[Closed] Ultra Virus

Welcome! Register for a free account (or login) > How does it work?

Quickly register. It will only take 60 seconds.
Start a new topic. Ask your question. Wait for an email reply.
Is your system infected? Begin reading the malware removal guide.

What the Tech > Spyware / Malware / Virus Removal > Infections Removal

[Closed] Ultra Virus, help appreciated

Options

Aleks View Member Profile	Apr 14 2009, 06:47 PM Post #1
Authentic Member Group: Authentic Member Posts: 21 Joined: 28-December 08 Member No.: 83,239 Operating System: Windows XP	Hey everyone. Heres my story. The other day I went onto facebook and through some inderect downloads recieved a viurs. This particular one set up a bunch of random site cookies on my computer preventing from going on any site other than the one it wants me to go to. These sites include engines like getsearch0303 and some weird "findhunter" one. With that I also recieve the constant spyware pop-up telling me I need to download spyware along with other annoying advertisements. My computer speed has also dramatically slowed down. If theres ANYONE that can help me with this I would be in your debt Here is my Hijack log, I already have ComboFix and Malware installed for future refrences. Thank You! EDIT: I've had to resort to using my laptop from now, seems this trojan (or whatever it is) has a mind of its own and has decided that everything including google is a threat and won't let me go on it. Im completely baffled about what to do at this point. Sorry for being so inpatient but looks like youre my last resort unless I bring it to a computer shop. Once again thank you and any help would be greatly admired. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:53, on 2009-04-14 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16791) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\nvsvc32.exe c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe C:\WINDOWS\system32\svchost.exe c:\WINDOWS\system32\ZuneBusEnum.exe C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\Program Files\QuickTime\qttask.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Zune\ZuneLauncher.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\AIM\aim.exe C:\program files\steam\steam.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Registry Mechanic\RegMech.exe C:\WINDOWS\system32\dll32.exe C:\WINDOWS\system32\wscntfy.exe C:\Documents and Settings\Me\Desktop\Xfire\xfire.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:7171 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = .local;<local> O1 - Hosts: ::1 localhost O1 - Hosts: 94.232.248.53 browser-security.microsoft.com O1 - Hosts: 94.232.248.53 spy-wareprotector2009.com O1 - Hosts: 94.232.248.53 www.spy-wareprotector2009.com O1 - Hosts: 94.232.248.53 secure.spy-wareprotector2009.com O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: 887164 helper - {5FF186E7-0957-4095-8A2C-577CE6EA1B1F} - C:\WINDOWS\system32\887164\887164.dll O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: BHO - {ABD45510-9B22-41cd-9ACD-8182A2DA7C63} - C:\WINDOWS\system32\iehelper.dll O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe" O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe O4 - HKLM\..\Run: [Ulead AutoDetector v2] C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe O4 - HKLM\..\Run: [USB2Check] RUNDLL32.EXE "C:\WINDOWS\system32\PCLECoInst.dll",CheckUSBController O4 - HKLM\..\Run: [USBToolTip] "C:\Program Files\Pinnacle\Shared Files\\Programs\USBTip\USBTip.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Zune Launcher] "c:\Program Files\Zune\ZuneLauncher.exe" O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [realteczs] "C:\Documents and Settings\Me\Application Data\Google\pfysw721318.exe" 2 O4 - HKLM\..\Run: [sysldtray] C:\windows\ld07.exe O4 - HKLM\..\Run: [pp] C:\windows\pp06.exe O4 - HKLM\..\Run: [sysfbtray] C:\windows\freddy40.exe O4 - HKLM\..\Run: [sysmstray] C:\windows\mstre17.exe O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [RegistryMechanic] C:\Program Files\Registry Mechanic\RegMech.exe /H O4 - HKCU\..\Run: [dll32] dll32 O4 - HKCU\..\Run: [system tool] C:\WINDOWS\sysguard.exe O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user') O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe O4 - Startup: Xfire.lnk = C:\Documents and Settings\Me\Desktop\Xfire\xfire.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.srtest.com/srl_bin/sysreqlab3.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1192098404078 O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo.../sysreqlab2.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1192098236312 O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownlo...iaSmartScan.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe (file missing) -- End of file - 8722 bytes This post has been edited by Aleks*: Apr 15 2009, 06:18 PM

