PC...runs...too...slow...ly...HELP!

panget

Hello,

Something went wrong with my PC. Start up takes too much time to download. Could there be a spyware inside?

Here is my log. Hope you could respond the soonest. Thank you.

Logfile of HijackThis v1.99.1
Scan saved at 10:54, on 2009-12-10
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
E:\hijackthis\HijackThis.exe
C:\Documents and Settings\inkfinity center\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\inkfinity center\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\inkfinity center\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\inkfinity center\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: gFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\PROGRA~1\FlashGet\getflash.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (file missing)
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Auto EPSON Stylus Photo R230 Series on USER-EB7F5E9936] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIP.EXE /P54 "Auto EPSON Stylus Photo R230 Series on USER-EB7F5E9936" /O27 "\\USER-EB7F5E9936\Printer17" /M "Stylus Photo R230"
O4 - HKLM\..\Run: [USB Antivirus] C:\Program Files\USB Disk Security\USBGuard.exe
O4 - HKLM\..\Run: [EPSON Stylus Photo R230 Series (Copy 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIP.EXE /P39 "EPSON Stylus Photo R230 Series (Copy 1)" /O6 "USB019" /M "Stylus Photo R230"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [EPSON Stylus Photo R310 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P30 "EPSON Stylus Photo R310 Series" /O6 "USB014" /M "Stylus Photo R310"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [EPSON Stylus Photo R290 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICKP.EXE /FU "C:\WINDOWS\TEMP\E_SAD.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [EPSON Stylus T10 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIEBS.EXE /FU "C:\WINDOWS\TEMP\E_S73.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\inkfinity center\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [EPSON Stylus T10 Series (Copy 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIEBS.EXE /FU "C:\WINDOWS\TEMP\E_S6.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [EPSON Stylus Photo R230 Series (Copy 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIP.EXE /FU "C:\WINDOWS\TEMP\E_S8.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [Videohost] C:\DOCUME~1\INKFIN~1\LOCALS~1\Temp\b.exe
O4 - HKCU\..\Run: [EPSON Stylus T10 Series (Copy 2)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIEBS.EXE /FU "C:\WINDOWS\TEMP\E_SA.tmp" /EF "HKCU"
O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} (DjVuCtl Class) - http://www.lizardtech.com/download/files/win/djvuplugin/en_US/DjVuControl_en_US.cab
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf (file missing)
O23 - Service: SQL Server (INFLOWSQL) (MSSQL$INFLOWSQL) - Unknown owner - c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sINFLOWSQL (file missing)
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

chiaz

Hi.

A few things before we start....
1. Please Read All Instructions Carefully.
2. If you don't understand something, stop and ask! Don't keep going on.
3. Please do not run any other tools or scans whilst I am helping you.
4. If you have to go away for an extended period of time, let me know.
5. Please continue to respond until I give you the "All Clear".
(Just because you can't see a problem doesn't mean it isn't there)

======================

Please download Malwarebytes' Anti-Malware by clicking the link below:
http://www.besttechie.net/tools/mbam-setup.exe

Double Click mbam-setup.exe to install the application.

* Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select "Perform Quick Scan", then click Scan.
* The scan may take some time to finish,so please be patient.
* When the scan is complete, click OK, then Show Results to view the results.
* Make sure that everything is checked, and click Remove Selected.
* When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
* The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
* You'll be required to post the contents of this log later.

Please Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.

========================

Next let's have you download ComboFix.exe. Please visit this webpage for downloading and instructions for running the tool:

Go here ======> A guide and tutorial on using ComboFix <====== Go here

Please ensure you read this guide carefully and install the Recovery Console first.This applies to XP Pro and XP Home users only.If you have SP3 installed you will need to use the download meant for SP2.

The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once installed, you should get a prompt that says:

The Recovery Console was successfully installed.

Please continue as follows:

(1) Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
(2) Click Yes to allow ComboFix to continue scanning for malware.

When the tool is finished, it will produce a report for you. Post this later.

Caution: Never run and remove files with Combofix unless supervised by a qualified security analyst who is experienced in the use of Combofix. Misuse can cause serious computer problems.

=========================

Now download the latest version of HijackThis from Trend Micro and save it to your desktop.

• Download HJTInstall.exe to your desktop.
• Doubleclick HJTInstall.exe to install HijackThis.
• By default it will install to C:\Program Files\Trend Micro\HijackThis .
• Click on Install.
• It will create a HijackThis icon on the desktop.
• Once installed, it will launch Hijackthis.
• Click on the Do a system scan and save a logfile button. It will scan and the log should open in Notepad.

Please include the MBAM log and C:\ComboFix.txt as well as this new HijackThis log for further review, so that we may continue cleansing the system.

Notes:
Do not use the AnalyseThis button, its findings are dangerous if misinterpreted.
Do not have Hijackthis fix anything yet. Most of what it finds will be harmless, or required for your computer to run like it should.

panget

Hello,

Combofix is not working. Here is the message:

ComboFix is not available for download until an issue with the program has been resolved. Please be patient while the developer fixes the program and makes it available once again. As more information becomes available, we will update this page.

DO NOT attempt to download ComboFix from sites other than BleepingComputer.com and Forospyware.com!

