Trojan.Vundo detected

Bob39Bob39
edited September 2008 in Spyware & Virus Removal
Hello

I recently ran a scan with bitdefender on my computer, and it detected 'Trojan.Vundo' on my computer. It told me that the trojan had been blocked and that it can't affect my computer, but i highly doubt that. so i posted a Hijack This log to hope that you guys can help me out.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:49:55 PM, on 13/09/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\D-Link\Wireless G WDA-1320\AirGCFG.exe
C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
C:\Program Files\Pure Networks\Network Magic\nmapp.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\lxbtcoms.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\BitDefender\BitDefender 2009\seccenter.exe
C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
C:\Program Files\BitDefender\BitDefender 2009\uiscan.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [D-Link Wireless G WDA-1320] C:\Program Files\D-Link\Wireless G WDA-1320\AirGCFG.exe
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [LXBTCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBTtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [nmctxth] "C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe"
O4 - HKLM\..\Run: [nmapp] "C:\Program Files\Pure Networks\Network Magic\nmapp.exe" -autorun -nosplash
O4 - HKLM\..\Run: [b88c8e15] rundll32.exe "C:\WINDOWS\system32\nxemytiq.dll",b
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe"
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe"
O4 - HKLM\..\Run: [BMbbbfbd89] Rundll32.exe "C:\WINDOWS\system32\ajsbtqgd.dll",s
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Eraser RiskMonitor] "C:\Program Files\East-Tec Eraser 2008\Launch.exe" "C:\Program Files\East-Tec Eraser 2008\etRiskMon.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - AppInit_DLLs: dqaxkx.dll
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Wireless Service - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: BitDefender Arrakis Server (Arrakis3) - BitDefender S.R.L. http://www.bitdefender.com - C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Jumpstart Wifi Protected Setup (jswpsapi) - Atheros Communications, Inc. - C:\Program Files\D-Link\Wireless G WDA-1320\JSWUtil\jswpsapi.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
O23 - Service: lxbt_device - - C:\WINDOWS\system32\lxbtcoms.exe
O23 - Service: Pure Networks Net2Go Service (nmraapache) - Pure Networks, Inc. - C:\Program Files\Pure Networks\Network Magic\WebServer\bin\nmraapache.exe
O23 - Service: Pure Networks Platform Service (nmservice) - Pure Networks, Inc. - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S. R. L. - C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe

--
End of file - 6227 bytes


Thanks

Comments

  • chiazchiaz
    edited September 2008
    Hello Bob. :)

    Please download Malwarebytes' Anti-Malware by clicking the link below:
    http://www.besttechie.net/tools/mbam-setup.exe

    Double Click mbam-setup.exe to install the application.

    * Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
    * If an update is found, it will download and install the latest version.
    * Once the program has loaded, select "Perform Quick Scan", then click Scan.
    * The scan may take some time to finish,so please be patient.
    * When the scan is complete, click OK, then Show Results to view the results.
    * Make sure that everything is checked, and click Remove Selected.
    * When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
    * The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
    * You'll be required to post the contents of this log later.

    Please Note:
    If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.


    ==============================================


    Ok. Let's have you download ComboFix.exe. This will give me a better view to the files running and also hidden on your computer and also those in the registry..Please visit this webpage for downloading and instructions for running the tool:

    Go here ======> A guide and tutorial on using ComboFix <====== Go here

    Please ensure you read this guide carefully and install the Recovery Console first.This applies to XP Pro and XP Home users only.If you have SP3 installed you will need to use SP2

    The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

    Once installed, you should get a prompt that says:

    The Recovery Console was successfully installed.

    Please continue as follows:

    (1) Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    (2) Click Yes to allow ComboFix to continue scanning for malware.

    When the tool is finished, it will produce a report for you.

    Please include the following reports for further review (copy and paste them, not attach), so that we may continue cleansing the system:

    MBAM log
    C:\ComboFix.txt
    New HijackThis log

    Caution: Never run and remove files with Combofix unless supervised by a qualified security analyst who is experienced in the use of Combofix. Misuse can cause serious computer problems.
  • Bob39Bob39
    edited September 2008
    Hello Chiaz

    I ran a scan with Malwarebytes' Anti-Malware and it worked properly. Then I downloaded ComboFix and recovery Console according to the tutorial. however, Combofix didn't ask me to start a scan. So i just ran a scan with Combo Fix, and I think it worked. Here are the results form Malwarebytes' Anti-Malware and ComboFix.

    Malwarebytes' Anti-Malware

    Malwarebytes' Anti-Malware 1.28
    Database version: 1171
    Windows 5.1.2600 Service Pack 2

    18/09/2008 7:41:20 PM
    mbam-log-2008-09-18 (19-41-20).txt

    Scan type: Quick Scan
    Objects scanned: 43451
    Time elapsed: 2 minute(s), 11 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 3
    Registry Keys Infected: 16
    Registry Values Infected: 2
    Registry Data Items Infected: 2
    Folders Infected: 0
    Files Infected: 13

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    C:\WINDOWS\system32\nxemytiq.dll (Trojan.Vundo.H) -> Delete on reboot.
    C:\WINDOWS\system32\wvUKAPHa.dll (Trojan.Vundo.H) -> Delete on reboot.
    C:\WINDOWS\system32\dqaxkx.dll (Trojan.Vundo) -> Delete on reboot.

