LDTate
OK. Just run the last fix I postedi just removed spybot all together cause i dont really need it ijust downloaded it to try and help me but it didnt do much so ill just get rid of it
Spyware / Malware / Virus Removal
[Resolved] Serious Rootkit/malware problem Prunnet.exe
15 min read
meintool
Running combofix now be back with logs in a moment it is taking an awful long time to produce a log file
meintool
ok got the log file…the Virus seems to have subsided considerably since you started helping me i am no longer being redirected through google from what ive seen. explorer.exe is now staying open and opening normally. (i had to manually open it from taskmanager before) my windows clock time is messed up(militarytime) my wallpaper has dissapeared and computer is still kinda slow with doing anything and my keyboard seems to be working normally now
here is the Combofix log
ComboFix 09-02-15.01 - jeremy 2009-02-16 20:04:07.10 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1023.665 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\jeremy\Desktop\CFScript.txt
AV: avast! antivirus 4.8.1335 [VPS 090216-1] *On-access scanning disabled* (Updated)
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
——-\Legacy_ECPPOLMR
——-\Service_ecppolmr
——-\Service_ecxlkbix
——-\Service_mlwchsjd
——-\Service_oqcsxypd
——-\Service_zqqcysuu
((((((((((((((((((((((((( Files Created from 2009-01-17 to 2009-02-17 )))))))))))))))))))))))))))))))
.
2009-02-16 17:52 . 2009-02-16 17:52 d——– c:\program files\Trend Micro
2009-02-16 12:59 . 2009-02-16 12:59 d——– c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-02-16 00:37 . 2009-02-16 03:07 d——– C:\4a79e3d5ec5d5f0f175609
2009-02-16 00:09 . 2009-02-16 00:09 d——– c:\windows\system32\XPSViewer
2009-02-16 00:08 . 2009-02-16 00:08 d——– c:\program files\Reference Assemblies
2009-02-16 00:08 . 2009-02-16 00:08 d——– c:\program files\MSBuild
2009-02-16 00:07 . 2008-07-06 07:06 117,760 ——— c:\windows\system32\prntvpt.dll
2009-02-16 00:07 . 2008-07-06 07:06 89,088 —–c— c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-02-16 00:06 . 2009-02-16 00:08 d——– C:\4848ae0ae9e08ae480
2009-02-16 00:06 . 2008-07-06 07:06 1,676,288 ——— c:\windows\system32\xpssvcs.dll
2009-02-16 00:06 . 2008-07-06 07:06 1,676,288 —–c— c:\windows\system32\dllcache\xpssvcs.dll
2009-02-16 00:06 . 2008-07-06 05:50 597,504 —–c— c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-02-16 00:06 . 2008-07-06 07:06 575,488 ——— c:\windows\system32\xpsshhdr.dll
2009-02-16 00:06 . 2008-07-06 07:06 575,488 —–c— c:\windows\system32\dllcache\xpsshhdr.dll
2009-02-16 00:04 . 2009-02-16 03:09 d——– c:\windows\SxsCaPendDel
2009-02-15 20:46 . 2009-02-15 20:46 d——– c:\program files\Alwil Software
2009-02-15 20:42 . 2009-02-15 21:51 2,204 –a—— c:\windows\zkvyrebe
2009-02-15 20:12 . 2009-02-15 20:12 d——– c:\program files\Network Associates
2009-02-15 19:23 . 2009-02-15 19:23 d——– c:\documents and settings\jeremy\Application Data\Malwarebytes
2009-02-15 19:22 . 2009-02-15 19:23 d——– c:\program files\Malwarebytes' Anti-Malware
2009-02-15 19:22 . 2009-02-15 19:22 d——– c:\documents and settings\All Users\Application Data\Malwarebytes
2009-02-15 19:22 . 2009-02-11 10:19 38,496 –a—— c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-15 19:22 . 2009-02-11 10:19 15,504 –a—— c:\windows\system32\drivers\mbam.sys
2009-02-15 18:07 . 2009-02-15 19:39 1,716 –a—— c:\windows\qeietljl
2009-02-15 14:21 . 2009-02-15 14:21 d——– c:\program files\Windows Live Safety Center
2009-02-15 11:09 . 2009-02-16 19:39 d——– c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-02-15 09:36 . 2009-02-15 09:37 250 –a—— c:\windows\gmer.ini
