VUNDOm

Unknown

just caught the vundo virus on sunday.

When it hit Symantec identified it.

I'm running XP on a modified HP machine. Symantec ver 9
I've tried both the fix utilities from Symantec, fixvundo and fixvundo.b
also Vundofix from atribune?
Any suggestions on how to get rid of this, short of reformatting my hard drive?

Thank you in advance.

Just ran Hijack this the log is below:


Logfile of HijackThis v1.99.1
Scan saved at 6:43:17 PM, on 8/6/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Hijackthis\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Adobe Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {33FDF7B9-442D-3089-7876-3CB60D4FF1C5} - C:\WINDOWS\system32\zsdkkses.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: BndDrive BHO Class - {9815DA81-2E0C-478c-90E4-06E474E704D0} - C:\Program Files\ISM\BndDrive.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: (no name) - {C6039E6C-BDE9-4de5-BB40-768CAA584FDC} - C:\WINDOWS\system32\tmp10.tmp.dll
O2 - BHO: (no name) - {fd9ac659-7fc8-4269-8408-90669e5f705a} - C:\WINDOWS\system32\Declen.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Norton Ghost 9.0] C:\Program Files\Symantec\Norton Ghost\Agent\GhostTray.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\\vptray.exe
O4 - HKLM\..\Run: [Adobe Version Cue CS2] C:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ISMModule2] "C:\Program Files\ISM\ISMModule2.exe"
O4 - HKCU\..\Run: [Olob] "C:\PROGRA~1\CROSOF~1\wucrtupd.exe" -vt yazb
O4 - HKCU\..\Run: [Sugh] "C:\Program Files\?racle\l?ass.exe"
O4 - Global Startup: ColorVisionStartup.lnk = C:\Program Files\PANTONE COLORVISION\Startup\ColorVisionStartup.exe
O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\SYSTEM32\WTablet\TabUserW.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\Declen.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\Declen.dll
O9 - Extra button: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\All Users\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk
O9 - Extra 'Tools' menuitem: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\All Users\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra button: Poker.com - {6FDD5236-C9F0-49ef-935D-385F5E21991A} - C:\Program Files\Poker.com\Poker.exe (HKCU)
O16 - DPF: {02A2D714-433E-46E4-B217-7C3B3FAF8EAE} (ScrabbleCubes Control) - http://www.worldwinner.com/games/v46/scrabblecubes/scrabblecubes.cab
O16 - DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} (FunGamesLoader Object) - http://www.worldwinner.com/games/v47/shared/FunGamesLoader.cab
O16 - DPF: {615F158E-D5CA-422F-A8E7-F6A5EED7063B} (Bejeweled Control) - http://www.worldwinner.com/games/v46/bejeweled/bejeweled.cab
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://fortunelounge.microgaming.com/generic/FlashAX.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://artafact.webex.com/client/v_mywebex-t20-pso-artafact/training/ieatgpc.cab
O20 - AppInit_DLLs: c:\windows\system32\pmnnmmk.dll
O20 - Winlogon Notify: Declen - C:\WINDOWS\SYSTEM32\Declen.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Version Cue CS2 - Unknown owner - C:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe" -win32service (file missing)
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: iPodService - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Symantec\Norton Ghost\Agent\PQV2iSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Western Digital Array Message Server (RAIDmSvr) - Unknown owner - C:\Program Files\Western Digital Technology, Inc\Western Digital Array Management\MsgSvr.exe (file missing)
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: ScsiAccess - Unknown owner - C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe (file missing)
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe

peku006

Hi sslickk and welcome to icrontic Spyware & Virus Removal

Please do the following...

1. Download combofix from one of these links:
Link1
Link2
2. Double click combofix.exe & follow the prompts.
3. When finished, it shall produce a log for you. Post that log & a fresh HJT log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

sslickk

Thankyou for your assistance, follows the requested logs.
I made sure to turn off the spybot immunize program so beneficial changes could be made. All of this done in Safe Mode.
____
Combofix log:

ComboFix 07-08-04.3 - "H" 2007-08-07 9:15:08.3 [GMT -6:00] - NTFS [SAFE MODE]
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.True


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\system32\ddcya.exe
C:\WINDOWS\system32\dn18d9fe71.dat
C:\WINDOWS\system32\EBAPgES.dll
C:\DOCUME~1\H\APPLIC~1\tmp10.tmp.exe
C:\DOCUME~1\H\APPLIC~1\tmp13.tmp.exe
C:\DOCUME~1\H\APPLIC~1\tmp14.tmp.exe
C:\DOCUME~1\H\APPLIC~1\tmp1B.tmp.exe
C:\DOCUME~1\H\APPLIC~1\tmp3B.tmp.exe
C:\DOCUME~1\H\APPLIC~1\tmp44.tmp.exe
C:\DOCUME~1\H\APPLIC~1\tmp6E.tmp.exe
C:\DOCUME~1\H\APPLIC~1\tmp73.tmp.exe
C:\Program Files\Common Files\Yazzle1552OinUninstaller.exe
C:\Program Files\crosof~1
C:\Program Files\outerinfo
C:\Program Files\outerinfo\Terms.rtf
C:\Program Files\racle~1
C:\Program Files\racle~1\l?ass.exe
C:\WINDOWS\system32\Declen.dll
C:\WINDOWS\system32\tmp10.tmp.dll
C:\WINDOWS\system32\tmp14.tmp.dll
C:\WINDOWS\system32\tmp73.tmp.dll
C:\WINDOWS\system32\wcpicomsv32.exe
C:\WINDOWS\system32\jkkjk.exe
C:\WINDOWS\system32\lzexnit.dll


