Hi jpshortstuff,
Just a note. I have no internet connection on this computer. I lost it awhile ago. I have been using a junk drive & to transnfer the programs & logs form one computer to the other..
Here are the logs...
ComboFix 07-10-14.4 - admin 2007-10-15 15:54:05.6 -
FAT32x86
Running from: E:\ComboFix.exe
Command switches used :: C:\Documents and Settings\admin\Desktop\CFScript.txt
FILE::
C:\Program Files\Common Files\lavu
C:\WINDOWS\system32\cagacag.dll
C:\WINDOWS\system32\cagacag.dll.bak
C:\WINDOWS\system32\drivers\iiccncfm.dat
C:\WINDOWS\system32\drivers\lhfjncwk.dat
C:\WINDOWS\system32\mstlsap.dll
C:\WINDOWS\system32\syslodr.sys
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Program Files\Common Files\lavu
C:\WINDOWS\system32\cagacag.dll
C:\WINDOWS\system32\cagacag.dll
C:\WINDOWS\system32\drivers\iiccncfm.dat
C:\WINDOWS\system32\drivers\lhfjncwk.dat
C:\WINDOWS\system32\drivers\lhfjncwk.dat
C:\WINDOWS\system32\mstlsap.dll
C:\WINDOWS\system32\syslodr.sys
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\LEGACY_GPEJSJBQ
-------\LEGACY_PNJMLGJX
-------\gpejsjbq
-------\pnjmlgjx
((((((((((((((((((((((((( Files Created from 2007-09-15 to 2007-10-15 )))))))))))))))))))))))))))))))
.
2007-10-09 19:13 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-10-05 17:26 <DIR> d-------- C:\Documents and Settings\admin\Application Data\TrojanHunter
2007-10-05 13:57 <DIR> d-------- C:\Program Files\TrojanHunter 5.0
2007-10-04 21:47 <DIR> d-------- C:\WINDOWS\peernet
2007-10-04 21:46 <DIR> d-------- C:\WINDOWS\provisioning
2007-10-04 21:33 20,480 --a------ C:\WINDOWS\system32\sprecovr.exe
2007-10-04 21:28 15,872 --a------ C:\WINDOWS\system32\spupdsvc.exe
2007-10-04 21:19 <DIR> d-------- C:\WINDOWS\EHome
2007-10-04 20:53 4,569 --------- C:\WINDOWS\system32\secupd.dat
2007-10-04 17:28 313,856 --a------ C:\WINDOWS\system32\dx3j.dll
2007-10-04 17:28 171,280 --a------ C:\WINDOWS\system32\jit.dll
2007-10-04 17:28 139,536 --a------ C:\WINDOWS\system32\javaee.dll
2007-10-04 17:28 46,352 --a------ C:\WINDOWS\setdebug.exe
2007-10-04 17:28 6,550 --a------ C:\WINDOWS\jautoexp.dat
2007-10-04 17:08 <DIR> d--h----- C:\WINDOWS\$xpsp1hfm$
2007-10-04 17:08 26,112 --a------ C:\WINDOWS\system32\xpsp1hfm.exe
2007-10-04 02:56 <DIR> d-------- C:\WINDOWS\system32\bits
2007-10-04 00:09 <DIR> d-------- C:\WINDOWS\pss
2007-10-03 23:49 <DIR> d-------- C:\Documents and Settings\admin\Application Data\Grisoft
2007-10-03 23:49 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-10-03 23:48 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2007-10-03 23:24 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-10-03 23:17 549,720 --a------ C:\WINDOWS\system32\wuapi.dll
2007-10-03 23:17 325,976 --a------ C:\WINDOWS\system32\wucltui.dll
2007-10-03 23:17 203,096 --a------ C:\WINDOWS\system32\wuweb.dll
2007-10-03 23:17 186,136 --a------ C:\WINDOWS\system32\wuaueng1.dll
2007-10-03 23:17 167,704 --a------ C:\WINDOWS\system32\wuauclt1.exe
2007-10-03 23:17 33,624 --a------ C:\WINDOWS\system32\wups.dll
2007-09-20 19:24 <DIR> d--h----- C:\Program Files\InstallShield Installation Information
2007-09-20 19:24 17,992 --a------ C:\WINDOWS\system32\bcm42rly.sys
2007-09-20 19:24 17,801 --a------ C:\WINDOWS\system32\drivers\AegisP.sys
2007-09-20 19:23 <DIR> d-------- C:\Program Files\Common Files\InstallShield
2007-09-20 19:07 <DIR> d-------- C:\Documents and Settings\admin\Application Data\AdobeUM
2007-09-20 19:03 <DIR> d-------- C:\Program Files\Common Files\Adobe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-08 02:23 --------- d--ha-w C:\Documents and Settings\All Users\Application Data\GTek
2007-09-08 02:23 --------- d-----w C:\Program Files\Linksys EasyLink Advisor
2007-08-20 22:09 --------- d-----w C:\Documents and Settings\All Users\Application Data\MSN6