2009-02-15 08:21 . 2007-06-24 15:43 23,600 –a—— c:\windows\system32\drivers\TVICHW32.SYS
2009-02-15 00:13 . 2009-02-15 15:57 3,844 –a—— c:\windows\ecppolmr
2009-02-13 19:05 . 2009-02-13 19:05 d——– c:\documents and settings\All Users\Application Data\ATI
2009-02-13 19:00 . 2009-02-13 19:00 d——– c:\program files\Common Files\ATI Technologies
2009-02-13 18:59 . 2008-12-01 14:35 593,920 –a—— c:\windows\system32\ati2sgag.exe
2009-02-13 18:59 . 2009-01-05 09:20 93,184 -ra—— c:\windows\system32\drivers\AtiHdmi.sys
2009-02-13 18:58 . 2009-01-05 09:19 3,107,788 -ra—— c:\windows\system32\ativvaxx.dat
2009-02-13 18:58 . 2009-01-05 09:18 3,107,788 -ra—— c:\windows\system32\ativva5x.dat
2009-02-13 18:58 . 2009-01-05 09:18 887,724 -ra—— c:\windows\system32\ativva6x.dat
2009-02-13 18:58 . 2009-01-05 09:17 425,984 -ra—— c:\windows\system32\ATIDEMGX.dll
2009-02-13 18:58 . 2009-01-05 09:17 307,200 -ra—— c:\windows\system32\atiiiexx.dll
2009-02-13 18:58 . 2009-01-05 09:17 180,720 -ra—— c:\windows\system32\atiicdxx.dat
2009-02-13 18:58 . 2009-01-05 09:17 15,079 -ra—— c:\windows\atiogl.xml
2009-02-13 18:58 . 2009-01-05 09:17 7,167 -ra—— c:\windows\system32\atifglpf.xml
2009-02-13 18:58 . 2009-01-05 09:17 529 -ra—— c:\windows\system32\ATIODCLI.exe.manifest
2009-02-13 18:58 . 2009-01-05 09:17 527 -ra—— c:\windows\system32\ATIODE.exe.manifest
2009-02-12 19:41 . 2009-02-12 19:40 102,664 –a—— c:\windows\system32\drivers\tmcomm.sys
2009-02-12 18:57 . 2009-02-12 18:57 d——– c:\documents and settings\All Users\Application Data\PC Drivers HeadQuarters
2009-02-08 19:44 . 2009-02-08 19:44 682,280 –a—— c:\windows\system32\pbsvc.exe
2009-02-08 19:44 . 2009-02-08 19:44 22,328 –a—— c:\documents and settings\jeremy\Application Data\PnkBstrK.sys
2009-02-01 18:21 . 2009-02-01 18:21 d——– c:\documents and settings\All Users\Application Data\NVIDIA Corporation
2009-02-01 18:20 . 2005-06-13 16:28 671,744 –a—— c:\windows\system32\DolbyHph.dll
2009-02-01 18:20 . 2005-06-13 16:29 60,416 –a—— c:\windows\system32\DSETUP.dll
2009-02-01 18:20 . 2005-06-30 12:23 4,608 –a—— c:\windows\system32\drivers\nvport.sys
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-16 22:11 ——— d—–w c:\program files\Google
2009-02-16 21:55 ——— d—–w c:\program files\QUICKENW
2009-02-16 21:45 ——— d—–w c:\documents and settings\All Users\Application Data\WildTangent
2009-02-16 21:36 ——— d—–w c:\program files\Common Files\Adobe
2009-02-16 20:21 ——— d—–w c:\documents and settings\All Users\Application Data\Symantec
2009-02-16 04:38 96,384 —-a-w c:\windows\system32\drivers\sptd5869.sys
2009-02-15 17:44 ——— d—–w c:\documents and settings\All Users\Application Data\Viewpoint
2009-02-15 13:23 ——— d—–w c:\documents and settings\All Users\Application Data\AOL
2009-02-15 13:19 ——— d—–w c:\program files\Creative
2009-02-15 13:18 ——— d–h–w c:\program files\InstallShield Installation Information
2009-02-15 13:16 ——— d—–w c:\program files\MAIET
2009-02-14 00:02 ——— d—–w c:\program files\ATI Technologies
2009-02-13 03:42 ——— d—–w c:\program files\World of Warcraft
2009-02-13 01:37 4,649 —-a-w c:\windows\compaq.reg
2009-02-09 00:47 138,624 -c–a-w c:\windows\system32\drivers\PnkBstrK.sys
2009-02-09 00:27 ——— d—–w c:\program files\America's Army
2009-02-08 23:32 ——— d—–w c:\program files\America's Army Deploy Client
2009-02-01 23:20 ——— d—–w c:\program files\NVIDIA Corporation
2009-02-01 23:11 ——— d—–w c:\documents and settings\jeremy\Application Data\LimeWire
2009-01-13 23:58 ——— d—–w c:\program files\DivX
2009-01-07 22:12 ——— d—–w c:\program files\ComcastToolbar
