Options

Ursnif.A Please Someone help me!!!!

Unknown
edited June 2009 in Spyware & Virus Removal
My NOD32 has been going crazy with this pop up of this virus saying:

File : C:\Windows\system32\winlogin.exe
Threat: Win32/Spy.Ursnif.A virus

threat detected. What do i do? I'm scared please help me i don't want identity thef. I'm broke anyway so the hackers would be very dissapointed anyway. LOL.:bigggrin:

Comments

  • chiazchiaz
    edited June 2009
    Hello. :)

    Let's have you download ComboFix.exe. Please visit this webpage for downloading and instructions for running the tool:

    Go here ======> A guide and tutorial on using ComboFix <====== Go here

    Please ensure you read this guide carefully and install the Recovery Console first.This applies to XP Pro and XP Home users only.If you have SP3 installed you will need to use the download meant for SP2.

    The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

    Once installed, you should get a prompt that says:

    The Recovery Console was successfully installed.

    Please continue as follows:

    (1) Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    (2) Click Yes to allow ComboFix to continue scanning for malware.

    When the tool is finished, it will produce a report for you.


    Please include C:\ComboFix.txt for further review (copy and paste it), so that we may continue cleansing the system.


    Caution: Never run and remove files with Combofix unless supervised by a qualified security analyst who is experienced in the use of Combofix. Misuse can cause serious computer problems.
  • showoff
    edited June 2009
    chiaz wrote:
    Hello. :)

    Let's have you download ComboFix.exe. Please visit this webpage for downloading and instructions for running the tool:

    Go here ======> A guide and tutorial on using ComboFix <====== Go here

    Please ensure you read this guide carefully and install the Recovery Console first.This applies to XP Pro and XP Home users only.If you have SP3 installed you will need to use the download meant for SP2.

    The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

    Once installed, you should get a prompt that says:

    The Recovery Console was successfully installed.

    Please continue as follows:

    (1) Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    (2) Click Yes to allow ComboFix to continue scanning for malware.

    When the tool is finished, it will produce a report for you.


    Please include C:\ComboFix.txt for further review (copy and paste it), so that we may continue cleansing the system.


    Caution: Never run and remove files with Combofix unless supervised by a qualified security analyst who is experienced in the use of Combofix. Misuse can cause serious computer problems.

    ComboFix 09-06-28.02 - beerboy 06/29/2009 6:58.1 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2559.2012 [GMT -4:00]
    Running from: c:\documents and settings\beerboy\Desktop\ComboFix.exe
    AV: Eset NOD32 antivirus system 2.51 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
    FW: ZoneAlarm Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
    * Resident AV is active

    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\documents and settings\beerboy\Application Data\inst.exe
    c:\windows\wiaserviv.log

    .
    ((((((((((((((((((((((((( Files Created from 2009-05-28 to 2009-06-29 )))))))))))))))))))))))))))))))
    .

    2009-06-29 01:08 . 2008-04-13 16:44 2560 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\USMT\iconlib.dll
    2009-06-29 01:00 . 2001-08-18 02:36 94720 -c--a-w- c:\windows\system32\dllcache\umaxud32.dll
    2009-06-29 00:59 . 2001-07-21 18:29 161568 -c--a-w- c:\windows\system32\dllcache\sgsmusb.sys
    2009-06-29 00:58 . 2001-08-18 02:36 44544 -c--a-w- c:\windows\system32\dllcache\ovui2.dll
    2009-06-29 00:57 . 2008-04-13 18:40 7040 -c--a-w- c:\windows\system32\dllcache\ltotape.sys
    2009-06-29 00:56 . 2001-08-17 17:28 50751 -c--a-w- c:\windows\system32\dllcache\hsf_tone.sys
    2009-06-29 00:55 . 2001-08-17 17:28 634134 -c--a-w- c:\windows\system32\dllcache\el656ct5.sys
    2009-06-29 00:54 . 2008-04-13 18:46 17024 -c--a-w- c:\windows\system32\dllcache\ccdecode.sys
    2009-06-29 00:53 . 2001-08-17 17:52 22400 -c--a-w- c:\windows\system32\dllcache\asc3350p.sys
    2009-06-29 00:52 . 2001-08-17 16:19 747392 -c--a-w- c:\windows\system32\dllcache\adm8830.sys
    2009-06-27 20:48 . 2009-06-27 20:49 66952 ----a-w- c:\windows\system32\drivers\iksysflt.sys
    2009-06-27 20:48 . 2009-06-27 20:49 81288 ----a-w- c:\windows\system32\drivers\iksyssec.sys
    2009-06-27 20:48 . 2009-06-27 20:49 40840 ----a-w- c:\windows\system32\drivers\ikfilesec.sys
    2009-06-27 20:48 . 2008-06-02 19:19 29576 ----a-w- c:\windows\system32\drivers\kcom.sys
    2009-06-27 20:48 . 2009-06-28 01:28
    d
    w- c:\program files\Spyware Doctor
    2009-06-27 20:48 . 2009-06-27 20:48
    d
    w- c:\documents and settings\beerboy\Application Data\PC Tools
    2009-06-06 23:11 . 2009-06-06 23:11
    d-sh--w- c:\documents and settings\NetworkService\IETldCache
    2009-06-06 06:16 . 2009-06-06 06:16
    d
    w- c:\program files\iPod
    2009-06-06 06:16 . 2009-06-06 06:16
    d
    w- c:\program files\iTunes
    2009-06-06 06:13 . 2009-06-06 06:13
    d
    w- c:\program files\QuickTime
    2009-06-06 06:09 . 2009-06-06 06:09 75048 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe
    2009-06-01 00:39 . 2009-06-01 00:39 390664 ----a-w- c:\documents and settings\beerboy\Application Data\Real\RealPlayer\Update\RealPlayer11.exe

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-06-29 10:52 . 2008-02-02 16:41
    d
    w- c:\program files\nbpro
    2009-06-29 01:04 . 2008-10-26 14:25 169936 ----a-w- c:\documents and settings\beerboy\Application Data\Mozilla\Firefox\Profiles\c8avm3pr.default\FlashGot.exe
    2009-06-29 00:10 . 2008-10-24 16:41
    d
    w- c:\program files\FlashGet
    2009-06-28 23:38 . 2008-12-09 09:11
    d
    w- c:\program files\Malwarebytes' Anti-Malware
    2009-06-28 23:34 . 2009-03-24 15:23 3561743 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
    2009-06-28 17:48 . 2008-02-02 17:57
    d---a-w- c:\documents and settings\All Users\Application Data\TEMP
    2009-06-28 01:28 . 2008-04-28 18:26 18824769 ----a-w- c:\windows\Internet Logs\tvDebug.zip
    2009-06-27 19:33 . 2008-02-03 05:25
    d
    w- c:\documents and settings\beerboy\Application Data\Vso
    2009-06-17 15:27 . 2008-12-09 09:11 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2009-06-17 15:27 . 2008-12-09 09:11 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
    2009-06-10 01:23 . 2008-02-10 18:21
    d
    w- c:\documents and settings\beerboy\Application Data\uTorrent
    2009-06-10 01:12 . 2009-02-01 22:54
    d
    w- c:\program files\LimeWire
    2009-06-10 01:12 . 2008-03-02 17:52
    d
    w- c:\documents and settings\beerboy\Application Data\LimeWire
    2009-06-06 06:16 . 2009-03-02 16:09
    d
    w- c:\program files\Common Files\Apple
    2009-05-29 17:36 . 2009-03-15 02:35 2060288 ----a-w- c:\windows\system32\usbaaplrc.dll
    2009-05-29 17:36 . 2009-03-02 16:09 39424 ----a-w- c:\windows\system32\drivers\usbaapl.sys
    2009-05-24 05:12 . 2009-05-24 05:12
    d
    w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
    2009-05-18 21:09 . 2009-05-18 21:09 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_motmodem_01005.Wdf
    2009-05-06 17:56 . 2008-12-27 19:35
    d
    w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
    2009-05-05 09:39 . 2008-11-18 14:09
    d
    w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
    2009-04-01 19:49 . 2008-02-02 16:11 4212 ---ha-w- c:\windows\system32\zllictbl.dat
    2008-12-16 22:06 . 2008-12-16 22:06 1058 ----a-w- c:\program files\xofl.txt
    2008-12-09 11:44 . 2008-12-09 11:44 2112 ----a-w- c:\program files\zqggku.txt
    2009-01-27 01:34 . 2009-01-27 01:34 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
    2009-01-27 01:34 . 2009-01-27 01:34 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
    2009-01-27 01:34 . 2009-01-27 01:34 1044480 ----a-w- c:\program files\opera\program\plugins\libdivx.dll
    2009-01-27 01:34 . 2009-01-27 01:34 200704 ----a-w- c:\program files\opera\program\plugins\ssldivx.dll
    2008-12-04 18:59 . 2008-12-04 18:59 2713 --sh--w- c:\windows\system32\yofabutu.exe
    .
    Sigcheck

