Trouble - Win32.Trojan.Agent

omar77omar77 Member
edited October 2007 in Spyware & Virus Removal
hello, i am kind of new to this site but have seen good things... i was wondering if anyone can help me with this Win32.Trojan.Agent infection that my antivirus programme detected.... i have a "hijackthis" log here :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:17:10, on 23/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
C:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE
C:\Program Files\F-Secure Internet Security\Common\FCH32.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\F-Secure Internet Security\backweb\4476822\Program\fspex.exe
C:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXE
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsqh.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsrw.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsav32.exe
C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\F-SECU~1\ANTI-S~1\fsaw.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Messenger\MSMSGS.EXE
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\ALI\Desktop\utorrent.exe
C:\Documents and Settings\ALI\Desktop\HijackThis.exe

O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\F-Secure Internet Security\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Salestart] "C:\Program Files\Common Files\WinAntiVirus Pro 2007\mav_startupmon.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [SearchIndexer] rundll32.exe "C:\WINDOWS\system32\xdvjqhgs.dll",sitypnow
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Registration Ghost Recon Advanced Warfighter® 2.LNK = C:\Program Files\UBISOFT\Ghost Recon Advanced Warfighter 2\Support\Register\RegistrationReminder.exe
O4 - Global Startup: F-Secure Anti-Virus 2006.lnk = C:\Program Files\F-Secure Internet Security\backweb\4476822\Program\fspex.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Block this popup - C:\Program Files\F-Secure Internet Security\Anti-Spyware\blockpopups.htm
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-gb\msntabres.dll.mui/229?aca2e8877bfd4d96a1b55998996e952f
O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-gb\msntabres.dll.mui/230?aca2e8877bfd4d96a1b55998996e952f
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: IE Shield - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: IE Shield... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\Anti-Spyware\ieshield.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by103fd.bay103.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-GB/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1177672648140
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{646ECF41-BAD9-4346-A4DA-70020BD50885}: NameServer = 212.139.132.9 212.139.132.8
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: F-Secure Anti-Virus 2006 (BackWeb Plug-in - 4476822) - F-Secure Internet Security 2005 - C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE
O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\qghjpgie.exe (file missing)
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel Alert Originator - LANDesk Software Ltd. - C:\WINDOWS\system32\ams_ii\iao.exe
O23 - Service: Intel File Transfer - LANDesk Software Ltd. - C:\WINDOWS\system32\cba\xfr.exe
O23 - Service: Intel PDS - LANDesk Software Ltd. - C:\WINDOWS\system32\cba\pds.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe

--
End of file - 9717 bytes
I thought this might help anyone out there detect how to fix the problem. this problem has now made my windows explorer lag, volume control slows and lags the whole system down, and adware is present everytime Internet Explorer is open and also randomly when the internet connection is on.
This has been going on too long now and i now want too really really get rid of it i mean it's about 12.30am....
Much appreciated to those who respond and help me...thank you :(

Comments

  • VekaVeka Finland
    edited October 2007
    Hi omar77, and welcome to Icrontic.

    Please do a couple of important things:

    (1) Create a permanent folder for HijackThis ( I suggest C:\HijackThis ) and move the HijackThis program there.
    (2) Rename HijackThis.exe to Scanner.exe, and post a new log.

    If you need any help, please feel free to ask.
  • omar77omar77 Member
    edited October 2007
    Thank you for your time Vekarppe...here is the new log from c drive

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 14:46:13, on 23/10/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE
    C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
    C:\Program Files\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe
    C:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32.EXE
    C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
    C:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe
    C:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE
    C:\Program Files\F-Secure Internet Security\Common\FCH32.EXE
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    C:\Program Files\F-Secure Internet Security\backweb\4476822\Program\fspex.exe
    C:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXE
    C:\Program Files\F-Secure Internet Security\Anti-Virus\fsqh.exe
    C:\Program Files\F-Secure Internet Security\Anti-Virus\fsrw.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\F-Secure Internet Security\Anti-Virus\fsav32.exe
    C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
    C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE
    C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\PROGRA~1\F-SECU~1\ANTI-S~1\fsaw.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
    C:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Program Files\Messenger\MSMSGS.EXE
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Documents and Settings\ALI\Desktop\utorrent.exe
    C:\Hijack This\Scanner.exe

    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {219A4B33-8A2C-43EF-A4DF-39733E71B270} - C:\WINDOWS\system32\jkhfe.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: (no name) - {89AD4D75-2429-462e-BD4E-443F233F6033} - C:\WINDOWS\system32\kbqbrswm.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O2 - BHO: (no name) - {E4EEFFED-93CD-4CF0-A0F3-50D139121FEE} - C:\WINDOWS\system32\yaywtrr.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\F-Secure Internet Security\FSGUI\FSSW.EXE" /reboot
    O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
    O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [Salestart] "C:\Program Files\Common Files\WinAntiVirus Pro 2007\mav_startupmon.exe"
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
    O4 - HKLM\..\Run: [SearchIndexer] rundll32.exe "C:\WINDOWS\system32\xdvjqhgs.dll",sitypnow
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [Steam] "C:\Documents and Settings\ALI\My Documents\Half life 2\Steam.exe" -silent
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Startup: Registration Ghost Recon Advanced Warfighter® 2.LNK = C:\Program Files\UBISOFT\Ghost Recon Advanced Warfighter 2\Support\Register\RegistrationReminder.exe
    O4 - Global Startup: F-Secure Anti-Virus 2006.lnk = C:\Program Files\F-Secure Internet Security\backweb\4476822\Program\fspex.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: &Block this popup - C:\Program Files\F-Secure Internet Security\Anti-Spyware\blockpopups.htm
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-gb\msntabres.dll.mui/229?aca2e8877bfd4d96a1b55998996e952f
    O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-gb\msntabres.dll.mui/230?aca2e8877bfd4d96a1b55998996e952f
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: IE Shield - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\Anti-Spyware\ieshield.dll
    O9 - Extra 'Tools' menuitem: IE Shield... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\Anti-Spyware\ieshield.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by103fd.bay103.hotmail.msn.com/resources/MsnPUpld.cab
    O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-GB/a-UNO1/GAME_UNO1.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1177672648140
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{646ECF41-BAD9-4346-A4DA-70020BD50885}: NameServer = 212.139.132.9 212.139.132.8
    O20 - Winlogon Notify: jkhfe - C:\WINDOWS\system32\jkhfe.dll
    O20 - Winlogon Notify: yaywtrr - C:\WINDOWS\SYSTEM32\yaywtrr.dll
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: F-Secure Anti-Virus 2006 (BackWeb Plug-in - 4476822) - F-Secure Internet Security 2005 - C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE
    O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\qghjpgie.exe (file missing)
    O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
    O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
    O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: Intel Alert Originator - LANDesk Software Ltd. - C:\WINDOWS\system32\ams_ii\iao.exe
    O23 - Service: Intel File Transfer - LANDesk Software Ltd. - C:\WINDOWS\system32\cba\xfr.exe
    O23 - Service: Intel PDS - LANDesk Software Ltd. - C:\WINDOWS\system32\cba\pds.exe
    O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe

    --
    End of file - 10915 bytes

    thank you for the step...now what do i do now.
  • VekaVeka Finland
    edited October 2007
    Hi, please do the followings...

    Step 1

    Download to your desktop

    Vundofix
    Combofix

    Step 2

    Run Vundofix
    • Double-click VundoFix.exe to run it.
    • When VundoFix re-opens, click the Scan for Vundo button.
    • Once it's done scanning, click the Remove Vundo button.
    • You will receive a prompt asking if you want to remove the files, click YES
    • Once you click yes, your desktop will go blank as it starts removing Vundo.
    • When completed, it will prompt that it will reboot your computer, click OK.
    Note: It is possible that VundoFix encountered a file it could not remove. In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button" when VundoFix appears at reboot.

    Step 3

    Run Combofix
    • Double click combofix.exe and follow the prompts.
    • When finished, it shall produce a log for you.
    • Save the log to your desktop.
    Note: Do not mouseclick combofix's window while its running. That may cause it to stall.

    Step 4

    Please post contents of Vundofix ( C:\vundofix.txt ) and Combofix logs, along with a fresh Hijackthis log. :)
  • omar77omar77 Member
    edited October 2007
    Vundofix log :

    VundoFix V6.5.10

    Checking Java version...

    Java version is 1.5.0.3
    Old versions of java are exploitable and should be removed.

    Scan started at 13:13:50 24/10/2007

    Listing files found while scanning....


    VundoFix V6.5.10

    Checking Java version...

    Java version is 1.5.0.3
    Old versions of java are exploitable and should be removed.

    Scan started at 13:19:51 24/10/2007

    Listing files found while scanning....

    C:\WINDOWS\system32\kbqbrswm.dll
    C:\WINDOWS\system32\pbkojccw.dll
    C:\WINDOWS\system32\sghqjvdx.ini
    C:\WINDOWS\system32\xdvjqhgs.dll

    Beginning removal...

    Attempting to delete C:\WINDOWS\system32\kbqbrswm.dll
    C:\WINDOWS\system32\kbqbrswm.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\sghqjvdx.ini
    C:\WINDOWS\system32\sghqjvdx.ini Has been deleted!

    Performing Repairs to the registry.
    Done!

    Combo fix log:

    ComboFix 07-10-23.2 - ALI 2007-10-24 13:28:53.1 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1091 [GMT 1:00]
    Running from: C:\Documents and Settings\ALI\Desktop\ComboFix.exe
    * Created a new restore point
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Documents and Settings\Administrator\Application Data\WinAntiVirus Pro 2007
    C:\Documents and Settings\Administrator\Application Data\WinAntiVirus Pro 2007\Logs\winav.log
    C:\Documents and Settings\ALI\Application Data\macromedia\Flash Player\#SharedObjects\HC4U8FBL\iforex.com
    C:\Documents and Settings\ALI\Application Data\macromedia\Flash Player\#SharedObjects\HC4U8FBL\iforex.com\Emerp\Events\flash_object.swf\user_data.sol
    C:\Documents and Settings\ALI\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com
    C:\Documents and Settings\ALI\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com\settings.sol
    C:\Documents and Settings\ALI\err.log
    C:\Documents and Settings\ALI\ResErrors.log
    C:\Documents and Settings\All Users\Application Data.\salesmonitor
    C:\WINDOWS\cookies.ini

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

    .
    \LEGACY_DOMAINSERVICE
    \LEGACY_FOPN
    \DomainService


    ((((((((((((((((((((((((( Files Created from 2007-09-24 to 2007-10-24 )))))))))))))))))))))))))))))))
    .

