Options

computer slow, think i have some virus's- please help-

Unknown
edited March 2008 in Spyware & Virus Removal
here is a fresh hijack log..

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:19:17 PM, on 1/12/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\sm56hlpr.exe
C:\WINDOWS\system32\SysMonitor.exe
C:\Program Files\Acer\Acer eMode Management\AspireService.exe
C:\Program Files\Acer\Acer eConsole\MediaSync.exe
C:\Program Files\Acer TV-FM\PCMService.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Ahead\ODD Toolkit\DVDTray.exe
C:\Program Files\dvd43\dvd43_tray.exe
C:\WINDOWS\wt\updater\wcmdmgr.exe
C:\WINDOWS\system32\goxorb.exe
C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Acer TV-FM\Kernel\TV\CLCapSvc.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Acer TV-FM\Kernel\CLML_NTService\CLMLServer.exe
C:\WINDOWS\system32\sistray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\oodag.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Acer TV-FM\Kernel\TV\CLSched.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [ntiMUI] c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\WINDOWS\system32\SysMonitor.exe
O4 - HKLM\..\Run: [AspireService] C:\Program Files\Acer\Acer eMode Management\AspireService.exe
O4 - HKLM\..\Run: [MediaSync] C:\Program Files\Acer\Acer eConsole\MediaSync.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Acer TV-FM\PCMService.exe"
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [DVDTray] C:\Program Files\Ahead\ODD Toolkit\DVDTray.exe
O4 - HKLM\..\Run: [wcmdmgr] C:\WINDOWS\wt\updater\wcmdmgrl.exe -launch
O4 - HKLM\..\Run: [dvd43] C:\Program Files\dvd43\dvd43_tray.exe
O4 - HKLM\..\Run: [Microsoft Update Machine] goxorb.exe
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe"
O4 - HKLM\..\Run: [b84cec3f] rundll32.exe "C:\WINDOWS\system32\rwtcuvqu.dll",b
O4 - HKLM\..\Run: [BMbb7fdfa3] Rundll32.exe "C:\WINDOWS\system32\yfeeqorh.dll",s
O4 - HKLM\..\RunServices: [Microsoft Update Machine] goxorb.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Microsoft Update Machine] goxorb.exe
O4 - HKCU\..\Run: [MsgCenterExe] "C:\Program Files\Common Files\Real\Update_OB\RealOneMessageCenter.exe" -osboot
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Acer Empowering Technology.lnk = ?
O4 - Global Startup: Acer WLAN 11g USB Dongle.lnk = C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} - C:\Program Files\ShoppingReport\Bin\2.0.26\ShoppingReport.dll
O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\Program Files\ShoppingReport\Bin\2.0.26\ShoppingReport.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Acer Media Server - Acer Inc. - C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Acer TV-FM\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Acer TV-FM\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Acer TV-FM\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Trend Micro Protection Against Spyware (PcScnSrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
O23 - Service: Pml Driver HPZ12 - Unknown owner - C:\WINDOWS\system32\HPZipm12.exe (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

Comments

  • TroganTrogan London, UK
    edited January 2008
    Hi toofast4u, and welcome to Icrontic!

    There is a file that I would like scanned:
    • Go to VirusTotal
    • Copy and paste the following file path into the Search Box in the middle of the page:
    • C:\WINDOWS\system32\goxorb.exe
    • Now, click on the Send File button
    • Save a copy of the Anti-Virus results. Post the results in your next reply.
  • toofast4u
    edited January 2008
    Here is the results of that scan...

    File goxorb.exe received on 01.20.2008 01:11:58 (CET)
    Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED
    loader.gif
    Result: 18/32 (56.25%)

    Loading server information...
    Your file is queued in position: 4.
    Estimated start time is between 47 and 68 seconds.
    Do not close the window until scan is complete.
    The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.
    If you are waiting for more than five minutes you have to resend your file.
    Your file is being scanned by VirusTotal in this moment,
    results will be shown as they're generated.
    compress-icon.pngCompact
    [URL="javascript:window.print()"]Print results[/URL] print-icon.png

    Your file has expired or does not exists.
    Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time.
    You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished. Email:



    Antivirus Version Last Update Result AhnLab-V32008.1.19.102008.01.18-AntiVir7.6.0.482008.01.18WORM/Rbot.GenAuthentium4.93.82008.01.19-Avast4.7.1098.02008.01.19Win32:CiaDoor-ATAVG7.5.0.5162008.01.19BackDoor.RBotBitDefender7.22008.01.20DeepScan:Generic.Malware.G!SKI!!FLMWX!!Bg.025043F7CAT-QuickHeal9.002008.01.19Backdoor.SdBot.genClamAV0.91.22008.01.19PUA.Packed.ThemidaDrWeb4.44.0.091702008.01.19-eSafe7.0.15.02008.01.16-eTrust-Vet31.3.54702008.01.18-Ewido4.02008.01.19-FileAdvisor12008.01.20-Fortinet3.14.0.02008.01.19-F-Prot4.4.2.542008.01.19W32/Heuristic-162!EldoradoF-Secure6.70.13260.02008.01.19SDBot.gen8IkarusT3.1.1.202008.01.19Generic.SdbotKaspersky7.0.0.1252008.01.20-McAfee52112008.01.18-Microsoft1.31092008.01.20Backdoor:Win32/Sdbot.gen!ANOD32v228072008.01.19-Norman5.80.022008.01.18SDBot.gen8Panda9.0.0.42008.01.19W32/Rxbot.SV.wormPrevx1V22008.01.20LoveBoom:Worm-aRising20.27.50.002008.01.19-Sophos4.24.02008.01.19Sus/ComPackSunbelt2.2.907.02008.01.17VIPRE.SuspiciousSymantec102008.01.19W32.Spybot.WormTheHacker6.2.9.1912008.01.19W32/Behav-Heuristic-064VBA323.12.2.52008.01.19-VirusBuster4.3.26:92008.01.19-Webwasher-Gateway6.6.22008.01.18Worm.Rbot.Gen Additional information File size: 1303639 bytesMD5: edbf0fbfb97d669236b03dd7d1ba8efdSHA1: e1711e289802d499dec63f6c0b84c9566e0d7ed9PEiD: Themida/WinLicense V1.8.0.2 + -> Oreans Technologiespackers: ThemidaPrevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=65DF1C2457EA09C6E49B135305F161009A42E67DSunbelt info: VIPRE.Suspicious is a generic detection for potential threats that are deemed suspicious through heuristics.
  • TroganTrogan London, UK
    edited January 2008
    Since its been a week, can you post a new HijackThis log.