Other sites hosting ComboFix are not authorized mirrors and are hosting outdated copies of ComboFix that contain a bug that may render some machines unbootable. Using unauthorized mirrors of ComboFix puts your computer at risk of not booting again. Please wait for the official version to be fixed and released again.

We will also announce when ComboFix is available on our Twitter and Facebook pages.

http://download.bleepingcomputer.com/sUBs/ComboFix.html

In the meantime, here is mbam's log:

Malwarebytes' Anti-Malware 1.42
Database version: 3357
Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

2009-12-14 18:37:54
mbam-log-2009-12-14 (18-37-54).txt

Scan type: Quick Scan
Objects scanned: 120799
Time elapsed: 32 minute(s), 13 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 1
Registry Keys Infected: 4
Registry Values Infected: 3
Registry Data Items Infected: 0
Folders Infected: 1
Files Infected: 12

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
c:\WINDOWS\system32\sshnas.dll (Trojan.FakeAlert) -> Delete on reboot.

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{28abc5c0-4fcb-11cf-aax5-81cx1c635612} (Generic.Bot.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{28abc5c0-4fcb-11cf-aax5-81cx1c635612} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SSHNAS (Trojan.Renos) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Handle (Malware.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\userini (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\userini (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\sysrun (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013 (Trojan.Agent) -> Delete on reboot.

Files Infected:
C:\Documents and Settings\inkfinity center\Application Data\install.config.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\inkfinity center\Application Data\xlscheck332.exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Documents and Settings\inkfinity center\Local Settings\Temp\a.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\inkfinity center\Local Settings\Temporary Internet Files\Content.IE5\4Q8DONY5\xlscheck332[1].exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Documents and Settings\inkfinity center\Local Settings\Temporary Internet Files\Content.IE5\JMCZRDWH\install.config[1].exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\Desktop.ini (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\inkfinity center\Local Settings\Temp\hi.bat (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\svshost.dll (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wininet.exe (Trojan.Proxy) -> Delete on reboot.
C:\WINDOWS\system32\winint.exe (Worm.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sshnas.dll (Trojan.FakeAlert) -> Delete on reboot.

chiaz

Sorry for the late response...I missed this somehow.

Combofix download link can be found temporarily at:
http://download.bleepingcomputer.com/sUBs/Beta/KittyFix.exe

Please download, then follow the instructions in my above post and post back with ComboFix.txt as well as a new HijackThis log.

panget

chiaz wrote:

Sorry for the late response...I missed this somehow.

Combofix download link can be found temporarily at:
http://download.bleepingcomputer.com/sUBs/Beta/KittyFix.exe

Please download, then follow the instructions in my above post and post back with ComboFix.txt as well as a new HijackThis log.

Sorry, but I was directed to http://www.bleepingcomputer.com. I think a bug has to be fixed at the moment.

chiaz

The link I posted on 19 Dec was to a beta version.

A new version has been put out, and the instructions on my second post should all work now. Please follow that, and post all the requested logs in your reply.

panget

chiaz wrote:

The link I posted on 19 Dec was to a beta version.

A new version has been put out, and the instructions on my second post should all work now. Please follow that, and post all the requested logs in your reply.

Afraid not .

http://download.bleepingcomputer.com/sUBs/Beta/KittyFix.exe
Oops! This link appears to be broken.
Suggestions:
Go to bleepingcomputer . com
Go to sitemap www. bleepingcomputer . com/ sitemap. php
Search on Google:

chiaz

My second post...

panget

Combofix log:

*******************

ComboFix 09-12-22.09 - inkfinity center 2009-12-24 11:31:15.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.495.205 [GMT 8:00]
Running from: c:\documents and settings\inkfinity center\My Documents\Downloads\ComboFix.exe
AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Thumbs.db
C:\update.exe
c:\windows\a3kebook.ini
c:\windows\akebook.ini
c:\windows\ANS2000.INI
c:\windows\system32\bszip.dll
c:\windows\system32\drivers\str.sys
c:\windows\system32\prsgrc.dll

Infected copy of c:\windows\system32\DRIVERS\atapi.sys was found and disinfected
Restored copy from - Kitty ate it
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

---

\Legacy_SSHNAS

---

\Legacy_SYNSEND

---

\Legacy_WINSRIR

---

\Service_synsend

---

\Service_winsrir

---

\Legacy_sswxplore

---

\Service_sswxplore


((((((((((((((((((((((((( Files Created from 2009-11-24 to 2009-12-24 )))))))))))))))))))))))))))))))
.

2009-12-18 09:41 . 2009-12-18 09:41

---

d

---

w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-12-14 09:56 . 2009-12-14 09:56

---

d

---

w- c:\documents and settings\inkfinity center\Application Data\Malwarebytes
2009-12-14 09:56 . 2009-12-03 08:14 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-14 09:56 . 2009-12-14 09:56

---

d

---

w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-12-14 09:56 . 2009-12-03 08:13 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-12-14 09:56 . 2009-12-14 09:56

---

d

---

w- c:\program files\Malwarebytes' Anti-Malware
2009-12-14 05:44 . 2009-12-14 05:44