2009-01-07 22:10 ——— d—–w c:\documents and settings\jeremy\Application Data\Petroglyph
2009-01-07 19:06 ——— d—–w c:\documents and settings\jeremy\Application Data\ATI
2009-01-07 19:03 ——— d—–w c:\documents and settings\Guest\Application Data\ATI
2009-01-05 14:16 3,452,928 —-a-w c:\windows\system32\drivers\ati2mtag.sys
2009-01-05 14:15 53,248 —-a-w c:\windows\system32\drivers\ati2erec.dll
2008-12-27 22:30 ——— d—–w c:\documents and settings\jeremy\Application Data\Ventrilo
2008-12-27 22:26 ——— d—–w c:\program files\Ventrilo
2008-12-27 22:26 ——— d—–w c:\program files\Common Files\Wise Installation Wizard
2008-12-17 05:34 ——— d—–w c:\program files\TrackMania Nations ESWC
2006-11-23 06:19 24,192 -c–a-w c:\documents and settings\jeremy\usbsermptxp.sys
2006-11-23 06:19 22,768 -c–a-w c:\documents and settings\jeremy\usbsermpt.sys
.
((((((((((((((((((((((((((((( SnapShot@2009-02-16_19.18.34.07 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-10-21 01:02:28 163,328 —-a-w c:\windows\ERDNT\subs\ERDNT.EXE
+ 2009-02-17 01:09:09 16,384 —-atw c:\windows\temp\Perflib_Perfdata_518.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"prunnet"="c:\windows\system32\prunnet.exe" [BU]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="c:\windows\system32\logonuiX.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.SP54"= SP5X_32.DLL
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Belkin Wireless G USB Adapter Client Utility.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Belkin Wireless G USB Adapter Client Utility.lnk
backup=c:\windows\pss\Belkin Wireless G USB Adapter Client Utility.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^PI Monitor.lnk]
[HKLM\~\startupfolder\C:^Documents and Settings^jeremy^Start Menu^Programs^Startup^Adobe Gamma.lnk]
[HKLM\~\startupfolder\C:^Documents and Settings^jeremy^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
path=c:\documents and settings\jeremy\Start Menu\Programs\Startup\LimeWire On Startup.lnk
backup=c:\windows\pss\LimeWire On Startup.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^jeremy^Start Menu^Programs^Startup^Xfire.lnk]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
–a–c— 2008-07-03 01:23 116040 c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CPQEASYACC]
–a–c— 2001-12-15 00:01 32768 c:\program files\compaq\Easy Access Button Support\STARTEAK.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ddoctorv2]
–a—— 2008-04-24 12:25 202560 c:\program files\Comcast\Desktop Doctor\bin\sprtcmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EA Core]
–a—— 2008-07-21 13:07 2752512 c:\program files\Electronic Arts\EADM\Core.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
–a–c— 2002-05-15 05:20 114688 c:\windows\system32\hkcmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpsysdrv]
–a–c— 1998-05-07 18:04 52736 c:\windows\system\hpsysdrv.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
–a–c— 2002-05-15 05:29 155648 c:\windows\system32\igfxtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
–a–c— 2008-07-09 12:30 289064 c:\program files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogonStudio]
–a–c— 2002-09-03 17:38 987187 c:\program files\WinCustomize\LogonStudio\LogonStudio.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MRT]
–a–c— 2009-02-11 20:56 21244872 c:\windows\system32\MRT.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
——— 2008-04-13 19:12 1695232 c:\program files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a–c— 2008-05-27 09:50 413696 c:\program files\QuickTime\QTTask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Recguard]