Replies

Aleks View Member Profile	Apr 19 2009, 06:52 PM Post #2
Authentic Member Group: Authentic Member Posts: 21 Joined: 28-December 08 Member No.: 83,239 Operating System: Windows XP	Sorry it took so long to respond, but thanks a lot for responding! Here are my logs in order 1. Rooter log 2. SDFix log 3. ComboFixLog 4. Fresh HJT Log Rooter Log Microsoft Windows XP Home Edition (5.1.2600) Service Pack 2 A:\ [Removable] (Total:0 Mo/Free:0 Mo) C:\ [Fixed] - NTFS - (Total:305234 Mo/Free:2440 Mo) D:\ [CD-Rom] (Total:0 Mo/Free:0 Mo) E:\ [Fixed] - NTFS - (Total:194466 Mo/Free:2955 Mo) F:\ [Removable] (Total:1919 Mo/Free:1371 Mo) 2009-04-19\|17:47 ----------------------\\ Processes.. --Locked-- [System Process] ---------- System ---------- \SystemRoot\System32\smss.exe ---------- \??\C:\WINDOWS\system32\csrss.exe ---------- \??\C:\WINDOWS\system32\winlogon.exe ---------- C:\WINDOWS\system32\services.exe ---------- C:\WINDOWS\system32\lsass.exe ---------- C:\WINDOWS\system32\svchost.exe ---------- C:\WINDOWS\system32\svchost.exe ---------- C:\WINDOWS\System32\svchost.exe ---------- C:\WINDOWS\system32\svchost.exe ---------- C:\WINDOWS\system32\svchost.exe ---------- C:\WINDOWS\system32\svchost.exe ---------- C:\WINDOWS\system32\spoolsv.exe ---------- C:\WINDOWS\system32\svchost.exe ---------- C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe ---------- C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe ---------- C:\PROGRA~1\Grisoft\AVG7\avgemc.exe ---------- C:\WINDOWS\System32\svchost.exe ---------- C:\Program Files\Java\jre6\bin\jqs.exe ---------- c:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe ---------- C:\WINDOWS\system32\nvsvc32.exe ---------- c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe ---------- C:\WINDOWS\system32\svchost.exe ---------- c:\WINDOWS\system32\ZuneBusEnum.exe ---------- c:\Program Files\Zune\ZuneNss.exe ---------- C:\WINDOWS\System32\alg.exe ---------- C:\WINDOWS\system32\wscntfy.exe ---------- C:\WINDOWS\Explorer.EXE ---------- C:\PROGRA~1\Grisoft\AVG7\avgcc.exe ---------- C:\Program Files\QuickTime\qttask.exe ---------- C:\Program Files\HP\HP Software Update\HPWuSchd.exe ---------- C:\Program Files\HP\hpcoretech\hpcmpmgr.exe ---------- C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe ---------- C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe ---------- C:\WINDOWS\system32\rundll32.exe ---------- C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe ---------- C:\WINDOWS\RTHDCPL.EXE ---------- C:\Program Files\Zune\ZuneLauncher.exe ---------- C:\WINDOWS\system32\RUNDLL32.EXE ---------- C:\Program Files\Java\jre6\bin\jusched.exe ---------- C:\Program Files\AIM\aim.exe ---------- C:\program files\steam\steam.exe ---------- C:\Program Files\Messenger\msmsgs.exe ---------- C:\WINDOWS\system32\ctfmon.exe ---------- C:\Program Files\Registry Mechanic\RegMech.exe ---------- C:\WINDOWS\sysguard.exe ---------- C:\WINDOWS\system32\wuauclt.exe ---------- C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe ---------- C:\Documents and Settings\Me\Desktop\Xfire\xfire.exe ---------- C:\WINDOWS\system32\wbem\wmiprvse.exe ---------- C:\WINDOWS\system32\wuauclt.exe ---------- C:\PROGRA~1\WINDOW~1\ACCESS~1\wordpad.exe ---------- C:\WINDOWS\system32\cmd.exe ---------- C:\Rooter$\RK.exe ----------------------\\ Search.. ----------------------\\ ROOTKIT !! ----------------------\\ KoobFace ! C:\WINDOWS\msmark2.dat 1 - "C:\Rooter$\Rooter_1.txt" - 2009-04-19\|17:48 ----------------------\\ Scan completed at 17:48 SDFix Log SDFix: Version 1.240 Run by Me on 2009-04-19 at 17:59 Microsoft Windows XP [Version 5.1.2600] Running From: C:\SDFix Checking Services : Restoring Default Security Values Restoring Default Hosts File Rebooting Checking Files : No Trojan Files Found Removing Temp Files ADS Check : Final Check : catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-04-19 18:10:21 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... scanning hidden registry entries ... [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher] "TracesProcessed"=dword:0000015c [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "DeviceNotSelectedTimeout"="15" "GDIProcessHandleQuota"=dword:00002710 "Spooler"="yes" "swapdisk"="" "TransmissionRetryTimeout"="90" "USERProcessHandleQuota"=dword:00002710 "appinit_dlls"="" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{2B508D48-0306-9B9A-2351-4EAA4AB67FDD}] scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services : Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe::enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"="C:\\Program Files\\Grisoft\\AVG7\\avginet.exe::Enabled:avginet.exe" "C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe::Enabled:avgamsvr.exe" "C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe::Enabled:avgcc.exe" "C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe::Enabled:avgemc.exe" "C:\\Program Files\\THQ\\Dawn of War - Dark Crusade\\DarkCrusade.exe"="C:\\Program Files\\THQ\\Dawn of War - Dark Crusade\\DarkCrusade.exe::Enabled:DarkCrusade" "C:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"="C:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe::Enabled:Battlefield 2" "C:\\Program Files\\AIM\\aim.exe"="C:\\Program Files\\AIM\\aim.exe::Enabled:AOL Instant Messenger" "C:\\Program Files\\World of Warcraft\\WoW-2.1.0-enUS-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-2.1.0-enUS-downloader.exe::Enabled:Blizzard Downloader" "C:\\Program Files\\Steam\\Steam.exe"="C:\\Program Files\\Steam\\Steam.exe::Enabled:Steam Client" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe::Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\Steam\\steamapps\\01468\\counter-strike source\\hl2.exe"="C:\\Program Files\\Steam\\steamapps\\01468\\counter-strike source\\hl2.exe::Enabled:hl2" "C:\\Program Files\\Pinnacle\\Studio 10\\programs\\RM.exe"="C:\\Program Files\\Pinnacle\\Studio 10\\programs\\RM.exe::Enabled:Render Manager" "C:\\Program Files\\Pinnacle\\Studio 10\\programs\\Studio.exe"="C:\\Program Files\\Pinnacle\\Studio 10\\programs\\Studio.exe::Enabled:Studio" "C:\\Program Files\\Pinnacle\\Studio 10\\programs\\PMSRegisterFile.exe"="C:\\Program Files\\Pinnacle\\Studio 10\\programs\\PMSRegisterFile.exe::Enabled:PMSRegisterFile" "C:\\Program Files\\Pinnacle\\Shared Files\\Programs\\MediaManager\\PMSManager.exe"="C:\\Program Files\\Pinnacle\\Shared Files\\Programs\\MediaManager\\PMSManager.exe::Enabled:PMSManager" "C:\\Program Files\\Pinnacle\\Studio 10\\programs\\umi.exe"="C:\\Program Files\\Pinnacle\\Studio 10\\programs\\umi.exe::Enabled:umi" "C:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"="C:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe::Enabled:Blizzard Downloader" "C:\\WINDOWS\\system32\\dpvsetup.exe"="C:\\WINDOWS\\system32\\dpvsetup.exe::Enabled:Microsoft DirectPlay Voice Test" "C:\\Documents and Settings\\Me\\Desktop\\Xfire\\xfire.exe"="C:\\Documents and Settings\\Me\\Desktop\\Xfire\\xfire.exe::Enabled:Xfire" "C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe::Enabled:Windows Messenger" "C:\\Program Files\\Common Files\\Microsoft Shared\\XNA\\XnaTrans\\v3.0\\XnaTransX.exe"="C:\\Program Files\\Common Files\\Microsoft Shared\\XNA\\XnaTrans\\v3.0\\XnaTransX.exe:LocalSubNet:Enabled:XNA Game Studio 3.0 Transport" "C:\\Program Files\\Microsoft XNA\\XNA Game Studio\\v3.0\\Bin\\XnaLiveProxy.exe"="C:\\Program Files\\Microsoft XNA\\XNA Game Studio\\v3.0\\Bin\\XnaLiveProxy.exe:LocalSubNet:Enabled:XNA Framework Games for Windows - LIVE" "C:\\Program Files\\Steam\\steamapps\\01468\\source sdk base\\hl2.exe"="C:\\Program Files\\Steam\\steamapps\\01468\\source sdk base\\hl2.exe::Enabled:hl2" "C:\\Program Files\\THQ\\Titan Quest Immortal Throne\\Tqit.exe"="C:\\Program Files\\THQ\\Titan Quest Immortal Throne\\Tqit.exe::Enabled:Tqit" "C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe::Enabled:LimeWire" "C:\\Program Files\\THQ\\Titan Quest\\Titan Quest.exe"="C:\\Program Files\\THQ\\Titan Quest\\Titan Quest.exe::Enabled:Titan Quest" "C:\\Documents and Settings\\Me\\Desktop\\Phone\\Skype.exe"="C:\\Documents and Settings\\Me\\Desktop\\Phone\\Skype.exe::Enabled:Skype" "%windir%\\system32\\drivers\\svchost.exe"="%windir%\\system32\\drivers\\svchost.exe::Enabled:svchost" "C:\\Documents and Settings\\Me\\Desktop\\Skype.exe"="C:\\Documents and Settings\\Me\\Desktop\\Skype.exe::Enabled:Skype" "C:\\Program Files\\Common Files\\Ulead Systems\\AutoDetector\\Monitor.exe"="C:\\Program Files\\Common Files\\Ulead Systems\\AutoDetector\\Monitor.exe::Enabled:monitor" "C:\\Program Files\\Java\\jre6\\bin\\jucheck.exe"="C:\\Program