((((((((((((((((((((((((( Files Created from 2007-07-07 to 2007-08-07 )))))))))))))))))))))))))))))))


2007-08-07 08:48 51,200 --a

---

C:\WINDOWS\nircmd.exe
2007-08-06 22:29 13,380 --a

---

C:\WINDOWS\SYSTEM32\ssqppml.dll
2007-08-06 14:29 <DIR> d

---

C:\VundoFix Backups
2007-08-05 14:56 13,380 --a

---

C:\WINDOWS\SYSTEM32\vturqqo.dll
2007-08-05 14:28 13,380 --a

---

C:\WINDOWS\SYSTEM32\mlljgdc.dll
2007-08-05 13:57 13,380 --a

---

C:\WINDOWS\SYSTEM32\pmnnmmk.dll
2007-08-05 13:40 25,664 --a

---

C:\WINDOWS\SYSTEM32\5Rc035V4.exe
2007-08-05 13:39 <DIR> d

---

C:\Program Files\ISM
2007-07-31 14:48 51,392 --a

---

C:\WINDOWS\SYSTEM32\DRIVERS\atnt40k.sys
2007-07-31 14:48 <DIR> d

---

C:\DOCUME~1\H\WebEx
2007-07-28 14:56 <DIR> d

---

C:\DOCUME~1\H\.javaws
2007-07-14 09:46 <DIR> d

---

C:\DOCUME~1\H\APPLIC~1\Walgreens
2007-07-07 15:51 3,131,392 --a

---

C:\WINDOWS\My Pictures 3D.scr
2007-07-07 15:51 <DIR> d

---

C:\Program Files\My Pictures 3D
2007-07-07 12:57 <DIR> d

---

C:\Program Files\MPEGTOAVI


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-07 09:20 19451 --a

---

C:\WINDOWS\system32\tablet.dat
2007-08-07 09:12

---

d

---

C:\Program Files\Symantec AntiVirus
2007-08-06 22:09

---

d

---

C:\Program Files\Tweak-XP Pro 4
2007-07-31 14:48 217088 --a

---

C:\WINDOWS\system32\atasnt40.dll
2007-07-20 20:00

---

d

---

C:\Program Files\TruePoker
2007-07-10 11:06

---

d

---

C:\Program Files\Absolute Poker
2007-07-04 17:09

---

d

---

C:\Program Files\Full Tilt Poker
2007-07-04 16:29

---

d

---

C:\Program Files\VIP Poker
2007-07-04 12:35

---

d

---

C:\Program Files\DivX
2007-07-03 20:20

---

d

---

C:\DOCUME~1\H\APPLIC~1\Vso
2007-07-02 17:55

---

d

---

C:\DOCUME~1\H\APPLIC~1\Nero
2007-07-02 16:57

---

d

---

C:\Program Files\Common Files\LightScribe
2007-07-01 08:12

---

d

---

C:\Program Files\Xvid
2007-06-29 16:32

---

d

---

C:\DOCUME~1\H\APPLIC~1\Sony
2007-06-28 19:36

---

d

---

C:\DOCUME~1\H\APPLIC~1\dvdcss
2007-06-26 09:27

---

d

---

C:\Program Files\QPoker
2007-06-07 16:12

---

d

---

C:\DOCUME~1\H\APPLIC~1\Creative
2007-06-07 15:57

---

d--h

---

C:\Program Files\InstallShield Installation Information
2007-06-07 15:57

---

d--h

---

C:\Program Files\Creative Installation Information
2007-06-07 15:56

---

d

---

C:\Program Files\Creative
2007-06-07 15:56

---

d

---

C:\Program Files\Common Files\Creative
2007-05-30 11:20 3716 --a

---

C:\WINDOWS\mozver.dat
2007-02-20 17:57 87608 --a

---

C:\DOCUME~1\H\APPLIC~1\ezpinst.exe
2007-02-20 17:57 47360 --a

---

C:\DOCUME~1\H\APPLIC~1\pcouffin.sys
2006-09-11 16:04 1348 --a

---

C:\Program Files\TRANSLAT.ION
2006-09-11 16:03 23 --a

---

C:\Program Files\1.ENG
2006-08-03 12:09 266 ---hs---- C:\Program Files\desktop.ini
2006-08-03 12:09 11079 --ah