    Registry Keys Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{33bda384-d439-43c5-9895-0c54ff948c0c} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{33bda384-d439-43c5-9895-0c54ff948c0c} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{35cfe9b1-81c2-4d01-a350-a759292ad7fc} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\nnndwpfv (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{35cfe9b1-81c2-4d01-a350-a759292ad7fc} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5671a873-17e1-4bd0-8297-de1256febf04} (Trojan.Vundo.H) -> Delete on reboot.
    HKEY_CLASSES_ROOT\CLSID\{5671a873-17e1-4bd0-8297-de1256febf04} (Trojan.Vundo.H) -> Delete on reboot.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IProxyProvider (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Trojan.Vundo) -> Quarantined and deleted successfully.

    Registry Values Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b88c8e15 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bmbbbfbd89 (Trojan.Agent) -> Quarantined and deleted successfully.

    Registry Data Items Infected:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\wvukapha -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\wvukapha -> Quarantined and deleted successfully.

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    C:\WINDOWS\system32\dqaxkx.dll (Trojan.Vundo.H) -> Delete on reboot.
    C:\WINDOWS\system32\nnNDWPFv.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\wvUKAPHa.dll (Trojan.Vundo.H) -> Delete on reboot.
    C:\WINDOWS\system32\aHPAKUvw.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\aHPAKUvw.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\nxemytiq.dll (Trojan.Vundo.H) -> Delete on reboot.
    C:\WINDOWS\system32\qitymexn.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\spnfpyns.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\mcrh.tmp (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\cookies.ini (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\pskt.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\WINDOWS\BMbbbfbd89.xml (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\WINDOWS\BMbbbfbd89.txt (Trojan.Vundo) -> Quarantined and deleted successfully.


    ComboFix


    ComboFix 08-09-19.12 - Goraya Family 2008-09-20 13:49:45.1 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1435 [GMT -4:00]
    Running from: C:\Documents and Settings\Goraya Family\Desktop\ComboFix.exe
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Documents and Settings\Goraya Family\Application Data\inst.exe

    .
    ((((((((((((((((((((((((( Files Created from 2008-08-20 to 2008-09-20 )))))))))))))))))))))))))))))))
    .