Files\\Java\\jre6\\bin\\jucheck.exe::Enabled:jucheck" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe::enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe::Enabled:@xpsp3res.dll,-20000" "%windir%\\system32\\drivers\\svchost.exe"="%windir%\\system32\\drivers\\svchost.exe::Enabled:svchost" Remaining Files* : Files with Hidden Attributes : Tue 14 Apr 2009 28,160 ...H. --- "C:\WINDOWS\freddy41.exe" Sun 12 Apr 2009 24,576 ...H. --- "C:\WINDOWS\mstre16.exe" Wed 22 Oct 2008 949,072 A.SHR --- "C:\Program Files\File Scanner Library (Spybot - Search & Destroy)\advcheck.dll" Wed 22 Oct 2008 962,896 A.SHR --- "C:\Program Files\Misc. Support Library (Spybot - Search & Destroy)\Tools.dll" Mon 15 Sep 2008 1,562,960 A.SHR --- "C:\Program Files\SDHelper (Spybot - Search & Destroy)\SDHelper.dll" Tue 16 Sep 2008 1,833,296 A.SHR --- "C:\Program Files\TeaTimer (Spybot - Search & Destroy)\TeaTimer.exe" Sun 11 Jan 2009 69,632 A.SH. --- "C:\WINDOWS\system32\bufezeza.dll.tmp" Sun 12 Apr 2009 64,000 A.SH. --- "C:\WINDOWS\system32\tiyunike.exe" Sat 11 Apr 2009 62,976 A.SH. --- "C:\WINDOWS\system32\yivozizi.exe" Thu 11 Oct 2007 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Sat 20 Aug 2005 121,237 A..HR --- "C:\Program Files\THQ\Dawn of War\Disk1Check.EXE" Tue 23 Sep 2008 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp" Finished! Combo Fix Log ComboFix 09-04-20.02 - Me 2009-04-19 18:26.3 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.2559.2002 [GMT -4:00] Running from: F:\ComboFix.exe AV: AVG 7.5.524 On-access scanning enabled (Outdated) * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\sysguard.exe c:\windows\system32\887164 c:\windows\system32\887164\887164.dll c:\windows\system32\iehelper.dll c:\windows\system32\nfr.assembly c:\windows\system32\nfr.gpref . ---- Previous Run ------- . c:\windows\system32\batiweja.dll c:\windows\system32\bekoduya.dll c:\windows\system32\jonefede.dll c:\windows\system32\juvoguru.dll c:\windows\system32\puwisuro.dll c:\windows\system32\titohoru.dll c:\windows\system32\urugovuj.ini . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_SERVERTIME -------\Service_ServerTime ((((((((((((((((((((((((( Files Created from 2009-03-20 to 2009-04-20 ))))))))))))))))))))))))))))))) . 2009-04-19 21:53 . 2009-04-19 21:53 -------- d-----w c:\windows\ERUNT 2009-04-19 21:49 . 2009-04-19 22:12 -------- d-----w C:\SDFix 2009-04-19 21:47 . 2009-04-19 21:48 -------- d-----w C:\Rooter$ 2009-04-15 22:54 . 2009-04-15 22:54 197 ----a-w c:\windows\system32\MRT.INI 2009-04-15 19:29 . 2009-04-15 19:29 138 ----a-w C:\pch.bat 2009-04-15 19:27 . 2009-04-15 19:27 2 ---h--w c:\windows\t55ft2772f44.dat 2009-04-14 22:42 . 2009-04-14 22:42 2 ---h--w c:\windows\t55ft2831f44.dat 2009-04-14 22:42 . 2009-04-14 22:42 28160 ---h--w c:\windows\freddy41.exe 2009-04-14 22:42 . 2009-04-14 22:42 2 ---h--w c:\windows\t55ft2804f44.dat 2009-04-12 19:39 . 2009-04-12 19:39 1 ----a-w c:\windows\9g2234wesdf3dfgjf23 2009-04-12 19:39 . 2009-04-12 19:39 24576 ---h--w c:\windows\mstre16.exe 2009-04-12 19:39 . 2009-04-12 19:39 2 ---h--w c:\windows\t55ft2830f44.dat 2009-04-12 19:39 . 2009-04-12 19:39 1 ---h--w c:\windows\msmark2.dat 2009-04-12 19:39 . 2009-04-12 19:39 2 ---h--w c:\windows\t55ft2803f44.dat 2009-04-12 19:39 . 2009-04-12 19:39 1 ---h--w c:\windows\f23567.dat 2009-04-05 02:11 . 2009-04-05 02:11 54156 ---ha-w c:\windows\QTFont.qfn 2009-04-05 02:11 . 2009-04-05 02:11 1409 ----a-w c:\windows\QTFont.for 2009-03-25 17:24 . 2009-03-25 17:24 20472 ----a-w c:\windows\system32\drivers\icsak.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-04-20 22:26 . 2007-08-13 17:10 -------- d-----w c:\program files\Steam 2009-04-19 22:15 . 2009-01-04 17:23 -------- d-----w c:\documents and settings\Me\Application Data\Hamachi 2009-04-19 22:13 . 2008-01-13 23:48 -------- d---a-w c:\documents and settings\All Users\Application Data\TEMP 2009-04-19 21:48 . 2009-04-19 21:48 3231 ----a-w C:\Rooter.txt 2009-04-14 22:40 . 2007-07-26 19:38 -------- d-----w c:\program files\Spybot - Search & Destroy 2009-04-14 00:53 . 2007-07-26 19:38 -------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2009-04-13 22:56 . 2007-07-26 19:45 -------- d-----w c:\documents and settings\Me\Application Data\AVG7 2009-04-12 19:22 . 2007-07-30 21:01 -------- d-----w c:\documents and settings\Me\Application Data\Xfire 2009-04-12 14:23 . 2009-01-12 14:23 64000 --sha-w c:\windows\system32\tiyunike.exe 2009-04-11 21:12 . 