---

C:\Program Files\folder.htt
2006-04-08 17:23 774144 --a

---

C:\Program Files\RngInterstitial.dll
2005-01-17 18:58 2385

---

c--- C:\Program Files\uninstalcwp2.log
2002-09-11 08:26 63730 --a--c--- C:\Program Files\viewsonicinstruct_xp.pdf
1998-12-09 03:53 99840

---

c--- C:\Program Files\Common Files\IRAABOUT.DLL
1998-12-09 03:53 70144

---

C:\Program Files\Common Files\IRAMDMTR.DLL
1998-12-09 03:53 48640

---

C:\Program Files\Common Files\IRALPTTR.DLL
1998-12-09 03:53 31744

---

C:\Program Files\Common Files\IRAWEBTR.DLL
1998-12-09 03:53 186368

---

c--- C:\Program Files\Common Files\IRAREG.DLL
1998-12-09 03:53 17920

---

C:\Program Files\Common Files\IRASRIAL.DLL
1996-11-28 22:35 185643 --a

---

C:\Program Files\LATIN.EXE
1996-11-28 22:02 162 --a

---

C:\Program Files\LATIN.INI
1996-10-31 11:39 5076 --a

---

C:\Program Files\README.TXT
1996-10-31 11:36 821 --a

---

C:\Program Files\INSTALL.TXT
1994-02-23 09:58 55264 --a

---

C:\Program Files\QPRO200.DLL
1993-11-08 11:59 33744 --a

---

C:\Program Files\CSDIALOG.VBX


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{33FDF7B9-442D-3089-7876-3CB60D4FF1C5}]
C:\WINDOWS\system32\zsdkkses.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9815DA81-2E0C-478c-90E4-06E474E704D0}]
C:\Program Files\ISM\BndDrive.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Norton Ghost 9.0"="C:\Program Files\Symantec\Norton Ghost\Agent\GhostTray.exe" [2004-07-29 03:41]
"nwiz"="nwiz.exe" [2006-10-22 12:22 C:\WINDOWS\SYSTEM32\nwiz.exe]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2004-02-29 15:44]
"NWEReboot"="" []
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 12:22]
"ftutil2"="ftutil2.dll" [2004-06-07 14:05 C:\WINDOWS\SYSTEM32\ftutil2.dll]
"vptray"="C:\PROGRA~1\SYMANT~1\\vptray.exe" [2004-03-12 14:18]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-10-22 12:22]
"Adobe Version Cue CS2"="C:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe" [2005-04-04 18:58]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
ColorVisionStartup.lnk - C:\Program Files\PANTONE COLORVISION\Startup\ColorVisionStartup.exe [2004-11-11 11:00:31]
TabUserW.exe.lnk - C:\WINDOWS\SYSTEM32\WTablet\TabUserW.exe [2006-08-04 15:04:50]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableStatusMessages"=1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=c:\windows\system32\pmnnmmk.dll

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" /background
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
"ISMModule2"="C:\Program Files\ISM\ISMModule2.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe"
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime
"InCD"=C:\Program Files\Nero\Nero 7\InCD\InCD.exe
"NeroFilterCheck"=C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
"Adobe Version Cue CS2"=C:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe
"Acrobat Assistant 7.0"="C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe"
"HPDJ Taskbar Utility"=C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
"SunJavaUpdateSched"=C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe

R0 bb-run;Promise driver accelerator;C:\WINDOWS\system32\DRIVERS\bb-run.sys
R0 dontgo;Promise Removable Disk Control Driver;C:\WINDOWS\system32\DRIVERS\DontGo.sys
R0 ftsata2;ftsata2;C:\WINDOWS\system32\DRIVERS\ftsata2.sys
R0 PenClass;Pen Class;C:\WINDOWS\system32\drivers\PenClass.sys
R0 PQV2i;PQV2i;C:\WINDOWS\system32\drivers\PQV2i.sys
R0 sbp2port;SBP-2 Transport/Protocol Bus Driver;C:\WINDOWS\system32\DRIVERS\sbp2port.sys
R1 nvport;NVIDIA PORT IO Control Driver;\??\C:\WINDOWS\system32\Drivers\nvport.sys
R1 PQIMount;PQIMount;C:\WINDOWS\system32\drivers\PQIMount.sys
R2 CdaD10BA;CdaD10BA;\??\C:\WINDOWS\system32\drivers\CdaD10BA.SYS
R3 pcouffin;VSO Software pcouffin;C:\WINDOWS\system32\Drivers\pcouffin.sys
S3 cvspydr2;ColorVision Spyder 2;C:\WINDOWS\system32\DRIVERS\cvspydr2.sys
S3 MSSQL$SONY_MEDIAMGR;MSSQL$SONY_MEDIAMGR;C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe -sSONY_MEDIAMGR
S3 ROOTMODEM;Microsoft Legacy Modem Driver;C:\WINDOWS\system32\Drivers\RootMdm.sys
S3 SISNICXP;SiS PCI Fast Ethernet Adapter Driver for NDIS51;C:\WINDOWS\system32\DRIVERS\sisnicxp.sys
S3 SQLAgent$SONY_MEDIAMGR;SQLAgent$SONY_MEDIAMGR;C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE -i SONY_MEDIAMGR