    2008-09-18 19:18 . 2008-09-18 19:20 <DIR> d
    C:\Program Files\Malwarebytes' Anti-Malware
    2008-09-18 19:18 . 2008-09-18 19:18 <DIR> d
    C:\Documents and Settings\Goraya Family\Application Data\Malwarebytes
    2008-09-18 19:18 . 2008-09-18 19:18 <DIR> d
    C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-09-18 19:18 . 2008-09-10 00:04 38,528 --a
    C:\WINDOWS\system32\drivers\mbamswissarmy.sys
    2008-09-18 19:18 . 2008-09-10 00:03 17,200 --a
    C:\WINDOWS\system32\drivers\mbam.sys
    2008-09-15 00:44 . 2008-09-15 00:44 17,312 --ah
    C:\WINDOWS\system32\mlfcache.dat
    2008-09-14 18:06 . 2008-09-14 18:06 850 --a
    C:\WINDOWS\system32\ProductTweaks.xml
    2008-09-14 18:06 . 2008-09-14 18:06 385 --a
    C:\WINDOWS\system32\user_gensett.xml
    2008-09-13 18:54 . 2008-09-13 18:58 <DIR> d
    C:\Documents and Settings\All Users\Application Data\WinZip
    2008-09-13 18:48 . 2008-09-20 13:27 <DIR> d
    C:\Documents and Settings\Goraya Family\Application Data\VMware
    2008-09-13 18:48 . 2008-09-20 13:27 7 --a
    C:\WINDOWS\system32\ANIWZCSUSERNAME
    2008-09-13 18:45 . 2008-09-20 12:11 <DIR> d
    C:\Documents and Settings\LocalService\Application Data\VMware
    2008-09-13 18:44 . 2008-05-16 00:51 436,784 --a
    C:\WINDOWS\system32\vnetlib.dll
    2008-09-13 18:44 . 2008-05-16 00:51 150,064 --a
    C:\WINDOWS\system32\vmnat.exe
    2008-09-13 18:44 . 2008-05-16 00:51 121,392 --a
    C:\WINDOWS\system32\vmnetdhcp.exe
    2008-09-13 18:44 . 2008-05-16 00:51 50,992 -ra
    C:\WINDOWS\system32\vmnetbridge.dll
    2008-09-13 18:44 . 2008-05-16 00:51 28,592 -ra
    C:\WINDOWS\system32\drivers\vmnetbridge.sys
    2008-09-13 18:44 . 2008-05-16 00:52 25,136 --a
    C:\WINDOWS\system32\drivers\vmnetuserif.sys
    2008-09-13 18:44 . 2008-05-16 00:51 17,712 -ra
    C:\WINDOWS\system32\drivers\vmnet.sys
    2008-09-13 18:44 . 2008-05-16 00:51 16,816 -ra
    C:\WINDOWS\system32\drivers\vmnetadapter.sys
    2008-09-13 18:44 . 2008-05-16 00:51 13,104 -ra
    C:\WINDOWS\system32\vnetinst.dll
    2008-09-13 18:43 . 2008-05-16 00:52 20,912 --a
    C:\WINDOWS\system32\drivers\VMkbd.sys
    2008-09-13 18:43 . 2008-09-13 18:43 1,024 --a
    C:\.rnd
    2008-09-13 18:42 . 2008-09-20 12:11 <DIR> d
    C:\Documents and Settings\All Users\Application Data\VMware
    2008-09-13 18:41 . 2008-09-13 18:41 <DIR> d
    C:\Program Files\VMware
    2008-09-13 18:41 . 2008-09-13 18:41 <DIR> d
    C:\Program Files\Common Files\VMware
    2008-09-13 18:34 . 2008-09-13 18:37 <DIR> d
    C:\Documents and Settings\Goraya Family\Application Data\Corel
    2008-09-13 18:34 . 2008-09-13 18:37 2,516 --ahs---- C:\Documents and Settings\All Users\Application Data\KGyGaAvL.sys
    2008-09-13 18:34 . 2008-09-13 18:34 8 -r-hs---- C:\Documents and Settings\All Users\Application Data\4F4C82D358.sys
    2008-09-13 17:57 . 2008-09-13 17:57 <DIR> d
    C:\Program Files\Common Files\Protexis
    2008-09-13 17:56 . 2008-09-13 17:56 506 --a
    C:\WINDOWS\system32\mapisvc.inf
    2008-09-13 17:55 . 2008-09-13 17:56 <DIR> d
    C:\WINDOWS\ShellNew
    2008-09-13 17:55 . 2008-09-13 18:00 <DIR> d
    C:\Documents and Settings\All Users\Application Data\Corel
    2008-09-13 17:54 . 2008-09-13 17:54 <DIR> d
    C:\Program Files\Common Files\Borland Shared
    2008-09-13 17:54 . 2008-09-13 17:55 <DIR> d
    C:\Documents and Settings\All Users\Application Data\Borland
    2008-09-13 17:53 . 2008-09-13 17:54 <DIR> d
    C:\Program Files\Common Files\Corel
    2008-09-13 17:52 . 2008-09-13 17:59 <DIR> d
    C:\Program Files\Corel
    2008-09-13 16:49 . 2008-09-13 16:49 <DIR> d
    C:\Program Files\Trend Micro
    2008-09-13 16:46 . 2008-09-13 16:46 <DIR> d
    C:\Documents and Settings\Administrator
    2008-09-13 16:33 . 2008-09-13 16:33 <DIR> d
    C:\WINDOWS\system32\logs
    2008-09-13 16:32 . 2008-09-13 16:41 <DIR> d
    C:\Program Files\BitDefender
    2008-09-13 16:32 . 2008-09-13 16:32 <DIR> d
    C:\Documents and Settings\Goraya Family\Application Data\BitDefender
    2008-09-13 16:32 . 2008-09-13 16:39 <DIR> d
    C:\Documents and Settings\All Users\Application Data\BitDefender
    2008-09-13 16:32 . 2008-09-13 16:32 <DIR> d
    C:\Binaries
    2008-09-13 16:30 . 2008-09-13 16:30 <DIR> d
    C:\WINDOWS\system32\URTTemp
    2008-09-13 16:29 . 2008-09-13 16:32 <DIR> d
    C:\Program Files\Common Files\BitDefender
    2008-09-13 16:20 . 2008-09-13 16:20 <DIR> d---s---- C:\Documents and Settings\Goraya Family\UserData
    2008-09-13 16:07 . 2008-09-13 16:07 <DIR> d
    C:\Program Files\PowerISO
    2008-09-13 16:04 . 2008-09-13 16:04 <DIR> d
    C:\Documents and Settings\All Users\Application Data\LightScribe
    2008-09-13 15:40 . 2008-09-13 15:40 <DIR> d
    C:\Program Files\Windows Media Connect 2
    2008-09-13 15:37 . 2008-09-15 00:46 <DIR> d
    C:\WINDOWS\system32\LogFiles
    2008-09-13 15:37 . 2008-09-13 15:38 <DIR> d
    C:\WINDOWS\system32\drivers\UMDF
    2008-09-13 15:36 . 2008-09-13 15:37 <DIR> d
    C:\Program Files\iTunes
    2008-09-13 15:36 . 2008-09-13 15:36 <DIR> d
    C:\Program Files\iPod
    2008-09-13 15:36 . 2008-09-13 15:37 <DIR> d
    C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
    2008-09-13 15:35 . 2008-09-13 15:35 <DIR> d
    C:\Program Files\Bonjour
    2008-09-13 15:33 . 2008-09-13 15:34 <DIR> d
    C:\Program Files\QuickTime
    2008-09-13 15:29 . 2008-09-13 15:29 <DIR> d
    C:\Program Files\Microsoft Silverlight
    2008-09-13 15:27 . 2008-09-13 15:27 <DIR> d
    C:\Program Files\uTorrent
    2008-09-13 15:27 . 2008-09-13 15:29 <DIR> d
    C:\Documents and Settings\Goraya Family\Application Data\uTorrent
    2008-09-13 15:23 . 2008-09-13 15:23 <DIR> d
    C:\Program Files\Strong DC++
    2008-09-13 15:20 . 2008-09-13 15:21 <DIR> d
    C:\Program Files\Magic Video Converter
