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:01:21 AM

Posted 07 May 2007 - 06:21 PM

My computer is like 5 years old, and i thought it would be a good idea just to reformat it, because of all the problems that weren't virus related. Thanks for all your help, I appreciate it

#10 Aaflac

Aaflac

    Doin' Dis 'n Dat...


  • Malware Response Team
  • 2,307 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:USA
  • Local time:01:21 AM

Posted 07 May 2007 - 09:35 PM

Sometimes the best solution is to format and reinstall Windows.
You will have the reassurance that the system is clean after you do.

Once Windows is reinstalled, take a good look at the following suggestions to remain malware free:
Tony Klein’s article 'How Did I Get Infected In The First Place'
http://forums.spywareinfo.com/index.php?showtopic=60955


Good luck, Hylianfalcon!

Old duck...


#11 Hylianfalcon

Hylianfalcon
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:01:21 AM

Posted 08 May 2007 - 09:41 PM

Haha, i'll try not to ruin my computer a second time. Thanks again for all of your help

#12 Aaflac

Aaflac

    Doin' Dis 'n Dat...


  • Malware Response Team
  • 2,307 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:USA
  • Local time:01:21 AM

Posted 08 May 2007 - 10:14 PM

Glad to do so! :thumbsup:

Old duck...





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users