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"

Contents of the 'Scheduled Tasks' folder
2007-08-05 19:40:14 C:\WINDOWS\Tasks\At1.job - C:\WINDOWS\system32\5Rc035V4.exe
2007-08-07 15:08:17 C:\WINDOWS\Tasks\At10.job - C:\WINDOWS\system32\5Rc035V4.exe
2007-08-05 19:40:14 C:\WINDOWS\Tasks\At11.job - C:\WINDOWS\system32\5Rc035V4.exe
2007-08-06 17:01:00 C:\WINDOWS\Tasks\At12.job - C:\WINDOWS\system32\5Rc035V4.exe
2007-08-05 19:40:14 C:\WINDOWS\Tasks\At13.job - C:\WINDOWS\system32\5Rc035V4.exe
2007-08-05 19:40:14 C:\WINDOWS\Tasks\At14.job
2007-08-05 20:01:00 C:\WINDOWS\Tasks\At15.job - C:\WINDOWS\system32\5Rc035V4.exe
2007-08-05 21:01:01 C:\WINDOWS\Tasks\At16.job - C:\WINDOWS\system32\5Rc035V4.exe
2007-08-05 22:01:00 C:\WINDOWS\Tasks\At17.job - C:\WINDOWS\system32\5Rc035V4.exe
2007-08-05 23:01:03 C:\WINDOWS\Tasks\At18.job - C:\WINDOWS\system32\5Rc035V4.exe
2007-08-05 19:40:14 C:\WINDOWS\Tasks\At19.job - C:\WINDOWS\system32\5Rc035V4.exe
2007-08-05 19:40:14 C:\WINDOWS\Tasks\At2.job
2007-08-05 19:40:14 C:\WINDOWS\Tasks\At20.job - C:\WINDOWS\system32\5Rc035V4.exe
2007-08-05 19:40:14 C:\WINDOWS\Tasks\At21.job - C:\WINDOWS\system32\5Rc035V4.exe
2007-08-06 03:01:02 C:\WINDOWS\Tasks\At22.job - C:\WINDOWS\system32\5Rc035V4.exe
2007-08-05 19:40:14 C:\WINDOWS\Tasks\At23.job - C:\WINDOWS\system32\5Rc035V4.exe
2007-08-07 05:01:02 C:\WINDOWS\Tasks\At24.job - C:\WINDOWS\system32\5Rc035V4.exe
2007-08-05 19:40:14 C:\WINDOWS\Tasks\At3.job - C:\WINDOWS\system32\5Rc035V4.exe
2007-08-05 19:40:14 C:\WINDOWS\Tasks\At4.job - C:\WINDOWS\system32\5Rc035V4.exe
2007-08-05 19:40:14 C:\WINDOWS\Tasks\At5.job - C:\WINDOWS\system32\5Rc035V4.exe
2007-08-05 19:40:14 C:\WINDOWS\Tasks\At6.job - C:\WINDOWS\system32\5Rc035V4.exe
2007-08-05 19:40:14 C:\WINDOWS\Tasks\At7.job - C:\WINDOWS\system32\5Rc035V4.exe
2007-08-05 19:40:14 C:\WINDOWS\Tasks\At8.job - C:\WINDOWS\system32\5Rc035V4.exe
2007-08-05 19:40:14 C:\WINDOWS\Tasks\At9.job - C:\WINDOWS\system32\5Rc035V4.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-07 09:20:14
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:000001b3
"TracesSuccessful"=dword:00000006

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-07 9:22:09 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-08-07 09:21
C:\ComboFix2.txt ... 2007-08-07 09:10
C:\ComboFix3.txt ... 2007-08-07 08:56