    2008-09-13 15:20 . 2004-05-26 21:37 719,872 --a
    C:\WINDOWS\system32\devil.dll
    2008-09-13 15:20 . 2006-09-16 19:44 314,368 --a
    C:\WINDOWS\system32\avisynth.dll
    2008-09-13 15:20 . 2008-09-13 15:20 81,920 --a
    C:\Documents and Settings\Goraya Family\Application Data\ezpinst.exe
    2008-09-13 15:17 . 2008-09-13 15:17 <DIR> d
    C:\Program Files\Safari
    2008-09-13 15:11 . 2008-09-13 16:51 <DIR> d
    C:\Documents and Settings\Goraya Family\Application Data\Apple Computer
    2008-09-13 15:09 . 2008-09-13 16:03 <DIR> d
    C:\Program Files\Apple Software Update
    2008-09-13 15:09 . 2008-09-13 15:11 <DIR> d
    C:\Documents and Settings\All Users\Application Data\Apple Computer
    2008-09-13 15:08 . 2008-09-13 15:08 <DIR> d
    C:\Program Files\Common Files\Apple
    2008-09-13 15:08 . 2008-09-13 15:08 <DIR> d
    C:\Documents and Settings\All Users\Application Data\Apple
    2008-09-13 15:00 . 2008-09-13 15:00 <DIR> d
    C:\Program Files\VSO
    2008-09-13 15:00 . 2008-09-13 15:21 <DIR> d
    C:\Documents and Settings\Goraya Family\Application Data\Vso
    2008-09-13 15:00 . 2004-05-04 12:53 1,645,320 --a
    C:\WINDOWS\gdiplus.dll
    2008-09-13 15:00 . 2006-05-11 20:21 626,688 --a
    C:\WINDOWS\system32\vp7vfw.dll
    2008-09-13 15:00 . 2006-09-29 13:24 217,127 --a
    C:\WINDOWS\system32\drv43260.dll
    2008-09-13 15:00 . 2006-09-29 13:25 208,935 --a
    C:\WINDOWS\system32\drv33260.dll
    2008-09-13 15:00 . 2006-09-29 13:26 176,165 --a
    C:\WINDOWS\system32\drv23260.dll
    2008-09-13 15:00 . 2007-03-18 21:37 65,602 --a
    C:\WINDOWS\system32\cook3260.dll
    2008-09-13 15:00 . 2008-09-13 15:00 47,360 --a
    C:\WINDOWS\system32\drivers\pcouffin.sys
    2008-09-13 15:00 . 2008-09-13 15:20 47,360 --a
    C:\Documents and Settings\Goraya Family\Application Data\pcouffin.sys
    2008-09-13 14:59 . 2008-09-13 14:59 <DIR> d
    C:\Program Files\VideoLAN
    2008-09-13 14:57 . 2008-09-13 14:58 <DIR> d
    C:\Program Files\SureThing CD Labeler 5
    2008-09-13 14:57 . 2008-09-13 14:57 <DIR> d
    C:\Program Files\Common Files\SureThing Shared
    2008-09-13 14:56 . 2008-09-13 14:56 <DIR> d
    C:\Program Files\Common Files\LightScribe
    2008-09-13 14:55 . 2008-09-13 14:55 <DIR> d
    C:\Program Files\ImTOO
    2008-09-13 14:52 . 2008-09-13 14:52 <DIR> d
    C:\Program Files\WMA to MP3 Converter
    2008-09-13 14:51 . 2008-09-13 14:51 <DIR> d
    C:\Program Files\RM to MP3 Converter
    2008-09-13 14:51 . 2008-09-13 14:51 <DIR> d
    C:\Program Files\iPod Video Converter
    2008-09-13 14:51 . 2004-05-25 17:06 417,792 --a
    C:\WINDOWS\system32\ac3filter.ax
    2008-09-13 14:51 . 2005-02-27 21:48 356,352 --a
    C:\WINDOWS\system32\RealMediaSplitter.ax
    2008-09-13 14:51 . 2004-01-10 17:02 258,048 --a
    C:\WINDOWS\system32\GplMpgDec.ax
    2008-09-13 14:50 . 2008-09-13 14:50 <DIR> d
    C:\Program Files\DVD MP3 Ripper
    2008-09-13 14:47 . 2008-09-13 14:47 <DIR> d
    C:\Program Files\East-Tec Eraser 2008
    2008-09-13 14:47 . 2008-09-13 14:47 <DIR> d
    C:\Documents and Settings\Goraya Family\Application Data\EAST Technologies
    2008-09-13 14:47 . 2008-09-20 13:27 <DIR> d-a
    C:\Documents and Settings\All Users\Application Data\TEMP
    2008-09-13 14:45 . 2008-09-13 14:46 <DIR> d
    C:\Program Files\Advanced Batch Converter
    2008-09-13 14:42 . 2008-09-13 14:42 <DIR> d
    C:\Program Files\Sarm Software
    2008-09-13 14:34 . 2008-09-13 15:37 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
    2008-09-13 14:34 . 2008-09-13 14:34 <DIR> d
    C:\Program Files\Pure Networks
    2008-09-13 14:34 . 2008-09-13 14:34 <DIR> d
    C:\Program Files\Common Files\Pure Networks Shared
    2008-09-13 14:34 . 2008-05-16 06:10 25,272 --a
    C:\WINDOWS\system32\drivers\purendis.sys
    2008-09-13 14:34 . 2008-05-16 06:10 23,992 --a
    C:\WINDOWS\system32\drivers\pnarp.sys
    2008-09-13 14:31 . 2008-09-13 14:34 <DIR> d
    C:\Documents and Settings\All Users\Application Data\Pure Networks
    2008-09-13 14:29 . 2008-09-13 14:29 <DIR> d
    C:\Swsetup
    2008-09-13 14:27 . 2008-09-13 14:27 <DIR> d
    C:\5200
    2008-09-13 14:25 . 2008-09-19 00:39 <DIR> d
    C:\Program Files\Lx_cats
    2008-09-13 14:22 . 2008-09-13 14:22 <DIR> d
    C:\Program Files\Lexmark 5200 Series
    2008-09-13 14:22 . 2007-04-25 09:24 421,888 --a
    C:\WINDOWS\system32\lxbtdrs.dll
    2008-09-13 14:22 . 2007-02-22 18:32 344,064 --a
    C:\WINDOWS\system32\lxbtcoin.dll
    2008-09-13 14:22 . 2001-08-17 22:36 87,040 --a
    C:\WINDOWS\system32\wiafbdrv.dll
    2008-09-13 14:22 . 2001-08-17 22:36 87,040 --a--c--- C:\WINDOWS\system32\dllcache\wiafbdrv.dll
    2008-09-13 14:22 . 2005-05-25 09:07 61,440 --a
    C:\WINDOWS\system32\lxbtcnv4.dll
    2008-09-13 14:22 . 2005-08-18 06:26 40,960 --a
    C:\WINDOWS\system32\lxbtvs.dll
    2008-09-13 14:22 . 2004-08-03 22:58 15,104 --a
    C:\WINDOWS\system32\drivers\usbscan.sys
    2008-09-13 14:22 . 2004-08-03 22:58 15,104 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys
    2008-09-13 14:16 . 2006-11-09 13:11 134 --a
    C:\WINDOWS\system32\DWLAB.DAT
    2008-09-13 14:16 . 2008-09-20 13:27 14 --a
    C:\WINDOWS\system32\ANIWZCSUSERNAME{DC554E95-A924-4CEF-B2F8-07E14F78550A}
    2008-09-13 14:15 . 2008-09-13 14:15 <DIR> d
    C:\Program Files\D-Link
    2008-09-13 14:15 . 2008-09-13 14:15 <DIR> d
    C:\Program Files\ANI
    2008-09-13 14:15 . 2008-09-13 14:15 <DIR> d
    C:\Documents and Settings\Goraya Family\Application Data\InstallShield
    2008-09-13 14:14 . 2008-09-13 14:14 <DIR> d
    C:\WINDOWS\system32\Lang
    2008-09-13 14:13 . 2007-10-11 11:04 1,826,816 --a
    C:\WINDOWS\SkyTel.exe
    2008-09-13 14:13 . 2006-08-01 15:02 49,152 --a
    C:\WINDOWS\system32\ChCfg.exe
    2008-09-13 14:12 . 2008-09-13 14:12 <DIR> d
    C:\Program Files\Realtek