–a–c— 2002-07-04 19:55 212992 c:\windows\SMINST\Recguard.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\srmclean]
–a–c— 2001-07-24 23:34 36864 c:\cpqs\scom\srmclean.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
–a—— 2008-08-29 17:11 61440 c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StorageGuard]
–a–c— 2002-05-09 10:01 155648 c:\program files\VERITAS Software\Update Manager\sgtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
–a–c— 2005-11-10 12:03 36975 c:\program files\Java\jre1.5.0_06\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
–a–c— 2006-05-17 18:42 180269 c:\program files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WCOLOREAL]
–a–c— 2002-02-20 21:40 143360 c:\program files\compaq\Coloreal\COLOREAL.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
—–c— 2006-10-18 20:05 204288 c:\program files\Windows Media Player\wmpnscfg.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcxMonitor]
–a—— 2004-09-07 13:47 57344 c:\windows\ALCXMNTR.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\P17Helper]
–a–c— 2005-05-03 19:38 64512 c:\windows\system32\P17.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Bonjour Service"=2 (0x2)
"x10nets"=3 (0x3)
"WMPNetworkSvc"=2 (0x2)
"Viewpoint Manager Service"=2 (0x2)
"StarWindService"=2 (0x2)
"sprtsvc_ddoctorv2"=2 (0x2)
"PnkBstrB"=2 (0x2)
"PnkBstrA"=2 (0x2)
"msCMTSrvc"=3 (0x3)
"iPod Service"=3 (0x3)
"ImapiService"=3 (0x3)
"gusvc"=2 (0x2)
"GameConsoleService"=3 (0x3)
"Fax"=2 (0x2)
"Compaq_RBA"=2 (0x2)
"Apple Mobile Device"=2 (0x2)
"Adobe LM Service"=3 (0x3)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
"SpybotSD TeaTimer"=c:\program files\Spybot - Search & Destroy\TeaTimer.exe
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" -osboot
"WMPNSCFG"=c:\program files\Windows Media Player\WMPNSCFG.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
"prunnet"="c:\windows\system32\prunnet.exe"
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" -osboot
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Westwood\\Renegade\\Game.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\America's Army\\System\\ArmyOps.exe"=
"c:\\Program Files\\TrackMania Nations ESWC\\TmNationsESWC.exe"=
"c:\\Program Files\\TrackMania Nations ESWC\\TrackManiaServer.exe"=
"c:\\Program Files\\America's Army\\System\\Server.exe"=
"c:\\Westwood\\Renegade\\Game2.exe"=
"c:\\Program Files\\Real\\RealOne Player\\realplay.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Sony\\Station\\LaunchPad\\LaunchPad.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Electronic Arts\\EADM\\Core.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\America's Army Deploy Client\\AADeployClient.exe"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\World of Warcraft\\Launcher.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724
"1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015
"1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016
"500:UDP"= 500:UDP:@xpsp2res.dll,-22017
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-02-15 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-02-15 20560]
R2 SVKP;SVKP;c:\windows\system32\SVKP.sys [2006-08-31 2368]
R3 AtiHdmiService;ATI Function Driver for HDMI Service;c:\windows\system32\drivers\AtiHdmi.sys [2009-02-13 93184]
S3 BELKIN;Belkin Wireless G USB Network Adapter;c:\windows\system32\drivers\BLKWGU.sys [2007-12-18 238848]
S3 JSINMIS;JSINMIS;c:\docume~1\jeremy\LOCALS~1\Temp\JSINMIS.exe –> c:\docume~1\jeremy\LOCALS~1\Temp\JSINMIS.exe [?]