--- E O F ---
=========
Hijackthis log

Logfile of HijackThis v1.99.1
Scan saved at 9:42:02 AM, on 8/7/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Hijackthis\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Adobe Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {20b40b38-ff2b-43a8-88a9-372ad99ef8b1} - C:\WINDOWS\system32\c_502}.dll
O2 - BHO: (no name) - {33FDF7B9-442D-3089-7876-3CB60D4FF1C5} - C:\WINDOWS\system32\zsdkkses.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: BndDrive BHO Class - {9815DA81-2E0C-478c-90E4-06E474E704D0} - C:\Program Files\ISM\BndDrive.dll (file missing)
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Norton Ghost 9.0] C:\Program Files\Symantec\Norton Ghost\Agent\GhostTray.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\\vptray.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Version Cue CS2] C:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe
O4 - Global Startup: ColorVisionStartup.lnk = C:\Program Files\PANTONE COLORVISION\Startup\ColorVisionStartup.exe
O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\SYSTEM32\WTablet\TabUserW.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\c_502}.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\c_502}.dll
O9 - Extra button: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\All Users\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk
O9 - Extra 'Tools' menuitem: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\All Users\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra button: Poker.com - {6FDD5236-C9F0-49ef-935D-385F5E21991A} - C:\Program Files\Poker.com\Poker.exe (HKCU)
O16 - DPF: {02A2D714-433E-46E4-B217-7C3B3FAF8EAE} (ScrabbleCubes Control) - http://www.worldwinner.com/games/v46/scrabblecubes/scrabblecubes.cab
O16 - DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} (FunGamesLoader Object) - http://www.worldwinner.com/games/v47/shared/FunGamesLoader.cab
O16 - DPF: {615F158E-D5CA-422F-A8E7-F6A5EED7063B} (Bejeweled Control) - http://www.worldwinner.com/games/v46/bejeweled/bejeweled.cab
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://fortunelounge.microgaming.com/generic/FlashAX.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://artafact.webex.com/client/v_mywebex-t20-pso-artafact/training/ieatgpc.cab
O20 - AppInit_DLLs: c:\windows\system32\pmnnmmk.dll
O20 - Winlogon Notify: c_502} - C:\WINDOWS\SYSTEM32\c_502}.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Version Cue CS2 - Unknown owner - C:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe" -win32service (file missing)
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: iPodService - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Symantec\Norton Ghost\Agent\PQV2iSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Western Digital Array Message Server (RAIDmSvr) - Unknown owner - C:\Program Files\Western Digital Technology, Inc\Western Digital Array Management\MsgSvr.exe (file missing)
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: ScsiAccess - Unknown owner - C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe (file missing)
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe

peku006

Hi sslickk
how is your system running now?
Lets start with this:

Start your computer into Normal Mode

Run HijackThis
Click on the Scan button
Put a check beside all of the items listed below (if present):
O2 - BHO: (no name) - {20b40b38-ff2b-43a8-88a9-372ad99ef8b1} - C:\WINDOWS\system32\c_502}.dll
O2 - BHO: (no name) - {33FDF7B9-442D-3089-7876-3CB60D4FF1C5} - C:\WINDOWS\system32\zsdkkses.dll (file missing)
O2 - BHO: BndDrive BHO Class - {9815DA81-2E0C-478c-90E4-06E474E704D0} - C:\Program Files\ISM\BndDrive.dll (file missing)
O20 - AppInit_DLLs: c:\windows\system32\pmnnmmk.dll
O20 - Winlogon Notify: c_502} - C:\WINDOWS\SYSTEM32\c_502}.dll

Close all open windows and browsers/email, etc...
Click on the "Fix Checked" button
When completed, close the application.

Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\WINDOWS\SYSTEM32\ssqppml.dll
C:\WINDOWS\SYSTEM32\vturqqo.dll
C:\WINDOWS\SYSTEM32\mlljgdc.dll
C:\WINDOWS\SYSTEM32\pmnnmmk.dll
C:\WINDOWS\SYSTEM32\5Rc035V4.exe
C:\WINDOWS\Tasks\At1.job 
C:\WINDOWS\Tasks\At10.job 
C:\WINDOWS\Tasks\At11.job 
C:\WINDOWS\Tasks\At12.job 
C:\WINDOWS\Tasks\At13.job 
C:\WINDOWS\Tasks\At14.job
C:\WINDOWS\Tasks\At15.job 
C:\WINDOWS\Tasks\At16.job 
C:\WINDOWS\Tasks\At17.job 
C:\WINDOWS\Tasks\At18.job 
C:\WINDOWS\Tasks\At19.job
C:\WINDOWS\Tasks\At2.job
C:\WINDOWS\Tasks\At20.job 
C:\WINDOWS\Tasks\At21.job
C:\WINDOWS\Tasks\At22.job
C:\WINDOWS\Tasks\At23.job
C:\WINDOWS\Tasks\At24.job
C:\WINDOWS\Tasks\At3.job 
C:\WINDOWS\Tasks\At4.job 
C:\WINDOWS\Tasks\At5.job 
C:\WINDOWS\Tasks\At6.job 
C:\WINDOWS\Tasks\At7.job 
C:\WINDOWS\Tasks\At8.job 
C:\WINDOWS\Tasks\At9.job 
C:\WINDOWS\system32\c_502}.dll
C:\WINDOWS\system32\zsdkkses.dll
 
Folder::
C:\VundoFix Backups
C:\Program Files\ISM
 
Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"pmnnmmk.dll"=-

Save this as "CFScript"

Refering to the picture above, drag CFScript.txt into ComboFix.exe
This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThislog.

sslickk

Hi,
Not good, still getting all the popups etc.

Ran Hijackthis, it was not able to remove the two *dll files.
I'm running combo fix right now with the addtion you directed.

Will post the logs asap

and thank you

sslickk

OK, went through the steps,
The error message I'm getting from Hijack this is:
modBackup_Make Backup(sItem=020 - Appinit_Dlls: c\windows\systen32\pmnnmmk.dll)Err #5 Invald procedure call or argument.