---

d

---

w- c:\program files\Common Files\xing shared
2009-12-14 05:43 . 2009-12-14 05:43

---

d

---

w- c:\program files\Real
2009-12-14 05:43 . 2009-12-14 05:44

---

d

---

w- c:\program files\Common Files\Real
2009-12-11 04:47 . 2009-12-11 11:22

---

d

---

w- c:\program files\a-squared Free
2009-12-10 06:40 . 2009-03-30 01:33 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-12-10 06:40 . 2009-02-13 03:29 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2009-12-10 06:40 . 2009-12-11 06:42 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-12-10 06:40 . 2009-02-13 03:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2009-12-10 06:40 . 2009-12-10 06:40

---

d

---

w- c:\program files\Avira
2009-12-10 06:40 . 2009-12-10 06:40

---

d

---

w- c:\documents and settings\All Users\Application Data\Avira
2009-12-09 09:16 . 2009-12-09 09:16

---

d

---

w- c:\windows\system32\LogFiles
2009-12-09 06:32 . 2009-12-09 06:32

---

d

---

w- c:\windows\system32\wbem\Repository

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-24 03:50 . 2008-01-10 09:56

---

d

---

w- c:\documents and settings\inkfinity center\Application Data\uTorrent
2009-12-24 03:46 . 2008-10-19 04:15 2942672 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-12-24 03:46 . 2008-10-19 04:15 251230240 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-12-23 06:13 . 2008-08-25 02:46

---

d

---

w- c:\documents and settings\All Users\Application Data\Google Updater
2009-12-22 04:13 . 2007-10-20 01:33 1 ----a-w- c:\documents and settings\inkfinity center\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-12-16 09:14 . 2008-10-28 11:18

---

d

---

w- c:\program files\EPSON Print CD
2009-12-14 05:43 . 2003-03-18 12:14 499712 ----a-w- c:\windows\system32\msvcp71.dll
2009-12-14 05:43 . 2003-02-20 20:42 348160 ----a-w- c:\windows\system32\msvcr71.dll
2009-12-11 09:25 . 2004-08-04 12:00 385024 --sh--r- c:\windows\system32\serviceh0.exe
2009-12-11 09:25 . 2004-08-04 12:00 1033728 ----a-w- c:\windows\explorer.exe
2009-12-09 09:11 . 2008-04-09 10:18

---

d

---

w- c:\documents and settings\All Users\Application Data\PC Suite
2009-12-07 07:26 . 2007-10-11 02:06

---

d

---

w- c:\program files\FlashGet
2009-11-02 05:01 . 2009-11-02 04:14 319456 ----a-w- c:\windows\difxapi.dll
2009-11-02 05:01 . 2009-11-02 04:14 135263 ----a-w- c:\windows\wdreg_gui.exe
2009-11-02 04:53 . 2008-10-12 10:01 88 --sh--r- c:\windows\system32\B4988B6DE9.sys
2009-11-02 04:53 . 2008-10-12 10:01 1890 --sha-w- c:\windows\system32\KGyGaAvL.sys
2009-11-02 04:14 . 2009-11-02 04:14 194362 ----a-w- c:\windows\system32\drivers\windrvr6.sys
2009-11-01 19:42 . 2009-11-01 19:42 39916560 ----a-w- c:\documents and settings\inkfinity center\Application Data\setupengpro.exe
2009-11-01 19:42 . 2009-11-01 19:42 39916560 ----a-w- c:\documents and settings\inkfinity center\Application Data\setupengpro.exe
2009-10-29 05:38 . 2004-08-04 12:00 667136 ----a-w- c:\windows\system32\wininet.dll
2009-10-21 05:38 . 2004-08-04 12:00 75776 ----a-w- c:\windows\system32\strmfilt.dll
2009-10-21 05:38 . 2004-08-04 12:00 25088 ----a-w- c:\windows\system32\httpapi.dll
2009-10-20 16:20 . 2004-08-04 12:00 265728 ----a-w- c:\windows\system32\drivers\http.sys
2009-10-13 10:30 . 2004-08-04 12:00 270336 ----a-w- c:\windows\system32\oakley.dll
2009-10-12 13:38 . 2004-08-04 12:00 149504 ----a-w- c:\windows\system32\rastls.dll
2009-10-12 13:38 . 2004-08-04 12:00 79872 ----a-w- c:\windows\system32\raschap.dll
2009-09-25 05:37 . 2004-08-04 12:00 81920 ----a-w- c:\windows\system32\ieencode.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2009-08-01 288048]
"serviche0"="serviceh0.exe" [2009-12-11 385024]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Auto EPSON Stylus Photo R230 Series on USER-EB7F5E9936"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIAIP.EXE" [2006-12-25 177664]
"EPSON Stylus Photo R230 Series (Copy 1)"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIAIP.EXE" [2006-12-25 177664]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-12-14 198160]
"serviche0"="serviceh0.exe" [2009-12-11 385024]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"serviche0"="serviceh0.exe" [2009-12-11 385024]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2008-03-26 1232896]
"serviche0"="serviceh0.exe" [2009-12-11 385024]