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-09-13 18:12 315,392 ----a-w C:\WINDOWS\HideWin.exe
    2008-09-13 17:16
    d
    w C:\Program Files\microsoft frontpage
    2008-08-14 22:54 102,208 ----a-w C:\WINDOWS\system32\drivers\bdfndisf.sys
    2008-08-12 22:40 228,672 ----a-w C:\WINDOWS\system32\drivers\bdfsfltr.sys
    2008-08-12 22:40 108,864 ----a-w C:\WINDOWS\system32\drivers\bdfm.sys
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]
    "Eraser RiskMonitor"="C:\Program Files\East-Tec Eraser 2008\Launch.exe" [2008-03-22 18536]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-16 13529088]
    "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-16 86016]
    "D-Link Wireless G WDA-1320"="C:\Program Files\D-Link\Wireless G WDA-1320\AirGCFG.exe" [2007-08-29 1662976]
    "ANIWZCS2Service"="C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [2007-01-19 49152]
    "LXBTCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBTtime.dll" [2007-02-22 73728]
    "nmctxth"="C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2008-05-16 648504]
    "nmapp"="C:\Program Files\Pure Networks\Network Magic\nmapp.exe" [2008-09-18 451896]
    "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-09-06 413696]
    "AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-09-03 111936]
    "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-09-10 289576]
    "BDAgent"="C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe" [2008-09-18 716800]
    "BitDefender Antiphishing Helper"="C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe" [2008-08-10 69632]
    "QuickFinder Scheduler"="c:\Program Files\Corel\WordPerfect Office X4\Programs\QFSCHD140.EXE" [2008-03-21 83232]
    "vmware-tray"="C:\Program Files\VMware\VMware Workstation\vmware-tray.exe" [2008-05-16 72240]
    "VMware hqtray"="C:\Program Files\VMware\VMware Workstation\hqtray.exe" [2008-05-16 55856]
    "nwiz"="nwiz.exe" [2008-05-16 C:\WINDOWS\system32\nwiz.exe]
    "RTHDCPL"="RTHDCPL.EXE" [2007-10-25 C:\WINDOWS\RTHDCPL.exe]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 15360]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=dqaxkx.dll