    [7] 2004-08-04 07:56 502272 01C3346C241652F43AED8E2149881BFE c:\windows\$NtServicePackUninstall$\winlogon.exe
    [7] 2008-04-14 00:12 507904 ED0EF0A136DEC83DF69F04118870003E c:\windows\LastGood\system32\dllcache\winlogon.exe
    [7] 2008-04-14 00:12 507904 ED0EF0A136DEC83DF69F04118870003E c:\windows\ServicePackFiles\i386\winlogon.exe
    [-] 2008-11-18 12:28 507904 !HASH: ERROR_LOCK_VIOLATION ! c:\windows\system32\winlogon.exe
    [7] 2008-04-14 00:12 507904 ED0EF0A136DEC83DF69F04118870003E c:\windows\system32\dllcache\winlogon.exe

    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-01-17 486856]
    "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-03-08 39408]
    "RegistryMechanic"="c:\program files\Registry Mechanic\RegMech.exe" [2008-07-08 2828184]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
    "nod32kui"="c:\program files\Eset\nod32kui.exe" [2006-05-31 921600]
    "ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-02-16 981384]
    "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
    "Flashget"="c:\program files\FlashGet\flashget.exe" [2007-09-25 2007088]
    "CTHelper"="CTHELPER.EXE" - c:\windows\CTHELPER.EXE [2006-08-11 17920]
    "CTxfiHlp"="CTXFIHLP.EXE" - c:\windows\system32\CTXFIHLP.EXE [2006-08-11 18944]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-2-23 805392]

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-27 304128]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
    2008-05-02 07:42 72208 ----a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
    BootExecute REG_MULTI_SZ PDBoot.exe\0autocheck autochk *

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
    @=&quot;"

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
    @=&quot;"

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
    @=&quot;"

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\WINDOWS\\system32\\PnkBstrA.exe"=
    "c:\\WINDOWS\\system32\\PnkBstrB.exe"=
    "c:\\Program Files\\uTorrent\\uTorrent.exe"=
    "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
    "c:\\Program Files\\LimeWire\\LimeWire.exe"=
    "c:\\Program Files\\FlashGet\\FlashGet.exe"=
    "c:\\Program Files\\AIM6\\aim6.exe"=
    "c:\\WINDOWS\\system32\\searchprotocolhost.exe"=
    "c:\\Program Files\\Common Files\\Nero\\Lib\\NMIndexingService.exe"=
    "c:\\Program Files\\ESET\\nod32krn.exe"=
    "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
    "%windir%\\explorer.exe"=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "c:\\Program Files\\ICQ6.5\\ICQ.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "7795:TCP"= 7795:TCP:BitComet 7795 TCP
    "7795:UDP"= 7795:UDP:BitComet 7795 UDP
    "18543:TCP"= 18543:TCP:BitComet 18543 TCP(ED2K)
    "18543:UDP"= 18543:UDP:BitComet 18543 UDP(ED2K)
    "18967:TCP"= 18967:TCP:BitComet 18967 TCP
    "18967:UDP"= 18967:UDP:BitComet 18967 UDP
    "16320:TCP"= 16320:TCP:BitComet 16320 TCP(ED2K)
    "16320:UDP"= 16320:UDP:BitComet 16320 UDP(ED2K)
    "20128:TCP"= 20128:TCP:BitComet 20128 TCP
    "20128:UDP"= 20128:UDP:BitComet 20128 UDP
    "15342:TCP"= 15342:TCP:port
    "21204:TCP"= 21204:TCP:port

    R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2/15/2008 5:07 PM 24652]
    R3 SaiH8000;SaiH8000;c:\windows\system32\drivers\SaiH8000.sys [7/30/2004 11:25 AM 56576]
    S0 hsbrat;hsbrat;c:\windows\system32\drivers\vlnrqf.sys --> c:\windows\system32\drivers\vlnrqf.sys [?]
    S0 xzhuasmm;xzhuasmm;c:\windows\system32\drivers\stlq.sys --> c:\windows\system32\drivers\stlq.sys [?]
    S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [1/25/2007 1:31 PM 42000]
    S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [6/27/2009 4:48 PM 356920]

    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
    "c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{621FCD24-4498-4324-A81E-07D331376EDF}]
    c:\program files\PixiePack Codec Pack\InstallerHelper.exe
    .
    Contents of the 'Scheduled Tasks' folder

    2009-06-27 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]
    .
    .
    Supplementary Scan
    .
    uStart Page = hxxp://www.google.com
    uInternet Settings,ProxyOverride = *.local
    IE: &AOL Toolbar Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html
    IE: &Download All with FlashGet - c:\program files\FlashGet\jc_all.htm
    IE: &Download with FlashGet - c:\program files\FlashGet\jc_link.htm
    LSP: c:\windows\system32\imon.dll
    FF - ProfilePath - c:\documents and settings\beerboy\Application Data\Mozilla\Firefox\Profiles\c8avm3pr.default\
    FF - prefs.js: network.proxy.type - 2
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
    FF - plugin: c:\program files\Opera\program\plugins\npdivx32.dll
    FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-06-29 07:02
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************

    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{95808DC4-FA4A-4c74-92FE-5B863F82066B}]
    "ImagePath"="\??\c:\program files\CyberLink\PowerDVD\000.fcl"
    .
    LOCKED REGISTRY KEYS

    [HKEY_USERS\S-1-5-21-682003330-1960408961-839522115-1004\Software\SecuROM\License information*]
    "datasecu"=hex:36,e5,65,73,6c,95,61,1e,c9,2c,99,76,1c,00,1a,e0,ba,fe,a3,5b,76,
    ff,8f,25,39,3c,4d,0d,4c,52,95,4b,dd,67,c3,8c,c9,17,53,aa,dd,4a,36,89,3a,0e,\
    "rkeysecu"=hex:f2,5f,9d,45,56,7a,b9,ea,bb,8a,0b,ad,87,2f,43,cf
    .
    DLLs Loaded Under Running Processes

    - - - - - - - > 'winlogon.exe'(664)
    c:\windows\system32\Ati2evxx.dll
    c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
    c:\program files\common files\logishrd\bluetooth\LBTServ.dll

    - - - - - - - > 'lsass.exe'(728)
    c:\windows\system32\imon.dll
    .
    Completion time: 2009-06-29 7:03
    ComboFix-quarantined-files.txt 2009-06-29 11:03

    Pre-Run: 75,142,955,008 bytes free
    Post-Run: 75,315,830,784 bytes free

    WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn /usepmtimer

    212
  • chiazchiaz
    edited June 2009
    Please go to http://virusscan.jotti.org , click on Browse, and upload the following files for analysis: You will only be able to have one file scanned at a time.

    c:\program files\xofl.txt
    c:\program files\zqggku.txt

    Then click Submit. Allow the files to be scanned individually, and then please Copy/Paste the results here later for me to see.

