Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Ultimate Fixer And Other Delights


  • Please log in to reply
10 replies to this topic

#1 exitrun27

exitrun27

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:07:32 PM

Posted 24 June 2007 - 12:23 AM

G'day - I, like many are struggling inthis MALWARE world, even thougy I use 'protection'. I have followed some of the threads and had a go at a few things with some success, it is now done to a few hard ones.

To date I have run SmitFraudfix, Combofix, Spyware doctor and Tend Micro scanner.

Below is my HJT log and ComboFix log

ComboFix 07-06-18.2 - C:\Documents and Settings\Sam\Desktop\ComboFix.exe
"Sam" - 2007-06-24 14:36:14 - Service Pack 2 NTFS


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\wr.txt


((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


-------\LEGACY_NPF


((((((((((((((((((((((((( Files Created from 2007-05-24 to 2007-06-24 )))))))))))))))))))))))))))))))


2007-06-24 14:29 49,152 --a------ C:\WINDOWS\nircmd.exe
2007-06-24 12:48 <DIR> d-------- C:\WINDOWS\pss
2007-06-23 00:33 83,024 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2007-06-23 00:33 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll
2007-06-23 00:33 57,424 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2007-06-23 00:33 53,840 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2007-06-23 00:33 39,376 --a------ C:\WINDOWS\system32\drivers\ikfileflt.sys
2007-06-23 00:33 29,264 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2007-06-23 00:33 <DIR> d-------- C:\Program Files\Spyware Doctor
2007-06-22 23:50 <DIR> d-------- C:\Program Files\Enigma Software Group
2007-06-22 22:50 4,048 --a------ C:\WINDOWS\system32\tmp.reg
2007-06-22 21:40 <DIR> d-------- C:\Anti Virus Utilities
2007-06-21 17:01 31,254 --------- C:\WINDOWS\system32\jkkkklm.dll
2007-06-19 22:06 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-06-19 21:43 <DIR> d---s---- C:\DOCUME~1\Sam\UserData
2007-06-19 21:10 <DIR> d-------- C:\Program Files\HJT
2007-06-19 16:53 <DIR> d-------- C:\Program Files\WinPop
2007-06-18 16:39 920,650 --ahs---- C:\WINDOWS\system32\dgjlm.ini2
2007-06-17 20:56 <DIR> d-------- C:\WINDOWS\system32\mevqvvvb
2007-06-17 18:05 94,976 --a------ C:\mevqvvvb3.exe
2007-06-17 18:05 100,096 --a------ C:\mevqvvvb2.exe
2007-06-17 18:04 99,072 --a------ C:\mevqvvvb1.exe
2007-06-17 18:03 286,720 --a------ C:\WINDOWS\system32\scchk32.exe
2007-06-16 19:54 8,704 --a------ C:\WINDOWS\system32\SpOrder.Dll
2007-06-16 19:54 257,536 --a------ C:\WINDOWS\system32\ICF.dll
2007-06-16 19:54 <DIR> d-------- C:\Program Files\Internet Content Filter
2007-06-16 19:45 <DIR> d-------- C:\DOCUME~1\Sam\APPLIC~1\InstallShield
2007-06-15 16:52 926,246 --ahs---- C:\WINDOWS\system32\dgjlm.bak2
2007-06-14 20:52 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2007-06-14 16:51 918,587 --ahs---- C:\WINDOWS\system32\dgjlm.bak1
2007-06-13 20:11 <DIR> d-------- C:\VundoFix Backups
2007-06-13 19:14 122,900 --a------ C:\WINDOWS\system32\hvllcfxp.exe
2007-06-05 21:22 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2007-06-05 20:16 <DIR> d-------- C:\DOCUME~1\Sam\APPLIC~1\Apple Computer
2007-06-05 20:14 <DIR> d-------- C:\Program Files\iTunes
2007-06-05 20:14 <DIR> d-------- C:\Program Files\iPod
2007-06-05 20:10 <DIR> d-------- C:\Program Files\QuickTime
2007-06-05 20:04 <DIR> d-------- C:\Program Files\Apple Software Update
2007-06-05 20:03 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
2007-06-04 21:45 <DIR> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-06-04 20:01 <DIR> d-------- C:\WINDOWS\system32\appmgmt
2007-06-03 20:38 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2007-06-03 20:38 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2007-06-03 20:38 <DIR> d-------- C:\WINDOWS\system32\PreInstall
2007-06-03 16:56 <DIR> d-------- C:\Program Files\Cat Daddy Games
2007-06-03 11:54 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2007-06-03 11:54 208,248 --a------ C:\WINDOWS\system32\muweb.dll
2007-06-02 16:56 <DIR> d-------- C:\DOCUME~1\Sam\Contacts
2007-06-02 16:55 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Live Toolbar
2007-06-02 16:50 <DIR> d-------- C:\Program Files\Windows Live Toolbar
2007-06-02 16:44 57,344 --a------ C:\DOCUME~1\ALLUSE~1\APPLIC~1\nebyzkdm.exe
2007-06-02 16:43 <DIR> d-------- C:\Program Files\MSN Messenger
2007-06-02 16:36 <DIR> d-------- C:\DOCUME~1\Sam\APPLIC~1\MSNInstaller
2007-06-02 12:07 <DIR> d-------- C:\WINDOWS\system32\SoftwareDistribution
2007-06-01 17:56 <DIR> d-------- C:\DOCUME~1\Sam\APPLIC~1\Lionhead Studios
2007-06-01 17:48 <DIR> d--hs---- C:\WINDOWS\ftpcache


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-06-16 09:54:21 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-06-07 12:16:30 -------- d-----w C:\Program Files\Messenger
2007-06-01 07:55:51 163,644 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-05-20 03:16:53 -------- d-----w C:\DOCUME~1\Sam\APPLIC~1\Artweaver
2007-05-20 03:16:46 -------- d-----w C:\Program Files\Artweaver 0.4
2007-05-19 11:23:32 -------- d-----w C:\Program Files\Temp
2007-05-16 15:12:02 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-05-07 07:41:07 -------- d-----w C:\Program Files\NetMeter
2007-05-07 07:14:52 -------- d-----w C:\DOCUME~1\Sam\APPLIC~1\Jasc Software Inc
2007-04-28 21:12:29 -------- d-----w C:\Program Files\Chessmaster 8000
2007-04-25 14:21:15 144,896 ----a-w C:\WINDOWS\system32\schannel.dll
2007-04-18 16:12:23 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll
2007-04-16 12:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll
2007-04-16 12:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll
2007-04-16 12:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
2007-04-16 12:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
2007-04-16 12:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
2007-04-16 12:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
2007-04-16 12:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
2007-04-16 12:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
2007-04-14 07:40:37 21,840 ----atw C:\WINDOWS\system32\SIntfNT.dll
2007-04-14 07:40:37 17,212 ----atw C:\WINDOWS\system32\SIntf32.dll
2007-04-14 07:40:37 12,067 ----atw C:\WINDOWS\system32\SIntf16.dll
2007-03-25 09:20:49 671 ----a-w C:\WINDOWS\mozver.dat
2007-03-25 09:13:21 0 ----a-w C:\WINDOWS\nsreg.dat


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{53707962-6F74-2D53-2644-206D7942484F}=C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [2005-05-31 01:04]
{5FBBFABB-60B4-467E-B88D-AACFDB50E5D2}=C:\WINDOWS\system32\eipjtvrh.dll []
{674DDFA6-BB3D-427B-961F-E9EEEF293004}=C:\WINDOWS\system32\jkkkklm.dll [2007-06-21 17:01]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 03:43]
{9030D464-4C02-4ABF-8ECC-5164760863C6}=C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2006-08-31 20:33]
{B7C84F3F-7305-4101-97C5-54AA8E974897}=C:\WINDOWS\system32\eipjtvrh.dll []
{F13F4A1D-E1A1-4D31-820D-1BC2334ACD91}=C:\WINDOWS\system32\mljgd.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DrvLsnr"="C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe" [2003-05-08 10:34]
"pccguide.exe"="C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe" [2006-08-25 11:25]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-10-25 18:58]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-10-30 09:36]
"ICF"="C:\Program Files\Internet Content Filter\SafeEyes.exe" [2007-06-05 10:17]
"SDTray"="C:\Program Files\Spyware Doctor\SDTrayApp.exe" [2007-06-12 13:19]
"nwiz"="nwiz.exe" [2006-10-22 12:22 C:\WINDOWS\system32\nwiz.exe]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 22:00]
"OE"="C:\Program Files\Trend Micro\Internet Security 2007\TMAS_OE\TMAS_OEMon.exe" [2006-08-18 13:06]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{EDB0E980-90BD-11D4-8599-0008C7D3B6F8}"="C:\Program Files\Qualcomm\Eudora\EuShlExt.dll" [2005-11-14 16:15]
"{674DDFA6-BB3D-427B-961F-E9EEEF293004}"="C:\WINDOWS\system32\jkkkklm.dll" [2007-06-21 17:01]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\jkkkklm]
jkkkklm.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mljgd]
C:\WINDOWS\system32\mljgd.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\yayxvvw]
yayxvvw.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\sdauxservice]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\sdcoreservice]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
"C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nebyzkdm.exe]
C:\Documents and Settings\All Users\Application Data\nebyzkdm.exe


Contents of the 'Scheduled Tasks' folder
2007-06-05 10:07:16 C:\WINDOWS\tasks\AppleSoftwareUpdate.job

**************************************************************************

catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-06-24 14:57:00
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-06-24 15:02:24 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-06-24 15:02