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\WINDOWS\\system32\\lxbtcoms.exe"=
    "C:\\Program Files\\uTorrent\\uTorrent.exe"=
    "C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "C:\\Program Files\\iTunes\\iTunes.exe"=

    R2 BDVEDISK;BDVEDISK;C:\Program Files\BitDefender\BitDefender 2009\BDVEDISK.sys [2008-07-02 82568]
    R2 PSI_SVC_2;Protexis Licensing V2;c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe [2007-07-24 185632]
    R3 bdfm;BDFM;C:\WINDOWS\system32\drivers\bdfm.sys [2008-08-12 108864]
    R3 Bdfndisf;BitDefender Firewall NDIS Filter Service;C:\WINDOWS\system32\DRIVERS\bdfndisf.sys [2008-08-14 102208]
    R3 JSWSCIMD;jswscimd Service;C:\WINDOWS\system32\DRIVERS\jswscimd.sys [2007-07-06 57376]
    S3 A3AB;D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB);C:\WINDOWS\system32\DRIVERS\A3AB.sys [2007-05-24 547744]
    S3 Arrakis3;BitDefender Arrakis Server;C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe [2008-07-17 118784]
    S3 jswpsapi;Jumpstart Wifi Protected Setup;C:\Program Files\D-Link\Wireless G WDA-1320\JSWUtil\jswpsapi.exe [2007-08-02 352338]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    bdx REG_MULTI_SZ scan

    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
    "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
    .
    Contents of the 'Scheduled Tasks' folder
    .
    .
    Supplementary Scan
    .
    R1 -: HKCU-Internet Settings,ProxyOverride = *.local
    O8 -: Open with WordPerfect - c:\Program Files\Corel\WordPerfect Office X4\Programs\WPLauncher.hta
    .

    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-09-20 13:50:45
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    HKLM\Software\Microsoft\Windows\CurrentVersion\Run
    LXBTCATS = rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBTtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-09-20 13:51:18
    ComboFix-quarantined-files.txt 2008-09-20 17:51:16

    Pre-Run: 44,237,062,144 bytes free
    Post-Run: 44,348,231,680 bytes free

    220


    Thanks for your help
  • chiazchiaz
    edited September 2008
    I would like to see a new HijackThis log as well. :)
  • Bob39Bob39
    edited September 2008
    Sorry about that. here is the HijackThis log