    If Jotti is busy, please go to http://www.virustotal.com.



    Next please open Notepad
    Click Start, then Run
    Type notepad.exe in the Run Box.

    2. Now copy/paste the entire content of the codebox below into the Notepad window:
    KillAll::

Drivers::
hsbrat
xzhuasmm

File::
c:\windows\system32\yofabutu.exe
c:\windows\system32\drivers\vlnrqf.sys
c:\windows\system32\drivers\stlq.sys

FCopy::
c:\windows\ServicePackFiles\i386\winlogon.exe|c:\windows\system32\winlogon.exe
    Save the above to your Desktop as CFScript.txt.

    4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

    CFScript.gif


    ComboFix will reboot your computer.



    Post the fresh log in your reply, along with the Jotti/VirusTotal results.
  • showoff
    edited June 2009
    ok will do now thxs.
  • showoff
    edited June 2009
    Filename: xofl.txt Status: Scan finished. 0 out of 21 scanners reported malware.
    Scan taken on: Mon 29 Jun 2009 13:42:14 (CET) Permalink
  • showoff
    edited June 2009
    Filename: zqggku.txt Status: Scan finished. 0 out of 21 scanners reported malware.
    Scan taken on: Mon 29 Jun 2009 13:44:36 (CET) Permalink
  • showoff
    edited June 2009
    ComboFix 09-06-28.02 - beerboy 06/29/2009 7:53.2 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2559.2073 [GMT -4:00]
    Running from: c:\documents and settings\beerboy\Desktop\ComboFix.exe
    Command switches used :: c:\documents and settings\beerboy\Desktop\CFScript.txt..txt
    AV: Eset NOD32 antivirus system 2.51 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
    FW: ZoneAlarm Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
    * Resident AV is active


    FILE ::
    "c:\windows\system32\drivers\stlq.sys"
    "c:\windows\system32\drivers\vlnrqf.sys"
    "c:\windows\system32\yofabutu.exe"
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\windows\system32\yofabutu.exe

    .
    FCopy

    c:\windows\ServicePackFiles\i386\winlogon.exe --> c:\windows\system32\winlogon.exe
    .
    ((((((((((((((((((((((((( Files Created from 2009-05-28 to 2009-06-29 )))))))))))))))))))))))))))))))
    .

    2009-06-29 11:02 . 2009-06-29 11:02
    dc----w- c:\windows\system32\dllcache\cache
    2009-06-29 01:08 . 2008-04-13 16:44 2560 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\USMT\iconlib.dll
    2009-06-29 01:00 . 2001-08-18 02:36 94720 -c--a-w- c:\windows\system32\dllcache\umaxud32.dll
    2009-06-29 00:59 . 2001-07-21 18:29 161568 -c--a-w- c:\windows\system32\dllcache\sgsmusb.sys
    2009-06-29 00:58 . 2001-08-18 02:36 44544 -c--a-w- c:\windows\system32\dllcache\ovui2.dll
    2009-06-29 00:57 . 2008-04-13 18:40 7040 -c--a-w- c:\windows\system32\dllcache\ltotape.sys
    2009-06-29 00:56 . 2001-08-17 17:28 50751 -c--a-w- c:\windows\system32\dllcache\hsf_tone.sys
    2009-06-29 00:55 . 2001-08-17 17:28 634134 -c--a-w- c:\windows\system32\dllcache\el656ct5.sys
    2009-06-29 00:54 . 2008-04-13 18:46 17024 -c--a-w- c:\windows\system32\dllcache\ccdecode.sys
    2009-06-29 00:53 . 2001-08-17 17:52 22400 -c--a-w- c:\windows\system32\dllcache\asc3350p.sys
    2009-06-29 00:52 . 2001-08-17 16:19 747392 -c--a-w- c:\windows\system32\dllcache\adm8830.sys
    2009-06-27 20:48 . 2009-06-27 20:49 66952 ----a-w- c:\windows\system32\drivers\iksysflt.sys
    2009-06-27 20:48 . 2009-06-27 20:49 81288 ----a-w- c:\windows\system32\drivers\iksyssec.sys
    2009-06-27 20:48 . 2009-06-27 20:49 40840 ----a-w- c:\windows\system32\drivers\ikfilesec.sys
    2009-06-27 20:48 . 2008-06-02 19:19 29576 ----a-w- c:\windows\system32\drivers\kcom.sys
    2009-06-27 20:48 . 2009-06-28 01:28
    d
    w- c:\program files\Spyware Doctor
    2009-06-27 20:48 . 2009-06-27 20:48
    d
    w- c:\documents and settings\beerboy\Application Data\PC Tools
    2009-06-06 23:11 . 2009-06-06 23:11
    d-sh--w- c:\documents and settings\NetworkService\IETldCache
    2009-06-06 06:16 . 2009-06-06 06:16
    d
    w- c:\program files\iPod
    2009-06-06 06:16 . 2009-06-06 06:16
    d
    w- c:\program files\iTunes
    2009-06-06 06:13 . 2009-06-06 06:13
    d
    w- c:\program files\QuickTime
    2009-06-06 06:09 . 2009-06-06 06:09 75048 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe
    2009-06-01 00:39 . 2009-06-01 00:39 390664 ----a-w- c:\documents and settings\beerboy\Application Data\Real\RealPlayer\Update\RealPlayer11.exe