--- E O F ---

_________________________

Logfile of HijackThis v1.99.1
Scan saved at 3:07:29 PM, on 24/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\hvllcfxp.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\WINDOWS\System32\alg.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\TRENDM~1\INTERN~1\PccGuide.exe
C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Internet Content Filter\SafeEyes.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Trend Micro\Internet Security 2007\TMAS_OE\TMAS_OEMon.exe
C:\Program Files\NETGEAR WG311v2 Adapter\wlancfg5.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\HJT\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {5FBBFABB-60B4-467E-B88D-AACFDB50E5D2} - C:\WINDOWS\system32\eipjtvrh.dll (file missing)
O2 - BHO: (no name) - {674DDFA6-BB3D-427B-961F-E9EEEF293004} - C:\WINDOWS\system32\jkkkklm.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {B7C84F3F-7305-4101-97C5-54AA8E974897} - C:\WINDOWS\system32\eipjtvrh.dll (file missing)
O2 - BHO: (no name) - {F13F4A1D-E1A1-4D31-820D-1BC2334ACD91} - C:\WINDOWS\system32\mljgd.dll (file missing)
O3 - Toolbar: Safe &Eyes Toolbar - {430DDB4F-38CC-4E91-AF33-4157334EC937} - C:\Program Files\Internet Content Filter\setoolbar.dll
O4 - HKLM\..\Run: [DrvLsnr] C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ICF] "C:\Program Files\Internet Content Filter\SafeEyes.exe"
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [OE] "C:\Program Files\Trend Micro\Internet Security 2007\TMAS_OE\TMAS_OEMon.exe"
O4 - Global Startup: NETGEAR WG311v2 Smart Configuration.lnk = C:\Program Files\NETGEAR WG311v2 Adapter\wlancfg5.exe
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Broken Internet access because of LSP provider 'icf.dll' missing
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: jkkkklm - C:\WINDOWS\SYSTEM32\jkkkklm.dll
O20 - Winlogon Notify: mljgd - C:\WINDOWS\system32\mljgd.dll (file missing)
O20 - Winlogon Notify: yayxvvw - yayxvvw.dll (file missing)
O23 - Service: DomainService - - C:\WINDOWS\system32\hvllcfxp.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Trend Micro Protection Against Spyware (PcScnSrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe



Thanks in advance :thumbsup:

BC AdBot (Login to Remove)

 


#2 -David-

-David-

  • Members
  • 10,603 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London
  • Local time:10:32 AM

Posted 24 June 2007 - 03:20 AM

Hello there and welcome to Bleeping Computer's security forum.
My name is David, I will be helping you with your log today.

It is a good idea to print off these instructions. There is a possibility some of the instructions will need to be carried out where internet access is not available. It is important that you complete the instructions in the right order, and that you don't miss out any steps.

Please set your system to show all files.
Click Start, open My Computer, select the Tools menu and click Folder Options.
Select the View Tab. Under the Hidden files and folders heading, select Show hidden files and folders.
Uncheck: Hide file extensions for known file types
Uncheck the Hide protected operating system files (recommended) option.
Click Yes to confirm.

Start HijackThis, close all open windows leaving only HijackThis running. Place a check against each of the following if still present:

O2 - BHO: (no name) - {5FBBFABB-60B4-467E-B88D-AACFDB50E5D2} - C:\WINDOWS\system32\eipjtvrh.dll (file missing)
O2 - BHO: (no name) - {674DDFA6-BB3D-427B-961F-E9EEEF293004} - C:\WINDOWS\system32\jkkkklm.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {B7C84F3F-7305-4101-97C5-54AA8E974897} - C:\WINDOWS\system32\eipjtvrh.dll (file missing)
O2 - BHO: (no name) - {F13F4A1D-E1A1-4D31-820D-1BC2334ACD91} - C:\WINDOWS\system32\mljgd.dll (file missing)
O20 - Winlogon Notify: jkkkklm - C:\WINDOWS\SYSTEM32\jkkkklm.dll
O20 - Winlogon Notify: mljgd - C:\WINDOWS\system32\mljgd.dll (file missing)
O20 - Winlogon Notify: yayxvvw - yayxvvw.dll (file missing)
O23 - Service: DomainService - - C:\WINDOWS\system32\hvllcfxp.exe

Click on Fix Checked when finished and exit HijackThis.
Make sure your Internet Explorer is closed when you click Fix Checked!

Now reboot into Safe Mode.
This can be done tapping the F8 key as soon as you start your computer
You will be brought to a menu where you can choose to boot into safe mode.
Make sure you choose the option without networking support.

Using Windows Explorer, please locate the following files/folders, and delete them if still present:

C:\WINDOWS\system32\dgjlm.ini2
C:\WINDOWS\system32\mevqvvvb <--folder
C:\mevqvvvb3.exe
C:\mevqvvvb2.exe
C:\mevqvvvb1.exe
C:\WINDOWS\system32\scchk32.exe
C:\WINDOWS\system32\dgjlm.bak2
C:\WINDOWS\system32\dgjlm.bak1
C:\WINDOWS\system32\hvllcfxp.exe
C:\Documents and Settings\All Users\Application Data\nebyzkdm.exe

Reboot back into normal mode.

Please click on start > run > and type: sc stop "DomainService"
Hit enter and let the DOS windows open and close. This is normal.
Do the same for this command: sc delete "DomainService"

Please download VundoFix.exe to your desktop
Double-click VundoFix.exe to run it.
Click the Scan for Vundo button.
Once it's done scanning, click the Remove Vundo button.
You will receive a prompt asking if you want to remove the files, click YES
Once you click yes, your desktop will go blank as it starts removing Vundo.
When completed, it will prompt that it will reboot your computer, click OK.
Please post the contents of C:\vundofix.txt and a new HiJackThis log in a reply to this thread.
Note: It is possible that VundoFix encountered a file it could not remove.
VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button".

#3 exitrun27

exitrun27
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:07:32 PM

Posted 24 June 2007 - 07:54 AM

David, thanks very much. The Computer sseems to be running better already, although it is taking an inordinate amount of time to log in, before we can do somoething useful.

Please find the latesst logs below:


VundoFix V6.3.17

Checking Java version...

Java version is 1.5.0.11

Scan started at 8:11:31 PM 13/06/2007

Listing files found while scanning....

C:\WINDOWS\system32\rqtss.bak2
C:\WINDOWS\system32\rqtss.ini
C:\WINDOWS\system32\sstqr.dll

Beginning removal...

Attempting to delete C:\WINDOWS\system32\rqtss.bak2
C:\WINDOWS\system32\rqtss.bak2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\rqtss.ini
C:\WINDOWS\system32\rqtss.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\sstqr.dll
C:\WINDOWS\system32\sstqr.dll Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V6.5.1

Checking Java version...

Java version is 1.5.0.11

Scan started at 9:53:39 PM 22/06/2007

Listing files found while scanning....

C:\WINDOWS\system32\avjndqto.dll
C:\windows\system32\bnpmsxmk.ini
C:\WINDOWS\system32\cmfmahhk.dll
C:\windows\system32\eipjtvrh.dll
C:\WINDOWS\system32\hesdteme.dll
C:\WINDOWS\system32\hvsffbks.dll
C:\windows\system32\kmxsmpnb.dll
C:\WINDOWS\system32\mljgd.dll
C:\windows\system32\urqnlll.dll

Beginning removal...

Attempting to delete C:\WINDOWS\system32\avjndqto.dll
C:\WINDOWS\system32\avjndqto.dll Has been deleted!

Attempting to delete C:\windows\system32\bnpmsxmk.ini
C:\windows\system32\bnpmsxmk.ini Has been deleted!

Attempting to delete C:\windows\system32\eipjtvrh.dll
C:\windows\system32\eipjtvrh.dll Could not be deleted.

Attempting to delete C:\WINDOWS\system32\hesdteme.dll
C:\WINDOWS\system32\hesdteme.dll Could not be deleted.

Attempting to delete C:\windows\system32\kmxsmpnb.dll
C:\windows\system32\kmxsmpnb.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\mljgd.dll
C:\WINDOWS\system32\mljgd.dll Could not be deleted.

Attempting to delete C:\windows\system32\urqnlll.dll
C:\windows\system32\urqnlll.dll Has been deleted!

Performing Repairs to the registry.
Done!

Beginning removal...

Attempting to delete C:\windows\system32\eipjtvrh.dll
C:\windows\system32\eipjtvrh.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\hesdteme.dll
C:\WINDOWS\system32\hesdteme.dll Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V6.5.1

Checking Java version...

Java version is 1.5.0.11

Scan started at 10:09:48 PM 24/06/2007

Listing files found while scanning....

No infected files were found.

________________________________________________

Logfile of HijackThis v1.99.1
Scan saved at 10:29:33 PM, on 24/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trend Micro\Internet Security 2007\TMAS_OE\TMAS_OEMon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\NETGEAR WG311v2 Adapter\wlancfg5.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Internet Content Filter\SafeEyes.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\Program Files\HJT\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {674DDFA6-BB3D-427B-961F-E9EEEF293004} - C:\WINDOWS\system32\jkkkklm.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Safe &Eyes Toolbar - {430DDB4F-38CC-4E91-AF33-4157334EC937} - C:\Program Files\Internet Content Filter\setoolbar.dll
O4 - HKLM\..\Run: [DrvLsnr] C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ICF] "C:\Program Files\Internet Content Filter\SafeEyes.exe"
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nebyzkdm.exe] C:\Documents and Settings\All Users\Application Data\nebyzkdm.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [OE] "C:\Program Files\Trend Micro\Internet Security 2007\TMAS_OE\TMAS_OEMon.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: NETGEAR WG311v2 Smart Configuration.lnk = C:\Program Files\NETGEAR WG311v2 Adapter\wlancfg5.exe
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Broken Internet access because of LSP provider 'icf.dll' missing
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: jkkkklm - C:\WINDOWS\SYSTEM32\jkkkklm.dll
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Trend Micro Protection Against Spyware (PcScnSrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

thanks

:thumbsup:

#4 -David-

-David-

  • Members
  • 10,603 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London
  • Local time:10:32 AM

Posted 24 June 2007 - 08:24 AM

Good work! Let's continue.. :thumbsup:

It is a good idea to print off these instructions. There is a possibility some of the instructions will need to be carried out where internet access is not available. It is important that you complete the instructions in the right order, and that you don't miss out any steps.