    Also, I need you to do the VirusTotal scan again. When the results show, copy and paste them into Notepad.

    Post the VirusTotal results, and a new HijackThis log please.
  • toofast4u
    edited January 2008
    Sorry it takes me so long to get back to you, I' m kind of a doe head...

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 5:56:43 PM, on 1/26/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16574)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
    C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
    C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
    C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\WINDOWS\sm56hlpr.exe
    C:\WINDOWS\system32\SysMonitor.exe
    C:\Program Files\Acer\Acer eMode Management\AspireService.exe
    C:\Program Files\Acer\Acer eConsole\MediaSync.exe
    C:\Program Files\Acer TV-FM\PCMService.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\Ahead\ODD Toolkit\DVDTray.exe
    C:\Program Files\dvd43\dvd43_tray.exe
    C:\WINDOWS\wt\updater\wcmdmgr.exe
    C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Acer TV-FM\Kernel\TV\CLCapSvc.exe
    C:\Program Files\Acer TV-FM\Kernel\CLML_NTService\CLMLServer.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
    C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\WINDOWS\system32\sistray.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
    C:\WINDOWS\system32\oodag.exe
    C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
    C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    C:\WINDOWS\system32\svchost.exe
    C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
    C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
    C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
    C:\Program Files\Acer TV-FM\Kernel\TV\CLSched.exe
    C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
    C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
    C:\WINDOWS\system32\wbem\wmiapsrv.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\PokerStars\PokerStars.exe
    C:\Program Files\Movie Label 2007\MovieLabel.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
    O4 - HKLM\..\Run: [LaunchApp] Alaunch
    O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
    O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
    O4 - HKLM\..\Run: [ntiMUI] c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
    O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
    O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\WINDOWS\system32\SysMonitor.exe
    O4 - HKLM\..\Run: [AspireService] C:\Program Files\Acer\Acer eMode Management\AspireService.exe
    O4 - HKLM\..\Run: [MediaSync] C:\Program Files\Acer\Acer eConsole\MediaSync.exe
    O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Acer TV-FM\PCMService.exe"
    O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [DVDTray] C:\Program Files\Ahead\ODD Toolkit\DVDTray.exe
    O4 - HKLM\..\Run: [wcmdmgr] C:\WINDOWS\wt\updater\wcmdmgrl.exe -launch
    O4 - HKLM\..\Run: [dvd43] C:\Program Files\dvd43\dvd43_tray.exe
    O4 - HKLM\..\Run: [Microsoft Update Machine] goxorb.exe
    O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe"
    O4 - HKLM\..\Run: [1194862116] C:\PROGRA~1\eGames\PUZZLE~3\Register\EGAMES~1.EXE /r "C:\PROGRA~1\eGames\PUZZLE~3\Register\EGAMES~1.rpd"
    O4 - HKLM\..\Run: [BMbb7fdfa3] Rundll32.exe "C:\WINDOWS\system32\facdofgd.dll",s
    O4 - HKLM\..\Run: [b84cec3f] rundll32.exe "C:\WINDOWS\system32\tfycebit.dll",b
    O4 - HKLM\..\RunServices: [Microsoft Update Machine] goxorb.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [Microsoft Update Machine] goxorb.exe
    O4 - HKCU\..\Run: [MsgCenterExe] "C:\Program Files\Common Files\Real\Update_OB\RealOneMessageCenter.exe" -osboot
    O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Acer Empowering Technology.lnk = ?
    O4 - Global Startup: Acer WLAN 11g USB Dongle.lnk = C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} - C:\Program Files\ShoppingReport\Bin\2.0.26\ShoppingReport.dll
    O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\Program Files\ShoppingReport\Bin\2.0.26\ShoppingReport.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O23 - Service: Acer Media Server - Acer Inc. - C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
    O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Acer TV-FM\Kernel\TV\CLCapSvc.exe
    O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Acer TV-FM\Kernel\TV\CLSched.exe
    O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Acer TV-FM\Kernel\CLML_NTService\CLMLServer.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
    O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
    O23 - Service: Trend Micro Protection Against Spyware (PcScnSrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
    O23 - Service: Pml Driver HPZ12 - Unknown owner - C:\WINDOWS\system32\HPZipm12.exe (file missing)
    O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
    O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
    O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
  • toofast4u
    edited January 2008
    Trogan: I tried to do that scan again, and it showed 0 bites sent so I checked to see if that file was still in the system32 folder and it seems to be gone now. My last post shows the new hijack log.
  • TroganTrogan London, UK
    edited January 2008
    Hi toofast4u,

    The file is there, but most likely hidden.

    Please do the following...

    1. Please download ComboFix to your Desktop.
    • Double click on Combofix.exe & follow the prompts.
    • When the scan has finished, it shall produce a log for you. Post that log in your next reply
    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall

    2. Post the ComboFix log back here, along with a new HijackThis log.
  • toofast4u
    edited January 2008
    Thank you for the quick response, here are the logs that you asked for..