[HKLM\~\startupfolder\C:^Documents and Settings^inkfinity center^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=c:\documents and settings\inkfinity center\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=c:\windows\pss\Adobe Gamma.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^inkfinity center^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
path=c:\documents and settings\inkfinity center\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^inkfinity center^Start Menu^Programs^Startup^OpenOffice.org 3.0.lnk]
path=c:\documents and settings\inkfinity center\Start Menu\Programs\Startup\OpenOffice.org 3.0.lnk
backup=c:\windows\pss\OpenOffice.org 3.0.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Auto EPSON Stylus C90 Series on LABAS-OOJF41LFC]
2006-09-27 04:00 139264 ----a-w- c:\windows\system32\spool\drivers\w32x86\3\E_FATIBZP.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Auto EPSON Stylus CX3900 Series on USER-EB7F5E9936]
2006-09-20 20:01 139264 -c--a-w- c:\windows\system32\spool\drivers\w32x86\3\E_FATIBEP.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]
2008-04-14 00:12 110592 ----a-w- c:\windows\system32\bthprops.cpl

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonMyPrinter]
2008-03-04 01:06 1848648 ----a-w- c:\program files\Canon\MyPrinter\BJMYPRT.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonSolutionMenu]
2008-03-11 01:20 689488 ----a-w- c:\program files\Canon\SolutionMenu\CNSLMAIN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2008-04-14 00:12 15360

---

w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus CX3900 Series]
2006-09-20 20:01 139264 -c--a-w- c:\windows\system32\spool\drivers\w32x86\3\E_FATIBEP.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus Photo R230 Series (Copy 1)]
2006-12-25 05:00 177664 ----a-w- c:\windows\system32\spool\drivers\w32x86\3\E_FATIAIP.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus Photo R290 Series]
2007-04-13 06:00 182272 ----a-w- c:\windows\system32\spool\drivers\w32x86\3\E_FATICKP.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus Photo R310 Series]
2003-05-26 19:08 99840 ----a-w- c:\windows\system32\spool\drivers\w32x86\3\E_S10IC2.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus T10 Series]
2007-11-30 06:00 188928 ----a-w- c:\windows\system32\spool\drivers\w32x86\3\E_FATIEBS.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus T10 Series (Copy 1)]
2007-11-30 06:00 188928 ----a-w- c:\windows\system32\spool\drivers\w32x86\3\E_FATIEBS.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus T10 Series (Copy 2)]
2007-11-30 06:00 188928 ----a-w- c:\windows\system32\spool\drivers\w32x86\3\E_FATIEBS.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2009-09-06 05:13 133104 ----atw- c:\documents and settings\inkfinity center\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
2004-08-04 12:00 208952 ----a-w- c:\windows\ime\imjp8_1\imjpmig.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
2004-04-17 04:41 196608 ----a-w- c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
2004-04-12 22:07 69632 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]
2004-08-04 12:00 59392 ----a-w- c:\windows\system32\IME\PINTLGNT\IMSCINST.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nokia.PCSync]
2008-03-26 10:41 1232896 ----a-w- c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
2008-04-16 04:53 1079808 ----a-w- c:\program files\Nokia\Nokia PC Suite 6\PCSuite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
2004-08-04 12:00 455168 ----a-w- c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
2004-08-04 12:00 455168 ----a-w- c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
2007-04-16 07:28 577536 ----a-w- c:\windows\soundman.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-03-13 08:42 136600 ----a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\USB Antivirus]
2008-02-07 11:57 798720 ----a-w- c:\program files\USB Disk Security\USBGuard.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
2009-08-01 09:04 288048 ----a-w- c:\program files\uTorrent\uTorrent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
2007-08-30 09:43 4670704 ----a-w- c:\program files\Yahoo!\Messenger\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"SQLWriter"=2 (0x2)
"ServiceLayer"=3 (0x3)
"ose"=3 (0x3)
"odserv"=3 (0x3)
"MSSQL$INFLOWSQL"=2 (0x2)
"Microsoft Office Groove Audit Service"=3 (0x3)
"JavaQuickStarterService"=2 (0x2)
"idsvc"=3 (0x3)
"gusvc"=2 (0x2)
"AntiVirService"=2 (0x2)
"AntiVirScheduler"=2 (0x2)
"Adobe LM Service"=3 (0x3)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\FrostWire\\FrostWire.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R1 is-IBT1Odrv;is-IBT1Odrv;c:\windows\system32\drivers\82168145.sys [2008-10-19 148496]
R2 a2free;a-squared Free Service;c:\program files\a-squared Free\a2service.exe [2009-12-11 1858144]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-12-10 108289]
S4 MSSQL$INFLOWSQL;SQL Server (INFLOWSQL);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2007-02-10 29178224]
.

---

Supplementary Scan

---

.
IE: Download All by FlashGet - c:\program files\FlashGet\jc_all.htm
IE: Download using FlashGet - c:\program files\FlashGet\jc_link.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\inkfinity center\Application Data\Mozilla\Firefox\Profiles\70z10ni4.default\
FF - prefs.js: browser.search.selectedEngine - Wikipedia (en)
FF - prefs.js: keyword.URL - hxxp://toolbar.ask.com/toolbarv/askRedirect?o=101668&gct=&gc=1&q=
FF - plugin: c:\documents and settings\inkfinity center\Local Settings\Application Data\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
pref(dom.disable_open_during_load, true);.
- - - - ORPHANS REMOVED - - - -