S3 PBDOWNFORCE_SERVICE;PBDOWNFORCE_SERVICE;c:\documents and settings\jeremy\Desktop\gamefiles\PBDownForce.sys [2006-08-05 20480]
S3 PBDOWNFORCE_TEST_SERVICE;PBDOWNFORCE_TEST_SERVICE;\??\c:\documents and settings\jeremy\Desktop\gamefiles\Test.sys –> c:\documents and settings\jeremy\Desktop\gamefiles\Test.sys [?]
.
Contents of the 'Scheduled Tasks' folder
2009-02-03 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:57]
2005-12-07 c:\windows\Tasks\Registration reminder 3.job
- c:\windows\System32\OOBE\oobebaln.exe [2008-04-13 19:12]
2007-06-24 c:\windows\Tasks\Uniblue SpeedUpMyPC.job
- c:\program files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe []
.
.
——- Supplementary Scan ——-
.
mWindow Title = Windows Internet Explorer provided by Comcast
uInternet Connection Wizard,ShellNext = iexplore
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\jeremy\Application Data\Mozilla\Firefox\Profiles\b5n4lzny.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.e30tech.com/forum/index.php
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava11.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava12.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava13.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava14.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava32.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJPI150_06.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPOJI610.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npagent.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nppl3260.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nprjplug.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nprpjplug.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-16 20:10:22
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
[HKEY_USERS\S-1-5-21-4021508746-488748980-3615762775-1006\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
[HKEY_USERS\S-1-5-21-4021508746-488748980-3615762775-1006\Software\SecuROM\License information*]
"datasecu"=hex:a9,30,38,3a,49,dd,3a,96,79,df,7d,08,47,ee,64,48,f7,5e,f5,7c,44,
5b,c3,54,ab,ba,3c,9f,27,e0,1d,cc,3d,75,2b,d1,ec,2e,97,4b,f6,51,3d,9e,8d,16,\
"rkeysecu"=hex:e2,26,6d,94,9c,ba,ad,1d,64,79,70,1b,d8,19,de,23
.
——————— DLLs Loaded Under Running Processes ———————
- - - - - - - > 'winlogon.exe'(580)
c:\windows\system32\Ati2evxx.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\taskmgr.exe
.
**************************************************************************
.