    ComboFix 08-01-23.1C - Steve 2008-01-26 20:58:20.1 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.399 [GMT -8:00]
    Running from: C:\Documents and Settings\Steve\Desktop\ComboFix.exe
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\DOCUME~1\Steve\APPLIC~1\inst.exe
    C:\DOCUME~1\Steve\APPLIC~1\ShoppingReport\cs\Config.xml
    C:\DOCUME~1\Steve\APPLIC~1\ShoppingReport\cs\db\Aliases.dbs
    C:\DOCUME~1\Steve\APPLIC~1\ShoppingReport\cs\db\Sites.dbs
    C:\DOCUME~1\Steve\APPLIC~1\ShoppingReport\cs\dwld\WhiteList.xip
    C:\DOCUME~1\Steve\APPLIC~1\ShoppingReport\cs\report\aggr_storage.xml
    C:\DOCUME~1\Steve\APPLIC~1\ShoppingReport\cs\report\send_storage.xml
    C:\DOCUME~1\Steve\APPLIC~1\ShoppingReport\cs\res2\WhiteList.dbs
    C:\Documents and Settings\Steve\Application Data\inst.exe
    C:\Documents and Settings\Steve\Application Data\ShoppingReport
    C:\Documents and Settings\Steve\Application Data\ShoppingReport\cs\Config.xml
    C:\Documents and Settings\Steve\Application Data\ShoppingReport\cs\db\Aliases.dbs
    C:\Documents and Settings\Steve\Application Data\ShoppingReport\cs\db\Sites.dbs
    C:\Documents and Settings\Steve\Application Data\ShoppingReport\cs\dwld\WhiteList.xip
    C:\Documents and Settings\Steve\Application Data\ShoppingReport\cs\report\aggr_storage.xml
    C:\Documents and Settings\Steve\Application Data\ShoppingReport\cs\report\send_storage.xml
    C:\Documents and Settings\Steve\Application Data\ShoppingReport\cs\res2\WhiteList.dbs
    C:\Program Files\ShoppingReport
    C:\Program Files\ShoppingReport\Bin\2.0.26\ShoppingReport.dll
    C:\Program Files\ShoppingReport\Uninst.exe
    C:\WINDOWS\cookies.ini
    C:\WINDOWS\system32\akplqkwo.dll
    C:\WINDOWS\system32\arfmmoph.dll
    C:\WINDOWS\system32\bdfcebcd_r.dll
    C:\WINDOWS\system32\bnmfbxvy.dll
    C:\WINDOWS\system32\bqmtvhlo.dll
    C:\WINDOWS\system32\csdcmrdn.dll
    C:\WINDOWS\system32\dbjogxen.dll
    C:\WINDOWS\system32\etmkogsp.dll
    C:\WINDOWS\system32\facdofgd.dll
    C:\WINDOWS\system32\fbmnnsee.dll
    C:\WINDOWS\system32\fclfxfkv.ini
    C:\WINDOWS\system32\fivbwugy.dll
    C:\WINDOWS\system32\ftgdogtd.dll
    C:\WINDOWS\system32\gfhkj.ini
    C:\WINDOWS\system32\gfhkj.ini2
    C:\WINDOWS\system32\gjbklyqu.dll
    C:\WINDOWS\system32\jiadtqxb.dll
    C:\WINDOWS\system32\jkhfg.dll
    C:\WINDOWS\system32\jmncfekx.dll
    C:\WINDOWS\system32\kidfsoyr.dll
    C:\WINDOWS\system32\klkqquhk.dll
    C:\WINDOWS\system32\lhjsegja.dll
    C:\WINDOWS\system32\lidalwul.dll
    C:\WINDOWS\system32\loonpycx.dll
    C:\WINDOWS\system32\mcrh.tmp
    C:\WINDOWS\system32\mfqyxikg.dll
    C:\WINDOWS\system32\mgsfpqrg.dll
    C:\WINDOWS\system32\mrxgcuhw.dll
    C:\WINDOWS\system32\mvhajvsr.dll
    C:\WINDOWS\system32\nbbwyfim.dll
    C:\WINDOWS\system32\nbgdlnhw.dll
    C:\WINDOWS\system32\ophwvddx.dll
    C:\WINDOWS\system32\psgokmte.ini
    C:\WINDOWS\system32\puudfkbx.dll
    C:\WINDOWS\system32\pyddjjnk.dll
    C:\WINDOWS\system32\qbssdval.dll
    C:\WINDOWS\system32\qokyyqvt.dll
    C:\WINDOWS\system32\qwysawaw.dll
    C:\WINDOWS\system32\ricrpwyy.dll
    C:\WINDOWS\system32\rwtcuvqu.dll
    C:\WINDOWS\system32\tfycebit.dll
    C:\WINDOWS\system32\tibecyft.ini
    C:\WINDOWS\system32\twalqsei.dll
    C:\WINDOWS\system32\update\
    C:\WINDOWS\system32\uqvuctwr.ini
    C:\WINDOWS\system32\vitgxpqk.dll
    C:\WINDOWS\system32\vkfxflcf.dll
    C:\WINDOWS\system32\whucgxrm.ini
    C:\WINDOWS\system32\wovcoofa.dll
    C:\WINDOWS\system32\xddvwhpo.ini
    C:\WINDOWS\system32\xjdqfnnw.dll
    C:\WINDOWS\system32\xsixafcf.dll
    C:\WINDOWS\system32\yfeeqorh.dll
    C:\WINDOWS\system32\yrwkoiex.dll

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

    .
    \LEGACY_DOMAINSERVICE
    \DomainService


    ((((((((((((((((((((((((( Files Created from 2007-12-27 to 2008-01-27 )))))))))))))))))))))))))))))))
    .