Toolbar-{3041d03e-fd4b-44e0-b742-2d9b88305f98} - c:\program files\AskBarDis\bar\bin\askBar.dll
HKU-Default-Run-userini - c:\windows\explorer.exe:userini.exe
HKU-Default-Explorer_Run-userini - c:\windows\explorer.exe:userini.exe
MSConfigStartUp-ares - c:\program files\Ares\Ares.exe
MSConfigStartUp-avgnt - c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
MSConfigStartUp-Videohost - c:\docume~1\INKFIN~1\LOCALS~1\Temp\b.exe
AddRemove-Ask Toolbar_is1 - c:\program files\AskBarDis\unins000.exe
AddRemove-Excel Key Demo - c:\program files\Passware\demos\un-xlkeyd.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-24 11:48
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


c:\windows\system32\drivers\str.sys 16437 bytes
c:\windows\system32\drivers\zpcvpbc.sys 73856 bytes executable

scan completed successfully
hidden files: 2

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\flmfophpphum]
"ImagePath"="\??\c:\windows\system32\drivers\zpcvpbc.sys"
.

---

LOCKED REGISTRY KEYS

---

[HKEY_USERS\S-1-5-21-436374069-152049171-682003330-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*i*n*f*_*«ˆO\=…(glš]
@Class=&quot;Shell"

[HKEY_USERS\S-1-5-21-436374069-152049171-682003330-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*i*n*f*_*«ˆO\=…(glš\OpenWithList]
@Class=&quot;Shell"
.

---

DLLs Loaded Under Running Processes

---

- - - - - - - > 'explorer.exe'(4160)
c:\progra~1\MICROS~2\OFFICE11\MCPS.DLL
.

---

Other Running Processes

---

.
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\windows\system32\serviceh0.exe
c:\windows\system32\wscntfy.exe
c:\documents and settings\inkfinity center\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
c:\documents and settings\inkfinity center\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
.
**************************************************************************
.
Completion time: 2009-12-24 11:56:59 - machine was rebooted
ComboFix-quarantined-files.txt 2009-12-24 03:56

Pre-Run: 40,102,449,152 bytes free
Post-Run: 55,466,012,672 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - D42C6F038024DC6001BC335090A20746

panget

btw, a file named synsenddrv.sys still remained in the system. Couldn't get rid of it:(.

chiaz

Please copy this page to *Notepad* and save to your desktop for reference as you will not have any browsers open while you are carrying out portions of these instructions.

It's IMPORTANT to carry out the instructions in the sequence listed below.
1. Close any open browsers.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Open *notepad* and copy/paste the red text in the quotebox below into it:

[COLOR="red"]File::
c:\windows\system32\B4988B6DE9.sys
c:\windows\system32\drivers\82168145.sys
c:\windows\system32\drivers\zpcvpbc.sys

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"serviche0"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"serviche0"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"serviche0"=-
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"serviche0"=-
[-HKEY_LOCAL_MACHINE\System\ControlSet002\Services\flmfophpphum]

Driver::
is-IBT1Odrv[/COLOR]

Save this as CFScript.txt, in the same location as ComboFix.exe which is on the Desktop.




Refering to the picture above, drag CFScript.txt into ComboFix.exe


When finished, it shall produce a log for you at C:\ComboFix.txt

Please copy and paste the ComboFix.txt in your new reply, then delete CFScript.txt from the desktop.

*Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall. Altering this script in any way could damage your computer.*

panget

Here you go:



ComboFix 09-12-23.02 - inkfinity center 2009-12-24 13:50:46.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.495.150 [GMT 8:00]
Running from: c:\documents and settings\inkfinity center\My Documents\Downloads\ComboFix.exe
Command switches used :: c:\documents and settings\inkfinity center\My Documents\Downloads\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

FILE ::
"c:\windows\system32\B4988B6DE9.sys"
"c:\windows\system32\drivers\82168145.sys"
"c:\windows\system32\drivers\zpcvpbc.sys"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\B4988B6DE9.sys
c:\windows\system32\drivers\82168145.sys
c:\windows\system32\drivers\str.sys
c:\windows\system32\drivers\zpcvpbc.sys
c:\windows\system32\serviceh0.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

---

\Legacy_IS-IBT1ODRV

---

\Service_is-IBT1Odrv

---

\Legacy_flmfophpphum

---

\Service_flmfophpphum


((((((((((((((((((((((((( Files Created from 2009-11-24 to 2009-12-24 )))))))))))))))))))))))))))))))
.

2009-12-18 09:41 . 2009-12-18 09:41

---

d

---

w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-12-14 09:56 . 2009-12-14 09:56

---

d

---

w- c:\documents and settings\inkfinity center\Application Data\Malwarebytes
2009-12-14 09:56 . 2009-12-03 08:14 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-14 09:56 . 2009-12-14 09:56

---

d

---

w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-12-14 09:56 . 2009-12-03 08:13 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-12-14 09:56 . 2009-12-14 09:56

---

d

---

w- c:\program files\Malwarebytes' Anti-Malware
2009-12-14 05:44 . 2009-12-14 05:44

---

d

---

w- c:\program files\Common Files\xing shared
2009-12-14 05:43 . 2009-12-14 05:43

---

d

---

w- c:\program files\Real
2009-12-14 05:43 . 2009-12-14 05:44

---

d

---

w- c:\program files\Common Files\Real
2009-12-11 04:47 . 2009-12-11 11:22

---

d

---

w- c:\program files\a-squared Free
2009-12-10 06:40 . 2009-03-30 01:33 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-12-10 06:40 . 2009-02-13 03:29 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2009-12-10 06:40 . 2009-12-11 06:42 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-12-10 06:40 . 2009-02-13 03:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2009-12-10 06:40 . 2009-12-10 06:40