Start HijackThis, close all open windows leaving only HijackThis running. Place a check against each of the following if still present:

O2 - BHO: (no name) - {674DDFA6-BB3D-427B-961F-E9EEEF293004} - C:\WINDOWS\system32\jkkkklm.dll
O4 - HKLM\..\Run: [nebyzkdm.exe] C:\Documents and Settings\All Users\Application Data\nebyzkdm.exe
O20 - Winlogon Notify: jkkkklm - C:\WINDOWS\SYSTEM32\jkkkklm.dll

Click on Fix Checked when finished and exit HijackThis.
Make sure your Internet Explorer is closed when you click Fix Checked!

Click start > run and type: notepad, then hit enter.

File::
C:\WINDOWS\SYSTEM32\jkkkklm.dll
C:\Documents and Settings\All Users\Application Data\nebyzkdm.exe

Click File > Save and call it "ComboFix-Do.txt" (without quotes).
Save it to your desktop.
Posted Image
Refering to the picture above, drag ComboFix-Do.txt into ComboFix.exe
Combofix will run, and a text file will open. Please post it back here.

#5 exitrun27

exitrun27
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:07:32 PM

Posted 25 June 2007 - 03:32 AM

David,

trust this shows further improvement. Thanks again

ComboFix 07-06-18.2 - C:\Documents and Settings\Sam\Desktop\ComboFix.exe
"Sam" - 2007-06-25 17:52:48 - Service Pack 2 NTFS
Command switches used :: C:\Documents and Settings\Sam\Desktop\ComboFix-Do.txt


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\SYSTEM32\jkkkklm.dll


((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


-------\LEGACY_NPF


((((((((((((((((((((((((( Files Created from 2007-05-25 to 2007-06-25 )))))))))))))))))))))))))))))))


2007-06-24 14:29 49,152 --a------ C:\WINDOWS\nircmd.exe
2007-06-24 12:48 <DIR> d-------- C:\WINDOWS\pss
2007-06-23 00:33 83,024 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2007-06-23 00:33 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll
2007-06-23 00:33 57,424 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2007-06-23 00:33 53,840 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2007-06-23 00:33 39,376 --a------ C:\WINDOWS\system32\drivers\ikfileflt.sys
2007-06-23 00:33 29,264 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2007-06-23 00:33 <DIR> d-------- C:\Program Files\Spyware Doctor
2007-06-22 23:50 <DIR> d-------- C:\Program Files\Enigma Software Group
2007-06-22 22:50 4,048 --a------ C:\WINDOWS\system32\tmp.reg
2007-06-22 21:40 <DIR> d-------- C:\Anti Virus Utilities
2007-06-19 22:06 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-06-19 21:43 <DIR> d---s---- C:\DOCUME~1\Sam\UserData
2007-06-19 21:10 <DIR> d-------- C:\Program Files\HJT
2007-06-19 16:53 <DIR> d-------- C:\Program Files\WinPop
2007-06-16 19:54 8,704 --a------ C:\WINDOWS\system32\SpOrder.Dll
2007-06-16 19:54 257,536 --a------ C:\WINDOWS\system32\ICF.dll
2007-06-16 19:54 <DIR> d-------- C:\Program Files\Internet Content Filter
2007-06-16 19:45 <DIR> d-------- C:\DOCUME~1\Sam\APPLIC~1\InstallShield
2007-06-14 20:52 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2007-06-13 20:11 <DIR> d-------- C:\VundoFix Backups
2007-06-05 21:22 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2007-06-05 20:16 <DIR> d-------- C:\DOCUME~1\Sam\APPLIC~1\Apple Computer
2007-06-05 20:14 <DIR> d-------- C:\Program Files\iTunes
2007-06-05 20:14 <DIR> d-------- C:\Program Files\iPod
2007-06-05 20:10 <DIR> d-------- C:\Program Files\QuickTime
2007-06-05 20:04 <DIR> d-------- C:\Program Files\Apple Software Update
2007-06-05 20:03 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
2007-06-04 21:45 <DIR> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-06-04 20:01 <DIR> d-------- C:\WINDOWS\system32\appmgmt
2007-06-03 20:38 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2007-06-03 20:38 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2007-06-03 20:38 <DIR> d-------- C:\WINDOWS\system32\PreInstall
2007-06-03 16:56 <DIR> d-------- C:\Program Files\Cat Daddy Games
2007-06-03 11:54 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2007-06-03 11:54 208,248 --a------ C:\WINDOWS\system32\muweb.dll
2007-06-02 16:56 <DIR> d-------- C:\DOCUME~1\Sam\Contacts
2007-06-02 16:55 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Live Toolbar
2007-06-02 16:50 <DIR> d-------- C:\Program Files\Windows Live Toolbar
2007-06-02 16:43 <DIR> d-------- C:\Program Files\MSN Messenger
2007-06-02 16:36 <DIR> d-------- C:\DOCUME~1\Sam\APPLIC~1\MSNInstaller
2007-06-02 12:07 <DIR> d-------- C:\WINDOWS\system32\SoftwareDistribution
2007-06-01 17:56 <DIR> d-------- C:\DOCUME~1\Sam\APPLIC~1\Lionhead Studios
2007-06-01 17:48 <DIR> d--hs---- C:\WINDOWS\ftpcache


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-06-16 09:54:21 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-06-07 12:16:30 -------- d-----w C:\Program Files\Messenger
2007-06-01 07:55:51 163,644 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-05-20 03:16:53 -------- d-----w C:\DOCUME~1\Sam\APPLIC~1\Artweaver
2007-05-20 03:16:46 -------- d-----w C:\Program Files\Artweaver 0.4
2007-05-19 11:23:32 -------- d-----w C:\Program Files\Temp
2007-05-16 15:12:02 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-05-07 07:41:07 -------- d-----w C:\Program Files\NetMeter
2007-05-07 07:14:52 -------- d-----w C:\DOCUME~1\Sam\APPLIC~1\Jasc Software Inc
2007-04-28 21:12:29 -------- d-----w C:\Program Files\Chessmaster 8000
2007-04-25 14:21:15 144,896 ----a-w C:\WINDOWS\system32\schannel.dll
2007-04-18 16:12:23 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll
2007-04-16 12:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll
2007-04-16 12:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll
2007-04-16 12:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
2007-04-16 12:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
2007-04-16 12:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
2007-04-16 12:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
2007-04-16 12:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
2007-04-16 12:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
2007-04-14 07:40:37 21,840 ----atw C:\WINDOWS\system32\SIntfNT.dll
2007-04-14 07:40:37 17,212 ----atw C:\WINDOWS\system32\SIntf32.dll
2007-04-14 07:40:37 12,067 ----atw C:\WINDOWS\system32\SIntf16.dll
2007-03-25 09:20:49 671 ----a-w C:\WINDOWS\mozver.dat
2007-03-25 09:13:21 0 ----a-w C:\WINDOWS\nsreg.dat


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{53707962-6F74-2D53-2644-206D7942484F}=C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [2005-05-31 01:04]
{674DDFA6-BB3D-427B-961F-E9EEEF293004}=C:\WINDOWS\system32\jkkkklm.dll []
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 03:43]
{9030D464-4C02-4ABF-8ECC-5164760863C6}=C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2006-08-31 20:33]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DrvLsnr"="C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe" [2003-05-08 10:34]
"pccguide.exe"="C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe" [2006-08-25 11:25]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-10-25 18:58]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-10-30 09:36]
"ICF"="C:\Program Files\Internet Content Filter\SafeEyes.exe" [2007-06-05 10:17]
"SDTray"="C:\Program Files\Spyware Doctor\SDTrayApp.exe" [2007-06-12 13:19]
"nwiz"="nwiz.exe" [2006-10-22 12:22 C:\WINDOWS\system32\nwiz.exe]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 22:00]
"OE"="C:\Program Files\Trend Micro\Internet Security 2007\TMAS_OE\TMAS_OEMon.exe" [2006-08-18 13:06]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{EDB0E980-90BD-11D4-8599-0008C7D3B6F8}"="C:\Program Files\Qualcomm\Eudora\EuShlExt.dll" [2005-11-14 16:15]
"{674DDFA6-BB3D-427B-961F-E9EEEF293004}"="C:\WINDOWS\system32\jkkkklm.dll" []

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\jkkkklm]
jkkkklm.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\sdauxservice]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\sdcoreservice]


Contents of the 'Scheduled Tasks' folder
2007-06-05 10:07:16 C:\WINDOWS\tasks\AppleSoftwareUpdate.job

**************************************************************************

catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-06-25 18:10:54
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-06-25 18:16:41 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-06-25 18:16
C:\ComboFix2.txt ... 2007-06-24 15:02

--- E O F ---

:thumbsup:

#6 -David-

-David-

  • Members
  • 10,603 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London
  • Local time:10:32 AM

Posted 25 June 2007 - 10:48 AM

Good work! Let's continue.. :thumbsup:

It is a good idea to print off these instructions. There is a possibility some of the instructions will need to be carried out where internet access is not available. It is important that you complete the instructions in the right order, and that you don't miss out any steps.