    2007-10-24 13:27 51,200 --a
    C:\WINDOWS\NirCmd.exe
    2007-10-24 13:13 <DIR> d
    C:\VundoFix Backups
    2007-10-24 01:04 171,240 --a
    C:\WINDOWS\system32\drivers\mfehidk.sys
    2007-10-24 01:04 109,608 --a
    C:\WINDOWS\system32\drivers\Mpfp.sys
    2007-10-24 01:04 71,496 --a
    C:\WINDOWS\system32\drivers\mfeavfk.sys
    2007-10-24 01:04 37,480 --a
    C:\WINDOWS\system32\drivers\mfesmfk.sys
    2007-10-24 01:04 34,184 --a
    C:\WINDOWS\system32\drivers\mfebopk.sys
    2007-10-24 01:04 32,008 --a
    C:\WINDOWS\system32\drivers\mferkdk.sys
    2007-10-24 01:02 <DIR> d
    C:\Program Files\McAfee.com
    2007-10-24 01:01 <DIR> d
    C:\Program Files\McAfee
    2007-10-24 01:01 <DIR> d
    C:\Program Files\Common Files\McAfee
    2007-10-24 00:13 84,544 --a
    C:\WINDOWS\system32\poonnxsh.dll
    2007-10-23 21:31 <DIR> d
    C:\WINDOWS\system32\ZoneLabs
    2007-10-23 21:31 11,264 --a
    C:\WINDOWS\system32\SpOrder.dll
    2007-10-23 21:31 4,212 ---h
    C:\WINDOWS\system32\zllictbl.dat
    2007-10-23 21:30 <DIR> d
    C:\WINDOWS\Internet Logs
    2007-10-23 21:28 84,544 --a
    C:\WINDOWS\system32\yiyfhcvb.dll
    2007-10-23 21:15 84,544 --a
    C:\WINDOWS\system32\aurkncuu.dll
    2007-10-23 14:43 <DIR> d
    C:\Hijack This
    2007-10-23 03:00 <DIR> d
    C:\Program Files\Microsoft CAPICOM 2.1.0.2
    2007-10-21 23:35 <DIR> d
    C:\WINDOWS\system32\CBA
    2007-10-21 23:35 <DIR> d
    C:\WINDOWS\system32\AMS_II
    2007-10-21 20:55 <DIR> d--h
    C:\WINDOWS\PIF
    2007-10-21 20:13 965,587 ---hs---- C:\WINDOWS\system32\efhkj.ini2
    2007-10-21 20:04 <DIR> d
    C:\Program Files\Common Files\Symantec Shared
    2007-10-21 19:54 <DIR> d
    C:\Program Files\PowerISO
    2007-10-21 19:47 <DIR> d
    C:\Program Files\AlphaAudioPlayer
    2007-10-21 19:12 <DIR> d
    C:\Documents and Settings\ALI\Application Data\Nero
    2007-10-21 19:03 <DIR> d
    C:\Program Files\Common Files\Nero
    2007-10-11 18:25 <DIR> d
    C:\WINDOWS\Halo Combat Evolved
    2007-10-11 18:25 <DIR> d
    C:\Program Files\Halo Combat Evolved
    2007-10-10 11:03 584,192
    c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll
    2007-10-02 19:26 <DIR> d
    C:\WINDOWS\system32\AGEIA
    2007-10-02 19:26 <DIR> d
    C:\Program Files\AGEIA Technologies
    2007-10-02 19:25 <DIR> d
    C:\Program Files\Common Files\Wise Installation Wizard
    2007-10-02 18:22 <DIR> d
    C:\Documents and Settings\ALI\Application Data\InstallShield
    2007-10-02 18:19 <DIR> d
    C:\Program Files\MagicDisc
    2007-10-02 18:19 92,544 --a
    C:\WINDOWS\system32\drivers\mcdbus.sys
    2007-10-02 17:27 685,816 --a
    C:\WINDOWS\system32\drivers\sptd.sys
    2007-09-30 00:13 <DIR> d
    C:\Program Files\Elaborate Bytes
    2007-09-28 11:24 <DIR> d
    C:\Documents and Settings\ALI\Application Data\GRETECH
    2007-09-28 11:23 <DIR> d
    C:\Program Files\GRETECH

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2007-10-24 12:22
    d
    w C:\Documents and Settings\ALI\Application Data\uTorrent
    2007-10-23 20:02
    d
    w C:\Program Files\Google
    2007-10-23 19:56
    d--h--w C:\Program Files\InstallShield Installation Information
    2007-10-23 15:36
    d
    w C:\Documents and Settings\ALI\Application Data\LimeWire
    2007-10-21 18:03
    d
    w C:\Program Files\Nero
    2007-10-20 20:56
    d
    w C:\Program Files\Common Files\Ahead
    2007-10-15 21:54
    d
    w C:\Program Files\Java
    2007-09-28 20:25
    d
    w C:\Documents and Settings\ALI\Application Data\Azureus
    2007-09-21 22:59
    d
    w C:\Program Files\Microsoft Games
    2007-09-06 21:38
    d
    w C:\Program Files\Azureus
    2007-08-31 19:34
    d
    w C:\Program Files\Common Files\Adobe
    2007-08-30 18:01
    d
    w C:\Program Files\SystemRequirementsLab
    2007-08-30 18:01
    d
    w C:\Documents and Settings\ALI\Application Data\SystemRequirementsLab
    2007-08-04 09:40 972,072 ----a-w C:\WINDOWS\UNRecode.exe
    2007-08-03 11:52 972,072 ----a-w C:\WINDOWS\UNNeroMediaHome.exe
    2007-05-20 17:24 20,184 ----a-w C:\Documents and Settings\ALI\Application Data\GDIPFONTCACHEV1.DAT
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "@=" []
    "SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38]
    "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 23:46]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]
    "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-05-31 16:00]
    "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 11:12]
    "SoundMan"="SOUNDMAN.EXE" [2007-04-16 15:28 C:\WINDOWS\soundman.exe]
    "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
    "NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 15:57]
    "NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-08-08 09:25]
    "e88c4bf9"="C:\WINDOWS\system32\poonnxsh.dll" [2007-10-24 00:13]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 08:56]
    "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54]
    "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35]
    "MSMSGS"="C:\Program Files\Messenger\MSMSGS.exe" [2004-10-13 17:24]
    "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" []
    "Steam"="C:\Documents and Settings\ALI\My Documents\Half life 2\Steam.exe" []

    [HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
    "msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" /background

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
    @=&quot;"

    R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3;C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe

    .
    Contents of the 'Scheduled Tasks' folder
    "2007-10-24 12:10:05 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
    "2007-10-24 00:03:21 C:\WINDOWS\Tasks\McDefragTask.job"
    - c:\program files\mcafee\mqc\QcConsol.exe
    "2007-10-24 00:03:20 C:\WINDOWS\Tasks\McQcTask.job"
    - c:\program files\mcafee\mqc\QcConsol.exe
    "2007-10-23 20:15:09 C:\WINDOWS\Tasks\Pareto UNS.job"
    - C:\Program Files\Common Files\ParetoLogic\UUS\UUS.dll\Pareto_Update.exe
    .
    **************************************************************************

    catchme 0.3.1232 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2007-10-24 13:34:04
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2007-10-24 13:35:26 - machine was rebooted
    .
    --- E O F ---
    And fresh hijack this log:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 13:40:46, on 24/10/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
    C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    c:\program files\common files\mcafee\mna\mcnasvc.exe
    C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
    C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
    c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
    C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    C:\Program Files\McAfee\MPF\MPFSrv.exe
    C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    c:\PROGRA~1\mcafee.com\agent\mcagent.exe
    C:\Program Files\Messenger\MSMSGS.EXE
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\WINDOWS\system32\notepad.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Hijack This\Scanner.exe

    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptcl.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
    O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
    O4 - HKLM\..\Run: [e88c4bf9] rundll32.exe "C:\WINDOWS\system32\poonnxsh.dll",b
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [Steam] "C:\Documents and Settings\ALI\My Documents\Half life 2\Steam.exe" -silent
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Startup: Registration Ghost Recon Advanced Warfighter® 2.LNK = C:\Program Files\UBISOFT\Ghost Recon Advanced Warfighter 2\Support\Register\RegistrationReminder.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-gb\msntabres.dll.mui/229?aca2e8877bfd4d96a1b55998996e952f
    O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-gb\msntabres.dll.mui/230?aca2e8877bfd4d96a1b55998996e952f
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by103fd.bay103.hotmail.msn.com/resources/MsnPUpld.cab
    O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-GB/a-UNO1/GAME_UNO1.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1177672648140
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{646ECF41-BAD9-4346-A4DA-70020BD50885}: NameServer = 212.139.132.9 212.139.132.8
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
    O23 - Service: Intel Alert Originator - LANDesk Software Ltd. - C:\WINDOWS\system32\ams_ii\iao.exe
    O23 - Service: Intel File Transfer - LANDesk Software Ltd. - C:\WINDOWS\system32\cba\xfr.exe
    O23 - Service: Intel PDS - LANDesk Software Ltd. - C:\WINDOWS\system32\cba\pds.exe
    O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
    O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
    O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
    O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
    O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
    O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
    O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
    O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe

    --
    End of file - 8653 bytes
    PS
    Im not sure how to interpret this but im sure its going fine...:)
    ALSO...just before i did all of these steps i recently installed mcafee security center and ran a scan and it detected trojan...i prompted delete and then ran your steps straight after...i just thought you'd like to know...:rolleyes2
    I ran your checks becuase i didnt know what to do...thank you for your help and please keep me prompted as usual...thank you very much
  • VekaVeka Finland
    edited October 2007
    Good job.

    Print out these instructions or save [SIZE=-1]them into a notepad on your desktop, because you will not have internet access while in Safe Mode.