    2008-01-26 20:56 . 2000-08-31 08:00 51,200 --a
    C:\WINDOWS\Nircmd.exe
    2008-01-26 19:28 . 2008-01-26 19:28 <DIR> d
    C:\temp\Movie Label 2008
    2008-01-26 18:51 . 2008-01-26 18:51 23 --a
    C:\WINDOWS\system32\fdbfaa5_r.ocx
    2008-01-26 18:50 . 2008-01-26 18:52 <DIR> d
    C:\Program Files\jv16 PowerTools 2007
    2008-01-25 06:27 . 2008-01-25 21:50 1,134,040 --ahs---- C:\WINDOWS\system32\ouffksam.ini
    2008-01-23 06:25 . 2008-01-24 06:25 1,123,003 --ahs---- C:\WINDOWS\system32\funcsvoe.ini
    2008-01-22 09:05 . 2008-01-22 06:15 1,091,720 --ahs---- C:\WINDOWS\system32\vukkowpg.ini
    2008-01-22 06:25 . 2008-01-22 06:25 1,091,780 --ahs---- C:\WINDOWS\system32\cfvrrvrs.ini
    2008-01-21 19:19 . 2008-01-21 19:50 <DIR> d
    C:\Program Files\eGames
    2008-01-21 19:19 . 2000-03-21 00:55 118,784 --a
    C:\WINDOWS\system32\vbalNCSM6.dll
    2008-01-21 19:19 . 1999-03-26 00:00 101,888 --a
    C:\WINDOWS\system32\Vb6stkit.dll
    2008-01-21 19:19 . 2000-07-17 14:41 70,088 --a
    C:\WINDOWS\system32\Project2-1.ocx
    2008-01-21 19:19 . 1999-02-19 08:54 40,960 --a
    C:\WINDOWS\system32\SSubTmr6.dll
    2008-01-21 19:19 . 2000-03-21 16:37 1,760 --a
    C:\WINDOWS\system32\objsafe.tlb
    2008-01-21 19:19 . 2000-04-06 15:58 1,453 --a
    C:\WINDOWS\system32\Project2.INF
    2008-01-18 09:05 . 2008-01-18 17:08 1,082,557 --ahs---- C:\WINDOWS\system32\kcplpioi.ini
    2008-01-16 09:05 . 2008-01-17 09:05 1,073,327 --ahs---- C:\WINDOWS\system32\spvgoqof.ini
    2008-01-14 01:48 . 2008-01-15 09:16 1,064,962 --ahs---- C:\WINDOWS\system32\erootbmh.ini
    2008-01-13 01:51 . 2008-01-14 01:48 1,056,916 --ahs---- C:\WINDOWS\system32\kdagbjuq.ini
    2008-01-11 01:46 . 2008-01-12 01:47 1,047,848 --ahs---- C:\WINDOWS\system32\icsstjcs.ini
    2008-01-11 01:43 . 2008-01-26 19:16 16,644 --a
    C:\WINDOWS\BMbb7fdfa3.xml
    2008-01-11 01:43 . 2008-01-26 20:58 21 --a
    C:\WINDOWS\pskt.ini
    2008-01-10 01:50 . 2008-01-11 01:47 1,049,683 --ahs---- C:\WINDOWS\system32\fbfiglwu.ini
    2008-01-09 03:04 . 2008-01-09 03:04 1,293 --a
    C:\WINDOWS\system32\MRT.INI
    2008-01-08 07:54 . 2008-01-08 01:48 1,055,382 --ahs---- C:\WINDOWS\system32\qnnokfrf.ini
    2008-01-08 01:48 . 2008-01-10 01:49 1,053,533 --ahs---- C:\WINDOWS\system32\mhnpqefk.ini
    2008-01-07 07:55 . 2008-01-07 17:34 1,044,275 --ahs---- C:\WINDOWS\system32\chpgjbtb.ini
    2008-01-06 07:55 . 2008-01-06 07:55 1,044,160 --ahs---- C:\WINDOWS\system32\xxeumoym.ini
    2008-01-05 07:52 . 2008-01-06 07:52 1,044,100 --ahs---- C:\WINDOWS\system32\rfpllsqn.ini
    2008-01-04 07:53 . 2008-01-04 15:58 1,043,980 --ahs---- C:\WINDOWS\system32\qexrnlln.ini
    2008-01-03 07:53 . 2008-01-03 17:50 1,036,232 --ahs---- C:\WINDOWS\system32\wodeopoy.ini
    2008-01-02 07:51 . 2008-01-02 07:51 1,027,137 --ahs---- C:\WINDOWS\system32\fdrllbgu.tmp
    2007-12-31 07:54 . 2008-01-01 16:22 1,027,137 --ahs---- C:\WINDOWS\system32\fdrllbgu.ini
    2007-12-30 07:51 . 2007-12-31 07:51 1,027,077 --ahs---- C:\WINDOWS\system32\uraskcid.ini
    2007-12-29 07:51 . 2007-12-29 07:51 1,027,017 --ahs---- C:\WINDOWS\system32\dakycsns.ini
    2007-12-28 07:51 . 2007-12-28 07:51 1,026,957 --ahs---- C:\WINDOWS\system32\lpsqwokp.ini
    2007-12-27 07:51 . 2007-12-27 07:51 1,025,488 --ahs---- C:\WINDOWS\system32\abcbgqdo.ini
    2007-12-27 00:54 . 2007-12-27 00:54 <DIR> d
    C:\Program Files\VSKey

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-01-27 03:04
    d
    w C:\Program Files\Movie Label 2007
    2008-01-26 11:32
    d
    w C:\Program Files\PokerStars
    2008-01-26 02:00
    d
    w C:\Program Files\Common Files\Symantec Shared
    2008-01-12 20:09
    d
    w C:\Program Files\Trend Micro
    2007-12-27 06:45 10,752 ----a-w C:\WINDOWS\DCEBoot.exe
    2007-12-18 18:04
    d
    w C:\Program Files\Common Files\Real
    2007-12-16 02:59
    d
    w C:\Program Files\uTorrent
    2007-12-07 14:12
    d
    w C:\Program Files\Real
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8CA5ED52-F3FB-4414-A105-2E3491156990}]
    2007-02-06 13:11 78848 --a
    C:\PROGRA~1\IWINGA~1\IWINGA~1.DLL