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-06-29 11:49 . 2008-02-02 16:41
    d
    w- c:\program files\nbpro
    2009-06-29 11:11 . 2008-10-26 14:25 169936 ----a-w- c:\documents and settings\beerboy\Application Data\Mozilla\Firefox\Profiles\c8avm3pr.default\FlashGot.exe
    2009-06-29 11:09 . 2008-02-02 17:57
    d---a-w- c:\documents and settings\All Users\Application Data\TEMP
    2009-06-29 11:09 . 2008-10-24 16:41
    d
    w- c:\program files\FlashGet
    2009-06-28 23:38 . 2008-12-09 09:11
    d
    w- c:\program files\Malwarebytes' Anti-Malware
    2009-06-28 23:34 . 2009-03-24 15:23 3561743 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
    2009-06-28 01:28 . 2008-04-28 18:26 18824769 ----a-w- c:\windows\Internet Logs\tvDebug.zip
    2009-06-27 19:33 . 2008-02-03 05:25
    d
    w- c:\documents and settings\beerboy\Application Data\Vso
    2009-06-17 15:27 . 2008-12-09 09:11 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2009-06-17 15:27 . 2008-12-09 09:11 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
    2009-06-10 01:23 . 2008-02-10 18:21
    d
    w- c:\documents and settings\beerboy\Application Data\uTorrent
    2009-06-10 01:12 . 2009-02-01 22:54
    d
    w- c:\program files\LimeWire
    2009-06-10 01:12 . 2008-03-02 17:52
    d
    w- c:\documents and settings\beerboy\Application Data\LimeWire
    2009-06-06 06:16 . 2009-03-02 16:09
    d
    w- c:\program files\Common Files\Apple
    2009-05-29 17:36 . 2009-03-15 02:35 2060288 ----a-w- c:\windows\system32\usbaaplrc.dll
    2009-05-29 17:36 . 2009-03-02 16:09 39424 ----a-w- c:\windows\system32\drivers\usbaapl.sys
    2009-05-24 05:12 . 2009-05-24 05:12
    d
    w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
    2009-05-18 21:09 . 2009-05-18 21:09 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_motmodem_01005.Wdf
    2009-05-06 17:56 . 2008-12-27 19:35
    d
    w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
    2009-05-05 09:39 . 2008-11-18 14:09
    d
    w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
    2009-04-01 19:49 . 2008-02-02 16:11 4212 ---ha-w- c:\windows\system32\zllictbl.dat
    2008-12-16 22:06 . 2008-12-16 22:06 1058 ----a-w- c:\program files\xofl.txt
    2008-12-09 11:44 . 2008-12-09 11:44 2112 ----a-w- c:\program files\zqggku.txt
    2009-01-27 01:34 . 2009-01-27 01:34 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
    2009-01-27 01:34 . 2009-01-27 01:34 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
    2009-01-27 01:34 . 2009-01-27 01:34 1044480 ----a-w- c:\program files\opera\program\plugins\libdivx.dll
    2009-01-27 01:34 . 2009-01-27 01:34 200704 ----a-w- c:\program files\opera\program\plugins\ssldivx.dll
    .

    ((((((((((((((((((((((((((((( SnapShot@2009-06-29_11.02.01 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2009-06-29 11:02 . 2008-10-16 19:09 51224 c:\windows\system32\dllcache\cache\wuauclt.exe
    + 2009-06-29 11:02 . 2008-04-14 00:12 82432 c:\windows\system32\dllcache\cache\ws2_32.dll
    + 2009-06-29 11:02 . 2008-04-14 00:12 26112 c:\windows\system32\dllcache\cache\userinit.exe
    + 2009-06-29 11:02 . 2008-04-14 00:12 14336 c:\windows\system32\dllcache\cache\svchost.exe
    + 2009-06-29 11:02 . 2008-04-14 00:12 57856 c:\windows\system32\dllcache\cache\spoolsv.exe
    + 2009-06-29 11:02 . 2008-04-14 00:12 17408 c:\windows\system32\dllcache\cache\powrprof.dll
    + 2009-06-29 11:02 . 2008-04-14 00:12 13312 c:\windows\system32\dllcache\cache\lsass.exe
    + 2009-06-29 11:02 . 2008-04-13 18:39 24576 c:\windows\system32\dllcache\cache\kbdclass.sys
    + 2009-06-29 11:02 . 2008-04-13 18:53 36608 c:\windows\system32\dllcache\cache\ip6fw.sys
    + 2009-06-29 11:02 . 2008-04-14 00:12 15360 c:\windows\system32\dllcache\cache\ctfmon.exe
    + 2001-08-23 12:00 . 2008-04-14 00:12 507904 c:\windows\system32\dllcache\winlogon.exe
    - 2004-08-04 07:56 . 2008-04-14 00:12 507904 c:\windows\system32\dllcache\winlogon.exe
    + 2009-06-29 11:02 . 2009-03-08 08:34 914944 c:\windows\system32\dllcache\cache\wininet.dll
    + 2009-06-29 11:02 . 2008-04-14 00:12 578560 c:\windows\system32\dllcache\cache\user32.dll
    + 2009-06-29 11:02 . 2008-04-14 00:12 295424 c:\windows\system32\dllcache\cache\termsrv.dll
    + 2009-06-29 11:02 . 2008-07-13 14:19 361600 c:\windows\system32\dllcache\cache\TCPIP.SYS
    + 2009-06-29 11:02 . 2009-02-06 11:11 110592 c:\windows\system32\dllcache\cache\services.exe
    + 2009-06-29 11:02 . 2008-04-13 19:20 182656 c:\windows\system32\dllcache\cache\ndis.sys
    + 2009-06-29 11:02 . 2009-03-21 14:06 989696 c:\windows\system32\dllcache\cache\kernel32.dll
    + 2009-06-29 11:02 . 2008-04-14 00:11 110080 c:\windows\system32\dllcache\cache\imm32.dll
    + 2009-06-29 11:02 . 2008-04-14 00:12 1614848 c:\windows\system32\dllcache\cache\sfcfiles.dll
    + 2009-06-29 11:02 . 2009-02-06 11:08 2189056 c:\windows\system32\dllcache\cache\ntoskrnl.exe
    + 2009-06-29 11:02 . 2009-02-07 23:02 2066048 c:\windows\system32\dllcache\cache\ntkrnlpa.exe
    + 2009-06-29 11:02 . 2008-04-14 00:12 1033728 c:\windows\system32\dllcache\cache\explorer.exe
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
    "nod32kui"="c:\program files\Eset\nod32kui.exe" [2006-05-31 921600]
    "ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-02-16 981384]
    "CTHelper"="CTHELPER.EXE" - c:\windows\CTHELPER.EXE [2006-08-11 17920]
    "CTxfiHlp"="CTXFIHLP.EXE" - c:\windows\system32\CTXFIHLP.EXE [2006-08-11 18944]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-2-23 805392]

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-27 304128]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
    2008-05-02 07:42 72208 ----a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
    BootExecute REG_MULTI_SZ PDBoot.exe\0autocheck autochk *

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
    @=&quot;"

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
    @=&quot;"

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
    @=&quot;"

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\WINDOWS\\system32\\PnkBstrA.exe"=
    "c:\\WINDOWS\\system32\\PnkBstrB.exe"=
    "c:\\Program Files\\uTorrent\\uTorrent.exe"=
    "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
    "c:\\Program Files\\LimeWire\\LimeWire.exe"=
    "c:\\Program Files\\FlashGet\\FlashGet.exe"=
    "c:\\Program Files\\AIM6\\aim6.exe"=
    "c:\\WINDOWS\\system32\\searchprotocolhost.exe"=
    "c:\\Program Files\\Common Files\\Nero\\Lib\\NMIndexingService.exe"=
    "c:\\Program Files\\ESET\\nod32krn.exe"=
    "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
    "%windir%\\explorer.exe"=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "c:\\Program Files\\ICQ6.5\\ICQ.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "7795:TCP"= 7795:TCP:BitComet 7795 TCP
    "7795:UDP"= 7795:UDP:BitComet 7795 UDP
    "18543:TCP"= 18543:TCP:BitComet 18543 TCP(ED2K)
    "18543:UDP"= 18543:UDP:BitComet 18543 UDP(ED2K)
    "18967:TCP"= 18967:TCP:BitComet 18967 TCP
    "18967:UDP"= 18967:UDP:BitComet 18967 UDP
    "16320:TCP"= 16320:TCP:BitComet 16320 TCP(ED2K)
    "16320:UDP"= 16320:UDP:BitComet 16320 UDP(ED2K)
    "20128:TCP"= 20128:TCP:BitComet 20128 TCP
    "20128:UDP"= 20128:UDP:BitComet 20128 UDP
    "15342:TCP"= 15342:TCP:port
    "21204:TCP"= 21204:TCP:port