    [/SIZE] Download

    ATF Cleaner
    AVG Anti-Spyware

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    Please open notepad and copy/paste the text in the code box below into it:
    File:: 
C:\WINDOWS\system32\xdvjqhgs.dll 
C:\WINDOWS\system32\pbkojccw.dll 
C:\WINDOWS\system32\poonnxsh.dll 
C:\WINDOWS\system32\yiyfhcvb.dll 
C:\WINDOWS\system32\aurkncuu.dll 
C:\WINDOWS\system32\efhkj.ini2
    Save this as CFScript

    Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

    CFScript.gif

    This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    Run ATF Cleaner

    Note: this program is for XP and Windows 2000 only
    • Double-click ATF-Cleaner.exe to run the program.
    • Under Main choose: Select All
    • Click the Empty Selected button.
    If you use Firefox browser
    • lick Firefox at the top and choose: Select All
    • Click the Empty Selected button.
    • NOTE: If you would like to keep your saved passwords, please click No at the prompt.
    If you use Opera browser
    • Click Opera at the top and choose: Select All
    • Click the Empty Selected button.
    • NOTE: If you would like to keep your saved passwords, please click No at the prompt.
    Click Exit on the Main menu to close the program.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    Configure and update AVG Anti-Spyware
    • Install and start AVG Anti-Spyware
    • Click the Update icon
    • Click Start update
    • Wait until updates are downloaded
    • Click the Scanner icon
    • Open the Settings tab
      • Make sure that under "How to act?" read Quarantine (If not, click the text and choose Quarantine)
      • Under "How to scan?" all checkboxes should be ticked
      • Under "Reports" check "Do not automatically generate report" and uncheck "Only if threats were found"
      • Under "What to scan?" select Scan every file
    • Click the Shield icon
    • Under the "Resident shield is" click active to make it inactive
    • Close AVG Anti-Spyware (do not scan yet)
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    Reboot into Safe Mode
    • Restart your computer
    • After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually
    • Instead of Windows loading as normal, a menu with options should appear
    • Select the first option, to run Windows in Safe Mode, then press Enter
    • Choose your usual account
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    Run AVG Anti-Spyware
    • Close all open windows / programs / folders
    • Start AVG Anti-Spyware
    • Click the Scanner icon
    • Click Complete System Scan
    • Let the program scan the machine
      (do NOT use your computer while sanning)
    • When the scan has finished, follow the instructions below
      • Make sure that under "Set all elements to" read Quarantine (If not, click the text and choose Quarantine)
      • Click Apply all actions
      • Click Save Report
      • Click Save reports as
      • Save report to your Desktop
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    Reboot into Normal Mode

    Please post, Combofix log and AVG Anti-Spyware's report along with a fresh Hijackthis log.
  • omar77omar77 Member
    edited October 2007
    Hello again:)

    Here is another log. First the Combofix log:

    ComboFix 07-10-23.2 - ALI 2007-10-25 18:51:04.3 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1158 [GMT 1:00]
    Running from: C:\Documents and Settings\ALI\Desktop\ComboFix.exe
    Command switches used :: C:\Documents and Settings\ALI\Desktop\CFScript_used_2007-10-25@15.56.txt
    * Created a new restore point

    FILE::
    C:\WINDOWS\system32\aurkncuu.dll
    C:\WINDOWS\system32\efhkj.ini2
    C:\WINDOWS\system32\pbkojccw.dll
    C:\WINDOWS\system32\poonnxsh.dll
    C:\WINDOWS\system32\xdvjqhgs.dll
    C:\WINDOWS\system32\yiyfhcvb.dll
    .

    ((((((((((((((((((((((((( Files Created from 2007-09-25 to 2007-10-25 )))))))))))))))))))))))))))))))
    .

    2007-10-25 16:15 <DIR> d
    C:\Documents and Settings\ALI\Application Data\Grisoft
    2007-10-25 16:15 10,872 --a
    C:\WINDOWS\system32\drivers\AvgAsCln.sys
    2007-10-24 23:33 <DIR> d
    C:\Program Files\Recover Files
    2007-10-24 13:27 51,200 --a
    C:\WINDOWS\NirCmd.exe
    2007-10-24 13:13 <DIR> d
    C:\VundoFix Backups
    2007-10-23 21:31 <DIR> d
    C:\WINDOWS\system32\ZoneLabs
    2007-10-23 21:31 11,264 --a
    C:\WINDOWS\system32\SpOrder.dll
    2007-10-23 21:31 4,212 ---h
    C:\WINDOWS\system32\zllictbl.dat
    2007-10-23 21:30 <DIR> d
    C:\WINDOWS\Internet Logs
    2007-10-23 14:43 <DIR> d
    C:\Hijack This
    2007-10-23 03:00 <DIR> d
    C:\Program Files\Microsoft CAPICOM 2.1.0.2
    2007-10-21 23:35 <DIR> d
    C:\WINDOWS\system32\CBA
    2007-10-21 23:35 <DIR> d
    C:\WINDOWS\system32\AMS_II
    2007-10-21 20:55 <DIR> d--h
    C:\WINDOWS\PIF
    2007-10-21 20:04 <DIR> d
    C:\Program Files\Common Files\Symantec Shared
    2007-10-21 19:54 <DIR> d
    C:\Program Files\PowerISO
    2007-10-21 19:47 <DIR> d
    C:\Program Files\AlphaAudioPlayer
    2007-10-21 19:12 <DIR> d
    C:\Documents and Settings\ALI\Application Data\Nero
    2007-10-21 19:03 <DIR> d
    C:\Program Files\Common Files\Nero
    2007-10-11 18:25 <DIR> d
    C:\WINDOWS\Halo Combat Evolved
    2007-10-11 18:25 <DIR> d
    C:\Program Files\Halo Combat Evolved
    2007-10-10 11:03 584,192
    c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll
    2007-10-02 19:26 <DIR> d
    C:\WINDOWS\system32\AGEIA
    2007-10-02 19:26 <DIR> d
    C:\Program Files\AGEIA Technologies
    2007-10-02 19:25 <DIR> d
    C:\Program Files\Common Files\Wise Installation Wizard
    2007-10-02 18:22 <DIR> d
    C:\Documents and Settings\ALI\Application Data\InstallShield
    2007-10-02 18:19 <DIR> d
    C:\Program Files\MagicDisc
    2007-10-02 18:19 92,544 --a
    C:\WINDOWS\system32\drivers\mcdbus.sys
    2007-10-02 17:27 685,816 --a
    C:\WINDOWS\system32\drivers\sptd.sys
    2007-09-30 00:13 <DIR> d
    C:\Program Files\Elaborate Bytes
    2007-09-28 11:24 <DIR> d
    C:\Documents and Settings\ALI\Application Data\GRETECH
    2007-09-28 11:23 <DIR> d
    C:\Program Files\GRETECH

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2007-10-25 13:26
    d
    w C:\Documents and Settings\ALI\Application Data\uTorrent
    2007-10-24 20:48
    d
    w C:\Documents and Settings\ALI\Application Data\LimeWire
    2007-10-23 23:07 509,073 --sh--w C:\WINDOWS\system32\efhkj.bak2
    2007-10-23 20:24 495,337 --sh--w C:\WINDOWS\system32\efhkj.bak1
    2007-10-23 20:02
    d
    w C:\Program Files\Google
    2007-10-23 19:56
    d--h--w C:\Program Files\InstallShield Installation Information
    2007-10-21 18:03
    d
    w C:\Program Files\Nero
    2007-10-20 20:56
    d
    w C:\Program Files\Common Files\Ahead
    2007-10-15 21:54
    d
    w C:\Program Files\Java
    2007-09-28 20:25
    d
    w C:\Documents and Settings\ALI\Application Data\Azureus
    2007-09-21 22:59
    d
    w C:\Program Files\Microsoft Games
    2007-09-06 21:38
    d
    w C:\Program Files\Azureus
    2007-08-31 19:34
    d
    w C:\Program Files\Common Files\Adobe
    2007-08-30 18:01
    d
    w C:\Program Files\SystemRequirementsLab
    2007-08-30 18:01
    d
    w C:\Documents and Settings\ALI\Application Data\SystemRequirementsLab
    2007-08-21 06:15 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
    2007-08-04 09:40 972,072 ----a-w C:\WINDOWS\UNRecode.exe
    2007-08-04 09:10 95,600 ----a-w C:\WINDOWS\system32\NeroCo.dll
    2007-08-03 11:52 972,072 ----a-w C:\WINDOWS\UNNeroMediaHome.exe
    2007-07-30 18:19 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
    2007-07-30 18:19 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
    2007-07-30 18:19 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
    2007-07-30 18:19 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
    2007-07-30 18:19 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
    2007-07-30 18:19 271,224 ----a-w C:\WINDOWS\system32\mucltui.dll
    2007-07-30 18:19 207,736 ----a-w C:\WINDOWS\system32\muweb.dll
    2007-07-30 18:19 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
    2007-07-30 18:19 1,712,984 ----a-w C:\WINDOWS\system32\wuaueng.dll
    2007-07-30 18:18 33,624 ----a-w C:\WINDOWS\system32\wups.dll
    2007-05-20 17:24 20,184 ----a-w C:\Documents and Settings\ALI\Application Data\GDIPFONTCACHEV1.DAT
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38]
    "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 23:46]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]
    "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-05-31 16:00]
    "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 11:12]
    "SoundMan"="SOUNDMAN.EXE" [2007-04-16 15:28 C:\WINDOWS\soundman.exe]
    "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
    "NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 15:57]
    "NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-08-08 09:25]
    "e88c4bf9"="C:\WINDOWS\system32\poonnxsh.dll" []
    "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 08:56]
    "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54]
    "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35]
    "MSMSGS"="C:\Program Files\Messenger\MSMSGS.exe" [2004-10-13 17:24]
    "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" []
    "Steam"="C:\Documents and Settings\ALI\My Documents\Half life 2\Steam.exe" []

    [HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
    "msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" /background

    R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3;C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe

    .
    Contents of the 'Scheduled Tasks' folder
    "2007-10-25 15:10:02 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
    "2007-10-23 20:15:09 C:\WINDOWS\Tasks\Pareto UNS.job"
    - C:\Program Files\Common Files\ParetoLogic\UUS\UUS.dll\Pareto_Update.exe
    .
    **************************************************************************

    catchme 0.3.1232 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2007-10-25 18:52:49
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2007-10-25 18:53:18
    C:\ComboFix2.txt ... 2007-10-25 16:02
    C:\ComboFix3.txt ... 2007-10-24 13:35
    .
    --- E O F ---
    Now the Anti virus log (report scan) :
    AVG Anti-Spyware - Scan Report

    + Created at: 21:04:56 25/10/2007

    + Scan result:



    C:\System Volume Information\_restore{CD931974-CE63-452F-866A-ABBDAA06AEA2}\RP268\A0019925.dll -> Adware.Companion : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{CD931974-CE63-452F-866A-ABBDAA06AEA2}\RP268\A0019927.exe -> Adware.SystemDoctor : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{CD931974-CE63-452F-866A-ABBDAA06AEA2}\RP268\A0019931.exe -> Not-A-Virus.Downloader.Win32.WinFixer.o : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{CD931974-CE63-452F-866A-ABBDAA06AEA2}\RP352\A0033416.exe -> Not-A-Virus.Downloader.Win32.WinFixer.o : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{CD931974-CE63-452F-866A-ABBDAA06AEA2}\RP268\A0019878.exe -> Not-A-Virus.Downloader.Win32.WinFixer.x : Cleaned with backup (quarantined).