2008-12-29 19:08 -------- d-----w c:\program files\World of Warcraft 2009-04-11 20:06 . 2009-01-11 20:06 62976 --sha-w c:\windows\system32\yivozizi.exe 2009-04-09 02:04 . 2008-10-02 23:06 -------- d-----w c:\documents and settings\Me\Application Data\LimeWire 2009-04-05 19:25 . 2008-10-06 00:54 -------- d-----w c:\program files\FreeUndelete 2009-04-05 19:24 . 2009-04-01 23:58 -------- d-----w c:\program files\MindArk 2009-04-01 23:03 . 2007-07-30 20:58 -------- d-----w c:\documents and settings\Me\Application Data\Skype 2009-03-31 23:37 . 2009-03-01 20:59 -------- d-----w c:\program files\Celtx 2009-03-31 00:20 . 2008-08-16 04:04 -------- d-----w c:\program files\Audacity 2009-03-06 14:00 . 2004-08-04 10:00 284160 ----a-w c:\windows\system32\pdh.dll 2009-03-03 00:18 . 2006-03-04 03:33 826368 ----a-w c:\windows\system32\wininet.dll 2009-03-01 20:59 . 2009-03-01 20:59 -------- d-----w c:\documents and settings\Me\Application Data\Greyfirst 2009-02-22 20:07 . 2008-10-02 23:01 -------- d-----w c:\program files\LimeWire 2009-02-22 16:35 . 2009-02-08 22:11 -------- d-----w c:\documents and settings\Me\Application Data\Audacity 2009-02-20 18:09 . 2004-08-04 10:00 78336 ----a-w c:\windows\system32\ieencode.dll 2009-02-09 10:19 . 2004-08-04 10:00 1846272 ----a-w c:\windows\system32\win32k.sys 2009-02-09 10:01 . 2004-08-04 10:00 728576 ----a-w c:\windows\system32\lsasrv.dll 2009-02-09 10:01 . 2004-08-04 10:00 617984 ----a-w c:\windows\system32\advapi32.dll 2009-02-09 10:01 . 2004-08-04 10:00 401408 ----a-w c:\windows\system32\rpcss.dll 2009-02-09 10:01 . 2004-08-04 10:00 715264 ----a-w c:\windows\system32\ntdll.dll 2009-02-06 10:29 . 2005-03-30 01:21 2142720 ----a-w c:\windows\system32\ntoskrnl.exe 2009-02-06 10:22 . 2004-08-04 10:00 110592 ----a-w c:\windows\system32\services.exe 2009-02-06 09:54 . 2004-08-04 10:00 35328 ----a-w c:\windows\system32\sc.exe 2009-02-06 09:49 . 2005-03-30 01:01 2020864 ----a-w c:\windows\system32\ntkrnlpa.exe 2009-02-03 20:08 . 2004-08-04 10:00 55808 ----a-w c:\windows\system32\secur32.dll 2009-02-03 02:05 . 2009-02-03 02:05 410984 ----a-w c:\windows\system32\deploytk.dll 2009-01-23 01:18 . 2009-01-23 01:18 42320 ----a-w c:\windows\system32\xfcodec.dll 2008-09-23 23:00 . 2007-08-12 01:06 44184 ----a-w c:\documents and settings\Me\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2008-09-23 22:33 . 2008-09-23 22:33 109288 ----a-w c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat 2008-07-02 18:56 . 2008-07-02 03:19 22328 ----a-w c:\documents and settings\Me\Application Data\PnkBstrK.sys 2008-01-14 00:26 . 2008-01-14 00:26 125 ----a-w c:\documents and settings\Me\Local Settings\Application Data\fusioncache.dat 2002-07-26 21:02 . 2008-01-28 21:55 153088 ----a-w c:\program files\UNWISE.EXE 2009-01-11 20:01 . 2009-01-11 20:01 69632 --sha-w c:\windows\system32\bufezeza.dll.tmp . ((((((((((((((((((((((((((((((((((((((((((((( AWF )))))))))))))))))))))))))))))))))))))))))))))))))))))))))) . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AIM"="c:\program files\AIM\aim.exe" [2006-08-01 67112] "Steam"="c:\program files\steam\steam.exe" [2008-10-08 1410296] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] "RegistryMechanic"="c:\program files\Registry Mechanic\RegMech.exe" [2008-07-08 2828184] "system tool"="c:\windows\sysguard.exe" [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AVG7_CC"="c:\progra~1\Grisoft\AVG7\avgcc.exe" [2008-04-16 579584] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-17 13574144] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-01-14 98304] "PinnacleDriverCheck"="c:\windows\system32\PSDrvCheck.exe" [2004-03-11 406016] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd.exe" [2003-08-04 49152] "HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 241664] "Ulead AutoDetector v2"="c:\program files\Common Files\Ulead Systems\AutoDetector\monitor.exe" [2004-11-26 90112] "USB2Check"="c:\windows\system32\PCLECoInst.dll" [2005-12-21 73728] "USBToolTip"="c:\program files\Pinnacle\Shared Files\\Programs\USBTip\USBTip.exe" [2006-01-23 196608] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792] "Zune Launcher"="c:\program files\Zune\ZuneLauncher.exe" [2008-09-12 160160] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-17 86016] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-03 