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 08:24 1694208]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 21:00 15360]
    "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-23 16:33 68856]
    "Microsoft Update Machine"="goxorb.exe" []

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "LaunchApp"="Alaunch" []
    "SoundMAXPnP"="C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 09:11 1388544]
    "SoundMAX"="C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" [2004-09-23 12:41 860160]
    "ntiMUI"="c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe" [2005-05-11 18:15 45056]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
    "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-03 21:00 208952]
    "MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-03 21:00 59392]
    "PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-03 21:00 455168]
    "PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-03 21:00 455168]
    "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 20:24 32768]
    "SiSPower"="SiSPower.dll" [2005-08-25 19:05 49152 C:\WINDOWS\system32\SiSPower.dll]
    "SMSERIAL"="sm56hlpr.exe" [2005-06-06 09:40 544768 C:\WINDOWS\sm56hlpr.exe]
    "Acer Empowering Technology Monitor"="C:\WINDOWS\system32\SysMonitor.exe" [2006-04-18 19:54 49152]
    "AspireService"="C:\Program Files\Acer\Acer eMode Management\AspireService.exe" [2006-06-09 12:24 110592]
    "MediaSync"="C:\Program Files\Acer\Acer eConsole\MediaSync.exe" [2006-05-04 14:55 425984]
    "PCMService"="C:\Program Files\Acer TV-FM\PCMService.exe" [2006-03-29 21:50 143360]
    "eRecoveryService"="C:\Acer\Empowering Technology\eRecovery\eRAgent.exe" [2006-06-01 14:40 413696]
    "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 02:41 49152]
    "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
    "DVDTray"="C:\Program Files\Ahead\ODD Toolkit\DVDTray.exe" [2004-09-03 00:58 65536]
    "wcmdmgr"="C:\WINDOWS\wt\updater\wcmdmgrl.exe" [2002-09-27 14:47 20480]
    "dvd43"="C:\Program Files\dvd43\dvd43_tray.exe" [2006-05-22 12:26 694272]
    "pccguide.exe"="C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe" [2007-03-07 22:19 3429904]
    "1194862116"="C:\PROGRA~1\eGames\PUZZLE~3\Register\EGAMES~1.exe" [2004-06-29 18:12 53322]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
    "Microsoft Update Machine"="goxorb.exe" []

    C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup\
    Acer Empowering Technology.lnk - C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe [2006-12-09 12:30:21 45056]
    Acer WLAN 11g USB Dongle.lnk - C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe [2005-11-16 19:25:14 745472]
    Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 04:44:06 29696]
    HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 04:21:22 288472]
    HP Photosmart Premier Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2006-02-10 07:56:20 73728]
    Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]
    Utility Tray.lnk - C:\WINDOWS\system32\sistray.exe [2006-12-09 12:35:11 262144]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ssqommm]
    ssqommm.dll

    R1 UBHelper;UBHelper;C:\WINDOWS\system32\drivers\UBHelper.sys [2004-12-17 17:14]
    R3 int15.sys;int15.sys;C:\Acer\Empowering Technology\eRecovery\int15.sys [2005-01-13 14:46]
    S3 ZD1211BU(ZyDAS);ZyDAS ZD1211B IEEE 802.11 b+g Wireless LAN Driver (USB)(ZyDAS);C:\WINDOWS\system32\DRIVERS\zd1211Bu.sys [2005-10-28 10:38]


    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{23559A9F-34FC-7AEC-0103-010100020305}]
    C:\WINDOWS\system32\Update.exe
    .
    **************************************************************************

    catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-01-26 21:41:00
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-01-26 21:44:28 - machine was rebooted
    ComboFix-quarantined-files.txt 2008-01-27 05:44:22
    .
    2008-01-09 11:04:08 --- E O F ---




    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 9:46:41 PM, on 1/26/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16574)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
    C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
    C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
    C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\WINDOWS\sm56hlpr.exe
    C:\WINDOWS\system32\SysMonitor.exe
    C:\Program Files\Acer\Acer eMode Management\AspireService.exe
    C:\Program Files\Acer\Acer eConsole\MediaSync.exe
    C:\Program Files\Acer TV-FM\PCMService.exe
    C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\Ahead\ODD Toolkit\DVDTray.exe
    C:\WINDOWS\wt\updater\wcmdmgr.exe
    C:\Program Files\dvd43\dvd43_tray.exe
    C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Program Files\Acer TV-FM\Kernel\TV\CLCapSvc.exe
    C:\Program Files\Acer TV-FM\Kernel\CLML_NTService\CLMLServer.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
    C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
    C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    C:\WINDOWS\system32\oodag.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\WINDOWS\system32\sistray.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
    C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
    C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    C:\WINDOWS\system32\svchost.exe
    C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
    C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
    C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
    C:\Program Files\Acer TV-FM\Kernel\TV\CLSched.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    C:\WINDOWS\system32\wbem\wmiapsrv.exe
    C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\system32\notepad.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: IEHlprObj Class - {8CA5ED52-F3FB-4414-A105-2E3491156990} - C:\PROGRA~1\IWINGA~1\IWINGA~1.DLL
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
    O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
    O4 - HKLM\..\Run: [LaunchApp] Alaunch
    O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
    O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
    O4 - HKLM\..\Run: [ntiMUI] c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
    O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
    O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\WINDOWS\system32\SysMonitor.exe
    O4 - HKLM\..\Run: [AspireService] C:\Program Files\Acer\Acer eMode Management\AspireService.exe
    O4 - HKLM\..\Run: [MediaSync] C:\Program Files\Acer\Acer eConsole\MediaSync.exe
    O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Acer TV-FM\PCMService.exe"
    O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [DVDTray] C:\Program Files\Ahead\ODD Toolkit\DVDTray.exe
    O4 - HKLM\..\Run: [wcmdmgr] C:\WINDOWS\wt\updater\wcmdmgrl.exe -launch
    O4 - HKLM\..\Run: [dvd43] C:\Program Files\dvd43\dvd43_tray.exe
    O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe"
    O4 - HKLM\..\Run: [1194862116] C:\PROGRA~1\eGames\PUZZLE~3\Register\EGAMES~1.EXE /r "C:\PROGRA~1\eGames\PUZZLE~3\Register\EGAMES~1.rpd"
    O4 - HKLM\..\RunServices: [Microsoft Update Machine] goxorb.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [Microsoft Update Machine] goxorb.exe
    O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Acer Empowering Technology.lnk = ?
    O4 - Global Startup: Acer WLAN 11g USB Dongle.lnk = C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O20 - Winlogon Notify: ssqommm - ssqommm.dll (file missing)
    O23 - Service: Acer Media Server - Acer Inc. - C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
    O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Acer TV-FM\Kernel\TV\CLCapSvc.exe
    O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Acer TV-FM\Kernel\TV\CLSched.exe
    O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Acer TV-FM\Kernel\CLML_NTService\CLMLServer.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
    O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
    O23 - Service: Trend Micro Protection Against Spyware (PcScnSrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
    O23 - Service: Pml Driver HPZ12 - Unknown owner - C:\WINDOWS\system32\HPZipm12.exe (file missing)
    O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
    O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
    O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
  • TroganTrogan London, UK
    edited January 2008
    Hi toofast4u,