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 10:11:13 PM, on 20/09/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
    C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\WINDOWS\system32\lxbtcoms.exe
    C:\WINDOWS\system32\nvsvc32.exe
    c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
    C:\WINDOWS\system32\vmnat.exe
    C:\WINDOWS\system32\vmnetdhcp.exe
    C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\Program Files\D-Link\Wireless G WDA-1320\AirGCFG.exe
    C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe
    C:\Program Files\VMware\VMware Workstation\vmware-tray.exe
    C:\Program Files\VMware\VMware Workstation\hqtray.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\BitDefender\BitDefender 2009\seccenter.exe
    C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
    C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
    C:\Program Files\Pure Networks\Network Magic\nmapp.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [D-Link Wireless G WDA-1320] C:\Program Files\D-Link\Wireless G WDA-1320\AirGCFG.exe
    O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
    O4 - HKLM\..\Run: [LXBTCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBTtime.dll,_RunDLLEntry@16
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe"
    O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe"
    O4 - HKLM\..\Run: [QuickFinder Scheduler] "c:\Program Files\Corel\WordPerfect Office X4\Programs\QFSCHD140.EXE"
    O4 - HKLM\..\Run: [vmware-tray] C:\Program Files\VMware\VMware Workstation\vmware-tray.exe
    O4 - HKLM\..\Run: [VMware hqtray] "C:\Program Files\VMware\VMware Workstation\hqtray.exe"
    O4 - HKLM\..\Run: [nmctxth] "C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe"
    O4 - HKLM\..\Run: [nmapp] "C:\Program Files\Pure Networks\Network Magic\nmapp.exe" -autorun -nosplash
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Eraser RiskMonitor] "C:\Program Files\East-Tec Eraser 2008\Launch.exe" "C:\Program Files\East-Tec Eraser 2008\etRiskMon.exe"
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O8 - Extra context menu item: Open with WordPerfect - c:\Program Files\Corel\WordPerfect Office X4\Programs\WPLauncher.hta
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O20 - AppInit_DLLs: dqaxkx.dll
    O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Wireless Service - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: BitDefender Arrakis Server (Arrakis3) - BitDefender S.R.L. http://www.bitdefender.com - C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Jumpstart Wifi Protected Setup (jswpsapi) - Atheros Communications, Inc. - C:\Program Files\D-Link\Wireless G WDA-1320\JSWUtil\jswpsapi.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
    O23 - Service: lxbt_device - - C:\WINDOWS\system32\lxbtcoms.exe
    O23 - Service: Pure Networks Net2Go Service (nmraapache) - Pure Networks, Inc. - C:\Program Files\Pure Networks\Network Magic\WebServer\bin\nmraapache.exe
    O23 - Service: Pure Networks Platform Service (nmservice) - Pure Networks, Inc. - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
    O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
    O23 - Service: VMware Agent Service (ufad-ws60) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-ufad.exe
    O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
    O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe
    O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
    O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe
    O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S. R. L. - C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe

    --
    End of file - 7773 bytes


    Thanks
  • chiazchiaz
    edited September 2008
    Did you reboot your computer after running MBAM? When was this log generated?
  • Bob39Bob39
    edited September 2008
    No, I don't think that MBAM asked me to reboot my comp. So, i didn't. The log was generated a few days ago. I think on September 18.
  • chiazchiaz
    edited September 2008
    The reason I asked was because MBAM specified that some bad files detected will only be removed on reboot.

    So can you please restart your computer (if you haven't done so between Sept 18 till now), and post a fresh HijackThis log.


    Thanks.
  • Bob39Bob39
    edited September 2008
    hello

    Ok. i've rebooted my comp about 3 times now to make sure that MBAM had deleted the bad files. here is my hijack this log.

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 4:28:25 PM, on 22/09/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
    C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\WINDOWS\RTHDCPL.EXE
    C:\Program Files\D-Link\Wireless G WDA-1320\AirGCFG.exe
    C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe
    C:\Program Files\VMware\VMware Workstation\vmware-tray.exe
    C:\Program Files\VMware\VMware Workstation\hqtray.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\WINDOWS\system32\lxbtcoms.exe
    C:\WINDOWS\system32\nvsvc32.exe
    c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
    C:\WINDOWS\system32\vmnat.exe
    C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
    C:\WINDOWS\system32\vmnetdhcp.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Safari\Safari.exe
    C:\Program Files\BitDefender\BitDefender 2009\seccenter.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [D-Link Wireless G WDA-1320] C:\Program Files\D-Link\Wireless G WDA-1320\AirGCFG.exe
    O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
    O4 - HKLM\..\Run: [LXBTCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBTtime.dll,_RunDLLEntry@16
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe"
    O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe"
    O4 - HKLM\..\Run: [QuickFinder Scheduler] "c:\Program Files\Corel\WordPerfect Office X4\Programs\QFSCHD140.EXE"
    O4 - HKLM\..\Run: [vmware-tray] C:\Program Files\VMware\VMware Workstation\vmware-tray.exe
    O4 - HKLM\..\Run: [VMware hqtray] "C:\Program Files\VMware\VMware Workstation\hqtray.exe"
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Eraser RiskMonitor] "C:\Program Files\East-Tec Eraser 2008\Launch.exe" "C:\Program Files\East-Tec Eraser 2008\etRiskMon.exe"
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O8 - Extra context menu item: Open with WordPerfect - c:\Program Files\Corel\WordPerfect Office X4\Programs\WPLauncher.hta
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O20 - AppInit_DLLs: dqaxkx.dll
    O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Wireless Service - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: BitDefender Arrakis Server (Arrakis3) - BitDefender S.R.L. http://www.bitdefender.com - C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Jumpstart Wifi Protected Setup (jswpsapi) - Atheros Communications, Inc. - C:\Program Files\D-Link\Wireless G WDA-1320\JSWUtil\jswpsapi.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
    O23 - Service: lxbt_device - - C:\WINDOWS\system32\lxbtcoms.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
    O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
    O23 - Service: VMware Agent Service (ufad-ws60) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-ufad.exe
    O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
    O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe
    O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
    O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe
    O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S. R. L. - C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe

    --
    End of file - 7125 bytes

    Thanks
  • chiazchiaz
    edited September 2008
    Please run HijackThis and place a checkmark by the following entry:
    O20 - AppInit_DLLs: dqaxkx.dll
    Then close all other windows except HijackThis and press "Fix Checked".