Please open notepad and and copy and paste next bold in it:
(don't forget to copy and paste REGEDIT4)

REGEDIT4

[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\jkkkklm]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{674DDFA6-BB3D-427B-961F-E9EEEF293004}"=-

Save this as "fix.reg" Choose to save as *all files and place it on your desktop.
It should look like this: Posted Image
Doubleclick on it and when it asks you if you want to merge the contents to the registry, click yes/ok.

Please perform this online scan: Kaspersky Webscan
Read the Requirements and Privacy statement, then select "Accept"
A dialogue box will appearing asking "Do you want to install this software?" Name: kavwebscan_unicode.cab
Select "Install" to download the ActiveX controls that allows ActiveScan to run.
When the download is complete it will say ready, click "Next"
Select a target to scan: Click on "My Computer"
When the scan is complete choose to save the results as "Save as Text"
Post the Kaspersky scan results in your next reply, along with a new Hijackthis log.

#7 exitrun27

exitrun27
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:07:32 PM

Posted 26 June 2007 - 03:43 AM

David

Do you want me to remove the items that the scan identified? That is if the scan offers that!!

er27

#8 exitrun27

exitrun27
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:07:32 PM

Posted 26 June 2007 - 07:02 AM

David,

here are the logs as requested. Reference my last posting - obviously I could not fix the infected files.

*KASPERSKY ONLINE SCANNER REPORT*
Tuesday, June 26, 2007 8:43:55 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2
(Build 2600)
Kaspersky Online Scanner version: 5.0.93.0
Kaspersky Anti-Virus database last update: 26/06/2007
Kaspersky Anti-Virus database records: 353491

*Scan Settings*
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true
*Scan Target* My Computer
A:\
C:\
D:\
E:\
F:\
G:\
H:\
I:\
*Scan Statistics*
Total number of scanned objects 154803
Number of viruses found 35
Number of infected objects 164
Number of suspicious objects 4
Duration of the scan process 02:36:02