    Please do the following...

    1. Open HijackThis
    - Click the Do a system scan only button
    - Check the following entries (below)

    O2 - BHO: IEHlprObj Class - {8CA5ED52-F3FB-4414-A105-2E3491156990} - C:\PROGRA~1\IWINGA~1\IWINGA~1.DLL

    O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)

    O4 - HKLM\..\RunServices: [Microsoft Update Machine] goxorb.exe
    O4 - HKCU\..\Run: [Microsoft Update Machine] goxorb.exe

    O20 - Winlogon Notify: ssqommm - ssqommm.dll (file missing)

    - Close ALL open windows (especially Internet Explorer!)
    - Click Fix Checked
    Close HiajckThis

    2. Open Notepad and copy/paste the text in the Quote Box below into it:
    File::
    C:\WINDOWS\system32\goxorb.exe
    C:\WINDOWS\system32\ouffksam.ini
    C:\WINDOWS\system32\funcsvoe.ini
    C:\WINDOWS\system32\vukkowpg.ini
    C:\WINDOWS\system32\cfvrrvrs.ini
    C:\WINDOWS\system32\kcplpioi.ini
    C:\WINDOWS\system32\spvgoqof.ini
    C:\WINDOWS\system32\erootbmh.ini
    C:\WINDOWS\system32\kdagbjuq.ini
    C:\WINDOWS\system32\icsstjcs.ini
    C:\WINDOWS\system32\qnnokfrf.ini
    C:\WINDOWS\system32\mhnpqefk.ini
    C:\WINDOWS\system32\chpgjbtb.ini
    C:\WINDOWS\system32\xxeumoym.ini
    C:\WINDOWS\system32\rfpllsqn.ini
    C:\WINDOWS\system32\qexrnlln.ini
    C:\WINDOWS\system32\wodeopoy.ini
    C:\WINDOWS\system32\fdrllbgu.tmp
    C:\WINDOWS\system32\fdrllbgu.ini
    C:\WINDOWS\system32\uraskcid.ini
    C:\WINDOWS\system32\dakycsns.ini
    C:\WINDOWS\system32\lpsqwokp.ini
    C:\WINDOWS\system32\abcbgqdo.ini

    Folder::
    C:\PROGRA~1\IWINGA~1

    Save this as CFScript.txt to your Desktop

    CFScript.gif

    Referring to the picture above, drag CFScript.txt into ComboFix.exe

    This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.
  • toofast4u
    edited January 2008
    The new log files you requested..

    ComboFix 08-01-23.1C - Steve 2008-01-28 15:54:31.1 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.319 [GMT -8:00]
    Running from: C:\Documents and Settings\Steve\Desktop\virus tools\ComboFix.exe
    Command switches used :: C:\Documents and Settings\Steve\Desktop\virus tools\CFScript.txt
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