    Next download The Avenger by Swandog46, and save it to your Desktop.
    • Extract avenger.exe from the Zip file and save it to your Desktop.
    • Run avenger.exe by double-clicking on it.
    • The Do not change any check box options!!
    • Copy everything in the Quote box below, and paste it into the Input script here: part of the window:
      Files to delete:
      C:\WINDOWS\system32\dqaxkx.dll
    • Now click the Execute button.
    • Click Yes to the prompt to confirm you want to execute.
    • Click Yes to the Reboot now? question that will appear when Avenger finishes running.
    • Your PC should reboot, if not, reboot it yourself.
    • A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.
    • Please post the content of the logfile, along with a new HijackThis log.
  • Bob39Bob39
    edited September 2008
    I ran the scan with Hijack this and THe Avenger like you said. Here are the log files.




    The Avenger


    //////////////////////////////////////////
    Avenger Pre-Processor log
    //////////////////////////////////////////
    Platform: Windows XP (build 2600, Service Pack 2)
    Tue Sep 23 16:07:34 2008
    16:07:34: Error: Invalid script. A valid script must begin with a command directive.
    Aborting execution!

    //////////////////////////////////////////

    Logfile of The Avenger Version 2.0, (c) by Swandog46
    http://swandog46.geekstogo.com
    Platform: Windows XP
    *******************
    Script file opened successfully.
    Script file read successfully.
    Backups directory opened successfully at C:\Avenger
    *******************
    Beginning to process script file:
    Rootkit scan active.
    No rootkits found!

    Error: file "C:\WINDOWS\system32\dqaxkx.dll" not found!
    Deletion of file "C:\WINDOWS\system32\dqaxkx.dll" failed!
    Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
    --> the object does not exist

    Completed script processing.
    *******************
    Finished! Terminate.




    Hijack This

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 4:14:24 PM, on 23/09/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal
    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
    C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\WINDOWS\RTHDCPL.EXE
    C:\Program Files\D-Link\Wireless G WDA-1320\AirGCFG.exe
    C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe
    C:\Program Files\VMware\VMware Workstation\vmware-tray.exe
    C:\Program Files\VMware\VMware Workstation\hqtray.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\WINDOWS\system32\lxbtcoms.exe
    C:\WINDOWS\system32\nvsvc32.exe
    c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
    C:\WINDOWS\system32\vmnat.exe
    C:\WINDOWS\system32\vmnetdhcp.exe
    C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\BitDefender\BitDefender 2009\seccenter.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [D-Link Wireless G WDA-1320] C:\Program Files\D-Link\Wireless G WDA-1320\AirGCFG.exe
    O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
    O4 - HKLM\..\Run: [LXBTCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBTtime.dll,_RunDLLEntry@16
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe"
    O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe"
    O4 - HKLM\..\Run: [QuickFinder Scheduler] "c:\Program Files\Corel\WordPerfect Office X4\Programs\QFSCHD140.EXE"
    O4 - HKLM\..\Run: [vmware-tray] C:\Program Files\VMware\VMware Workstation\vmware-tray.exe
    O4 - HKLM\..\Run: [VMware hqtray] "C:\Program Files\VMware\VMware Workstation\hqtray.exe"
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Eraser RiskMonitor] "C:\Program Files\East-Tec Eraser 2008\Launch.exe" "C:\Program Files\East-Tec Eraser 2008\etRiskMon.exe"
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O8 - Extra context menu item: Open with WordPerfect - c:\Program Files\Corel\WordPerfect Office X4\Programs\WPLauncher.hta
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Wireless Service - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: BitDefender Arrakis Server (Arrakis3) - BitDefender S.R.L. http://www.bitdefender.com - C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Jumpstart Wifi Protected Setup (jswpsapi) - Atheros Communications, Inc. - C:\Program Files\D-Link\Wireless G WDA-1320\JSWUtil\jswpsapi.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
    O23 - Service: lxbt_device - - C:\WINDOWS\system32\lxbtcoms.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
    O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
    O23 - Service: VMware Agent Service (ufad-ws60) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-ufad.exe
    O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
    O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe
    O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
    O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe
    O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S. R. L. - C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe
    --
    End of file - 7106 bytes


    Thanks
  • chiazchiaz
    edited September 2008
    Looks fine to me. How's your computer running now?
  • Bob39Bob39
    edited September 2008
    Hello

    Thanks a lot for your help. My computer is running smoothly now thanks to you guys. :rockon:

    Thanks
  • chiazchiaz
    edited September 2008
    Glad we could be of assistance! The help you received here was free.

    This topic is now closed. If you wish it reopened, please send a Private Message to Trogan with a link to your thread.

    If you are not the user who started this thread, you must start your own Thread instead :)
    _______________________________
    Have we helped you with any issues you have had with your PCs or other items? If so, you can now help us by Joining Team 93 and fold for a cure.
Sign In or Register to comment.