    ::Report end

    Now a fresh hijack this log:
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 21:09:24, on 25/10/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
    C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Program Files\Messenger\MSMSGS.EXE
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Hijack This\Scanner.exe

    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
    O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
    O4 - HKLM\..\Run: [e88c4bf9] rundll32.exe "C:\WINDOWS\system32\poonnxsh.dll",b
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [Steam] "C:\Documents and Settings\ALI\My Documents\Half life 2\Steam.exe" -silent
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Startup: Registration Ghost Recon Advanced Warfighter® 2.LNK = C:\Program Files\UBISOFT\Ghost Recon Advanced Warfighter 2\Support\Register\RegistrationReminder.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-gb\msntabres.dll.mui/229?aca2e8877bfd4d96a1b55998996e952f
    O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-gb\msntabres.dll.mui/230?aca2e8877bfd4d96a1b55998996e952f
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by103fd.bay103.hotmail.msn.com/resources/MsnPUpld.cab
    O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-GB/a-UNO1/GAME_UNO1.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1177672648140
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Intel Alert Originator - LANDesk Software Ltd. - C:\WINDOWS\system32\ams_ii\iao.exe
    O23 - Service: Intel File Transfer - LANDesk Software Ltd. - C:\WINDOWS\system32\cba\xfr.exe
    O23 - Service: Intel PDS - LANDesk Software Ltd. - C:\WINDOWS\system32\cba\pds.exe
    O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe

    --
    End of file - 7087 bytes
    Here is the logs and i followed your steps as you told me to...though i was sort of frustrated when the scan had finished and i forgot to "take action"
    and quarantine them so i had to do it all over again but i did it and here you go. The objects are quarantined are of 5 and 3 are of "low risk" values and the other 2 are of medium values.I eagerly await your next reply.
    Once again, thank you for your help. (rolls eyes)
  • VekaVeka Finland
    edited October 2007
    Very nice. :)

    Please open notepad and copy/paste the text in the code box below into it:
    File:: 
C:\WINDOWS\system32\efhkj.bak1 
C:\WINDOWS\system32\efhkj.bak2
    Save this as CFScript

    Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

    CFScript.gif

    This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.

    ~~~~~~~~~~~~~~

    Please run hijackthis and click Do system scan only.[SIZE=-1] When the scan is complete, check the following entries:[/SIZE]

    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O4 - HKLM\..\Run: [e88c4bf9] rundll32.exe "C:\WINDOWS\system32\poonnxsh.dll",b

     It seems that you don't have an anti-virus scanner and firewall running.

    Where is F-Secure Internet Security or Mcafee security center!?

    When done, post a fresh HijackThis lo and Combofix log.
  • omar77omar77 Member
    edited October 2007
    The new Combo fix log

    ComboFix 07-10-23.2 - ALI 2007-10-26 14:34:18.4 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1060 [GMT 1:00]
    Running from: C:\Documents and Settings\ALI\Desktop\Backed up OST's\Premier log\ComboFix.exe
    Command switches used :: C:\Documents and Settings\ALI\Desktop\CFScript.txt
    * Created a new restore point

    FILE::
    C:\WINDOWS\system32\efhkj.bak1
    C:\WINDOWS\system32\efhkj.bak2
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\WINDOWS\system32\efhkj.bak1
    C:\WINDOWS\system32\efhkj.bak2

    .
    ((((((((((((((((((((((((( Files Created from 2007-09-26 to 2007-10-26 )))))))))))))))))))))))))))))))
    .

    2007-10-26 13:51 171,240 --a
    C:\WINDOWS\system32\drivers\mfehidk.sys
    2007-10-26 13:51 109,608 --a
    C:\WINDOWS\system32\drivers\Mpfp.sys
    2007-10-26 13:51 71,496 --a
    C:\WINDOWS\system32\drivers\mfeavfk.sys
    2007-10-26 13:51 37,480 --a
    C:\WINDOWS\system32\drivers\mfesmfk.sys
    2007-10-26 13:51 34,184 --a
    C:\WINDOWS\system32\drivers\mfebopk.sys
    2007-10-26 13:51 32,008 --a
    C:\WINDOWS\system32\drivers\mferkdk.sys
    2007-10-26 13:50 <DIR> d
    C:\Program Files\McAfee.com
    2007-10-26 13:50 <DIR> d
    C:\Program Files\McAfee
    2007-10-26 13:50 <DIR> d
    C:\Program Files\Common Files\McAfee
    2007-10-26 02:14 <DIR> d
    C:\Program Files\GPL MPEG Decoder
    2007-10-26 02:08 <DIR> d
    C:\Documents and Settings\ALI\Application Data\DivX
    2007-10-26 02:08 129,784
    C:\WINDOWS\system32\pxafs.dll
    2007-10-26 02:08 120,056
    C:\WINDOWS\system32\pxcpyi64.exe
    2007-10-26 02:08 118,520
    C:\WINDOWS\system32\pxinsi64.exe
    2007-10-26 02:08 43,528
    C:\WINDOWS\system32\drivers\PxHelp20.sys
    2007-10-26 02:08 9,464
    C:\WINDOWS\system32\drivers\cdralw2k.sys
    2007-10-26 02:08 9,336
    C:\WINDOWS\system32\drivers\cdr4_xp.sys
    2007-10-26 01:51 <DIR> d
    C:\Program Files\MagicDisc
    2007-10-25 16:15 <DIR> d
    C:\Documents and Settings\ALI\Application Data\Grisoft
    2007-10-25 16:15 10,872 --a
    C:\WINDOWS\system32\drivers\AvgAsCln.sys
    2007-10-24 23:33 <DIR> d
    C:\Program Files\Recover Files
    2007-10-24 13:27 51,200 --a
    C:\WINDOWS\NirCmd.exe
    2007-10-24 13:13 <DIR> d
    C:\VundoFix Backups
    2007-10-23 21:31 <DIR> d
    C:\WINDOWS\system32\ZoneLabs
    2007-10-23 21:31 11,264 --a
    C:\WINDOWS\system32\SpOrder.dll
    2007-10-23 21:31 4,212 ---h
    C:\WINDOWS\system32\zllictbl.dat
    2007-10-23 21:30 <DIR> d
    C:\WINDOWS\Internet Logs
    2007-10-23 14:43 <DIR> d
    C:\Hijack This
    2007-10-23 03:00 <DIR> d
    C:\Program Files\Microsoft CAPICOM 2.1.0.2
    2007-10-21 23:35 <DIR> d
    C:\WINDOWS\system32\CBA
    2007-10-21 23:35 <DIR> d
    C:\WINDOWS\system32\AMS_II
    2007-10-21 20:55 <DIR> d--h
    C:\WINDOWS\PIF
    2007-10-21 20:04 <DIR> d
    C:\Program Files\Common Files\Symantec Shared
    2007-10-21 19:47 <DIR> d
    C:\Program Files\AlphaAudioPlayer
    2007-10-21 19:12 <DIR> d
    C:\Documents and Settings\ALI\Application Data\Nero
    2007-10-21 19:03 <DIR> d
    C:\Program Files\Common Files\Nero
    2007-10-11 18:25 <DIR> d
    C:\WINDOWS\Halo Combat Evolved
    2007-10-11 18:25 <DIR> d
    C:\Program Files\Halo Combat Evolved
    2007-10-10 11:03 584,192
    c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll
    2007-10-02 19:26 <DIR> d
    C:\WINDOWS\system32\AGEIA
    2007-10-02 19:26 <DIR> d
    C:\Program Files\AGEIA Technologies
    2007-10-02 19:25 <DIR> d
    C:\Program Files\Common Files\Wise Installation Wizard
    2007-10-02 18:22 <DIR> d
    C:\Documents and Settings\ALI\Application Data\InstallShield
    2007-10-02 18:19 92,544 --a
    C:\WINDOWS\system32\drivers\mcdbus.sys
    2007-10-02 17:27 685,816 --a
    C:\WINDOWS\system32\drivers\sptd.sys
    2007-09-30 00:13 <DIR> d
    C:\Program Files\Elaborate Bytes
    2007-09-28 17:08 156,992 --a
    C:\WINDOWS\system32\DivXCodecVersionChecker.exe
    2007-09-28 17:07 3,596,288 --a
    C:\WINDOWS\system32\qt-dx331.dll
    2007-09-28 17:07 1,044,480 --a
    C:\WINDOWS\system32\libdivx.dll
    2007-09-28 17:07 524,288 --a
    C:\WINDOWS\system32\DivXsm.exe
    2007-09-28 17:07 200,704 --a
    C:\WINDOWS\system32\ssldivx.dll
    2007-09-28 11:24 <DIR> d
    C:\Documents and Settings\ALI\Application Data\GRETECH
    2007-09-28 11:23 <DIR> d
    C:\Program Files\GRETECH