    R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2/15/2008 5:07 PM 24652]
    R3 SaiH8000;SaiH8000;c:\windows\system32\drivers\SaiH8000.sys [7/30/2004 11:25 AM 56576]
    S0 hsbrat;hsbrat;c:\windows\system32\drivers\vlnrqf.sys --> c:\windows\system32\drivers\vlnrqf.sys [?]
    S0 xzhuasmm;xzhuasmm;c:\windows\system32\drivers\stlq.sys --> c:\windows\system32\drivers\stlq.sys [?]
    S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [1/25/2007 1:31 PM 42000]
    S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [6/27/2009 4:48 PM 356920]

    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
    "c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{621FCD24-4498-4324-A81E-07D331376EDF}]
    c:\program files\PixiePack Codec Pack\InstallerHelper.exe
    .
    Contents of the 'Scheduled Tasks' folder

    2009-06-27 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]
    .
    .
    Supplementary Scan
    .
    uStart Page = hxxp://www.google.com
    uInternet Settings,ProxyOverride = *.local
    IE: &AOL Toolbar Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html
    IE: &Download All with FlashGet - c:\program files\FlashGet\jc_all.htm
    IE: &Download with FlashGet - c:\program files\FlashGet\jc_link.htm
    LSP: c:\windows\system32\imon.dll
    FF - ProfilePath - c:\documents and settings\beerboy\Application Data\Mozilla\Firefox\Profiles\c8avm3pr.default\
    FF - prefs.js: network.proxy.type - 2
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
    FF - plugin: c:\program files\Opera\program\plugins\npdivx32.dll
    FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-06-29 08:00
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************

    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{95808DC4-FA4A-4c74-92FE-5B863F82066B}]
    "ImagePath"="\??\c:\program files\CyberLink\PowerDVD\000.fcl"
    .
    LOCKED REGISTRY KEYS

    [HKEY_USERS\S-1-5-21-682003330-1960408961-839522115-1004\Software\SecuROM\License information*]
    "datasecu"=hex:36,e5,65,73,6c,95,61,1e,c9,2c,99,76,1c,00,1a,e0,ba,fe,a3,5b,76,
    ff,8f,25,39,3c,4d,0d,4c,52,95,4b,dd,67,c3,8c,c9,17,53,aa,dd,4a,36,89,3a,0e,\
    "rkeysecu"=hex:f2,5f,9d,45,56,7a,b9,ea,bb,8a,0b,ad,87,2f,43,cf
    .
    DLLs Loaded Under Running Processes

    - - - - - - - > 'winlogon.exe'(684)
    c:\windows\system32\Ati2evxx.dll
    c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
    c:\program files\common files\logishrd\bluetooth\LBTServ.dll

    - - - - - - - > 'lsass.exe'(740)
    c:\windows\system32\imon.dll

    - - - - - - - > 'explorer.exe'(1808)
    c:\program files\Logitech\SetPoint\GameHook.dll
    c:\program files\Logitech\SetPoint\lgscroll.dll
    c:\progra~1\WINDOW~3\wmpband.dll
    c:\windows\system32\ieframe.dll
    c:\windows\system32\OneX.DLL
    c:\windows\system32\eappprxy.dll
    c:\windows\system32\webcheck.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    Other Running Processes
    .
    c:\windows\system32\ati2evxx.exe
    c:\windows\system32\ati2evxx.exe
    c:\windows\system32\ZoneLabs\vsmon.exe
    c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    c:\program files\Bonjour\mDNSResponder.exe
    c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
    c:\program files\ESET\nod32krn.exe
    c:\program files\Raxco\PerfectDisk\PDAgent.exe
    c:\program files\CyberLink\Shared Files\RichVideo.exe
    c:\windows\system32\searchindexer.exe
    c:\windows\system32\wscntfy.exe
    c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    c:\program files\Common Files\Logishrd\KHAL2\KHALMNPR.exe
    c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
    c:\windows\system32\searchprotocolhost.exe
    c:\windows\system32\searchfilterhost.exe
    .
    **************************************************************************
    .
    Completion time: 2009-06-29 8:04 - machine was rebooted
    ComboFix-quarantined-files.txt 2009-06-29 12:04
    ComboFix2.txt 2009-06-29 11:03

    Pre-Run: 72,828,403,712 bytes free
    Post-Run: 72,807,374,848 bytes free

    258
  • showoff
    edited June 2009
    Hey Chaz i haven't seen the virus pop ups from NOD32.
  • showoff
    edited June 2009
    since the reboot
  • chiazchiaz
    edited June 2009
    I'm sorry, I made a mistake in the CFScript.

    Please delete CFScript.txt from your Desktop first.


    Next please open Notepad
    Click Start, then Run
    Type notepad.exe in the Run Box.

    2. Now copy/paste the entire content of the codebox below into the Notepad window:
    Driver::
hsbrat
xzhuasmm
    Save the above to your Desktop as CFScript.txt.

    4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

    CFScript.gif


    Once ComboFix is done, post the new log in your reply.

    Also let me know if you are still experiencing any problems with your PC.
  • showoff
    edited June 2009
    ok
  • showoff
    edited June 2009
    ComboFix 09-06-28.02 - beerboy 06/29/2009 8:20.3 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2559.2067 [GMT -4:00]
    Running from: c:\documents and settings\beerboy\Desktop\ComboFix.exe
    Command switches used :: c:\documents and settings\beerboy\Desktop\CFScript.txt..txt
    AV: Eset NOD32 antivirus system 2.51 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
    FW: ZoneAlarm Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
    * Resident AV is active

    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    \Service_hsbrat
    \Service_xzhuasmm


    ((((((((((((((((((((((((( Files Created from 2009-05-28 to 2009-06-29 )))))))))))))))))))))))))))))))
    .

    2009-06-29 11:02 . 2009-06-29 12:02
    dc----w- c:\windows\system32\dllcache\cache
    2009-06-29 01:08 . 2008-04-13 16:44 2560 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\USMT\iconlib.dll
    2009-06-29 01:00 . 2001-08-18 02:36 94720 -c--a-w- c:\windows\system32\dllcache\umaxud32.dll
    2009-06-29 00:59 . 2001-07-21 18:29 161568 -c--a-w- c:\windows\system32\dllcache\sgsmusb.sys
    2009-06-29 00:58 . 2001-08-18 02:36 44544 -c--a-w- c:\windows\system32\dllcache\ovui2.dll
    2009-06-29 00:57 . 2008-04-13 18:40 7040 -c--a-w- c:\windows\system32\dllcache\ltotape.sys
    2009-06-29 00:56 . 2001-08-17 17:28 50751 -c--a-w- c:\windows\system32\dllcache\hsf_tone.sys
    2009-06-29 00:55 . 2001-08-17 17:28 634134 -c--a-w- c:\windows\system32\dllcache\el656ct5.sys
    2009-06-29 00:54 . 2008-04-13 18:46 17024 -c--a-w- c:\windows\system32\dllcache\ccdecode.sys
    2009-06-29 00:53 . 2001-08-17 17:52 22400 -c--a-w- c:\windows\system32\dllcache\asc3350p.sys
    2009-06-29 00:52 . 2001-08-17 16:19 747392 -c--a-w- c:\windows\system32\dllcache\adm8830.sys
    2009-06-27 20:48 . 2009-06-27 20:49 66952 ----a-w- c:\windows\system32\drivers\iksysflt.sys
    2009-06-27 20:48 . 2009-06-27 20:49 81288 ----a-w- c:\windows\system32\drivers\iksyssec.sys
    2009-06-27 20:48 . 2009-06-27 20:49 40840 ----a-w- c:\windows\system32\drivers\ikfilesec.sys
    2009-06-27 20:48 . 2008-06-02 19:19 29576 ----a-w- c:\windows\system32\drivers\kcom.sys
    2009-06-27 20:48 . 2009-06-28 01:28
    d
    w- c:\program files\Spyware Doctor
    2009-06-27 20:48 . 2009-06-27 20:48
    d
    w- c:\documents and settings\beerboy\Application Data\PC Tools
    2009-06-06 23:11 . 2009-06-06 23:11
    d-sh--w- c:\documents and settings\NetworkService\IETldCache
    2009-06-06 06:16 . 2009-06-06 06:16
    d
    w- c:\program files\iPod
    2009-06-06 06:16 . 2009-06-06 06:16
    d
    w- c:\program files\iTunes
    2009-06-06 06:13 . 2009-06-06 06:13
    d
    w- c:\program files\QuickTime
    2009-06-06 06:09 . 2009-06-06 06:09 75048 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe
    2009-06-01 00:39 . 2009-06-01 00:39 390664 ----a-w- c:\documents and settings\beerboy\Application Data\Real\RealPlayer\Update\RealPlayer11.exe