*Infected Object Name* *Virus Name* *Last Action*
C:\Anti Virus
Utilities\Free-SpyHunter-Scanner-Install.exe/PRE/data/{65145FC9-DEA0-4738-A4FE-376C2BA51806}/1/EnigmaUpdater.dll
Infected: not-a-virus:FraudTool.Win32.SpyHunter.b skipped
C:\Anti Virus
Utilities\Free-SpyHunter-Scanner-Install.exe/PRE/data/{65145FC9-DEA0-4738-A4FE-376C2BA51806}/2/esgi_md5h.dll
Infected: not-a-virus:FraudTool.Win32.SpyHunter.b skipped
C:\Anti Virus
Utilities\Free-SpyHunter-Scanner-Install.exe/PRE/data/{65145FC9-DEA0-4738-A4FE-376C2BA51806}/7/SpyHunter.exe
Infected: not-a-virus:FraudTool.Win32.SpyHunter.b skipped
C:\Anti Virus
Utilities\Free-SpyHunter-Scanner-Install.exe/PRE/data/{65145FC9-DEA0-4738-A4FE-376C2BA51806}/17/Esgiutl1.dll
Infected: not-a-virus:FraudTool.Win32.SpyHunter.b skipped
C:\Anti Virus
Utilities\Free-SpyHunter-Scanner-Install.exe/PRE/data/{65145FC9-DEA0-4738-A4FE-376C2BA51806}/18/SHSched.dll
Infected: not-a-virus:FraudTool.Win32.SpyHunter.b skipped
C:\Anti Virus Utilities\Free-SpyHunter-Scanner-Install.exe/PRE
Infected: not-a-virus:FraudTool.Win32.SpyHunter.b skipped
C:\Anti Virus Utilities\Free-SpyHunter-Scanner-Install.exe Ghost
Installer: infected - 6 skipped
C:\Anti Virus Utilities\Free-SpyHunter-Scanner-Install.exe UPX:
infected - 6 skipped
C:\Documents and Settings\Administrator\Application
Data\Adobe\Acrobat\8.0\Synchronizer\adobesynchronizersu80 Object is
locked skipped
C:\Documents and Settings\Administrator\Application
Data\Adobe\Acrobat\8.0\Synchronizer\metadata\Synchronizer80 Object is
locked skipped
C:\Documents and Settings\Administrator\Application Data\desktop.ini
Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Microsoft\HTML
Help\hh.dat Object is locked skipped
C:\Documents and Settings\Administrator\Application
Data\Microsoft\IMJP8_1\imjp81u.dic Object is locked skipped
C:\Documents and Settings\Administrator\Application
Data\Microsoft\Internet Explorer\brndlog.bak Object is locked skipped
C:\Documents and Settings\Administrator\Application
Data\Microsoft\Internet Explorer\brndlog.txt Object is locked skipped
C:\Documents and Settings\Administrator\Application
Data\Microsoft\Internet Explorer\Desktop.htt Object is locked skipped
C:\Documents and Settings\Administrator\Application
Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini Object is
locked skipped
C:\Documents and Settings\Administrator\Application
Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer
Browser.lnk Object is locked skipped
C:\Documents and Settings\Administrator\Application
Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf Object
is locked skipped
C:\Documents and Settings\Administrator\Application
Data\Microsoft\Protect\CREDHIST Object is locked skipped
C:\Documents and Settings\Administrator\Application
Data\Microsoft\Protect\S-1-5-21-1177238915-1500820517-1417001333-500\7421be86-b086-4a95-b0c5-d904446c47a9
Object is locked skipped
C:\Documents and Settings\Administrator\Application
Data\Microsoft\Protect\S-1-5-21-1177238915-1500820517-1417001333-500\Preferred
Object is locked skipped
C:\Documents and Settings\Administrator\Application
Data\Microsoft\Windows\Themes\Custom.theme Object is locked skipped
C:\Documents and Settings\Administrator\Cookies\index.dat Object is
locked skipped
C:\Documents and Settings\Administrator\Desktop\HP
D330M\AUDIO\sp27103.exe Object is locked skipped
C:\Documents and Settings\Administrator\Desktop\HP D330M\BROADCOM
LAN\sp33670.exe Object is locked skipped
C:\Documents and Settings\Administrator\Desktop\HP
D330M\CHIPSET\sp27532.exe Object is locked skipped
C:\Documents and Settings\Administrator\Desktop\HP D330M\INTEL
VID\sp31335.exe Object is locked skipped
C:\Documents and Settings\Administrator\Desktop\HP D330M\NVIDIA
VID\sp33254.exe Object is locked skipped
C:\Documents and
Settings\Administrator\Desktop\SmitfraudFix\GenericRenosFix.exe Object
is locked skipped
C:\Documents and
Settings\Administrator\Desktop\SmitfraudFix\HostsChk.exe Object is
locked skipped
C:\Documents and
Settings\Administrator\Desktop\SmitfraudFix\Process.exe Object is
locked skipped
C:\Documents and
Settings\Administrator\Desktop\SmitfraudFix\restart.exe Object is
locked skipped
C:\Documents and
Settings\Administrator\Desktop\SmitfraudFix\SmitfraudFix.cmd Object is
locked skipped
C:\Documents and
Settings\Administrator\Desktop\SmitfraudFix\SmiUpdate.exe Object is
locked skipped
C:\Documents and
Settings\Administrator\Desktop\SmitfraudFix\SrchSTS.exe Object is
locked skipped
C:\Documents and Settings\Administrator\Desktop\SmitfraudFix\swreg.exe
Object is locked skipped
C:\Documents and Settings\Administrator\Desktop\SmitfraudFix\swsc.exe
Object is locked skipped
C:\Documents and Settings\Administrator\Desktop\SmitfraudFix\unzip.exe
Object is locked skipped
C:\Documents and Settings\Administrator\Desktop\SmitfraudFix.exe Object
is locked skipped
C:\Documents and Settings\Administrator\Favorites\Desktop.ini Object is
locked skipped
C:\Documents and Settings\Administrator\Favorites\Links\Customize
Links.url Object is locked skipped
C:\Documents and Settings\Administrator\Favorites\Links\Free
Hotmail.url Object is locked skipped
C:\Documents and Settings\Administrator\Favorites\Links\Windows
Marketplace.url Object is locked skipped
C:\Documents and Settings\Administrator\Favorites\Links\Windows
Media.url Object is locked skipped
C:\Documents and Settings\Administrator\Favorites\Links\Windows.url
Object is locked skipped
C:\Documents and Settings\Administrator\Favorites\MSN.com.url Object is
locked skipped
C:\Documents and Settings\Administrator\Favorites\Radio Station
Guide.url Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application
Data\IconCache.db Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application
Data\Microsoft\Internet Explorer\MSIMGSIZ.DAT Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application
Data\Microsoft\Media Player\CurrentDatabase_59R.wmdb Object is locked
skipped
C:\Documents and Settings\Administrator\Local Settings\Application
Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application
Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application
Data\Microsoft\Windows Media\9.0\WMSDKNS.DTD Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application
Data\Microsoft\Windows Media\9.0\WMSDKNS.XML Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\desktop.ini
Object is locked skipped
C:\Documents and Settings\Administrator\Local
Settings\History\desktop.ini Object is locked skipped
C:\Documents and Settings\Administrator\Local
Settings\History\History.IE5\desktop.ini Object is locked skipped
C:\Documents and Settings\Administrator\Local
Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Administrator\Local
Settings\History\History.IE5\MSHist012007062220070623\index.dat Object
is locked skipped
C:\Documents and Settings\Administrator\Local
Settings\History\History.IE5\MSHist012007062320070624\index.dat Object
is locked skipped
C:\Documents and Settings\Administrator\Local
Settings\Temp\DFC5A2B2.TMP Object is locked skipped
C:\Documents and Settings\Administrator\Local
Settings\Temp\e9b9_appcompat.txt Object is locked skipped
C:\Documents and Settings\Administrator\Local
Settings\Temp\is-MR642.tmp\SecurityUtil.dll Object is locked skipped
C:\Documents and Settings\Administrator\Local
Settings\Temp\jusched.log Object is locked skipped
C:\Documents and Settings\Administrator\Local
Settings\Temp\pftE1.tmp\b57amd64.inf Object is locked skipped
C:\Documents and Settings\Administrator\Local
Settings\Temp\pftE1.tmp\b57amd64.sys Object is locked skipped
C:\Documents and Settings\Administrator\Local
Settings\Temp\pftE1.tmp\b57dtect.dll Object is locked skipped
C:\Documents and Settings\Administrator\Local
Settings\Temp\pftE1.tmp\b57nt4.hlp Object is locked skipped
C:\Documents and Settings\Administrator\Local
Settings\Temp\pftE1.tmp\b57nt4.sys Object is locked skipped
C:\Documents and Settings\Administrator\Local
Settings\Temp\pftE1.tmp\b57w2k.sys Object is locked skipped
C:\Documents and Settings\Administrator\Local
Settings\Temp\pftE1.tmp\b57win32.inf Object is locked skipped
C:\Documents and Settings\Administrator\Local
Settings\Temp\pftE1.tmp\b57xp32.sys Object is locked skipped
C:\Documents and Settings\Administrator\Local
Settings\Temp\pftE1.tmp\oemsetup.inf Object is locked skipped
C:\Documents and Settings\Administrator\Local
Settings\Temp\pftE1.tmp\Silent.txt Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary
Internet Files\Content.IE5\desktop.ini Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary
Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary
Internet Files\desktop.ini Object is locked skipped
C:\Documents and Settings\Administrator\My Documents\desktop.ini Object
is locked skipped
C:\Documents and Settings\Administrator\NTUSER.DAT Object is locked
skipped
C:\Documents and Settings\Administrator\ntuser.dat.LOG Object is
locked skipped
C:\Documents and Settings\Administrator\ntuser.ini Object is locked
skipped
C:\Documents and Settings\Administrator\Recent\BOOTEX.lnk Object is
locked skipped
C:\Documents and Settings\Administrator\Recent\Desktop.ini Object is
locked skipped
C:\Documents and Settings\Administrator\Recent\Removable Disk (I).lnk
Object is locked skipped
C:\Documents and Settings\Administrator\Recent\spyware doctor
registration.lnk Object is locked skipped
C:\Documents and Settings\Administrator\Recent\Virus Software.lnk
Object is locked skipped
C:\Documents and Settings\Administrator\SendTo\Compressed (zipped)
Folder.ZFSendToTarget Object is locked skipped
C:\Documents and Settings\Administrator\SendTo\Desktop (create
shortcut).DeskLink Object is locked skipped
C:\Documents and Settings\Administrator\SendTo\desktop.ini Object is
locked skipped
C:\Documents and Settings\Administrator\SendTo\Mail Recipient.MAPIMail
Object is locked skipped
C:\Documents and Settings\Administrator\SendTo\My Documents.mydocs
Object is locked skipped
C:\Documents and Settings\Administrator\Start Menu\desktop.ini Object
is locked skipped
C:\Documents and Settings\Administrator\Start
Menu\Programs\Accessories\Accessibility\desktop.ini Object is locked
skipped
C:\Documents and Settings\Administrator\Start
Menu\Programs\Accessories\Accessibility\Magnifier.lnk Object is
locked skipped
C:\Documents and Settings\Administrator\Start
Menu\Programs\Accessories\Accessibility\Narrator.lnk Object is locked
skipped
C:\Documents and Settings\Administrator\Start
Menu\Programs\Accessories\Accessibility\On-Screen Keyboard.lnk Object
is locked skipped
C:\Documents and Settings\Administrator\Start
Menu\Programs\Accessories\Accessibility\Utility Manager.lnk Object is
locked skipped
C:\Documents and Settings\Administrator\Start
Menu\Programs\Accessories\Address Book.lnk Object is locked skipped
C:\Documents and Settings\Administrator\Start
Menu\Programs\Accessories\Command Prompt.lnk Object is locked skipped
C:\Documents and Settings\Administrator\Start
Menu\Programs\Accessories\desktop.ini Object is locked skipped
C:\Documents and Settings\Administrator\Start
Menu\Programs\Accessories\Entertainment\desktop.ini Object is locked
skipped
C:\Documents and Settings\Administrator\Start
Menu\Programs\Accessories\Entertainment\Windows Media Player.lnk Object
is locked skipped
C:\Documents and Settings\Administrator\Start
Menu\Programs\Accessories\Notepad.lnk Object is locked skipped
C:\Documents and Settings\Administrator\Start
Menu\Programs\Accessories\Program Compatibility Wizard.lnk Object is
locked skipped
C:\Documents and Settings\Administrator\Start
Menu\Programs\Accessories\Synchronize.lnk Object is locked skipped
C:\Documents and Settings\Administrator\Start
Menu\Programs\Accessories\Tour Windows XP.lnk Object is locked skipped
C:\Documents and Settings\Administrator\Start
Menu\Programs\Accessories\Windows Explorer.lnk Object is locked skipped
C:\Documents and Settings\Administrator\Start
Menu\Programs\desktop.ini Object is locked skipped
C:\Documents and Settings\Administrator\Start Menu\Programs\Internet
Explorer.lnk Object is locked skipped
C:\Documents and Settings\Administrator\Start Menu\Programs\Outlook
Express.lnk Object is locked skipped
C:\Documents and Settings\Administrator\Start Menu\Programs\Remote
Assistance.lnk Object is locked skipped
C:\Documents and Settings\Administrator\Start
Menu\Programs\Startup\desktop.ini Object is locked skipped
C:\Documents and Settings\Administrator\Start Menu\Programs\Windows
Media Player.lnk Object is locked skipped
C:\Documents and Settings\Administrator\Templates\amipro.sam Object is