    FILE
    C:\WINDOWS\system32\abcbgqdo.ini
    C:\WINDOWS\system32\cfvrrvrs.ini
    C:\WINDOWS\system32\chpgjbtb.ini
    C:\WINDOWS\system32\dakycsns.ini
    C:\WINDOWS\system32\erootbmh.ini
    C:\WINDOWS\system32\fdrllbgu.ini
    C:\WINDOWS\system32\fdrllbgu.tmp
    C:\WINDOWS\system32\funcsvoe.ini
    C:\WINDOWS\system32\goxorb.exe
    C:\WINDOWS\system32\icsstjcs.ini
    C:\WINDOWS\system32\kcplpioi.ini
    C:\WINDOWS\system32\kdagbjuq.ini
    C:\WINDOWS\system32\lpsqwokp.ini
    C:\WINDOWS\system32\mhnpqefk.ini
    C:\WINDOWS\system32\ouffksam.ini
    C:\WINDOWS\system32\qexrnlln.ini
    C:\WINDOWS\system32\qnnokfrf.ini
    C:\WINDOWS\system32\rfpllsqn.ini
    C:\WINDOWS\system32\spvgoqof.ini
    C:\WINDOWS\system32\uraskcid.ini
    C:\WINDOWS\system32\vukkowpg.ini
    C:\WINDOWS\system32\wodeopoy.ini
    C:\WINDOWS\system32\xxeumoym.ini
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft\Network\Downloader\qmgr0.dat
    C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft\Network\Downloader\qmgr1.dat
    C:\PROGRA~1\IWINGA~1
    C:\PROGRA~1\IWINGA~1\AdminWorker.exe
    C:\PROGRA~1\IWINGA~1\firefox\chrome.manifest
    C:\PROGRA~1\IWINGA~1\firefox\chrome\iwinarcade.jar
    C:\PROGRA~1\IWINGA~1\firefox\install.rdf
    C:\PROGRA~1\IWINGA~1\firefox\iWinArcadeLauncher.exe
    C:\PROGRA~1\IWINGA~1\ftdownload.dat
    C:\PROGRA~1\IWINGA~1\host.cfg
    C:\PROGRA~1\IWINGA~1\iWinGames.exe
    C:\PROGRA~1\IWINGA~1\pages\blank.html
    C:\PROGRA~1\IWINGA~1\pages\blank2.html
    C:\PROGRA~1\IWINGA~1\pages\error.html
    C:\PROGRA~1\IWINGA~1\pages\iwin_logo.gif
    C:\PROGRA~1\IWINGA~1\sounds\animation.wav
    C:\PROGRA~1\IWINGA~1\sounds\animationBack.wav
    C:\PROGRA~1\IWINGA~1\sounds\button_click.wav
    C:\PROGRA~1\IWINGA~1\sounds\download_completed.wav
    C:\PROGRA~1\IWINGA~1\sounds\start.wav
    C:\PROGRA~1\IWINGA~1\Uninstall.exe
    C:\PROGRA~1\IWINGA~1\WebInstaller.exe
    C:\PROGRA~1\IWINGA~1\WebUpdater.bmp
    C:\PROGRA~1\IWINGA~1\WebUpdater.exe
    C:\WINDOWS\system32\abcbgqdo.ini
    C:\WINDOWS\system32\cfvrrvrs.ini
    C:\WINDOWS\system32\chpgjbtb.ini
    C:\WINDOWS\system32\dakycsns.ini
    C:\WINDOWS\system32\erootbmh.ini
    C:\WINDOWS\system32\fdrllbgu.ini
    C:\WINDOWS\system32\fdrllbgu.tmp
    C:\WINDOWS\system32\funcsvoe.ini
    C:\WINDOWS\system32\icsstjcs.ini
    C:\WINDOWS\system32\kcplpioi.ini
    C:\WINDOWS\system32\kdagbjuq.ini
    C:\WINDOWS\system32\lpsqwokp.ini
    C:\WINDOWS\system32\mhnpqefk.ini
    C:\WINDOWS\system32\ouffksam.ini
    C:\WINDOWS\system32\qexrnlln.ini
    C:\WINDOWS\system32\qnnokfrf.ini
    C:\WINDOWS\system32\rfpllsqn.ini
    C:\WINDOWS\system32\spvgoqof.ini
    C:\WINDOWS\system32\update\
    C:\WINDOWS\system32\uraskcid.ini
    C:\WINDOWS\system32\vukkowpg.ini
    C:\WINDOWS\system32\wodeopoy.ini
    C:\WINDOWS\system32\xxeumoym.ini
    BITS: Possible infected sites

    hxxp://store.urge.com
    .
    ((((((((((((((((((((((((( Files Created from 2007-12-28 to 2008-01-28 )))))))))))))))))))))))))))))))
    .

    2008-01-26 20:56 . 2000-08-31 08:00 51,200 --a
    C:\WINDOWS\Nircmd.exe
    2008-01-26 19:28 . 2008-01-26 19:28 <DIR> d
    C:\temp\Movie Label 2008
    2008-01-26 18:51 . 2008-01-26 18:51 23 --a
    C:\WINDOWS\system32\fdbfaa5_r.ocx
    2008-01-26 18:50 . 2008-01-26 18:52 <DIR> d
    C:\Program Files\jv16 PowerTools 2007
    2008-01-21 19:19 . 2008-01-21 19:50 <DIR> d
    C:\Program Files\eGames
    2008-01-21 19:19 . 2000-03-21 00:55 118,784 --a
    C:\WINDOWS\system32\vbalNCSM6.dll
    2008-01-21 19:19 . 1999-03-26 00:00 101,888 --a
    C:\WINDOWS\system32\Vb6stkit.dll
    2008-01-21 19:19 . 2000-07-17 14:41 70,088 --a
    C:\WINDOWS\system32\Project2-1.ocx
    2008-01-21 19:19 . 1999-02-19 08:54 40,960 --a
    C:\WINDOWS\system32\SSubTmr6.dll
    2008-01-21 19:19 . 2000-03-21 16:37 1,760 --a
    C:\WINDOWS\system32\objsafe.tlb
    2008-01-21 19:19 . 2000-04-06 15:58 1,453 --a
    C:\WINDOWS\system32\Project2.INF
    2008-01-11 01:43 . 2008-01-26 19:16 16,644 --a
    C:\WINDOWS\BMbb7fdfa3.xml
    2008-01-11 01:43 . 2008-01-26 20:58 21 --a
    C:\WINDOWS\pskt.ini
    2008-01-10 01:50 . 2008-01-11 01:47 1,049,683 --ahs---- C:\WINDOWS\system32\fbfiglwu.ini
    2008-01-09 03:04 . 2008-01-09 03:04 1,293 --a
    C:\WINDOWS\system32\MRT.INI