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2007-10-26 12:33
    d
    w C:\Documents and Settings\ALI\Application Data\uTorrent
    2007-10-26 01:08
    d
    w C:\Program Files\DivX
    2007-10-24 20:48
    d
    w C:\Documents and Settings\ALI\Application Data\LimeWire
    2007-10-23 20:02
    d
    w C:\Program Files\Google
    2007-10-23 19:56
    d--h--w C:\Program Files\InstallShield Installation Information
    2007-10-21 18:03
    d
    w C:\Program Files\Nero
    2007-10-20 20:56
    d
    w C:\Program Files\Common Files\Ahead
    2007-10-15 21:54
    d
    w C:\Program Files\Java
    2007-09-28 20:25
    d
    w C:\Documents and Settings\ALI\Application Data\Azureus
    2007-09-28 16:05 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
    2007-09-28 16:05 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
    2007-09-28 16:05 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
    2007-09-28 16:05 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
    2007-09-28 16:05 739,840 ----a-w C:\WINDOWS\system32\DivX.dll
    2007-09-28 16:05 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
    2007-09-28 16:05 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
    2007-09-28 16:05 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
    2007-09-28 16:05 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
    2007-09-28 16:05 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
    2007-09-28 16:05 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
    2007-09-28 16:05 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
    2007-09-28 16:05 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
    2007-09-21 22:59
    d
    w C:\Program Files\Microsoft Games
    2007-09-06 21:38
    d
    w C:\Program Files\Azureus
    2007-08-31 19:34
    d
    w C:\Program Files\Common Files\Adobe
    2007-08-30 18:01
    d
    w C:\Program Files\SystemRequirementsLab
    2007-08-30 18:01
    d
    w C:\Documents and Settings\ALI\Application Data\SystemRequirementsLab
    2007-08-21 06:15 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
    2007-08-04 09:40 972,072 ----a-w C:\WINDOWS\UNRecode.exe
    2007-08-04 09:10 95,600 ----a-w C:\WINDOWS\system32\NeroCo.dll
    2007-08-03 11:52 972,072 ----a-w C:\WINDOWS\UNNeroMediaHome.exe
    2007-07-30 18:19 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
    2007-07-30 18:19 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
    2007-07-30 18:19 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
    2007-07-30 18:19 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
    2007-07-30 18:19 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
    2007-07-30 18:19 271,224 ----a-w C:\WINDOWS\system32\mucltui.dll
    2007-07-30 18:19 207,736 ----a-w C:\WINDOWS\system32\muweb.dll
    2007-07-30 18:19 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
    2007-07-30 18:19 1,712,984 ----a-w C:\WINDOWS\system32\wuaueng.dll
    2007-07-30 18:18 33,624 ----a-w C:\WINDOWS\system32\wups.dll
    2007-05-20 17:24 20,184 ----a-w C:\Documents and Settings\ALI\Application Data\GDIPFONTCACHEV1.DAT
    .

    ((((((((((((((((((((((((((((( snapshot@2007-10-24_13.34.46.95 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2007-09-28 16:07:48 551,672
    w C:\WINDOWS\system32\px.dll
    + 2007-09-28 16:07:48 66,296
    w C:\WINDOWS\system32\pxcpya64.exe
    + 2007-09-28 16:07:48 518,904
    w C:\WINDOWS\system32\pxdrv.dll
    + 2007-09-28 16:07:50 72,440
    w C:\WINDOWS\system32\pxhpinst.exe
    + 2007-09-28 16:07:48 64,760
    w C:\WINDOWS\system32\pxinsa64.exe
    + 2007-09-28 16:07:50 187,128
    w C:\WINDOWS\system32\pxmas.dll
    + 2007-09-28 16:07:50 1,628,920
    w C:\WINDOWS\system32\pxsfs.dll
    + 2007-09-28 16:07:50 379,640
    w C:\WINDOWS\system32\pxwave.dll
    + 2007-09-05 00:46:34 92,544 ----a-w C:\WINDOWS\system32\ReinstallBackups\0007\DriverFiles\mcdbus.sys
    + 2007-09-28 16:07:48 88,824
    w C:\WINDOWS\system32\vxblock.dll
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38]
    "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 23:46]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]
    "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-05-31 16:00]
    "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 11:12]
    "SoundMan"="SOUNDMAN.EXE" [2007-04-16 15:28 C:\WINDOWS\soundman.exe]
    "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
    "NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 15:57]
    "NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-08-08 09:25]
    "e88c4bf9"="C:\WINDOWS\system32\poonnxsh.dll" []
    "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 08:56]
    "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54]
    "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35]
    "MSMSGS"="C:\Program Files\Messenger\MSMSGS.exe" [2004-10-13 17:24]
    "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" []
    "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" []

    [HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
    "msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" /background

    C:\Documents and Settings\ALI\Start Menu\Programs\Startup\
    Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 19:16:50]
    MagicDisc.lnk - C:\Program Files\MagicDisc\MagicDisc.exe [2007-10-26 01:51:32]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
    @=&quot;"

    R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3;C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe

    .
    Contents of the 'Scheduled Tasks' folder
    "2007-10-26 13:11:00 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
    "2007-10-26 12:50:53 C:\WINDOWS\Tasks\McDefragTask.job"
    - c:\program files\mcafee\mqc\QcConsol.exe
    "2007-10-26 12:50:51 C:\WINDOWS\Tasks\McQcTask.job"
    - c:\program files\mcafee\mqc\QcConsol.exe
    "2007-10-23 20:15:09 C:\WINDOWS\Tasks\Pareto UNS.job"
    - C:\Program Files\Common Files\ParetoLogic\UUS\UUS.dll\Pareto_Update.exe
    .
    **************************************************************************

    catchme 0.3.1232 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2007-10-26 14:36:52
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2007-10-26 14:37:47
    .
    --- E O F ---

    When i did run hijack this only doing system scan i did detect the entries that you told me to look out for,word for word, letter to letter.
    Fresh hijack this log

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 14:48:01, on 26/10/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
    C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    c:\program files\common files\mcafee\mna\mcnasvc.exe
    C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
    C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
    c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
    C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\McAfee\MPF\MPFSrv.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Program Files\Messenger\MSMSGS.EXE
    C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    c:\PROGRA~1\mcafee.com\agent\mcagent.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINDOWS\explorer.exe
    C:\Hijack This\Scanner.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.daemonsearch.com/uk/ý
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptcl.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
    O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
    O4 - HKLM\..\Run: [e88c4bf9] rundll32.exe "C:\WINDOWS\system32\poonnxsh.dll",b
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Startup: MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe
    O4 - Startup: Registration Ghost Recon Advanced Warfighter® 2.LNK = C:\Program Files\UBISOFT\Ghost Recon Advanced Warfighter 2\Support\Register\RegistrationReminder.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-gb\msntabres.dll.mui/229?aca2e8877bfd4d96a1b55998996e952f
    O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-gb\msntabres.dll.mui/230?aca2e8877bfd4d96a1b55998996e952f
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by103fd.bay103.hotmail.msn.com/resources/MsnPUpld.cab
    O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-GB/a-UNO1/GAME_UNO1.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1177672648140
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{646ECF41-BAD9-4346-A4DA-70020BD50885}: NameServer = 212.139.132.9 212.139.132.8
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
    O23 - Service: Intel Alert Originator - LANDesk Software Ltd. - C:\WINDOWS\system32\ams_ii\iao.exe
    O23 - Service: Intel File Transfer - LANDesk Software Ltd. - C:\WINDOWS\system32\cba\xfr.exe
    O23 - Service: Intel PDS - LANDesk Software Ltd. - C:\WINDOWS\system32\cba\pds.exe
    O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
    O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
    O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
    O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
    O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
    O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
    O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
    O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe

    --
    End of file - 9084 bytes

    Oh yeh and the reason why u cant see my f-secure was becuse the software expired and i couldn't find the box to initate it again. Then i got mcafee but i recieved that avg anti virus software...i thought it was the same thing(2 anti virus softwares) so i deleted one...no bother however becuase i have now re-installed mcafee.:bigggrin:
    Thanks again for your help
  • VekaVeka Finland
    edited October 2007
    Hi, I'm sorry.... I was an idiot... :bigggrin:

    Please run hijackthis and click Do system scan only.[SIZE=-1]

    When the scan is complete, check the following entries:[/SIZE]

    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O4 - HKLM\..\Run: [e88c4bf9] rundll32.exe "C:\WINDOWS\system32\poonnxsh.dll",b

    Close web browsers, and all other programs/windows.

    Press Fix Checked :)( I forgot to say that )

    Post a fresh HijackThis log again.
  • omar77omar77 Member
    edited October 2007
    Hello again...i ran the fix check on both entries then i made a new log of hijack this...

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 14:03:15, on 27/10/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
    C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    c:\program files\common files\mcafee\mna\mcnasvc.exe
    C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
    C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
    c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
    C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\McAfee\MPF\MPFSrv.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Program Files\Messenger\MSMSGS.EXE
    C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    c:\PROGRA~1\mcafee.com\agent\mcagent.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
    C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
    C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe
    C:\Program Files\CDBurnerXP\NMSAccessU.exe
    C:\Program Files\MSN Messenger\usnsvc.exe
    C:\PROGRA~1\MAGICD~1\MAGICD~1.EXE
    C:\Hijack This\Scanner.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.msn.com/
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptcl.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
    O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Startup: MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe
    O4 - Startup: Registration Ghost Recon Advanced Warfighter® 2.LNK = C:\Program Files\UBISOFT\Ghost Recon Advanced Warfighter 2\Support\Register\RegistrationReminder.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-gb\msntabres.dll.mui/229?aca2e8877bfd4d96a1b55998996e952f
    O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-gb\msntabres.dll.mui/230?aca2e8877bfd4d96a1b55998996e952f
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by103fd.bay103.hotmail.msn.com/resources/MsnPUpld.cab
    O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-GB/a-UNO1/GAME_UNO1.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1177672648140
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{646ECF41-BAD9-4346-A4DA-70020BD50885}: NameServer = 212.139.132.9 212.139.132.8
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
    O23 - Service: Intel Alert Originator - LANDesk Software Ltd. - C:\WINDOWS\system32\ams_ii\iao.exe
    O23 - Service: Intel File Transfer - LANDesk Software Ltd. - C:\WINDOWS\system32\cba\xfr.exe
    O23 - Service: Intel PDS - LANDesk Software Ltd. - C:\WINDOWS\system32\cba\pds.exe
    O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
    O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
    O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
    O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
    O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
    O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
    O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
    O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
    O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe

    --
    End of file - 9254 bytes

    Well i cant see these entries so i assume that there gone...
    eagerly awaiting next reply,,,bye :tongue:
  • VekaVeka Finland
    edited October 2007
    Good. Your log is clean now.