Will try and get the scan logs up now.

sslickk

ComboFix 07-08-04.3 - "H" 2007-08-07 12:09:09.5 [GMT -6:00] - NTFS
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.True
Command switches used :: C:\Documents and Settings\H\Desktop\CFScript.txt


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\Program Files\ISM
C:\Program Files\ISM\bndloader.exe
C:\Program Files\ISM\dictionary.gz
C:\Program Files\ISM\ism.exe
C:\Program Files\ISM\ISMModule2.exe
C:\Program Files\ISM\targets.gz
C:\Program Files\ISM\Uninstall.exe
C:\VundoFix Backups
C:\WINDOWS\SYSTEM32\5Rc035V4.exe
C:\WINDOWS\system32\comSvr.dll
C:\WINDOWS\system32\dn18d9fe71.dat
C:\WINDOWS\SYSTEM32\mlljgdc.dll
C:\WINDOWS\SYSTEM32\pmnnmmk.dll
C:\WINDOWS\SYSTEM32\ssqppml.dll
C:\WINDOWS\system32\sstqn.exe
C:\WINDOWS\SYSTEM32\vturqqo.dll
C:\WINDOWS\Tasks\At1.job
C:\WINDOWS\Tasks\At10.job
C:\WINDOWS\Tasks\At11.job
C:\WINDOWS\Tasks\At12.job
C:\WINDOWS\Tasks\At13.job
C:\WINDOWS\Tasks\At14.job
C:\WINDOWS\Tasks\At15.job
C:\WINDOWS\Tasks\At16.job
C:\WINDOWS\Tasks\At17.job
C:\WINDOWS\Tasks\At18.job
C:\WINDOWS\Tasks\At19.job
C:\WINDOWS\Tasks\At2.job
C:\WINDOWS\Tasks\At20.job
C:\WINDOWS\Tasks\At21.job
C:\WINDOWS\Tasks\At22.job
C:\WINDOWS\Tasks\At23.job
C:\WINDOWS\Tasks\At24.job
C:\WINDOWS\Tasks\At3.job
C:\WINDOWS\Tasks\At4.job
C:\WINDOWS\Tasks\At5.job
C:\WINDOWS\Tasks\At6.job
C:\WINDOWS\Tasks\At7.job
C:\WINDOWS\Tasks\At8.job
C:\WINDOWS\Tasks\At9.job


((((((((((((((((((((((((( Files Created from 2007-07-07 to 2007-08-07 )))))))))))))))))))))))))))))))