136600] "realteczs"="c:\documents and settings\Me\Application Data\Google\pfysw721318.exe" [N/A] "sysmstray"="c:\windows\mstre17.exe" [N/A] "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-09-17 1657376] "DXDllRegExe"="dxdllreg.exe" [N/A] "RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2005-09-22 14854144] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "AVG7_Run"="c:\progra~1\Grisoft\AVG7\avgw.exe" [2007-10-30 219136] c:\documents and settings\Me\Start Menu\Programs\Startup\ hamachi.lnk - c:\program files\Hamachi\hamachi.exe [2009-1-4 625952] Xfire.lnk - c:\documents and settings\Me\Desktop\Xfire\xfire.exe [2009-1-22 2993488] c:\documents and settings\All Users\Start Menu\Programs\Startup\ HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2003-9-16 237568] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Grisoft\\AVG7\\avginet.exe"= "c:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"= "c:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"= "c:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"= "c:\\Program Files\\THQ\\Dawn of War - Dark Crusade\\DarkCrusade.exe"= "c:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"= "c:\\Program Files\\AIM\\aim.exe"= "c:\\Program Files\\Steam\\Steam.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Steam\\steamapps\\01468\\counter-strike source\\hl2.exe"= "c:\\Program Files\\Pinnacle\\Studio 10\\programs\\RM.exe"= "c:\\Program Files\\Pinnacle\\Studio 10\\programs\\Studio.exe"= "c:\\Program Files\\Pinnacle\\Studio 10\\programs\\PMSRegisterFile.exe"= "c:\\Program Files\\Pinnacle\\Shared Files\\Programs\\MediaManager\\PMSManager.exe"= "c:\\Program Files\\Pinnacle\\Studio 10\\programs\\umi.exe"= "c:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"= "c:\\WINDOWS\\system32\\dpvsetup.exe"= "c:\\Documents and Settings\\Me\\Desktop\\Xfire\\xfire.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\Steam\\steamapps\\01468\\source sdk base\\hl2.exe"= "c:\\Program Files\\THQ\\Titan Quest Immortal Throne\\Tqit.exe"= "c:\\Program Files\\LimeWire\\LimeWire.exe"= "c:\\Program Files\\THQ\\Titan Quest\\Titan Quest.exe"= "c:\\Program Files\\World of Warcraft\\WoW-2.4.0-enUS-downloader.exe"= "c:\\Documents and Settings\\Me\\Desktop\\Phone\\Skype.exe"= "%windir%\\system32\\drivers\\svchost.exe"= "c:\\Documents and Settings\\Me\\Desktop\\Skype.exe"= "c:\\Program Files\\Common Files\\Ulead Systems\\AutoDetector\\Monitor.exe"= "c:\\Program Files\\Java\\jre6\\bin\\jucheck.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3724:TCP"= 3724:TCP:Blizzard Downloader: 3724 R3 icsak;icsak;c:\windows\system32\drivers\icsak.sys [2009-03-25 20472] R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2008-07-11 47128] R4 RsFx0102;RsFx0102 Driver;c:\windows\system32\DRIVERS\RsFx0102.sys [2008-07-10 242712] R4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2008-07-11 369688] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{63ea380b-276d-11de-a800-003018a7956f}] \Shell\AutoRun\command - F:\rcaeasyrip_setup.exe \Shell\install\command - F:\rcaeasyrip_setup.exe \Shell\usermanualEnglish\command - F:\rcaeasyrip_setup.exe /pdf_English \Shell\usermanualFrench\command - F:\rcaeasyrip_setup.exe /pdf_French \Shell\usermanualSpanish\command - F:\rcaeasyrip_setup.exe /pdf_Spanish . Contents of the 'Scheduled Tasks' folder . - - - - ORPHANS REMOVED - - - - BHO-{ABD45510-9B22-41cd-9ACD-8182A2DA7C63} - c:\windows\system32\iehelper.dll . ------- Supplementary Scan ------- . uStart Page = www.google.com/ uInternet Settings,ProxyServer = http=localhost:7171 uInternet Settings,ProxyOverride = .local;<local> . *********************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-04-20 18:30 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************ . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_USERS\S-1-5-21-776561741-606747145-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{2B508D48-0306-9B9A-2351-4EAA4AB67FDD}] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "cd042efbbd7f7af1647644e76e06692b"=hex:c8,28,51,af,b0,29,a3,98,df,e8,30,a1,4d, 75,fa,4a,c8,28,51,af,b0,29,a3,98,ca,0b,94,17,0d,b0,21,26,e2,63,26,f1,3f,c8,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "bca643cdc5c2726b20d2ecedcc62c59b"=hex:6a,9c,d6,61,af,45,84,18,7b,0e,43,34,7f, 1d,33,ce,71,3b,04,66,8b,46,0d,96,94,c5,6c,a0,b0,5f,62,f8,6a,9c,d6,61,af,45,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "2c81e34222e8052573023a60d06dd016"=hex:ff,7c,85,e0,43,d4,0e,fe,10,74,bf,e4,a6, 95,33,3a,25,da,ec,7e,55,20,c9,26,55,20,47,a5,24,61,63,7a,ff,7c,85,e0,43,d4,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "2582ae41fb52324423be06337561aa48"=hex:6b,65,49,6a,7e,99,74,f7,28,19,65,99,0e, e1,65,8f,3e,1e,9e,e0,57,5a,93,61,03,0b,09,f6,cf,69,af,31,86,8c,21,01,be,91,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "caaeda5fd7a9ed7697d9686d4b818472"=hex:f5,1d,4d,73,a8,13,5c,05,d7,b7,df,18,6e, 64,94,54,cd,44,cd,b9,a6,33,6c,cd,85,1a,42,b6,86,09,ba,84,f5,1d,4d,73,a8,13,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:b0,18,ed,a7,3f,8d,37,a4,72,2a,ce,98,d9, 87,b4,29,b0,18,ed,a7,3f,8d,37,a4,f2,6b,ba,80,9b,ee,64,cb,df,20,58,62,78,6b,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "4d370831d2c43cd13623e232fed27b7b"=hex:fb,a7,78,e6,12,2f,9a,ea,e0,17,e6,26,23, f4,82,e8,31,77,e1,ba,b1,f8,68,02,b6,3a,39,98,9f,40,68,c6,fb,a7,78,e6,12,2f,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "1d68fe701cdea33e477eb204b76f993d"=hex:83,6c,56,8b,a0,85,96,ab,fc,13,9c,69,2f, 5a,db,ac,83,6c,56,8b,a0,85,96,ab,6f,f6,a6,68,bc,cf,87,d4,01,3a,48,fc,e8,04,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "1fac81b91d8e3c5aa4b0a51804d844a3"=hex:51,fa,6e,91,28,9e,14,cc,11,60,a3,17,71, 1c,4b,76,51,fa,6e,91,28,9e,14,cc,83,56,8d,47,18,07,55,d1,f6,0f,4e,58,98,5b,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "f5f62a6129303efb32fbe080bb27835b"=hex:b1,cd,45,5a,a8,c4,f8,b9,00,04,73,82,1a, d3,96,00,b1,cd,45,5a,a8,c4,f8,b9,e3,99,e5,9e,42,3b,07,86,3d,ce,ea,26,2d,45,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:2a,b7,cc,b5,b9,7f,41,e7,75,d1,8d,40,2c, 11,aa,d1,e3,0e,66,d5,eb,bc,2f,6b,9e,87,25,e3,50,1e,0a,1e,2a,b7,cc,b5,b9,7f,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "8a8aec57dd6508a385616fbc86791ec2"=hex:fa,ea,66,7f,d4,3b,6b,70,50,7d,a4,cc,33, ca,57,84,fa,ea,66,7f,d4,3b,6b,70,50,76,1e,a9,d2,03,5f,51,6c,43,2d,1e,aa,22,\ . Completion time: 2009-04-20 18:32 ComboFix-quarantined-files.txt 2009-04-20 22:31 ComboFix2.txt 2008-12-29 16:48 Pre-Run: 75,462,709,248 bytes free Post-Run: 75,458,396,160 bytes free 275 --- E O F --- 2009-04-15 22:55 New HJThis log* Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 18:32, on 2009-04-20 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16827) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\nvsvc32.exe c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe C:\WINDOWS\system32\svchost.exe c:\WINDOWS\system32\ZuneBusEnum.exe C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:7171 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = .local;<local> O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe" O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe O4 - HKLM\..\Run: [Ulead AutoDetector v2] C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe O4 - HKLM\..\Run: [USB2Check] RUNDLL32.EXE "C:\WINDOWS\system32\PCLECoInst.dll",CheckUSBController O4 - HKLM\..\Run: [USBToolTip] "C:\Program Files\Pinnacle\Shared Files\\Programs\USBTip\USBTip.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Zune Launcher] "c:\Program Files\Zune\ZuneLauncher.exe" O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [realteczs] "C:\Documents and Settings\Me\Application Data\Google\pfysw721318.exe" 2 O4 - HKLM\..\Run: [sysmstray] C:\windows\mstre17.exe O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [RegistryMechanic] C:\Program Files\Registry Mechanic\RegMech.exe /H O4 - HKCU\..\Run: [system tool] C:\WINDOWS\sysguard.exe O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user') O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe O4 - Startup: Xfire.lnk = C:\Documents and Settings\Me\Desktop\Xfire\xfire.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.srtest.com/srl_bin/sysreqlab3.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1192098404078 O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo.../sysreqlab2.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1192098236312 O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownlo...iaSmartScan.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe (file missing) -- End of file - 7432 bytes Thank You, Hope This Helps! This post has been edited by Aleks*: Apr 19 2009, 06:55 PM