    Please [SIZE=-1]run a final scan with Panda ActiveScan ( Internet Explorer only ) to be sure there is no junk remaining[/SIZE]

    - Once you are on the Panda site, click the Scan your PC button
    - A new window will open...click the Check Now button
    - Enter your Country
    - Enter your State/Province
    - Enter your e-mail address and click send
    - Select either Home User or Company
    - Click the big Scan Now button
    - If it wants to install an ActiveX component allow it
    - It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
    - When download is complete, click on Local Disks to start the scan
    - When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location. Do NOT lose it!

    Post Panda ActiveScan log. :)
  • omar77omar77 Member
    edited October 2007
    Bad Bad news there were 2 viruses that were deleted but more malware detected. Log below:

    Incident Status Location

    Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\ALI\Application Data\Mozilla\Firefox\Profiles\22zht6zk.default\cookies.txt[.doubleclick.net/]
    Spyware:Cookie/Tradedoubler Not disinfected C:\Documents and Settings\ALI\Application Data\Mozilla\Firefox\Profiles\22zht6zk.default\cookies.txt[.tradedoubler.com/]
    Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\ALI\Application Data\Mozilla\Firefox\Profiles\22zht6zk.default\cookies.txt[.atdmt.com/]
    Spyware:Cookie/NewMedia Not disinfected C:\Documents and Settings\ALI\Application Data\Mozilla\Firefox\Profiles\22zht6zk.default\cookies.txt[.anm.co.uk/]
    Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\ALI\Application Data\Mozilla\Firefox\Profiles\22zht6zk.default\cookies.txt[.2o7.net/]
    Spyware:Cookie/Adtech Not disinfected C:\Documents and Settings\ALI\Application Data\Mozilla\Firefox\Profiles\22zht6zk.default\cookies.txt[.adtech.de/]
    Spyware:Cookie/Cd Freaks Not disinfected C:\Documents and Settings\ALI\Application Data\Mozilla\Firefox\Profiles\22zht6zk.default\cookies.txt[.cdfreaks.com/]
    Spyware:Cookie/Cd Freaks Not disinfected C:\Documents and Settings\ALI\Application Data\Mozilla\Firefox\Profiles\22zht6zk.default\cookies.txt[.club.cdfreaks.com/]
    Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\ALI\Application Data\Mozilla\Firefox\Profiles\22zht6zk.default\cookies.txt[.mediaplex.com/]
    Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\ALI\Application Data\Mozilla\Firefox\Profiles\22zht6zk.default\cookies.txt[ad.yieldmanager.com/]
    Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\ALI\Application Data\Mozilla\Firefox\Profiles\22zht6zk.default\cookies.txt[.fastclick.net/]
    Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\ALI\Application Data\Mozilla\Firefox\Profiles\22zht6zk.default\cookies.txt[.overture.com/]
    Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\ALI\Application Data\Mozilla\Firefox\Profiles\22zht6zk.default\cookies.txt[.com.com/]
    Spyware:Cookie/HotLog Not disinfected C:\Documents and Settings\ALI\Application Data\Mozilla\Firefox\Profiles\22zht6zk.default\cookies.txt[.hotlog.ru/]
    Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\ALI\Application Data\Mozilla\Firefox\Profiles\22zht6zk.default\cookies.txt[.casalemedia.com/]
    Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\ALI\Application Data\Mozilla\Firefox\Profiles\22zht6zk.default\cookies.txt[.advertising.com/]
    Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\ALI\Application Data\Mozilla\Firefox\Profiles\22zht6zk.default\cookies.txt[.perf.overture.com/]
    Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\ALI\Application Data\Mozilla\Firefox\Profiles\22zht6zk.default\cookies.txt[.tribalfusion.com/]
    Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\ALI\Cookies\ali@atdmt[2].txt
    Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\ALI\Cookies\ali@com[1].txt
    Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\ALI\Cookies\ali@doubleclick[1].txt
    Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\ALI\Cookies\ali@mediaplex[1].txt
    Spyware:Cookie/Tradedoubler Not disinfected C:\Documents and Settings\ALI\Cookies\ali@tradedoubler[1].txt
    Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\Documents and Settings\ALI\Desktop\Backed up OST's\Premier log\ComboFix.exe[nircmd.exe]
    Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\Documents and Settings\ALI\Desktop\Backed up OST's\Premier log\ComboFix.exe[nircmd.cfexe]
    Adware:Adware/SecurityError Not disinfected C:\Documents and Settings\ALI\Desktop\downloads\setup(2).0xe[²ÜÇ\xxl.dll]
    Virus:Generic Trojan Disinfected C:\Documents and Settings\ALI\Desktop\Recovered\Ali\hdl dump\hdl_dumb.exe
    Virus:Generic Malware Disinfected C:\Program Files\GameSpy Arcade\Services\_common\PortraitLoader.dll
    Potentially unwanted tool:Application/NirCmd.A

    Thanks again :rolleyes:
  • VekaVeka Finland
    edited October 2007
    Not so bad, cookies are not malware -- they are text files only. :)

    But there was one thing to be removed:

    Please open notepad and copy/paste the text in the code box below into it:
    File:: 
C:\Documents and Settings\ALI\Desktop\downloads\setup(2).0xe
    Save this as CFScript

    Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

    CFScript.gif

    This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.

    ~~~~~~~~~~~~~~~~~~~~

    I suggest to use CCleaner to clean up your system. It is great tool, and free!

    CCleaner is a freeware system optimization and privacy tool. It removes unused files from your system - allowing Windows to run faster and freeing up valuable hard disk space. It also cleans traces of your online activities such as your Internet history.

    Homepage : http://www.ccleaner.com/

    Jahewi's CCleaner guide

    http://www.jahewi.nl/ccleaner/quick/quick.html

    CCleaner Beginner's Guide

    http://www.internetrotsyourbrain.com/ccleanerbeginnersguide/
  • omar77omar77 Member
    edited October 2007
    hello again. Here is the new log of combofix:

    ComboFix 07-10-23.2 - ALI 2007-10-28 19:34:42.5 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1012 [GMT 0:00]
    Running from: C:\Documents and Settings\ALI\Desktop\Backed up OST's\Premier log\ComboFix.exe
    Command switches used :: C:\Documents and Settings\ALI\Desktop\CFScript.txt
    * Created a new restore point

    FILE::
    C:\Documents and Settings\ALI\Desktop\downloads\setup(2).0xe
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Documents and Settings\ALI\Desktop\downloads\setup(2).0xe

    .
    ((((((((((((((((((((((((( Files Created from 2007-09-28 to 2007-10-28 )))))))))))))))))))))))))))))))
    .

    2007-10-28 16:45 8,704 --a
    C:\WINDOWS\system32\pfdnnt.exe
    2007-10-28 16:45 143 --a
    C:\WINDOWS\system32\pfdnnt_actions.sys
    2007-10-28 14:33 <DIR> d
    C:\WINDOWS\system32\ActiveScan
    2007-10-28 14:33 <DIR> d
    C:\WINDOWS\LastGood
    2007-10-28 00:09 <DIR> d
    C:\Documents and Settings\ALI\Application Data\ImgBurn
    2007-10-28 00:08 <DIR> d
    C:\Program Files\ImgBurn
    2007-10-27 23:39 <DIR> d
    C:\Program Files\PowerISO
    2007-10-27 19:28 14 --a
    C:\WINDOWS\system32\SysEngineDrive1.sys
    2007-10-27 19:27 363,520 --a
    C:\WINDOWS\system32\psisdecd.dll
    2007-10-27 19:27 363,520 --a--c--- C:\WINDOWS\system32\dllcache\psisdecd.dll
    2007-10-27 19:26 <DIR> d
    C:\Program Files\BlazeVideo
    2007-10-27 19:24 <DIR> d
    C:\Program Files\AC3Filter
    2007-10-27 01:46 <DIR> d
    C:\Program Files\Common Files\AVSMedia
    2007-10-27 01:46 1,700,352 --a
    C:\WINDOWS\system32\GdiPlus.dll
    2007-10-27 01:46 974,848 --a
    C:\WINDOWS\system32\mfc70.dll
    2007-10-27 01:46 487,424 --a
    C:\WINDOWS\system32\msvcp70.dll
    2007-10-27 01:46 413,760 --a
    C:\WINDOWS\system32\mpg4c32.dll
    2007-10-27 01:46 344,064 --a
    C:\WINDOWS\system32\msvcr70.dll
    2007-10-27 01:46 261,632 --a
    C:\WINDOWS\system32\mcdvd_32.dll
    2007-10-26 16:46 <DIR> d
    C:\Documents and Settings\ALI\Application Data\Vso
    2007-10-26 16:46 81,920 --a
    C:\Documents and Settings\ALI\Application Data\ezpinst.exe
    2007-10-26 16:46 47,360 --a
    C:\WINDOWS\system32\drivers\pcouffin.sys
    2007-10-26 16:46 47,360 --a
    C:\Documents and Settings\ALI\Application Data\pcouffin.sys
    2007-10-26 16:46 14 --a
    C:\WINDOWS\system32\systeminfo3.dll
    2007-10-26 16:38 <DIR> d
    C:\Program Files\Alex Feinman
    2007-10-26 16:28 <DIR> d
    C:\Program Files\MagicISO
    2007-10-26 12:51 171,240 --a
    C:\WINDOWS\system32\drivers\mfehidk.sys
    2007-10-26 12:51 109,608 --a
    C:\WINDOWS\system32\drivers\Mpfp.sys
    2007-10-26 12:51 71,496 --a
    C:\WINDOWS\system32\drivers\mfeavfk.sys
    2007-10-26 12:51 37,480 --a
    C:\WINDOWS\system32\drivers\mfesmfk.sys
    2007-10-26 12:51 34,184 --a
    C:\WINDOWS\system32\drivers\mfebopk.sys
    2007-10-26 12:51 32,008 --a
    C:\WINDOWS\system32\drivers\mferkdk.sys
    2007-10-26 12:50 <DIR> d
    C:\Program Files\McAfee.com
    2007-10-26 12:50 <DIR> d
    C:\Program Files\McAfee
    2007-10-26 12:50 <DIR> d
    C:\Program Files\Common Files\McAfee
    2007-10-26 01:14 <DIR> d
    C:\Program Files\GPL MPEG Decoder
    2007-10-26 01:08 <DIR> d
    C:\Documents and Settings\ALI\Application Data\DivX
    2007-10-26 01:08 129,784
    C:\WINDOWS\system32\pxafs.dll
    2007-10-26 01:08 120,056
    C:\WINDOWS\system32\pxcpyi64.exe
    2007-10-26 01:08 118,520
    C:\WINDOWS\system32\pxinsi64.exe
    2007-10-26 01:08 43,528
    C:\WINDOWS\system32\drivers\PxHelp20.sys
    2007-10-26 01:08 9,464
    C:\WINDOWS\system32\drivers\cdralw2k.sys
    2007-10-26 01:08 9,336
    C:\WINDOWS\system32\drivers\cdr4_xp.sys
    2007-10-25 15:15 <DIR> d
    C:\Documents and Settings\ALI\Application Data\Grisoft
    2007-10-25 15:15 10,872 --a
    C:\WINDOWS\system32\drivers\AvgAsCln.sys
    2007-10-24 22:33 <DIR> d
    C:\Program Files\Recover Files
    2007-10-24 12:27 51,200 --a
    C:\WINDOWS\NirCmd.exe
    2007-10-24 12:13 <DIR> d
    C:\VundoFix Backups
    2007-10-23 20:31 <DIR> d
    C:\WINDOWS\system32\ZoneLabs
    2007-10-23 20:31 11,264 --a
    C:\WINDOWS\system32\SpOrder.dll
    2007-10-23 20:31 4,212 ---h
    C:\WINDOWS\system32\zllictbl.dat
    2007-10-23 20:30 <DIR> d
    C:\WINDOWS\Internet Logs
    2007-10-23 13:43 <DIR> d
    C:\Hijack This
    2007-10-23 02:00 <DIR> d
    C:\Program Files\Microsoft CAPICOM 2.1.0.2
    2007-10-21 22:35 <DIR> d
    C:\WINDOWS\system32\CBA
    2007-10-21 22:35 <DIR> d
    C:\WINDOWS\system32\AMS_II
    2007-10-21 19:55 <DIR> d--h
    C:\WINDOWS\PIF
    2007-10-21 19:04 <DIR> d
    C:\Program Files\Common Files\Symantec Shared
    2007-10-21 18:47 <DIR> d
    C:\Program Files\AlphaAudioPlayer
    2007-10-21 18:12 <DIR> d
    C:\Documents and Settings\ALI\Application Data\Nero
    2007-10-21 18:03 <DIR> d
    C:\Program Files\Common Files\Nero
    2007-10-11 17:25 <DIR> d
    C:\WINDOWS\Halo Combat Evolved
    2007-10-11 17:25 <DIR> d
    C:\Program Files\Halo Combat Evolved
    2007-10-10 10:03 584,192
    c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll
    2007-10-02 18:26 <DIR> d
    C:\WINDOWS\system32\AGEIA
    2007-10-02 18:26 <DIR> d
    C:\Program Files\AGEIA Technologies
    2007-10-02 18:25 <DIR> d
    C:\Program Files\Common Files\Wise Installation Wizard
    2007-10-02 17:22 <DIR> d
    C:\Documents and Settings\ALI\Application Data\InstallShield
    2007-10-02 17:19 92,544 --a
    C:\WINDOWS\system32\drivers\mcdbus.sys
    2007-10-02 16:27 685,816 --a
    C:\WINDOWS\system32\drivers\sptd.sys
    2007-09-29 23:13 <DIR> d
    C:\Program Files\Elaborate Bytes
    2007-09-28 16:08 156,992 --a
    C:\WINDOWS\system32\DivXCodecVersionChecker.exe
    2007-09-28 16:07 3,596,288 --a
    C:\WINDOWS\system32\qt-dx331.dll
    2007-09-28 16:07 1,044,480 --a
    C:\WINDOWS\system32\libdivx.dll
    2007-09-28 16:07 524,288 --a
    C:\WINDOWS\system32\DivXsm.exe
    2007-09-28 16:07 200,704 --a
    C:\WINDOWS\system32\ssldivx.dll
    2007-09-28 10:24 <DIR> d
    C:\Documents and Settings\ALI\Application Data\GRETECH
    2007-09-28 10:23 <DIR> d
    C:\Program Files\GRETECH