---

d

---

w- c:\program files\Avira
2009-12-10 06:40 . 2009-12-10 06:40

---

d

---

w- c:\documents and settings\All Users\Application Data\Avira
2009-12-09 09:16 . 2009-12-09 09:16

---

d

---

w- c:\windows\system32\LogFiles
2009-12-09 06:32 . 2009-12-09 06:32

---

d

---

w- c:\windows\system32\wbem\Repository

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-24 06:07 . 2008-01-10 09:56

---

d

---

w- c:\documents and settings\inkfinity center\Application Data\uTorrent
2009-12-24 06:05 . 2008-10-19 04:15 2947592 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-12-24 06:05 . 2008-10-19 04:15 251346976 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-12-23 06:13 . 2008-08-25 02:46

---

d

---

w- c:\documents and settings\All Users\Application Data\Google Updater
2009-12-22 04:13 . 2007-10-20 01:33 1 ----a-w- c:\documents and settings\inkfinity center\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-12-16 09:14 . 2008-10-28 11:18

---

d

---

w- c:\program files\EPSON Print CD
2009-12-14 05:43 . 2003-03-18 12:14 499712 ----a-w- c:\windows\system32\msvcp71.dll
2009-12-14 05:43 . 2003-02-20 20:42 348160 ----a-w- c:\windows\system32\msvcr71.dll
2009-12-11 09:25 . 2004-08-04 12:00 1033728

---

w- c:\windows\explorer.exe
2009-12-09 09:11 . 2008-04-09 10:18

---

d

---

w- c:\documents and settings\All Users\Application Data\PC Suite
2009-12-07 07:26 . 2007-10-11 02:06

---

d

---

w- c:\program files\FlashGet
2009-11-02 05:01 . 2009-11-02 04:14 319456 ----a-w- c:\windows\difxapi.dll
2009-11-02 05:01 . 2009-11-02 04:14 135263 ----a-w- c:\windows\wdreg_gui.exe
2009-11-02 04:53 . 2008-10-12 10:01 1890 --sha-w- c:\windows\system32\KGyGaAvL.sys
2009-11-02 04:14 . 2009-11-02 04:14 194362 ----a-w- c:\windows\system32\drivers\windrvr6.sys
2009-11-01 19:42 . 2009-11-01 19:42 39916560 ----a-w- c:\documents and settings\inkfinity center\Application Data\setupengpro.exe
2009-11-01 19:42 . 2009-11-01 19:42 39916560 ----a-w- c:\documents and settings\inkfinity center\Application Data\setupengpro.exe
2009-10-29 05:38 . 2004-08-04 12:00 667136

---

w- c:\windows\system32\wininet.dll
2009-10-21 05:38 . 2004-08-04 12:00 75776 ----a-w- c:\windows\system32\strmfilt.dll
2009-10-21 05:38 . 2004-08-04 12:00 25088 ----a-w- c:\windows\system32\httpapi.dll
2009-10-20 16:20 . 2004-08-04 12:00 265728 ----a-w- c:\windows\system32\drivers\http.sys
2009-10-13 10:30 . 2004-08-04 12:00 270336 ----a-w- c:\windows\system32\oakley.dll
2009-10-12 13:38 . 2004-08-04 12:00 149504 ----a-w- c:\windows\system32\rastls.dll
2009-10-12 13:38 . 2004-08-04 12:00 79872 ----a-w- c:\windows\system32\raschap.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2009-08-01 288048]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Auto EPSON Stylus Photo R230 Series on USER-EB7F5E9936"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIAIP.EXE" [2006-12-25 177664]
"EPSON Stylus Photo R230 Series (Copy 1)"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIAIP.EXE" [2006-12-25 177664]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-12-14 198160]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2008-03-26 1232896]

[HKLM\~\startupfolder\C:^Documents and Settings^inkfinity center^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=c:\documents and settings\inkfinity center\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=c:\windows\pss\Adobe Gamma.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^inkfinity center^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
path=c:\documents and settings\inkfinity center\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^inkfinity center^Start Menu^Programs^Startup^OpenOffice.org 3.0.lnk]
path=c:\documents and settings\inkfinity center\Start Menu\Programs\Startup\OpenOffice.org 3.0.lnk
backup=c:\windows\pss\OpenOffice.org 3.0.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Auto EPSON Stylus C90 Series on LABAS-OOJF41LFC]
2006-09-27 04:00 139264 ----a-w- c:\windows\system32\spool\drivers\w32x86\3\E_FATIBZP.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Auto EPSON Stylus CX3900 Series on USER-EB7F5E9936]
2006-09-20 20:01 139264 -c--a-w- c:\windows\system32\spool\drivers\w32x86\3\E_FATIBEP.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]
2008-04-14 00:12 110592 ----a-w- c:\windows\system32\bthprops.cpl

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonMyPrinter]
2008-03-04 01:06 1848648 ----a-w- c:\program files\Canon\MyPrinter\BJMYPRT.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonSolutionMenu]
2008-03-11 01:20 689488 ----a-w- c:\program files\Canon\SolutionMenu\CNSLMAIN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2008-04-14 00:12 15360