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-06-29 12:04 . 2008-10-26 14:25 169936 ----a-w- c:\documents and settings\beerboy\Application Data\Mozilla\Firefox\Profiles\c8avm3pr.default\FlashGot.exe
    2009-06-29 11:49 . 2008-02-02 16:41
    d
    w- c:\program files\nbpro
    2009-06-29 11:09 . 2008-02-02 17:57
    d---a-w- c:\documents and settings\All Users\Application Data\TEMP
    2009-06-29 11:09 . 2008-10-24 16:41
    d
    w- c:\program files\FlashGet
    2009-06-28 23:38 . 2008-12-09 09:11
    d
    w- c:\program files\Malwarebytes' Anti-Malware
    2009-06-28 23:34 . 2009-03-24 15:23 3561743 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
    2009-06-28 01:28 . 2008-04-28 18:26 18824769 ----a-w- c:\windows\Internet Logs\tvDebug.zip
    2009-06-27 19:33 . 2008-02-03 05:25
    d
    w- c:\documents and settings\beerboy\Application Data\Vso
    2009-06-17 15:27 . 2008-12-09 09:11 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2009-06-17 15:27 . 2008-12-09 09:11 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
    2009-06-10 01:23 . 2008-02-10 18:21
    d
    w- c:\documents and settings\beerboy\Application Data\uTorrent
    2009-06-10 01:12 . 2009-02-01 22:54
    d
    w- c:\program files\LimeWire
    2009-06-10 01:12 . 2008-03-02 17:52
    d
    w- c:\documents and settings\beerboy\Application Data\LimeWire
    2009-06-06 06:16 . 2009-03-02 16:09
    d
    w- c:\program files\Common Files\Apple
    2009-05-29 17:36 . 2009-03-15 02:35 2060288 ----a-w- c:\windows\system32\usbaaplrc.dll
    2009-05-29 17:36 . 2009-03-02 16:09 39424 ----a-w- c:\windows\system32\drivers\usbaapl.sys
    2009-05-24 05:12 . 2009-05-24 05:12
    d
    w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
    2009-05-18 21:09 . 2009-05-18 21:09 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_motmodem_01005.Wdf
    2009-05-06 17:56 . 2008-12-27 19:35
    d
    w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
    2009-05-05 09:39 . 2008-11-18 14:09
    d
    w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
    2009-04-01 19:49 . 2008-02-02 16:11 4212 ---ha-w- c:\windows\system32\zllictbl.dat
    2008-12-16 22:06 . 2008-12-16 22:06 1058 ----a-w- c:\program files\xofl.txt
    2008-12-09 11:44 . 2008-12-09 11:44 2112 ----a-w- c:\program files\zqggku.txt
    2009-01-27 01:34 . 2009-01-27 01:34 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
    2009-01-27 01:34 . 2009-01-27 01:34 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
    2009-01-27 01:34 . 2009-01-27 01:34 1044480 ----a-w- c:\program files\opera\program\plugins\libdivx.dll
    2009-01-27 01:34 . 2009-01-27 01:34 200704 ----a-w- c:\program files\opera\program\plugins\ssldivx.dll
    .

    ((((((((((((((((((((((((((((( SnapShot@2009-06-29_11.02.01 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2009-06-29 11:02 . 2008-10-16 19:09 51224 c:\windows\system32\dllcache\cache\wuauclt.exe
    + 2009-06-29 11:02 . 2008-04-14 00:12 82432 c:\windows\system32\dllcache\cache\ws2_32.dll
    + 2009-06-29 11:02 . 2008-04-14 00:12 26112 c:\windows\system32\dllcache\cache\userinit.exe
    + 2009-06-29 11:02 . 2008-04-14 00:12 14336 c:\windows\system32\dllcache\cache\svchost.exe
    + 2009-06-29 11:02 . 2008-04-14 00:12 57856 c:\windows\system32\dllcache\cache\spoolsv.exe
    + 2009-06-29 11:02 . 2008-04-14 00:12 17408 c:\windows\system32\dllcache\cache\powrprof.dll
    + 2009-06-29 11:02 . 2008-04-14 00:12 13312 c:\windows\system32\dllcache\cache\lsass.exe
    + 2009-06-29 11:02 . 2008-04-13 18:39 24576 c:\windows\system32\dllcache\cache\kbdclass.sys
    + 2009-06-29 11:02 . 2008-04-13 18:53 36608 c:\windows\system32\dllcache\cache\ip6fw.sys
    + 2009-06-29 11:02 . 2008-04-14 00:12 15360 c:\windows\system32\dllcache\cache\ctfmon.exe
    - 2001-08-23 12:00 . 2008-11-18 12:28 507904 c:\windows\system32\winlogon.exe
    + 2001-08-23 12:00 . 2008-04-14 00:12 507904 c:\windows\system32\winlogon.exe
    - 2004-08-04 07:56 . 2008-04-14 00:12 507904 c:\windows\system32\dllcache\winlogon.exe
    + 2001-08-23 12:00 . 2008-04-14 00:12 507904 c:\windows\system32\dllcache\winlogon.exe
    + 2009-06-29 12:02 . 2008-04-14 00:12 507904 c:\windows\system32\dllcache\cache\winlogon.exe
    + 2009-06-29 11:02 . 2009-03-08 08:34 914944 c:\windows\system32\dllcache\cache\wininet.dll
    + 2009-06-29 11:02 . 2008-04-14 00:12 578560 c:\windows\system32\dllcache\cache\user32.dll
    + 2009-06-29 11:02 . 2008-04-14 00:12 295424 c:\windows\system32\dllcache\cache\termsrv.dll
    + 2009-06-29 11:02 . 2008-07-13 14:19 361600 c:\windows\system32\dllcache\cache\TCPIP.SYS
    + 2009-06-29 11:02 . 2009-02-06 11:11 110592 c:\windows\system32\dllcache\cache\services.exe
    + 2009-06-29 11:02 . 2008-04-13 19:20 182656 c:\windows\system32\dllcache\cache\ndis.sys
    + 2009-06-29 11:02 . 2009-03-21 14:06 989696 c:\windows\system32\dllcache\cache\kernel32.dll
    + 2009-06-29 11:02 . 2008-04-14 00:11 110080 c:\windows\system32\dllcache\cache\imm32.dll
    + 2009-06-29 11:02 . 2008-04-14 00:12 1614848 c:\windows\system32\dllcache\cache\sfcfiles.dll
    + 2009-06-29 11:02 . 2009-02-06 11:08 2189056 c:\windows\system32\dllcache\cache\ntoskrnl.exe
    + 2009-06-29 11:02 . 2009-02-07 23:02 2066048 c:\windows\system32\dllcache\cache\ntkrnlpa.exe
    + 2009-06-29 11:02 . 2008-04-14 00:12 1033728 c:\windows\system32\dllcache\cache\explorer.exe
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
    "nod32kui"="c:\program files\Eset\nod32kui.exe" [2006-05-31 921600]
    "ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-02-16 981384]
    "CTHelper"="CTHELPER.EXE" - c:\windows\CTHELPER.EXE [2006-08-11 17920]
    "CTxfiHlp"="CTXFIHLP.EXE" - c:\windows\system32\CTXFIHLP.EXE [2006-08-11 18944]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-2-23 805392]