locked skipped
C:\Documents and Settings\Administrator\Templates\excel.xls Object is
locked skipped
C:\Documents and Settings\Administrator\Templates\excel4.xls Object is
locked skipped
C:\Documents and Settings\Administrator\Templates\lotus.wk4 Object is
locked skipped
C:\Documents and Settings\Administrator\Templates\powerpnt.ppt Object
is locked skipped
C:\Documents and Settings\Administrator\Templates\presenta.shw Object
is locked skipped
C:\Documents and Settings\Administrator\Templates\quattro.wb2 Object is
locked skipped
C:\Documents and Settings\Administrator\Templates\sndrec.wav Object is
locked skipped
C:\Documents and Settings\Administrator\Templates\winword.doc Object is
locked skipped
C:\Documents and Settings\Administrator\Templates\winword2.doc Object
is locked skipped
C:\Documents and Settings\Administrator\Templates\wordpfct.wpd Object
is locked skipped
C:\Documents and Settings\Administrator\Templates\wordpfct.wpg Object
is locked skipped
C:\Documents and Settings\All Users\Application
Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application
Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search &
Destroy\Recovery\WinAgentqt.zip/retadpu1000272.exe Suspicious:
Password-protected-EXE skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search &
Destroy\Recovery\WinAgentqt.zip ZIP: suspicious - 1 skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search &
Destroy\Recovery\WinAgentqt5.zip/retadpu1000272.exe Suspicious:
Password-protected-EXE skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search &
Destroy\Recovery\WinAgentqt5.zip ZIP: suspicious - 1 skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is
locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application
Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application
Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local
Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet
Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked
skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is
locked skipped
C:\Documents and Settings\NetworkService\Cookies\index.dat Object is
locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application
Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application
Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local
Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary
Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked
skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is
locked skipped
C:\Documents and Settings\Sam\Application
Data\Microsoft\Templates\Normal.dot Object is locked skipped
C:\Documents and Settings\Sam\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Sam\Local Settings\Application
Data\Microsoft\Messenger\Red_Flame586@hotmail.com\SharingMetadata\Logs\Dfsr00005.log
Object is locked skipped
C:\Documents and Settings\Sam\Local Settings\Application
Data\Microsoft\Messenger\Red_Flame586@hotmail.com\SharingMetadata\pending.dat
Object is locked skipped
C:\Documents and Settings\Sam\Local Settings\Application
Data\Microsoft\Messenger\Red_Flame586@hotmail.com\SharingMetadata\Working\database_8A94_F6CF_94F6_BCAF\dfsr.db
Object is locked skipped
C:\Documents and Settings\Sam\Local Settings\Application
Data\Microsoft\Messenger\Red_Flame586@hotmail.com\SharingMetadata\Working\database_8A94_F6CF_94F6_BCAF\fsr.log
Object is locked skipped
C:\Documents and Settings\Sam\Local Settings\Application
Data\Microsoft\Messenger\Red_Flame586@hotmail.com\SharingMetadata\Working\database_8A94_F6CF_94F6_BCAF\fsrtmp.log
Object is locked skipped
C:\Documents and Settings\Sam\Local Settings\Application
Data\Microsoft\Messenger\Red_Flame586@hotmail.com\SharingMetadata\Working\database_8A94_F6CF_94F6_BCAF\tmp.edb
Object is locked skipped
C:\Documents and Settings\Sam\Local Settings\Application
Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Sam\Local Settings\Application
Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Sam\Local Settings\Application
Data\Microsoft\Windows Live
Contacts\Red_Flame586@hotmail.com\real\members.stg Object is locked
skipped
C:\Documents and Settings\Sam\Local Settings\Application
Data\Microsoft\Windows Live
Contacts\Red_Flame586@hotmail.com\shadow\members.stg Object is locked
skipped
C:\Documents and Settings\Sam\Local
Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Sam\Local
Settings\History\History.IE5\MSHist012007062620070627\index.dat Object
is locked skipped
C:\Documents and Settings\Sam\Local Settings\Temp\~DF4ACE.tmp Object is
locked skipped
C:\Documents and Settings\Sam\Local Settings\Temp\~DF64B4.tmp Object is
locked skipped
C:\Documents and Settings\Sam\Local Settings\Temp\~DF64D4.tmp Object is
locked skipped
C:\Documents and Settings\Sam\Local Settings\Temp\~DF7F25.tmp Object is
locked skipped
C:\Documents and Settings\Sam\Local Settings\Temp\~DF9769.tmp Object is
locked skipped
C:\Documents and Settings\Sam\Local Settings\Temp\~DFC149.tmp Object is
locked skipped
C:\Documents and Settings\Sam\Local Settings\Temp\~DFC17E.tmp Object is
locked skipped
C:\Documents and Settings\Sam\Local Settings\Temporary Internet
Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Sam\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Sam\ntuser.dat.LOG Object is locked skipped
C:\Program Files\HJT\backups\backup-20070624-215211-922.dll Infected:
not-a-virus:AdWare.Win32.Virtumonde.jp skipped
C:\Program Files\HJT\backups\backup-20070625-173432-251.dll Infected:
not-a-virus:AdWare.Win32.Virtumonde.jp skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\106E.tmp Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\1149.tmp Infected: Trojan-Downloader.Win32.Agent.bls
skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\114F.tmp Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\1186.tmp Infected: Trojan.Win32.Agent.qt skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\1241.tmp Infected: Trojan-Downloader.Win32.Agent.bls
skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\16.tmp/stream/data0004 Infected:
not-a-virus:AdWare.Win32.Softomate.u skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\16.tmp/stream Infected:
not-a-virus:AdWare.Win32.Softomate.u skipped
C:\Program Files\Trend Micro\Internet Security 2007\Quarantine\16.tmp
NSIS: infected - 2 skipped
C:\Program Files\Trend Micro\Internet Security 2007\Quarantine\16.tmp
CryptFF.b: infected - 2 skipped
C:\Program Files\Trend Micro\Internet Security 2007\Quarantine\17.tmp
Infected: Trojan.Win32.Agent.aoy skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\1765.tmp Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\17A6.tmp Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\17B1.tmp Infected: Trojan.Win32.Agent.anr skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\17B2.tmp Infected: Trojan.Win32.Agent.anr skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\17B3.tmp Infected: Trojan.Win32.Agent.anr skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\17B4.tmp Infected: Trojan.Win32.Agent.anr skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\17B5.tmp Infected: Trojan-Downloader.Win32.Small.dod
skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\17B6.tmp Infected: Trojan-Downloader.Win32.Agent.brf
skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\17BA.tmp Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\17C0.tmp Infected: Trojan.Win32.Agent.anr skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\206C.tmp Infected: Trojan-Downloader.Win32.Agent.brf
skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\207E.tmp Infected:
not-a-virus:AdWare.Win32.Virtumonde.ki skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\20A3.tmp Infected:
not-a-virus:AdWare.Win32.Virtumonde.ki skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\20A9.tmp Infected:
not-a-virus:AdWare.Win32.Virtumonde.ki skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\20E1.tmp Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\20E2.tmp Infected:
not-a-virus:AdWare.Win32.Virtumonde.ki skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\20E3.tmp Infected:
not-a-virus:AdWare.Win32.Virtumonde.ki skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\20F0.tmp Infected: not-a-virus:AdWare.Win32.Rond.a
skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\20FB.tmp Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\20FD.tmp Infected:
not-a-virus:AdWare.Win32.Virtumonde.ki skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\2104.tmp Infected:
Trojan-Downloader.Win32.Alphabet.gen skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\211D.tmp Infected:
Trojan-Downloader.Win32.Alphabet.gen skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\211E.tmp Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\211F.tmp Infected:
Trojan-Downloader.Win32.Alphabet.gen skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\212E.tmp Infected: Trojan.Win32.Agent.qt skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\212F.tmp Infected:
not-a-virus:AdWare.Win32.Virtumonde.ki skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\2132.tmp/data0002 Infected:
Trojan-Downloader.Win32.PurityScan.eg skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\2132.tmp NSIS: infected - 1 skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\2132.tmp CryptFF.b: infected - 1 skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\214C.tmp Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\215D.tmp Infected:
not-a-virus:AdWare.Win32.Virtumonde.ki skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\216C.tmp Infected:
not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\2289.tmp Infected: Trojan-Downloader.Win32.Agent.bls
skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\22C1.tmp Infected: Trojan.Win32.BHO.bd skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\22C2.tmp Infected: Trojan.Win32.BHO.bd skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\22C3.tmp Infected:
not-a-virus:AdWare.Win32.Virtumonde.jp skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\2303.tmp Infected:
not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\231F.tmp Infected:
not-a-virus:AdWare.Win32.Virtumonde.ki skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\2321.tmp Infected: not-a-virus:AdWare.Win32.Rond.a
skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\232E.tmp Infected: Trojan-Downloader.Win32.Small.dod
skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\232F.tmp Infected:
not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\2330.tmp Infected: Trojan.Win32.Agent.qt skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\2331.tmp Infected:
Trojan-Downloader.Win32.Alphabet.gen skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\2332.tmp Infected: Trojan.Win32.Agent.qt skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\2333.tmp/data0002 Infected:
Trojan-Downloader.Win32.PurityScan.eg skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\2333.tmp NSIS: infected - 1 skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\2333.tmp CryptFF.b: infected - 1 skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\2336.tmp Infected:
not-a-virus:AdWare.Win32.Virtumonde.ar skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\2337.tmp Infected: Trojan.Win32.Agent.anr skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\2338.tmp Infected: Trojan.Win32.Agent.anr skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\2339.tmp Infected: Trojan.Win32.Agent.anr skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\233A.tmp Infected:
not-a-virus:AdWare.Win32.Virtumonde.ki skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\233B.tmp Infected:
not-a-virus:AdWare.Win32.Virtumonde.ki skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\233C.tmp Infected:
not-a-virus:AdWare.Win32.Virtumonde.ki skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\233D.tmp Infected: Trojan.Win32.BHO.bd skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\233E.tmp Infected: Trojan.Win32.BHO.bd skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\233F.tmp Infected:
not-a-virus:AdWare.Win32.Virtumonde.jp skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\2340.tmp Infected:
not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\Program Files\Trend Micro\Internet Security 2007\Quarantine\2B.tmp
Infected: Trojan-Downloader.Win32.Nurech.ak skipped
C:\Program Files\Trend Micro\Internet Security 2007\Quarantine\32.tmp
Infected: Trojan.Win32.Agent.qt skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\A42.tmp/data0002 Infected:
Trojan-Downloader.Win32.PurityScan.eg skipped
C:\Program Files\Trend Micro\Internet Security 2007\Quarantine\A42.tmp
NSIS: infected - 1 skipped
C:\Program Files\Trend Micro\Internet Security 2007\Quarantine\A42.tmp
CryptFF.b: infected - 1 skipped
C:\Program Files\Trend Micro\Internet Security 2007\Quarantine\A43.tmp
Infected: Trojan-Downloader.Win32.Alphabet.gen skipped
C:\Program Files\Trend Micro\Internet Security 2007\Quarantine\A44.tmp
Infected: Trojan.Win32.Agent.qt skipped
C:\Program Files\Trend Micro\Internet Security 2007\Quarantine\BBE.tmp
Infected: Trojan-Downloader.Win32.Alphabet.gen skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\BEA.tmp/stream/data0002/data0002 Infected:
Trojan-Downloader.Win32.PurityScan.eh skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\BEA.tmp/stream/data0002 Infected:
Trojan-Downloader.Win32.PurityScan.eh skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\BEA.tmp/stream/data0004 Infected:
not-a-virus:AdWare.Win32.Softomate.u skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\BEA.tmp/stream Infected:
not-a-virus:AdWare.Win32.Softomate.u skipped
C:\Program Files\Trend Micro\Internet Security 2007\Quarantine\BEA.tmp
NSIS: infected - 4 skipped
C:\Program Files\Trend Micro\Internet Security 2007\Quarantine\BEA.tmp
CryptFF.b: infected - 4 skipped
C:\Program Files\Trend Micro\Internet Security 2007\Quarantine\BF5.tmp
Infected: Trojan-Downloader.Win32.Alphabet.gen skipped
C:\Program Files\Trend Micro\Internet Security 2007\Quarantine\BF6.tmp
Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Program Files\Trend Micro\Internet Security 2007\Quarantine\C06.tmp
Infected: Trojan.Win32.Agent.qt skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\C13.tmp/data0002 Infected:
Trojan-Downloader.Win32.PurityScan.eg skipped
C:\Program Files\Trend Micro\Internet Security 2007\Quarantine\C13.tmp
NSIS: infected - 1 skipped
C:\Program Files\Trend Micro\Internet Security 2007\Quarantine\C13.tmp
CryptFF.b: infected - 1 skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\C2D.tmp/stream/data0004 Infected:
not-a-virus:AdWare.Win32.Softomate.u skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\C2D.tmp/stream Infected:
not-a-virus:AdWare.Win32.Softomate.u skipped
C:\Program Files\Trend Micro\Internet Security 2007\Quarantine\C2D.tmp
NSIS: infected - 2 skipped
C:\Program Files\Trend Micro\Internet Security 2007\Quarantine\C2D.tmp
CryptFF.b: infected - 2 skipped
C:\Program Files\Trend Micro\Internet Security 2007\Quarantine\C74.tmp
Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Program Files\Trend Micro\Internet Security 2007\Quarantine\D8E.tmp
Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Program Files\Trend Micro\Internet Security 2007\Quarantine\DAD.tmp
Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\E.tmp/stream/data0004 Infected:
not-a-virus:AdWare.Win32.Softomate.u skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\E.tmp/stream Infected:
not-a-virus:AdWare.Win32.Softomate.u skipped
C:\Program Files\Trend Micro\Internet Security 2007\Quarantine\E.tmp
NSIS: infected - 2 skipped
C:\Program Files\Trend Micro\Internet Security 2007\Quarantine\E.tmp
CryptFF.b: infected - 2 skipped
C:\Program Files\Trend Micro\Internet Security 2007\Quarantine\F2A.tmp
Infected: Trojan-Downloader.Win32.Alphabet.gen skipped
C:\Program Files\Trend Micro\Internet Security 2007\Quarantine\F2B.tmp
Infected: Trojan-Downloader.Win32.Alphabet.gen skipped
C:\Program Files\Trend Micro\Internet Security 2007\Quarantine\FA4.tmp
Infected: Trojan-Downloader.Win32.Alphabet.gen skipped
C:\Program Files\Trend Micro\Internet Security
2007\Quarantine\mljgd.dll Infected:
not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\Program Files\WinPop\UnInstall.exe Infected: Trojan.Win32.Small.oa
skipped
C:\QooBox\Quarantine\catchme2007-06-25_181046.82.zip/jkkkklm.dll
Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
C:\QooBox\Quarantine\catchme2007-06-25_181046.82.zip ZIP: infected -
1 skipped
C:\RECYCLER\S-1-5-21-1177238915-1500820517-1417001333-500\Dc1\GenericRenosFix.exe
Object is locked skipped
C:\RECYCLER\S-1-5-21-1177238915-1500820517-1417001333-500\Dc1\HostsChk.exe
Object is locked skipped
C:\RECYCLER\S-1-5-21-1177238915-1500820517-1417001333-500\Dc1\Process.exe
Object is locked skipped
C:\RECYCLER\S-1-5-21-1177238915-1500820517-1417001333-500\Dc1\reboot.exe
Object is locked skipped
C:\RECYCLER\S-1-5-21-1177238915-1500820517-1417001333-500\Dc1\restart.exe
Object is locked skipped
C:\RECYCLER\S-1-5-21-1177238915-1500820517-1417001333-500\Dc1\SmitfraudFix.cmd
Object is locked skipped
C:\RECYCLER\S-1-5-21-1177238915-1500820517-1417001333-500\Dc1\SmiUpdate.exe
Object is locked skipped
C:\RECYCLER\S-1-5-21-1177238915-1500820517-1417001333-500\Dc1\SrchSTS.exe
Object is locked skipped
C:\RECYCLER\S-1-5-21-1177238915-1500820517-1417001333-500\Dc1\swreg.exe Object
is locked skipped
C:\RECYCLER\S-1-5-21-1177238915-1500820517-1417001333-500\Dc1\swsc.exe
Object is locked skipped
C:\RECYCLER\S-1-5-21-1177238915-1500820517-1417001333-500\Dc1\unzip.exe Object
is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is
locked skipped
C:\System Volume
Information\_restore{B9003348-7F74-4CE2-AB5F-C282A24CECA1}\RP76\A0009334.dll
Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\System Volume
Information\_restore{B9003348-7F74-4CE2-AB5F-C282A24CECA1}\RP83\A0011696.dll
Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
C:\System Volume
Information\_restore{B9003348-7F74-4CE2-AB5F-C282A24CECA1}\RP83\A0011697.exe
Infected: Trojan-Downloader.Win32.Agent.bls skipped
C:\System Volume
Information\_restore{B9003348-7F74-4CE2-AB5F-C282A24CECA1}\RP84\A0011749.dll
Infected: Trojan.Win32.BHO.o skipped
C:\System Volume
Information\_restore{B9003348-7F74-4CE2-AB5F-C282A24CECA1}\RP84\A0011751.dll
Infected: not-a-virus:AdWare.Win32.Virtumonde.kg skipped
C:\System Volume
Information\_restore{B9003348-7F74-4CE2-AB5F-C282A24CECA1}\RP84\A0011752.dll
Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
C:\System Volume
Information\_restore{B9003348-7F74-4CE2-AB5F-C282A24CECA1}\RP84\A0011765.dll
Infected: not-a-virus:AdWare.Win32.BHO.v skipped
C:\System Volume
Information\_restore{B9003348-7F74-4CE2-AB5F-C282A24CECA1}\RP84\A0011766.dll
Infected: not-a-virus:AdWare.Win32.Virtumonde.kj skipped
C:\System Volume
Information\_restore{B9003348-7F74-4CE2-AB5F-C282A24CECA1}\RP85\A0013909.exe/data.rar/keygen.exe
Infected: Trojan-Downloader.Win32.Nurech.ak skipped
C:\System Volume
Information\_restore{B9003348-7F74-4CE2-AB5F-C282A24CECA1}\RP85\A0013909.exe/data.rar/crack.exe
Infected: not-a-virus:AdWare.Win32.Virtumonde.bq skipped
C:\System Volume
Information\_restore{B9003348-7F74-4CE2-AB5F-C282A24CECA1}\RP85\A0013909.exe/data.rar/serial.exe
Infected: Trojan.Win32.Dialer.qn skipped
C:\System Volume
Information\_restore{B9003348-7F74-4CE2-AB5F-C282A24CECA1}\RP85\A0013909.exe/data.rar
Infected: Trojan.Win32.Dialer.qn skipped
C:\System Volume
Information\_restore{B9003348-7F74-4CE2-AB5F-C282A24CECA1}\RP85\A0013909.exe
RarSFX: infected - 4 skipped
C:\System Volume
Information\_restore{B9003348-7F74-4CE2-AB5F-C282A24CECA1}\RP85\A0013910.exe/data.rar/keygen.exe
Infected: Trojan-Downloader.Win32.Nurech.ak skipped
C:\System Volume
Information\_restore{B9003348-7F74-4CE2-AB5F-C282A24CECA1}\RP85\A0013910.exe/data.rar/crack.exe
Infected: not-a-virus:AdWare.Win32.Virtumonde.bq skipped
C:\System Volume
Information\_restore{B9003348-7F74-4CE2-AB5F-C282A24CECA1}\RP85\A0013910.exe/data.rar/serial.exe
Infected: Trojan.Win32.Dialer.qn skipped
C:\System Volume
Information\_restore{B9003348-7F74-4CE2-AB5F-C282A24CECA1}\RP85\A0013910.exe/data.rar
Infected: Trojan.Win32.Dialer.qn skipped
C:\System Volume
Information\_restore{B9003348-7F74-4CE2-AB5F-C282A24CECA1}\RP85\A0013910.exe
RarSFX: infected - 4 skipped
C:\System Volume
Information\_restore{B9003348-7F74-4CE2-AB5F-C282A24CECA1}\RP85\A0014025.exe
Infected: not-a-virus:FraudTool.Win32.UltimateDefender.c skipped
C:\System Volume
Information\_restore{B9003348-7F74-4CE2-AB5F-C282A24CECA1}\RP85\A0014026.exe
Infected: not-a-virus:FraudTool.Win32.UltimateDefender.c skipped
C:\System Volume
Information\_restore{B9003348-7F74-4CE2-AB5F-C282A24CECA1}\RP85\A0014027.exe
Infected: not-a-virus:FraudTool.Win32.UltimateDefender.c skipped
C:\System Volume
Information\_restore{B9003348-7F74-4CE2-AB5F-C282A24CECA1}\RP85\A0014095.dll
Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
C:\System Volume
Information\_restore{B9003348-7F74-4CE2-AB5F-C282A24CECA1}\RP86\change.log
Object is locked skipped
C:\VundoFix Backups\avjndqto.dll.bad Infected: Trojan.Win32.BHO.o skipped
C:\VundoFix Backups\eipjtvrh.dll.bad Infected:
not-a-virus:AdWare.Win32.BHO.v skipped
C:\VundoFix Backups\hesdteme.dll.bad Infected:
not-a-virus:AdWare.Win32.Virtumonde.kj skipped
C:\VundoFix Backups\kmxsmpnb.dll.bad Infected:
not-a-virus:AdWare.Win32.Virtumonde.kg skipped
C:\VundoFix Backups\sstqr.dll.bad Infected:
not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\VundoFix Backups\urqnlll.dll.bad Infected:
not-a-virus:AdWare.Win32.Virtumonde.jp skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{58870405-2DD3-4FFD-BA49-7AB44C26ED64}.bin
Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked
skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\spool\PRINTERS\FP00002.SPL Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked
skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked
skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked
skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked
skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked
skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
E:\System Volume Information\MountPointManagerRemoteDatabase Object is
locked skipped
G:\Archive Cracks\ARPR\arpr.exe Infected:
not-a-virus:PSWTool.Win32.OEPass.b skipped
G:\audio\WAV to MP3 Encoder\bs3-m3.exe/data0002 Infected:
not-a-virus:AdWare.Win32.BookedSpace.a skipped
G:\audio\WAV to MP3 Encoder\bs3-m3.exe NSIS: infected - 1 skipped
G:\audio\WAV to MP3 Encoder\m3_bbi6009.exe/data0002 Infected:
not-a-virus:AdWare.Win32.BargainBuddy.v skipped
G:\audio\WAV to MP3 Encoder\m3_bbi6009.exe/data0003 Infected:
not-a-virus:AdWare.Win32.BargainBuddy.a skipped
G:\audio\WAV to MP3 Encoder\m3_bbi6009.exe NSIS: infected - 2 skipped
G:\Games\freesol.exe/WISE0042.BIN Infected:
not-a-virus:AdWare.Win32.Aureate skipped
G:\Games\freesol.exe/WISE0043.BIN Infected:
not-a-virus:AdWare.Win32.Aureate.a skipped
G:\Games\freesol.exe WiseSFX: infected - 2 skipped
G:\Games\Guild Wars\Gw.dat Object is locked skipped
G:\RECYCLER\NPROTECT\db\albums.db Object is locked skipped
G:\RECYCLER\NPROTECT\db\bigthumbs.db Object is locked skipped
G:\RECYCLER\NPROTECT\db\thumbs.db Object is locked skipped
G:\RECYCLER\NPROTECT\db\thumbs2.db Object is locked skipped
G:\System Volume Information\MountPointManagerRemoteDatabase Object is
locked skipped
H:\System Volume Information\MountPointManagerRemoteDatabase Object is
locked skipped
I:\Virus
Software\Free-SpyHunter-Scanner-Install.exe/PRE/data/{65145FC9-DEA0-4738-A4FE-376C2BA51806}/1/EnigmaUpdater.dll
Infected: not-a-virus:FraudTool.Win32.SpyHunter.b skipped
I:\Virus
Software\Free-SpyHunter-Scanner-Install.exe/PRE/data/{65145FC9-DEA0-4738-A4FE-376C2BA51806}/2/esgi_md5h.dll
Infected: not-a-virus:FraudTool.Win32.SpyHunter.b skipped
I:\Virus
Software\Free-SpyHunter-Scanner-Install.exe/PRE/data/{65145FC9-DEA0-4738-A4FE-376C2BA51806}/7/SpyHunter.exe
Infected: not-a-virus:FraudTool.Win32.SpyHunter.b skipped
I:\Virus
Software\Free-SpyHunter-Scanner-Install.exe/PRE/data/{65145FC9-DEA0-4738-A4FE-376C2BA51806}/17/Esgiutl1.dll
Infected: not-a-virus:FraudTool.Win32.SpyHunter.b skipped
I:\Virus
Software\Free-SpyHunter-Scanner-Install.exe/PRE/data/{65145FC9-DEA0-4738-A4FE-376C2BA51806}/18/SHSched.dll
Infected: not-a-virus:FraudTool.Win32.SpyHunter.b skipped
I:\Virus Software\Free-SpyHunter-Scanner-Install.exe/PRE Infected:
not-a-virus:FraudTool.Win32.SpyHunter.b skipped
I:\Virus Software\Free-SpyHunter-Scanner-Install.exe Ghost Installer:
infected - 6 skipped
I:\Virus Software\Free-SpyHunter-Scanner-Install.exe UPX: infected -
6 skipped
I:\Virus Software\SmitfraudFix.exe/data.rar/SmitfraudFix/Reboot.exe
Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
I:\Virus Software\SmitfraudFix.exe/data.rar Infected:
not-a-virus:RiskTool.Win32.Reboot.f skipped
I:\Virus Software\SmitfraudFix.exe RarSFX: infected - 2 skipped
*Scan process completed.*