---

w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus CX3900 Series]
2006-09-20 20:01 139264 -c--a-w- c:\windows\system32\spool\drivers\w32x86\3\E_FATIBEP.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus Photo R230 Series (Copy 1)]
2006-12-25 05:00 177664 ----a-w- c:\windows\system32\spool\drivers\w32x86\3\E_FATIAIP.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus Photo R290 Series]
2007-04-13 06:00 182272 ----a-w- c:\windows\system32\spool\drivers\w32x86\3\E_FATICKP.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus Photo R310 Series]
2003-05-26 19:08 99840 ----a-w- c:\windows\system32\spool\drivers\w32x86\3\E_S10IC2.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus T10 Series]
2007-11-30 06:00 188928 ----a-w- c:\windows\system32\spool\drivers\w32x86\3\E_FATIEBS.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus T10 Series (Copy 1)]
2007-11-30 06:00 188928 ----a-w- c:\windows\system32\spool\drivers\w32x86\3\E_FATIEBS.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus T10 Series (Copy 2)]
2007-11-30 06:00 188928 ----a-w- c:\windows\system32\spool\drivers\w32x86\3\E_FATIEBS.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2009-09-06 05:13 133104 ----atw- c:\documents and settings\inkfinity center\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
2004-08-04 12:00 208952 ----a-w- c:\windows\ime\imjp8_1\imjpmig.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
2004-04-17 04:41 196608 ----a-w- c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
2004-04-12 22:07 69632 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]
2004-08-04 12:00 59392 ----a-w- c:\windows\system32\IME\PINTLGNT\IMSCINST.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nokia.PCSync]
2008-03-26 10:41 1232896 ----a-w- c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
2008-04-16 04:53 1079808 ----a-w- c:\program files\Nokia\Nokia PC Suite 6\PCSuite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
2004-08-04 12:00 455168 ----a-w- c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
2004-08-04 12:00 455168 ----a-w- c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
2007-04-16 07:28 577536 ----a-w- c:\windows\soundman.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-03-13 08:42 136600 ----a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\USB Antivirus]
2008-02-07 11:57 798720 ----a-w- c:\program files\USB Disk Security\USBGuard.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
2009-08-01 09:04 288048 ----a-w- c:\program files\uTorrent\uTorrent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
2007-08-30 09:43 4670704 ----a-w- c:\program files\Yahoo!\Messenger\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"SQLWriter"=2 (0x2)
"ServiceLayer"=3 (0x3)
"ose"=3 (0x3)
"odserv"=3 (0x3)
"MSSQL$INFLOWSQL"=2 (0x2)
"Microsoft Office Groove Audit Service"=3 (0x3)
"JavaQuickStarterService"=2 (0x2)
"idsvc"=3 (0x3)
"gusvc"=2 (0x2)
"AntiVirService"=2 (0x2)
"AntiVirScheduler"=2 (0x2)
"Adobe LM Service"=3 (0x3)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\FrostWire\\FrostWire.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R2 a2free;a-squared Free Service;c:\program files\a-squared Free\a2service.exe [2009-12-11 1858144]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-12-10 108289]
S4 MSSQL$INFLOWSQL;SQL Server (INFLOWSQL);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2007-02-10 29178224]
.

---

Supplementary Scan

---

.
IE: Download All by FlashGet - c:\program files\FlashGet\jc_all.htm
IE: Download using FlashGet - c:\program files\FlashGet\jc_link.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\inkfinity center\Application Data\Mozilla\Firefox\Profiles\70z10ni4.default\
FF - prefs.js: browser.search.selectedEngine - Wikipedia (en)
FF - prefs.js: keyword.URL - hxxp://toolbar.ask.com/toolbarv/askRedirect?o=101668&gct=&gc=1&q=
FF - plugin: c:\documents and settings\inkfinity center\Local Settings\Application Data\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
pref(dom.disable_open_during_load, true);.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-24 14:06
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.

---

LOCKED REGISTRY KEYS

---

[HKEY_USERS\S-1-5-21-436374069-152049171-682003330-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*i*n*f*_*«ˆO\=…(glš]
@Class=&quot;Shell"

[HKEY_USERS\S-1-5-21-436374069-152049171-682003330-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*i*n*f*_*«ˆO\=…(glš\OpenWithList]
@Class=&quot;Shell"
.

---

Other Running Processes

---

.
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-12-24 14:14:34 - machine was rebooted
ComboFix-quarantined-files.txt 2009-12-24 06:14
ComboFix2.txt 2009-12-24 03:57

Pre-Run: 55,463,608,320 bytes free
Post-Run: 55,427,837,952 bytes free

- - End Of File - - FE75603E2D9B943ADF8FAD25E018C26E

chiaz

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

• Double-click SystemLook.exe to run it.
• Copy the content of the following codebox into the main textfield:

  :filefind
  synsenddrv.sys
  

• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

panget

SystemLook v1.0 by jpshortstuff (29.08.09)
Log created at 12:09 on 30/12/2009 by inkfinity center (Administrator - Elevation successful)

========== filefind ==========

Searching for "synsenddrv.sys"
No files found.