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-01-28 08:23
    d
    w C:\Program Files\PokerStars
    2008-01-27 03:04
    d
    w C:\Program Files\Movie Label 2007
    2008-01-26 02:00
    d
    w C:\Program Files\Common Files\Symantec Shared
    2008-01-12 20:09
    d
    w C:\Program Files\Trend Micro
    2007-12-27 08:54
    d
    w C:\Program Files\VSKey
    2007-12-27 06:45 10,752 ----a-w C:\WINDOWS\DCEBoot.exe
    2007-12-20 15:50 85,568 ----a-w C:\WINDOWS\system32\vctacbnf.dll
    2007-12-18 18:04
    d
    w C:\Program Files\Common Files\Real
    2007-12-17 15:05 85,568 ----a-w C:\WINDOWS\system32\qcdqcwpj.dll
    2007-12-16 02:59
    d
    w C:\Program Files\uTorrent
    2007-12-07 14:12
    d
    w C:\Program Files\Real
    2007-11-07 09:26 721,920 ----a-w C:\WINDOWS\system32\lsasrv.dll
    2007-11-07 09:26 721,920 ----a-w C:\WINDOWS\system32\dllcache\lsasrv.dll
    2007-10-30 23:42 3,590,656 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
    2007-10-30 17:20 360,064 ----a-w C:\WINDOWS\system32\dllcache\tcpip.sys
    2007-10-29 22:43 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
    2007-10-29 22:43 1,287,680 ----a-w C:\WINDOWS\system32\dllcache\quartz.dll
    2007-10-28 01:40 222,720 ----a-w C:\WINDOWS\system32\wmasf.dll
    2007-10-28 01:40 222,720 ----a-w C:\WINDOWS\system32\dllcache\wmasf.dll
    2006-02-19 11:28 12,288 -c--a-w C:\WINDOWS\Fonts\RandFont.dll
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))




    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 4:02:12 PM, on 1/28/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16574)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
    C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
    C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
    C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\WINDOWS\sm56hlpr.exe
    C:\WINDOWS\system32\SysMonitor.exe
    C:\Program Files\Acer\Acer eMode Management\AspireService.exe
    C:\Program Files\Acer\Acer eConsole\MediaSync.exe
    C:\Program Files\Acer TV-FM\PCMService.exe
    C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\Ahead\ODD Toolkit\DVDTray.exe
    C:\WINDOWS\wt\updater\wcmdmgr.exe
    C:\Program Files\dvd43\dvd43_tray.exe
    C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Program Files\Acer TV-FM\Kernel\TV\CLCapSvc.exe
    C:\Program Files\Acer TV-FM\Kernel\CLML_NTService\CLMLServer.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
    C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
    C:\WINDOWS\system32\oodag.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\WINDOWS\system32\sistray.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
    C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
    C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    C:\WINDOWS\system32\svchost.exe
    C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
    C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
    C:\Program Files\Acer TV-FM\Kernel\TV\CLSched.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    C:\WINDOWS\system32\wbem\wmiapsrv.exe
    C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
    C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINDOWS\explorer.exe
    C:\WINDOWS\system32\notepad.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
    O4 - HKLM\..\Run: [LaunchApp] Alaunch
    O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
    O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
    O4 - HKLM\..\Run: [ntiMUI] c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
    O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
    O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\WINDOWS\system32\SysMonitor.exe
    O4 - HKLM\..\Run: [AspireService] C:\Program Files\Acer\Acer eMode Management\AspireService.exe
    O4 - HKLM\..\Run: [MediaSync] C:\Program Files\Acer\Acer eConsole\MediaSync.exe
    O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Acer TV-FM\PCMService.exe"
    O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [DVDTray] C:\Program Files\Ahead\ODD Toolkit\DVDTray.exe
    O4 - HKLM\..\Run: [wcmdmgr] C:\WINDOWS\wt\updater\wcmdmgrl.exe -launch
    O4 - HKLM\..\Run: [dvd43] C:\Program Files\dvd43\dvd43_tray.exe
    O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe"
    O4 - HKLM\..\Run: [1194862116] C:\PROGRA~1\eGames\PUZZLE~3\Register\EGAMES~1.EXE /r "C:\PROGRA~1\eGames\PUZZLE~3\Register\EGAMES~1.rpd"
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Acer Empowering Technology.lnk = ?
    O4 - Global Startup: Acer WLAN 11g USB Dongle.lnk = C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O23 - Service: Acer Media Server - Acer Inc. - C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
    O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Acer TV-FM\Kernel\TV\CLCapSvc.exe
    O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Acer TV-FM\Kernel\TV\CLSched.exe
    O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Acer TV-FM\Kernel\CLML_NTService\CLMLServer.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
    O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
    O23 - Service: Trend Micro Protection Against Spyware (PcScnSrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
    O23 - Service: Pml Driver HPZ12 - Unknown owner - C:\WINDOWS\system32\HPZipm12.exe (file missing)
    O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
    O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
    O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

    --
    End of file - 9769 bytes
  • TroganTrogan London, UK
    edited January 2008
    ComboFix log is incomplete, but don't worry about it. Things are looking better...

    Please do an online scan with Kaspersky WebScanner

    Click on Kaspersky Online Scanner

    You will be promted to install an ActiveX component from Kaspersky, Click Yes.

    Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%.
    • The program will launch and then begin downloading the latest definition files:
    • Once the files have been downloaded click on NEXT
    • Now click on Scan Settings
    • In the scan settings make that the following are selected:
      • Scan using the following Anti-Virus database:
        Extended (if available otherwise Standard)
      • Scan Options:
        Scan Archives
        Scan Mail Bases
        [*]Click OK
        [*]Now under select a target to scan:
          Select
        My Computer
        [*]This will program will start and scan your system.
        [*]The scan will take a while so be patient and let it run.
        [*]Once the scan is complete it will display if your system has been infected.
        • Now click on the Save as Text button:
        [*]Save the file to your desktop.
        Please post the Kasperksy report back here.
      • TroganTrogan London, UK
        edited February 2008
        Hi,

        Do you still require help?
      • TroganTrogan London, UK
        edited March 2008
        This topic is now closed due to inactivity. If you wish to reopen your topic, please send a Private Message (PM) to Trogan with a link to your thread.

        If it has been 10 days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, this topic will not be reopened. If you still require help, please start a new topic and include a fresh HijackThis log and a link to this thread in your new topic.

        If you are not the user who started this thread, you must start your own Thread instead (grin)
      Sign In or Register to comment.