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2007-10-28 19:33
    d
    w C:\Documents and Settings\ALI\Application Data\uTorrent
    2007-10-28 17:55
    d
    w C:\Program Files\GameSpy Arcade
    2007-10-28 16:55
    d
    w C:\Program Files\Windows Live Toolbar
    2007-10-28 16:53
    d
    w C:\Program Files\QuickTime
    2007-10-28 16:50
    d
    w C:\Program Files\MSN Messenger
    2007-10-26 01:08
    d
    w C:\Program Files\DivX
    2007-10-24 20:48
    d
    w C:\Documents and Settings\ALI\Application Data\LimeWire
    2007-10-23 20:02
    d
    w C:\Program Files\Google
    2007-10-23 19:56
    d--h--w C:\Program Files\InstallShield Installation Information
    2007-10-21 18:03
    d
    w C:\Program Files\Nero
    2007-10-20 20:56
    d
    w C:\Program Files\Common Files\Ahead
    2007-10-15 21:54
    d
    w C:\Program Files\Java
    2007-09-28 20:25
    d
    w C:\Documents and Settings\ALI\Application Data\Azureus
    2007-09-28 16:05 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
    2007-09-28 16:05 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
    2007-09-28 16:05 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
    2007-09-28 16:05 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
    2007-09-28 16:05 739,840 ----a-w C:\WINDOWS\system32\DivX.dll
    2007-09-28 16:05 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
    2007-09-28 16:05 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
    2007-09-28 16:05 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
    2007-09-28 16:05 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
    2007-09-28 16:05 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
    2007-09-28 16:05 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
    2007-09-28 16:05 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
    2007-09-28 16:05 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
    2007-09-21 22:59
    d
    w C:\Program Files\Microsoft Games
    2007-09-06 21:38
    d
    w C:\Program Files\Azureus
    2007-08-31 19:34
    d
    w C:\Program Files\Common Files\Adobe
    2007-08-30 18:01
    d
    w C:\Program Files\SystemRequirementsLab
    2007-08-30 18:01
    d
    w C:\Documents and Settings\ALI\Application Data\SystemRequirementsLab
    2007-08-21 06:15 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
    2007-08-04 09:40 972,072 ----a-w C:\WINDOWS\UNRecode.exe
    2007-08-04 09:10 95,600 ----a-w C:\WINDOWS\system32\NeroCo.dll
    2007-08-03 11:52 972,072 ----a-w C:\WINDOWS\UNNeroMediaHome.exe
    2007-07-30 18:19 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
    2007-07-30 18:19 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
    2007-07-30 18:19 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
    2007-07-30 18:19 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
    2007-07-30 18:19 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
    2007-07-30 18:19 271,224 ----a-w C:\WINDOWS\system32\mucltui.dll
    2007-07-30 18:19 207,736 ----a-w C:\WINDOWS\system32\muweb.dll
    2007-07-30 18:19 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
    2007-07-30 18:19 1,712,984 ----a-w C:\WINDOWS\system32\wuaueng.dll
    2007-07-30 18:18 33,624 ----a-w C:\WINDOWS\system32\wups.dll
    2007-05-20 17:24 20,184 ----a-w C:\Documents and Settings\ALI\Application Data\GDIPFONTCACHEV1.DAT
    .