-=End Of File=-

chiaz

OK....let's have you go HERE to run Panda ActiveScan 2.0

• Click the big green Scan now button
• If it wants to install an ActiveX component allow it
• It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
• Once the scan is completed, please hit the notepad icon next to the text Export to:
• Save it to a convenient location such as your Desktop
• Post the contents of the ActiveScan.txt in your next reply.

Also let me know how's your PC running now?

panget

chiaz wrote:

OK....let's have you go HERE to run Panda ActiveScan 2.0

• Click the big green Scan now button
• If it wants to install an ActiveX component allow it
• It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
• Once the scan is completed, please hit the notepad icon next to the text Export to:
• Save it to a convenient location such as your Desktop
• Post the contents of the ActiveScan.txt in your next reply.

Also let me know how's your PC running now?

Please give me some time. I just came back in the office after the holidays. Thanks.

chiaz

Sure, just reply to this thread once you have the report ready.

panget

chiaz wrote:

Sure, just reply to this thread once you have the report ready.

Sir, my browser crashed unexpectedly while running the scan overnight. Is there any other way? Thank you.

chiaz

Try Kaspersky scanner instead.
http://www.kaspersky.com/kos/eng/partner/default/pages/default/check.html

panget

chiaz wrote:

Try Kaspersky scanner instead.
http://www.kaspersky.com/kos/eng/partner/default/pages/default/check.html

Done

---

KASPERSKY ONLINE SCANNER 7.0: scan report
Thursday, January 7, 2010
Operating system: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Wednesday, January 06, 2010 02:55:49
Records in database: 3344315

---

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\
E:\
F:\

Scan statistics:
Objects scanned: 118999
Threats found: 6
Infected objects found: 9
Suspicious objects found: 0
Scan duration: 10:39:28


File name / Threat / Threats count
C:\QooBox\Quarantine\C\update.exe.vir Infected: Trojan.Win32.Buzus.cvel 1
C:\QooBox\Quarantine\C\WINDOWS\system32\serviceh0.exe.vir Infected: Trojan.Win32.Buzus.cvmx 1
C:\System Volume Information\_restore{4F9D6F7A-DC64-4562-A61D-4E832F63EA5E}\RP667\A0206433.exe Infected: Backdoor.Win32.Kbot.adg 1
C:\System Volume Information\_restore{4F9D6F7A-DC64-4562-A61D-4E832F63EA5E}\RP673\A0220954.exe Infected: Email-Worm.Win32.Joleee.ejr 1
C:\System Volume Information\_restore{4F9D6F7A-DC64-4562-A61D-4E832F63EA5E}\RP673\A0220958.exe Infected: Trojan.Win32.VB.yxt 1
C:\System Volume Information\_restore{4F9D6F7A-DC64-4562-A61D-4E832F63EA5E}\RP679\A0224198.exe Infected: Trojan.Win32.Agent.defz 1
C:\System Volume Information\_restore{4F9D6F7A-DC64-4562-A61D-4E832F63EA5E}\RP679\A0224303.exe Infected: Trojan.Win32.Buzus.cvel 1
C:\System Volume Information\_restore{4F9D6F7A-DC64-4562-A61D-4E832F63EA5E}\RP679\A0224498.exe Infected: Trojan.Win32.Buzus.cvmx 1
E:\AVAST! 4.8.1358 PRO Latest Edition With Registration Keys (Antivirus + Antyspyware)\ setupengpro.exe Infected: Trojan.Win32.VB.yxt 1

Selected area has been scanned.

chiaz

I see you downloaded a cracked version of Avast. I'm not here to pass judgement over the morality or the legality of downloading such files/programs, but as you can see the one you downloaded here contains malware as indicated by the scanner.

The rest of the stuff Kaspersky detected are remnants. It's time to remove ComboFix. This command will also remove the remnants.

Go to to Start > Run
Type in box

combofix /uninstall

Note: the space between the X and the /u

Press Enter.

This command will:

Delete the following:
ComboFix and its associated files and folders.
VundoFix backups, if present
The C:\Deckard folder, if present
The C:_OtMoveIt folder, if present

Reset the clock settings.
Hide file extensions, if required.
Hide System/Hidden files, if required.
Reset System Restore.


Even if you have no more queries, I would appreciate if you can reply once more to this thread so that I will be able to have this archived. Thanks.

panget

chiaz wrote:

I see you downloaded a cracked version of Avast. I'm not here to pass judgement over the morality or the legality of downloading such files/programs, but as you can see the one you downloaded here contains malware as indicated by the scanner.

The rest of the stuff Kaspersky detected are remnants. It's time to remove ComboFix. This command will also remove the remnants.

Go to to Start > Run
Type in box

combofix /uninstall

Note: the space between the X and the /u

Press Enter.

This command will:

Delete the following:
ComboFix and its associated files and folders.
VundoFix backups, if present
The C:\Deckard folder, if present
The C:_OtMoveIt folder, if present

Reset the clock settings.
Hide file extensions, if required.
Hide System/Hidden files, if required.
Reset System Restore.


Even if you have no more queries, I would appreciate if you can reply once more to this thread so that I will be able to have this archived. Thanks.

pls give me around one week cuz i'm quite busy at the moment. tnx.

panget

I couldn't find the files you've asked me to delete.