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-27 304128]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
    2008-05-02 07:42 72208 ----a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
    BootExecute REG_MULTI_SZ PDBoot.exe\0autocheck autochk *

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
    @=&quot;"

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
    @=&quot;"

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
    @=&quot;"

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\WINDOWS\\system32\\PnkBstrA.exe"=
    "c:\\WINDOWS\\system32\\PnkBstrB.exe"=
    "c:\\Program Files\\uTorrent\\uTorrent.exe"=
    "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
    "c:\\Program Files\\LimeWire\\LimeWire.exe"=
    "c:\\Program Files\\FlashGet\\FlashGet.exe"=
    "c:\\Program Files\\AIM6\\aim6.exe"=
    "c:\\WINDOWS\\system32\\searchprotocolhost.exe"=
    "c:\\Program Files\\Common Files\\Nero\\Lib\\NMIndexingService.exe"=
    "c:\\Program Files\\ESET\\nod32krn.exe"=
    "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
    "%windir%\\explorer.exe"=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "c:\\Program Files\\ICQ6.5\\ICQ.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "7795:TCP"= 7795:TCP:BitComet 7795 TCP
    "7795:UDP"= 7795:UDP:BitComet 7795 UDP
    "18543:TCP"= 18543:TCP:BitComet 18543 TCP(ED2K)
    "18543:UDP"= 18543:UDP:BitComet 18543 UDP(ED2K)
    "18967:TCP"= 18967:TCP:BitComet 18967 TCP
    "18967:UDP"= 18967:UDP:BitComet 18967 UDP
    "16320:TCP"= 16320:TCP:BitComet 16320 TCP(ED2K)
    "16320:UDP"= 16320:UDP:BitComet 16320 UDP(ED2K)
    "20128:TCP"= 20128:TCP:BitComet 20128 TCP
    "20128:UDP"= 20128:UDP:BitComet 20128 UDP
    "15342:TCP"= 15342:TCP:port
    "21204:TCP"= 21204:TCP:port

    R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2/15/2008 5:07 PM 24652]
    R3 SaiH8000;SaiH8000;c:\windows\system32\drivers\SaiH8000.sys [7/30/2004 11:25 AM 56576]
    S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [1/25/2007 1:31 PM 42000]
    S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [6/27/2009 4:48 PM 356920]

    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
    "c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{621FCD24-4498-4324-A81E-07D331376EDF}]
    c:\program files\PixiePack Codec Pack\InstallerHelper.exe
    .
    Contents of the 'Scheduled Tasks' folder

    2009-06-27 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]
    .
    .
    Supplementary Scan
    .
    uStart Page = hxxp://www.google.com
    uInternet Settings,ProxyOverride = *.local
    IE: &AOL Toolbar Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html
    IE: &Download All with FlashGet - c:\program files\FlashGet\jc_all.htm
    IE: &Download with FlashGet - c:\program files\FlashGet\jc_link.htm
    LSP: c:\windows\system32\imon.dll
    FF - ProfilePath - c:\documents and settings\beerboy\Application Data\Mozilla\Firefox\Profiles\c8avm3pr.default\
    FF - prefs.js: network.proxy.type - 2
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
    FF - plugin: c:\program files\Opera\program\plugins\npdivx32.dll
    FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-06-29 08:25
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************

    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{95808DC4-FA4A-4c74-92FE-5B863F82066B}]
    "ImagePath"="\??\c:\program files\CyberLink\PowerDVD\000.fcl"
    .
    LOCKED REGISTRY KEYS

    [HKEY_USERS\S-1-5-21-682003330-1960408961-839522115-1004\Software\SecuROM\License information*]
    "datasecu"=hex:36,e5,65,73,6c,95,61,1e,c9,2c,99,76,1c,00,1a,e0,ba,fe,a3,5b,76,
    ff,8f,25,39,3c,4d,0d,4c,52,95,4b,dd,67,c3,8c,c9,17,53,aa,dd,4a,36,89,3a,0e,\
    "rkeysecu"=hex:f2,5f,9d,45,56,7a,b9,ea,bb,8a,0b,ad,87,2f,43,cf
    .
    DLLs Loaded Under Running Processes

    - - - - - - - > 'winlogon.exe'(676)
    c:\windows\system32\Ati2evxx.dll
    c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
    c:\program files\common files\logishrd\bluetooth\LBTServ.dll

    - - - - - - - > 'lsass.exe'(732)
    c:\windows\system32\imon.dll

    - - - - - - - > 'explorer.exe'(2616)
    c:\program files\Logitech\SetPoint\GameHook.dll
    c:\program files\Logitech\SetPoint\lgscroll.dll
    c:\windows\system32\ctagent.dll
    c:\progra~1\WINDOW~3\wmpband.dll
    c:\windows\system32\ieframe.dll
    c:\windows\system32\OneX.DLL
    c:\windows\system32\eappprxy.dll
    c:\windows\system32\webcheck.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    Other Running Processes
    .
    c:\windows\system32\ati2evxx.exe
    c:\windows\system32\ati2evxx.exe
    c:\windows\system32\ZoneLabs\vsmon.exe
    c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    c:\program files\Bonjour\mDNSResponder.exe
    c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
    c:\program files\ESET\nod32krn.exe
    c:\program files\Raxco\PerfectDisk\PDAgent.exe
    c:\program files\CyberLink\Shared Files\RichVideo.exe
    c:\windows\system32\searchindexer.exe
    c:\windows\system32\wscntfy.exe
    c:\program files\Raxco\PerfectDisk\PDEngine.exe
    c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    c:\program files\Common Files\Logishrd\KHAL2\KHALMNPR.exe
    c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
    .
    **************************************************************************
    .
    Completion time: 2009-06-29 8:29 - machine was rebooted
    ComboFix-quarantined-files.txt 2009-06-29 12:29
    ComboFix2.txt 2009-06-29 12:04
    ComboFix3.txt 2009-06-29 11:03

    Pre-Run: 72,816,828,416 bytes free
    Post-Run: 72,710,406,144 bytes free

    256
  • showoff
    edited June 2009
    Everything seems to be running smooth now no pop ups from NOD32 or when i open any other programs..... THXS CHIAZ UR DA FRIGGIN MAN!!!!!!!!!!!! thank you.
  • chiazchiaz
    edited June 2009
    Everything appears to be fine now, just that you have Viewpoint installed.