    ((((((((((((((((((((((((((((( snapshot@2007-10-24_13.34.46.95 )))))))))))))))))))))))))))))))))))))))))
    .
    - 2007-10-20 05:03:30 136,192 ----a-w C:\WINDOWS\catchme.exe
    + 2007-10-20 06:03:30 136,192 ----a-w C:\WINDOWS\catchme.exe
    + 2006-08-24 08:28:54 141,424 ----a-w C:\WINDOWS\Downloaded Program Files\asinst.dll
    + 2007-03-29 09:20:50 110,592 ----a-w C:\WINDOWS\system32\ActiveScan\as.dll
    + 2006-10-05 16:15:26 233,472 ----a-w C:\WINDOWS\system32\ActiveScan\ascontrol.dll
    + 2005-06-03 14:03:18 96,256 ----a-w C:\WINDOWS\system32\ActiveScan\asmdat.dll
    + 2003-08-01 11:00:16 36,864 ----a-w C:\WINDOWS\system32\ActiveScan\certdll.dll
    + 2005-05-20 13:42:44 86,016 ----a-w C:\WINDOWS\system32\ActiveScan\instlsp.dll
    + 2006-02-16 18:20:20 4,608 ----a-w C:\WINDOWS\system32\ActiveScan\memvfile.dll
    + 2005-10-25 18:08:32 348,160 ----a-w C:\WINDOWS\system32\ActiveScan\msvcr71.dll
    + 2004-05-04 15:01:02 139,264 ----a-w C:\WINDOWS\system32\ActiveScan\pavaleas.dll
    + 2006-07-14 13:04:10 45,056 ----a-w C:\WINDOWS\system32\ActiveScan\pavdr.exe
    + 2006-04-10 10:50:02 159,832 ----a-w C:\WINDOWS\system32\ActiveScan\pavexcom.dll
    + 2006-02-14 13:05:38 94,208 ----a-w C:\WINDOWS\system32\ActiveScan\pavinas.dll
    + 2006-02-16 18:35:38 180,224 ----a-w C:\WINDOWS\system32\ActiveScan\pavoe.dll
    + 2006-10-05 16:15:38 122,880 ----a-w C:\WINDOWS\system32\ActiveScan\pavpz.dll
    + 2006-06-30 14:13:38 8,704 ----a-w C:\WINDOWS\system32\ActiveScan\pfdnnt.exe
    + 2004-02-04 14:08:42 49,152 ----a-w C:\WINDOWS\system32\ActiveScan\port32.dll
    + 2006-08-01 13:23:10 69,632 ----a-w C:\WINDOWS\system32\ActiveScan\pscpu.dll
    + 2006-08-23 13:06:08 1,388,544 ----a-w C:\WINDOWS\system32\ActiveScan\pskahk.dll
    + 2006-08-17 11:38:14 10,752 ----a-w C:\WINDOWS\system32\ActiveScan\pskalloc.dll
    + 2006-09-04 11:49:54 61,440 ----a-w C:\WINDOWS\system32\ActiveScan\pskas.dll
    + 2006-08-18 08:46:18 779,264 ----a-w C:\WINDOWS\system32\ActiveScan\pskavs.dll
    + 2007-03-26 14:25:34 417,792 ----a-w C:\WINDOWS\system32\ActiveScan\pskcmp.dll
    + 2006-08-09 10:42:24 90,112 ----a-w C:\WINDOWS\system32\ActiveScan\pskfss.dll
    + 2006-07-19 10:55:58 208,896 ----a-w C:\WINDOWS\system32\ActiveScan\pskhtml.dll
    + 2006-01-20 16:57:00 9,728 ----a-w C:\WINDOWS\system32\ActiveScan\pskmas.dll
    + 2006-05-17 09:50:12 14,336 ----a-w C:\WINDOWS\system32\ActiveScan\pskmdfs.dll
    + 2006-08-16 10:58:12 33,280 ----a-w C:\WINDOWS\system32\ActiveScan\pskpack.dll
    + 2006-06-30 14:42:36 266,240 ----a-w C:\WINDOWS\system32\ActiveScan\pskscs.dll
    + 2006-08-17 14:33:14 62,976 ----a-w C:\WINDOWS\system32\ActiveScan\pskutil.dll
    + 2006-08-08 13:13:10 13,312 ----a-w C:\WINDOWS\system32\ActiveScan\pskvfile.dll
    + 2006-08-18 08:53:08 69,632 ----a-w C:\WINDOWS\system32\ActiveScan\pskvfs.dll
    + 2006-08-18 08:49:50 167,936 ----a-w C:\WINDOWS\system32\ActiveScan\pskvm.dll
    + 2007-04-18 17:16:04 353,840 ----a-w C:\WINDOWS\system32\ActiveScan\psscan.dll
    + 2007-01-22 14:42:48 35,328 ----a-w C:\WINDOWS\system32\ActiveScan\rawvfile.dll
    + 1997-09-18 06:12:32 9,488 ----a-w C:\WINDOWS\system32\ActiveScan\sporder.dll
    + 2006-02-28 17:23:40 69,632 ----a-w C:\WINDOWS\system32\ActiveScan\tcpvfile.dll
    + 2006-08-02 12:39:06 73,728 ----a-w C:\WINDOWS\system32\asuninst.exe
    - 2007-08-07 00:15:07 33,052 ----a-w C:\WINDOWS\system32\drivers\scdemu.sys
    + 2007-04-09 12:27:07 31,548 ----a-w C:\WINDOWS\system32\drivers\scdemu.sys
    - 2007-05-20 11:17:30 118,952 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
    + 2007-10-27 16:23:52 120,544 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
    - 2001-03-08 18:30:00 24,064 ----a-w C:\WINDOWS\system32\msxml3a.dll
    + 2003-05-21 12:50:38 24,576 ----a-w C:\WINDOWS\system32\msxml3a.dll
    - 2007-08-09 10:16:39 58,596 ----a-w C:\WINDOWS\system32\perfc009.dat
    + 2007-10-28 14:27:26 58,712 ----a-w C:\WINDOWS\system32\perfc009.dat
    - 2007-08-09 10:16:39 392,296 ----a-w C:\WINDOWS\system32\perfh009.dat
    + 2007-10-28 14:27:26 392,604 ----a-w C:\WINDOWS\system32\perfh009.dat
    + 2007-09-28 16:07:48 551,672
    w C:\WINDOWS\system32\px.dll
    + 2007-09-28 16:07:48 66,296
    w C:\WINDOWS\system32\pxcpya64.exe
    + 2007-09-28 16:07:48 518,904
    w C:\WINDOWS\system32\pxdrv.dll
    + 2007-09-28 16:07:50 72,440
    w C:\WINDOWS\system32\pxhpinst.exe
    + 2007-09-28 16:07:48 64,760
    w C:\WINDOWS\system32\pxinsa64.exe
    + 2007-09-28 16:07:50 187,128
    w C:\WINDOWS\system32\pxmas.dll
    + 2007-09-28 16:07:50 1,628,920
    w C:\WINDOWS\system32\pxsfs.dll
    + 2007-09-28 16:07:50 379,640
    w C:\WINDOWS\system32\pxwave.dll
    + 2007-09-05 00:46:34 92,544 ----a-w C:\WINDOWS\system32\ReinstallBackups\0007\DriverFiles\mcdbus.sys
    - 2007-04-02 13:21:27 139,776 ----a-w C:\WINDOWS\system32\swreg.exe
    + 2007-04-02 14:21:27 139,776 ----a-w C:\WINDOWS\system32\swreg.exe
    + 2007-09-28 16:07:48 88,824
    w C:\WINDOWS\system32\vxblock.dll
    - 2005-12-30 19:10:30 761,856 ----a-w C:\WINDOWS\system32\xvidcore.dll
    + 2004-07-03 20:59:06 524,288 ----a-w C:\WINDOWS\system32\xvidcore.dll
    - 2005-12-30 19:18:26 180,224 ----a-w C:\WINDOWS\system32\xvidvfw.dll
    + 2004-07-03 21:08:04 139,264 ----a-w C:\WINDOWS\system32\xvidvfw.dll
    + 2003-03-25 18:53:50 11,776 ----a-w C:\WINDOWS\system32\ZPORT4AS.dll
    .
    -- Snapshot reset to current date --
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 10:38]
    "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 22:46]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11]
    "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-05-31 15:00]
    "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 10:12]
    "SoundMan"="SOUNDMAN.EXE" [2007-04-16 14:28 C:\WINDOWS\soundman.exe]
    "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 02:06]
    "NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 14:57]
    "NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-08-08 08:25]
    "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 09:25]
    "PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2007-04-09 12:23]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:56]
    "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 11:54]
    "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 11:35]
    "MSMSGS"="C:\Program Files\Messenger\MSMSGS.exe" [2004-10-13 16:24]
    "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" []
    "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" []

    [HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
    "msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" /background

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
    @=&quot;"

    R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3;C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe

    .
    Contents of the 'Scheduled Tasks' folder
    "2007-10-28 19:10:02 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
    "2007-10-26 12:50:53 C:\WINDOWS\Tasks\McDefragTask.job"
    - c:\program files\mcafee\mqc\QcConsol.exe
    "2007-10-26 12:50:51 C:\WINDOWS\Tasks\McQcTask.job"
    - c:\program files\mcafee\mqc\QcConsol.exe
    "2007-10-23 20:15:09 C:\WINDOWS\Tasks\Pareto UNS.job"
    - C:\Program Files\Common Files\ParetoLogic\UUS\UUS.dll\Pareto_Update.exe
    .
    **************************************************************************

    catchme 0.3.1232 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2007-10-28 19:36:24
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2007-10-28 19:37:15
    C:\ComboFix2.txt ... 2007-10-26 13:37
    .
    --- E O F ---

    By the way, that CCLEANER tool was very handy indeed. I used the hyperlinks and followed the steps...now i should be free and clean...oh and this was after the combofix log...I cant thank you enough:p
  • VekaVeka Finland
    edited October 2007
    You should be clean now. How is the computer running?

    I'll give some suggestions to make your computer more secure, and to make it run smoothly.

    [SIZE=-1]
    [/SIZE]

    Remove unnecessary startup entries ( using Hijackthis ) to boot Windows faster.

    O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    [SIZE=-1]
    Check the entries, and click the Fix Checked button.
    [/SIZE][SIZE=-1]

    Disable [/SIZE]AVG Anti-Spyware's Resident Shield.

    Open AVG Antispyware and in the main window click Resident Shield, then toggle the AVG Anti-Spyware active protection 'off' by clicking Change state which will then change the protection status to inactive.

    You can still use AVG Anti-Spyware to scan your computer. It is handy tool also.

    [SIZE=-1]

    Now that you are clean, please follow these simple steps in order to keep your computer clean and secure: Reenable system restore with instructions from tutorial above
    • Make your Internet Explorer more secure - This can be done by following these simple instructions:
    • From within Internet Explorer click on the Tools menu and then click on Options.
    • Click once on the Security tab
    • Click once on the Internet icon so it becomes highlighted.
    • Click once on the Custom Level button.
    • Change the Download signed ActiveX controls to Prompt
    • Change the Download unsigned ActiveX controls to Disable
    • Change the Initialize and script ActiveX controls not marked as safe to Disable
    • Change the Installation of desktop items to Prompt
    • Change the Launching programs and files in an IFRAME to Prompt
    • Change the Navigate sub-frames across different domains to Prompt
    • When all these settings have been made, click on the OK button.
    • If it prompts you as to whether or not you want to save the settings, press the Yes button.
    • Next press the Apply button and then the OK to exit the Internet Properties page.
    • Use an AntiVirus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.
    See this link for a listing of some online & their stand-alone antivirus programs:

    Virus, Spyware, and Malware Protection and Removal Resources
    • Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
    • Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly.

      For a tutorial on Firewalls and a listing of some available ones see the link below:

      Understanding and Using Firewalls
    • Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
    • Install Ad-Aware - Install and download Ad-Aware. ou should also scan your computer with program on a regular basis just as you would an antivirus software in conjunction with Spybot.

      A tutorial on installing & using this product can be found here:

      Using Ad-aware to remove Spyware, Malware, & Hijackers from Your Computer
    • Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option.

      This will provide real-time spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an anti virus software. A tutorial on installing & using this product can be found here:

      Instructions for - Spybot S & D and Ad-aware
    • Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
    Follow this list and your potential for being infected again will reduce dramatically.

    Here are some additional utilities that will enhance your safety
    • IE/Spyad <= IE/Spyad places over 4000 websites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites.
    • MVPS Hosts file <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your coputer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
    • Google Toolbar <= Get the free google toolbar to help stop pop up windows.
    • Winpatrol <= Download and install the free version of Winpatrol. a tutorial for this product is located here:



      Using Winpatrol to protect your computer from malicious software
    Stand Up and Be Counted ---> Malware Complaints <--- where you can make difference!

    The site offers people who have been (or are) victims of malware the opportunity to document their story and, in that way, launch a complaint against the malware and the makers of the malware.

    Also, please read this great article by Tony Klein So How Did I Get Infected In First Place

    Happy surfing and stay clean! :):):cool:
    [/SIZE]
  • omar77omar77 Member
    edited October 2007
    I cant thank you enough 'vekarppe' for such a helpful response, and so quickly!!! I thought that this system could never be run like it used to when it was brand new but now i can firmly say with truth that it is just how i remember it...:rolleyes:
    Thank you again and i have took up the other safety tips...My windows explorer is running as it should and again a sincere thank :pyou:tongue:
  • VekaVeka Finland
    edited October 2007
    You're welcome. :)
Sign In or Register to comment.