_______________________________

Logfile of HijackThis v1.99.1
Scan saved at 9:54:14 PM, on 26/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Internet Content Filter\SafeEyes.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trend Micro\Internet Security 2007\TMAS_OE\TMAS_OEMon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\NETGEAR WG311v2 Adapter\wlancfg5.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\HJT\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {674DDFA6-BB3D-427B-961F-E9EEEF293004} - C:\WINDOWS\system32\jkkkklm.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Safe &Eyes Toolbar - {430DDB4F-38CC-4E91-AF33-4157334EC937} - C:\Program Files\Internet Content Filter\setoolbar.dll
O4 - HKLM\..\Run: [DrvLsnr] C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ICF] "C:\Program Files\Internet Content Filter\SafeEyes.exe"
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [OE] "C:\Program Files\Trend Micro\Internet Security 2007\TMAS_OE\TMAS_OEMon.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: NETGEAR WG311v2 Smart Configuration.lnk = C:\Program Files\NETGEAR WG311v2 Adapter\wlancfg5.exe
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Broken Internet access because of LSP provider 'icf.dll' missing
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Trend Micro Protection Against Spyware (PcScnSrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

Thanks

er27 :thumbsup:

#9 -David-

-David-

  • Members
  • 10,603 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London
  • Local time:10:32 AM

Posted 29 June 2007 - 03:27 AM

Good work! Let's continue.. :thumbsup:

It is a good idea to print off these instructions. There is a possibility some of the instructions will need to be carried out where internet access is not available. It is important that you complete the instructions in the right order, and that you don't miss out any steps.

Click Start, then All Programs, then Spybot - Search & Destroy and then Spybot - Search & Destroy.
On the left side, click "Recovery".
Select (place a check) beside ALL the backup files that contain quarantined items.
Click on the Purge Selected Items button.
A dialog will appear, stating that the backup will be removed. Click Yes.
When the Recovery window is empty, Exit Spybot.

Start HijackThis, close all open windows leaving only HijackThis running. Place a check against each of the following if still present:

O2 - BHO: (no name) - {674DDFA6-BB3D-427B-961F-E9EEEF293004} - C:\WINDOWS\system32\jkkkklm.dll (file missing)

Click on Fix Checked when finished and exit HijackThis.
Make sure your Internet Explorer is closed when you click Fix Checked!

Using Windows Explorer, please locate the following files/folders, and delete them if still present:

C:\Program Files\WinPop
C:\QooBox
C:\VundoFix Backups

Also, please find and delete these infected cracks/keygens:
Downloading these kinds of things is a bad idea, probably the cause of this infection.

G:\Archive Cracks\ARPR\arpr.exe
G:\audio\WAV to MP3 Encoder\bs3-m3.exe
G:\audio\WAV to MP3 Encoder\m3_bbi6009.exe
G:\Games\freesol.exe

We need to purge your infected system restore points.
On the Desktop, right-click My Computer, then click Properties.
Click the System Restore tab near the top of the window.
Check Turn off System Restore, click Apply, and then click OK.
More information on how to disable your system restore can be found here.

We want to create a new, clean restore point. Please first reboot your computer.
On the Desktop, right-click My Computer, then click Properties.
Click the System Restore tab near the top of the window.
Uncheck "Turn off System Restore", click Apply, and then click OK.

Click Start > All Programs > Accessories > System Tools, and select System Restore.
In the System Restore wizard, select the box next the text labeled "Create a restore point" and click the Next button.
Type a description for your new restore point - Something like "After trojan/spyware cleanup".
Click Create, and after it has created the restore point, click "Close".
Further instructions on creating a restore point can be found here

Also, you need to empty your Trend Micro quarantine files, do you know how to do this?
I don't have the program installed, and cannot find direct instructions on how to empty it.
If you don't know, let me know and we can use the manually method. :flowers:

#10 exitrun27

exitrun27
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:07:32 PM

Posted 12 July 2007 - 06:32 PM

Sorry for not getting back to you ...

Thanks very much things are running much better.

:thumbsup:

#11 -David-

-David-

  • Members
  • 10,603 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London
  • Local time:10:32 AM

Posted 13 July 2007 - 04:16 AM

Glad I could help! :flowers:
The latest log is looking clean!
Follow this list and your potential for being infected again will be reduced dramatically.

Use an Anti Virus Software -
* It is very important that your computer has an anti-virus software running on your machine.
* This alone can save you a lot of trouble with malware in the future. See this link for a listing of some on line & their stand-alone anti virus programs:
* Click here for more information on -> Computer Safety On line - Anti-Virus
* I would recommend Grisoft's AVG or AVAST.
* These are the more secure and better ones.

Update your Anti Virus Software - It is imperitive that you update your Anti virus software at least once a week (Even more if you wish). If you do not update your anti virus software then it will not be able to catch any of the new variants that may come out.

Use a Firewall -
* I can not stress how important it is that you use a Firewall on your computer.
* Without a firewall your computer is susceptible to being hacked and taken over.
* Simply using a Firewall in its default configuration can lower your risk greatly.
* For an article on Firewalls and a listing of some available ones see the link below:
* Click here for more information on -> Computer Safety On line - Software Firewalls
* I would recommend ZoneAlarm as a firewall as it's easy to use.

Visit Microsoft's Windows Update Site Frequently -
* It is important that you visit http://www.windowsupdate.com regularly.
* This will ensure your computer has always the latest security updates available installed on your computer.
* If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

Next, if they're not already present, I would recommend the download and installation of some or all of the following programs (all free), and the updating of them regularly

Install Spybot© - Search and Destroy- Install and download Spybot - Search and Destroy with its TeaTimer option.
* This will provide real-time spyware & hijacker protection on your computer alongside your virus protection.
* You should also scan your computer with program on a regular basis just as you would an anti virus software.
* A tutorial on installing & using this product can be found here:
* Click here for more info -->Instructions for - Spybot S & D and Ad-aware

Install Lavasofts© Ad-Aware - Install and download Ad-Aware.
* You should also scan your computer with the program on a regular basis just as you would an anti virus software in conjunction with Spybot.
* A tutorial on installing & using this product can be found here:
* Click here for more info -->Instructions for - Spybot S & D and Ad-aware

Install Javacools© SpywareBlaster -
* SpywareBlaster will added a large list of programs and sites into your Internet Explorer and Firefox settings and that will protect you from running and downloading known malicious programs.
* A article on anti-malware products with links for this program and others can be found here:
* Click here for more info -->Computer Safety on line - Anti-Malware

Update all these programs regularly - Make sure you update all the programs I have listed regularly.
Without regular updates you WILL NOT be protected when new malicious programs are released.
:thumbsup: If you wish to learn how to use HijackThis to remove malware, you might like to join the Malware Removal Training Program!

If you have any addition questions just ask...
David




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users