2007-08-07 12:06 13,380 --a

---

C:\WINDOWS\SYSTEM32\awvvuvt.dll
2007-08-07 08:48 51,200 --a

---

C:\WINDOWS\nircmd.exe
2007-07-31 14:48 51,392 --a

---

C:\WINDOWS\SYSTEM32\DRIVERS\atnt40k.sys
2007-07-31 14:48 <DIR> d

---

C:\DOCUME~1\H\WebEx
2007-07-28 14:56 <DIR> d

---

C:\DOCUME~1\H\.javaws
2007-07-14 09:46 <DIR> d

---

C:\DOCUME~1\H\APPLIC~1\Walgreens
2007-07-07 15:51 3,131,392 --a

---

C:\WINDOWS\My Pictures 3D.scr
2007-07-07 15:51 <DIR> d

---

C:\Program Files\My Pictures 3D
2007-07-07 12:57 <DIR> d

---

C:\Program Files\MPEGTOAVI


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-07 12:14 19451 --a

---

C:\WINDOWS\system32\tablet.dat
2007-08-07 12:12

---

d

---

C:\Program Files\Symantec AntiVirus
2007-08-06 22:09

---

d

---

C:\Program Files\Tweak-XP Pro 4
2007-07-31 14:48 217088 --a

---

C:\WINDOWS\system32\atasnt40.dll
2007-07-20 20:00

---

d

---

C:\Program Files\TruePoker
2007-07-10 11:06

---

d

---

C:\Program Files\Absolute Poker
2007-07-04 17:09

---

d

---

C:\Program Files\Full Tilt Poker
2007-07-04 16:29

---

d

---

C:\Program Files\VIP Poker
2007-07-04 12:35

---

d

---

C:\Program Files\DivX
2007-07-03 20:20

---

d

---

C:\DOCUME~1\H\APPLIC~1\Vso
2007-07-02 17:55

---

d

---

C:\DOCUME~1\H\APPLIC~1\Nero
2007-07-02 16:57

---

d

---

C:\Program Files\Common Files\LightScribe
2007-07-01 08:12

---

d

---

C:\Program Files\Xvid
2007-06-29 16:32

---

d

---

C:\DOCUME~1\H\APPLIC~1\Sony
2007-06-28 19:36

---

d

---

C:\DOCUME~1\H\APPLIC~1\dvdcss
2007-06-26 09:27

---

d

---

C:\Program Files\QPoker
2007-06-07 16:12

---

d

---

C:\DOCUME~1\H\APPLIC~1\Creative
2007-06-07 15:57

---

d--h

---

C:\Program Files\InstallShield Installation Information
2007-06-07 15:57

---

d--h

---

C:\Program Files\Creative Installation Information
2007-06-07 15:56

---

d

---

C:\Program Files\Creative
2007-06-07 15:56

---

d

---

C:\Program Files\Common Files\Creative
2007-05-30 11:20 3716 --a

---

C:\WINDOWS\mozver.dat
2007-02-20 17:57 87608 --a

---

C:\DOCUME~1\H\APPLIC~1\ezpinst.exe
2007-02-20 17:57 47360 --a

---

C:\DOCUME~1\H\APPLIC~1\pcouffin.sys
2006-09-11 16:04 1348 --a

---

C:\Program Files\TRANSLAT.ION
2006-09-11 16:03 23 --a

---

C:\Program Files\1.ENG
2006-08-03 12:09 266 ---hs---- C:\Program Files\desktop.ini
2006-08-03 12:09 11079 --ah

---

C:\Program Files\folder.htt
2006-04-08 17:23 774144 --a

---

C:\Program Files\RngInterstitial.dll
2005-01-17 18:58 2385

---

c--- C:\Program Files\uninstalcwp2.log
2002-09-11 08:26 63730 --a--c--- C:\Program Files\viewsonicinstruct_xp.pdf
1998-12-09 03:53 99840

---

c--- C:\Program Files\Common Files\IRAABOUT.DLL
1998-12-09 03:53 70144

---

C:\Program Files\Common Files\IRAMDMTR.DLL
1998-12-09 03:53 48640

---

C:\Program Files\Common Files\IRALPTTR.DLL
1998-12-09 03:53 31744

---

C:\Program Files\Common Files\IRAWEBTR.DLL
1998-12-09 03:53 186368

---

c--- C:\Program Files\Common Files\IRAREG.DLL
1998-12-09 03:53 17920

---

C:\Program Files\Common Files\IRASRIAL.DLL
1996-11-28 22:35 185643 --a

---

C:\Program Files\LATIN.EXE
1996-11-28 22:02 162 --a

---

C:\Program Files\LATIN.INI
1996-10-31 11:39 5076 --a

---

C:\Program Files\README.TXT
1996-10-31 11:36 821 --a

---

C:\Program Files\INSTALL.TXT
1994-02-23 09:58 55264 --a

---

C:\Program Files\QPRO200.DLL
1993-11-08 11:59 33744 --a

---

C:\Program Files\CSDIALOG.VBX


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Norton Ghost 9.0"="C:\Program Files\Symantec\Norton Ghost\Agent\GhostTray.exe" [2004-07-29 03:41]
"nwiz"="nwiz.exe" [2006-10-22 12:22 C:\WINDOWS\SYSTEM32\nwiz.exe]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2004-02-29 15:44]
"NWEReboot"="" []
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 12:22]
"ftutil2"="ftutil2.dll" [2004-06-07 14:05 C:\WINDOWS\SYSTEM32\ftutil2.dll]
"vptray"="C:\PROGRA~1\SYMANT~1\\vptray.exe" [2004-03-12 14:18]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-10-22 12:22]
"Adobe Version Cue CS2"="C:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe" [2005-04-04 18:58]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
ColorVisionStartup.lnk - C:\Program Files\PANTONE COLORVISION\Startup\ColorVisionStartup.exe [2004-11-11 11:00:31]
TabUserW.exe.lnk - C:\WINDOWS\SYSTEM32\WTablet\TabUserW.exe [2006-08-04 15:04:50]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableStatusMessages"=1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=c:\windows\system32\pmnnmmk.dll

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" /background
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
"ISMModule2"="C:\Program Files\ISM\ISMModule2.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe"
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime
"InCD"=C:\Program Files\Nero\Nero 7\InCD\InCD.exe
"NeroFilterCheck"=C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
"Adobe Version Cue CS2"=C:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe
"Acrobat Assistant 7.0"="C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe"
"HPDJ Taskbar Utility"=C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
"SunJavaUpdateSched"=C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe

R0 bb-run;Promise driver accelerator;C:\WINDOWS\system32\DRIVERS\bb-run.sys
R0 dontgo;Promise Removable Disk Control Driver;C:\WINDOWS\system32\DRIVERS\DontGo.sys
R0 ftsata2;ftsata2;C:\WINDOWS\system32\DRIVERS\ftsata2.sys
R0 PenClass;Pen Class;C:\WINDOWS\system32\drivers\PenClass.sys
R0 PQV2i;PQV2i;C:\WINDOWS\system32\drivers\PQV2i.sys
R0 sbp2port;SBP-2 Transport/Protocol Bus Driver;C:\WINDOWS\system32\DRIVERS\sbp2port.sys
R1 nvport;NVIDIA PORT IO Control Driver;\??\C:\WINDOWS\system32\Drivers\nvport.sys
R1 PQIMount;PQIMount;C:\WINDOWS\system32\drivers\PQIMount.sys
R2 CdaD10BA;CdaD10BA;\??\C:\WINDOWS\system32\drivers\CdaD10BA.SYS
R3 pcouffin;VSO Software pcouffin;C:\WINDOWS\system32\Drivers\pcouffin.sys
S3 cvspydr2;ColorVision Spyder 2;C:\WINDOWS\system32\DRIVERS\cvspydr2.sys
S3 MSSQL$SONY_MEDIAMGR;MSSQL$SONY_MEDIAMGR;C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe -sSONY_MEDIAMGR
S3 ROOTMODEM;Microsoft Legacy Modem Driver;C:\WINDOWS\system32\Drivers\RootMdm.sys
S3 SISNICXP;SiS PCI Fast Ethernet Adapter Driver for NDIS51;C:\WINDOWS\system32\DRIVERS\sisnicxp.sys
S3 SQLAgent$SONY_MEDIAMGR;SQLAgent$SONY_MEDIAMGR;C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE -i SONY_MEDIAMGR