Posts in this topic

Aleks [Closed] Ultra Virus Apr 14 2009, 06:47 PM

CatByte Hi, Please do the following (delete the Combofix... Apr 16 2009, 06:34 AM

Aleks Sorry it took so long to respond, but thanks a lot... Apr 19 2009, 06:52 PM

CatByte Hi Please do the following: Very Important! ... Apr 19 2009, 10:14 PM

Aleks Hey, I ran combofix with the proper script and it ... Apr 21 2009, 09:12 AM

CatByte Hi, While I am analysing the log there are a coup... Apr 21 2009, 01:20 PM

Aleks Alright so I tried all the things listed above. Un... Apr 21 2009, 07:40 PM

CatByte Open HiJackThisClick on Do a system scan onlyCheck... Apr 21 2009, 07:58 PM

Aleks yes! the first step did it, you had to get ... Apr 22 2009, 02:18 PM

CatByte I knew something would work eventually: There may... Apr 22 2009, 02:31 PM

CatByte Due to inactivity this topic will be closed. If yo... Apr 29 2009, 08:01 PM

« Next Oldest · Infections Removal · Next Newest »

Topic Title	Replies	Topic Starter	Views	Last Action
Infections Removal [Closed] severe trojan/infection please help	7	shawnav	169	37 minutes ago Last post by: ken545
Infections Removal Google Redirect Virus	5	ladykrimson	101	Today, 01:16 AM Last post by: oldman960
Infections Removal Malware/Virus Disable all AV and Spyware Tools	8	ZeroMovement	132	Today, 12:39 AM Last post by: ZeroMovement
Infections Removal Windows/Microsoft Pop-up virus notification	0	konagrrl	17	Yesterday, 06:29 PM Last post by: konagrrl