    Viewpoint Media Player/Manager/Toolbar is considered as foistware instead of malware since it is installed without users approval but doesn't spy or do anything "bad".

    This program is optional to remove. If you wish to proceed, go to Start > Settings > Control Panel > Add/Remove Programs and remove the following programs if present.
      [*] Viewpoint
      [*] Viewpoint Manager
      [*] Viewpoint Media Player
      [*] Viewpoint Toolbar
      [*] Viewpoint Experience Technology


      If you are having trouble removing Viewpoint, I suggest that you use ViewpointKiller. You may download it from this link.

      Once you have downloaded ViewpointKiller, unzip it to a convenient location such as your desktop. Run ViewpointKiller, and select File > Do All Killings. Follow the prompts, selecting Yes or No, depending on which selection you are most comfortable with. A logfile will be created in the folder you unzipped ViewpointKiller to, please paste the contents here.



      If you choose not to remove ViewPoint, then our work is done here.


      Let me know what way you decide to go, so that I will know when to retire this thread.
    • showoff
      edited June 2009
      chiaz wrote:
      Everything appears to be fine now, just that you have Viewpoint installed.

      Viewpoint Media Player/Manager/Toolbar is considered as foistware instead of malware since it is installed without users approval but doesn't spy or do anything "bad".

      This program is optional to remove. If you wish to proceed, go to Start > Settings > Control Panel > Add/Remove Programs and remove the following programs if present.
      • Viewpoint
      • Viewpoint Manager
      • Viewpoint Media Player
      • Viewpoint Toolbar
      • Viewpoint Experience Technology

      If you are having trouble removing Viewpoint, I suggest that you use ViewpointKiller. You may download it from this link.

      Once you have downloaded ViewpointKiller, unzip it to a convenient location such as your desktop. Run ViewpointKiller, and select File > Do All Killings. Follow the prompts, selecting Yes or No, depending on which selection you are most comfortable with. A logfile will be created in the folder you unzipped ViewpointKiller to, please paste the contents here.


      ok will do..anything else?
    • chiazchiaz
      edited June 2009
      It's time to remove ComboFix.

      Go to to Start > Run
      Type in box

      combofix /u

      Note: the space between the X and the /u

      Press Enter.

      This command will:

      Delete the following:
      ComboFix and its associated files and folders.
      VundoFix backups, if present
      The C:\Deckard folder, if present
      The C:_OtMoveIt folder, if present

      Reset the clock settings.
      Hide file extensions, if required.
      Hide System/Hidden files, if required.
      Reset System Restore.
    • showoff
      edited June 2009
      ViewpointKiller Version 1.30 (beta)

      The removal process was started on Mon Jun 29 08:50:01 2009

      Preparing to remove Viewpoint Media Player...



      Warning accepted, beginning removal process....



      ViewpointKiller determined that "aim.exe" was not running.

      ViewpointKiller determined that "aim6.exe" was not running.

      ViewpointKiller determined that "aolsoftware.exe" was not running.

      ViewpointKiller determined that "aol.exe" was not running.

      ViewpointKiller determined that "MtsAxInstaller.exe" was not running.



      Preparing to close the Viewpoint Manager Service if it is running...

      Closing "Viewpoint Manager Service" failed, or the service is not running.





      Searching for all known Viewpoint Media Player registry values and keys...

      Found and removed: SOFTWARE\Viewpoint

      Finished searching for and removing all known Viewpoint Media Player registry values and keys.



      Searching for all known Viewpoint Media Player files and folders...

      Found and removed: C:\Documents and Settings\All Users\Application Data\Viewpoint

      Finished searching for and removing all known Viewpoint Media Player files and folders.



      Finished reporting.
      ViewpointKiller Version 1.30 (beta)

      The removal process was started on Mon Jun 29 08:50:40 2009

      Preparing to remove Viewpoint Manager...



      ViewpointKiller determined that "viewmgr.exe" was not running.

      Searching for all known Viewpoint Manager registry values and keys...

      Found and removed: Software\Microsoft\Windows\CurrentVersion\Uninstall\Viewpoint Manager

      Finished searching for and removing all known Viewpoint Manager registry values and keys.



      Searching for all known Viewpoint Manager files and folders...

      Finished searching for and removing all known Viewpoint Manager files and folders.



      Finished reporting.
      ViewpointKiller Version 1.30 (beta)

      The removal process was started on Mon Jun 29 08:50:43 2009

      Preparing to remove Viewpoint Toolbar...



      ViewpointKiller determined that "FotomatDeviceConnect.exe" was not running.

      ViewpointKiller determined that "iexplore.exe" was not running.



      Searming for all known Viewpoint Toolbar registry values and keys...

      Finished searching for and removing all known Viewpoint Toolbar registry values and keys.



      Searching for all known Viewpoint Toolbar files and folders...

      Finished searching for and removing all known Viewpoint Toolbar files and folders.



      Finished reporting.
      ViewpointKiller Version 1.30 (beta)

      The removal process was started on Mon Jun 29 08:50:58 2009

      Preparing to remove Viewpoint Media Player...



      Warning accepted, beginning removal process....



      ViewpointKiller determined that "aim.exe" was not running.

      ViewpointKiller determined that "aim6.exe" was not running.

      ViewpointKiller determined that "aolsoftware.exe" was not running.

      ViewpointKiller determined that "aol.exe" was not running.

      ViewpointKiller determined that "MtsAxInstaller.exe" was not running.



      Preparing to close the Viewpoint Manager Service if it is running...

      Closing "Viewpoint Manager Service" failed, or the service is not running.





      Searching for all known Viewpoint Media Player registry values and keys...

      Finished searching for and removing all known Viewpoint Media Player registry values and keys.



      Searching for all known Viewpoint Media Player files and folders...

      Finished searching for and removing all known Viewpoint Media Player files and folders.



      Finished reporting.
      ViewpointKiller Version 1.30 (beta)

      The removal process was started on Mon Jun 29 08:51:00 2009

      Preparing to remove Viewpoint Manager...



      ViewpointKiller determined that "viewmgr.exe" was not running.

      Searching for all known Viewpoint Manager registry values and keys...

      Finished searching for and removing all known Viewpoint Manager registry values and keys.



      Searching for all known Viewpoint Manager files and folders...

      Finished searching for and removing all known Viewpoint Manager files and folders.



      Finished reporting.
      ViewpointKiller Version 1.30 (beta)

      The removal process was started on Mon Jun 29 08:51:01 2009

      Preparing to remove Viewpoint Toolbar...



      ViewpointKiller determined that "FotomatDeviceConnect.exe" was not running.

      ViewpointKiller determined that "iexplore.exe" was not running.



      Searming for all known Viewpoint Toolbar registry values and keys...

      Finished searching for and removing all known Viewpoint Toolbar registry values and keys.



      Searching for all known Viewpoint Toolbar files and folders...

      Finished searching for and removing all known Viewpoint Toolbar files and folders.



      Finished reporting.
    • chiazchiaz
      edited June 2009
      OK, read my last post on uninstalling ComboFix.

      And we are all done here. :)
    • showoff
      edited June 2009
      Ok thxs again bro your the best....
    • chiazchiaz
      edited June 2009
      Glad we could be of assistance! The help you received here was free.

      This topic is now closed. If you wish it reopened, please send a Private Message to Trogan with a link to your thread.

      If you are not the user who started this thread, you must start your own Thread instead :)
      _______________________________

      Have we helped you with any issues you have had with your PCs or other items? If so, you can now help us by Joining Team 93 and fold for a cure.
    Sign In or Register to comment.