2007-08-20 22:09 --------- d-----w C:\Documents and Settings\admin\Application Data\MSN6
2007-07-30 23:19 92,504 ----a-w C:\WINDOWS\system32\dllcache\cdm.dll
2007-07-30 23:19 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
2007-07-30 23:19 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
2007-07-30 23:19 53,080 ----a-w C:\WINDOWS\system32\dllcache\wuauclt.exe
2007-07-30 23:19 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
2007-07-30 23:19 1,712,984 ----a-w C:\WINDOWS\system32\wuaueng.dll
2007-07-30 23:19 1,712,984 ----a-w C:\WINDOWS\system32\dllcache\wuaueng.dll
2007-07-25 15:50 412,160 ----a-w C:\WINDOWS\installer.exe
2007-07-15 19:06 202,240 ----a-w C:\WINDOWS\system32\Yamaha 2007 R1.scr
2007-03-25 01:55 774,144 ----a-w C:\Program Files\RngInterstitial.dll
.
((((((((((((((((((((((((((((( snapshot@2007-10-09_19.28.22.10 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-10-15 19:48:42 585,791 ----a-w C:\WINDOWS\gmer.dll
+ 2007-06-29 13:38:18 581,632 ----a-r C:\WINDOWS\gmer.exe
+ 2007-10-15 19:48:44 70,001 ----a-w C:\WINDOWS\system32\drivers\gmer.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"@"="" []
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2006-08-10 18:10]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-08-10 18:11]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 05:25]
"THGuard"="C:\Program Files\TrojanHunter 5.0\THGuard.exe" [2007-09-09 09:31]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"@"="" []
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-28 00:33]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 04:44:06]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOL Spyware Protection]
"C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOLDialer]
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
"C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
C:\Program Files\Common Files\AOL\1155247693\ee\AOLSoftware.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Pure Networks Port Magic]
"C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" -Run
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
helpsvcgpejsjbq
*Newly Created Service* - GTNDIS5
.
**************************************************************************
catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2007-10-15 15:58:56
Windows 5.1.2600 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2007-10-15 16:02:02 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-10-12 21:07
C:\ComboFix3.txt ... 2007-10-12 21:07
C:\ComboFix2.txt ... 2007-10-14 15:58
.
--- E O F ---
Logfile of HijackThis v1.99.1
Scan saved at 4:03:01 PM, on 10/15/2007
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Compact Wireless-G USB Network Adapter with SpeedBooster\WLService.exe
C:\Program Files\Compact Wireless-G USB Network Adapter with SpeedBooster\WUSB54GSC.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\TrojanHunter 5.0\THGuard.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Documents and Settings\admin\Desktop\New Folder\hijackthis.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 5.0\THGuard.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: WUSB54GSCSVC - Unknown owner - C:\Program Files\Compact Wireless-G USB Network Adapter with SpeedBooster\WLService.exe" "WUSB54GSC.exe (file missing)
Looks like you're enjoying the discussion, but you're not signed up for an account. When you create an account, we remember exactly what you've read, so you always come right back where you left off. You also get notifications, here and via email, whenever new posts are made. You can like posts to share the love. 
Join 93124 other members! Anybody can ask, anybody can answer. Consistently helpful members may be invited to become staff. Here's how it works. Virus cleanup? Start here -> Malware Removal Forum.
This topic is locked