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-07 12:13:45
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:00000091

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-07 12:15:32 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-08-07 12:14
C:\ComboFix2.txt ... 2007-08-07 10:20
C:\ComboFix3.txt ... 2007-08-07 09:34

--- E O F ---


Logfile of HijackThis v1.99.1
Scan saved at 12:18:09 PM, on 8/7/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\Norton Ghost\Agent\GhostTray.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\vptray.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe
C:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\GEARSec.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\SYSTEM32\WTablet\TabUserW.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Symantec\Norton Ghost\Agent\PQV2iSvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\system32\Tablet.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Adobe\Adobe Version Cue CS2\data\database\bin\mysqld-nt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Hijackthis\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Adobe Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Norton Ghost 9.0] C:\Program Files\Symantec\Norton Ghost\Agent\GhostTray.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\\vptray.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Version Cue CS2] C:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe
O4 - Global Startup: ColorVisionStartup.lnk = C:\Program Files\PANTONE COLORVISION\Startup\ColorVisionStartup.exe
O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\SYSTEM32\WTablet\TabUserW.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O9 - Extra button: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\All Users\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk
O9 - Extra 'Tools' menuitem: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\All Users\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra button: Poker.com - {6FDD5236-C9F0-49ef-935D-385F5E21991A} - C:\Program Files\Poker.com\Poker.exe (HKCU)
O16 - DPF: {02A2D714-433E-46E4-B217-7C3B3FAF8EAE} (ScrabbleCubes Control) - http://www.worldwinner.com/games/v46/scrabblecubes/scrabblecubes.cab
O16 - DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} (FunGamesLoader Object) - http://www.worldwinner.com/games/v47/shared/FunGamesLoader.cab
O16 - DPF: {615F158E-D5CA-422F-A8E7-F6A5EED7063B} (Bejeweled Control) - http://www.worldwinner.com/games/v46/bejeweled/bejeweled.cab
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://fortunelounge.microgaming.com/generic/FlashAX.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://artafact.webex.com/client/v_mywebex-t20-pso-artafact/training/ieatgpc.cab
O20 - AppInit_DLLs: c:\windows\system32\pmnnmmk.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Version Cue CS2 - Unknown owner - C:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe" -win32service (file missing)
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: iPodService - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Symantec\Norton Ghost\Agent\PQV2iSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Western Digital Array Message Server (RAIDmSvr) - Unknown owner - C:\Program Files\Western Digital Technology, Inc\Western Digital Array Management\MsgSvr.exe (file missing)
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: ScsiAccess - Unknown owner - C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe (file missing)
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe

peku006

Hi sslickk
Please do the following...

Open notepad and copy/paste the text in the quotebox below into it:

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=-
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ISMModule2"=-

Save this as "CFScript"

Refering to the picture above, drag CFScript.txt into ComboFix.exe
This will start ComboFix again. After reboot, (in case it asks to reboot),

---

Run HijackThis
Click on the Scan button
Put a check beside all of the items listed below (if present):
O2 - BHO: (no name) - {20b40b38-ff2b-43a8-88a9-372ad99ef8b1} - C:\WINDOWS\system32\c_502}.dll
O2 - BHO: (no name) - {33FDF7B9-442D-3089-7876-3CB60D4FF1C5} - C:\WINDOWS\system32\zsdkkses.dll (file missing)
O2 - BHO: BndDrive BHO Class - {9815DA81-2E0C-478c-90E4-06E474E704D0} - C:\Program Files\ISM\BndDrive.dll (file missing)
O20 - AppInit_DLLs: c:\windows\system32\pmnnmmk.dll
O20 - Winlogon Notify: c_502} - C:\WINDOWS\SYSTEM32\c_502}.dll
Close all open windows and browsers/email, etc...
Click on the "Fix Checked" button
When completed, close the application.

post the contents of Combofix.txt in your next reply together with a new HijackThislog.

sslickk

I am opptomistic at this point that your help has solved the problem. I have a firefox browser open and there are no unwanted pages or pop ups appearing!

Thank you so much. May I never see another advert for Big Betty's Bingo parlor :}

JC (sslickk) relieved in San Antonio Texas