Completion time: 2009-02-16 20:16:35 - machine was rebooted
ComboFix-quarantined-files.txt 2009-02-17 01:16:32
ComboFix2.txt 2009-02-17 00:21:09
ComboFix3.txt 2009-02-16 18:22:21
Pre-Run: 56,012,894,208 bytes free
Post-Run: 55,943,835,648 bytes free
Current=5 Default=5 Failed=4 LastKnownGood=6 Sets=1,2,3,4,5,6
320 — E O F — 2009-02-16 08:02:47
And here is the hijackthis log
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:19:14, on 2/16/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
O2 - BHO: (no name) - AutorunsDisabled - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [prunnet] "C:\WINDOWS\system32\prunnet.exe"
O9 - Extra button: (no name) - AutorunsDisabled - (no file)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=2c02&lc=0409
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: JSINMIS - Unknown owner - C:\DOCUME~1\jeremy\LOCALS~1\Temp\JSINMIS.exe (file missing)
–
End of file - 3859 bytes
here is the Combofix log
ComboFix 09-02-15.01 - jeremy 2009-02-16 20:04:07.10 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1023.665 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\jeremy\Desktop\CFScript.txt
AV: avast! antivirus 4.8.1335 [VPS 090216-1] *On-access scanning disabled* (Updated)
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
——-\Legacy_ECPPOLMR
——-\Service_ecppolmr
——-\Service_ecxlkbix
——-\Service_mlwchsjd
——-\Service_oqcsxypd
——-\Service_zqqcysuu
((((((((((((((((((((((((( Files Created from 2009-01-17 to 2009-02-17 )))))))))))))))))))))))))))))))
.
2009-02-16 17:52 . 2009-02-16 17:52 d——– c:\program files\Trend Micro
2009-02-16 12:59 . 2009-02-16 12:59 d——– c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-02-16 00:37 . 2009-02-16 03:07 d——– C:\4a79e3d5ec5d5f0f175609
2009-02-16 00:09 . 2009-02-16 00:09 d——– c:\windows\system32\XPSViewer
2009-02-16 00:08 . 2009-02-16 00:08 d——– c:\program files\Reference Assemblies
2009-02-16 00:08 . 2009-02-16 00:08 d——– c:\program files\MSBuild
2009-02-16 00:07 . 2008-07-06 07:06 117,760 ——— c:\windows\system32\prntvpt.dll
2009-02-16 00:07 . 2008-07-06 07:06 89,088 —–c— c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-02-16 00:06 . 2009-02-16 00:08 d——– C:\4848ae0ae9e08ae480
2009-02-16 00:06 . 2008-07-06 07:06 1,676,288 ——— c:\windows\system32\xpssvcs.dll
2009-02-16 00:06 . 2008-07-06 07:06 1,676,288 —–c— c:\windows\system32\dllcache\xpssvcs.dll
2009-02-16 00:06 . 2008-07-06 05:50 597,504 —–c— c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-02-16 00:06 . 2008-07-06 07:06 575,488 ——— c:\windows\system32\xpsshhdr.dll
2009-02-16 00:06 . 2008-07-06 07:06 575,488 —–c— c:\windows\system32\dllcache\xpsshhdr.dll
2009-02-16 00:04 . 2009-02-16 03:09 d——– c:\windows\SxsCaPendDel
2009-02-15 20:46 . 2009-02-15 20:46 d——– c:\program files\Alwil Software
2009-02-15 20:42 . 2009-02-15 21:51 2,204 –a—— c:\windows\zkvyrebe
2009-02-15 20:12 . 2009-02-15 20:12 d——– c:\program files\Network Associates
2009-02-15 19:23 . 2009-02-15 19:23 d——– c:\documents and settings\jeremy\Application Data\Malwarebytes
2009-02-15 19:22 . 2009-02-15 19:23 d——– c:\program files\Malwarebytes' Anti-Malware
2009-02-15 19:22 . 2009-02-15 19:22 d——– c:\documents and settings\All Users\Application Data\Malwarebytes
2009-02-15 19:22 . 2009-02-11 10:19 38,496 –a—— c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-15 19:22 . 2009-02-11 10:19 15,504 –a—— c:\windows\system32\drivers\mbam.sys
2009-02-15 18:07 . 2009-02-15 19:39 1,716 –a—— c:\windows\qeietljl
2009-02-15 14:21 . 2009-02-15 14:21 d——– c:\program files\Windows Live Safety Center
2009-02-15 11:09 . 2009-02-16 19:39 d——– c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-02-15 09:36 . 2009-02-15 09:37 250 –a—— c:\windows\gmer.ini
2009-02-15 08:21 . 2007-06-24 15:43 23,600 –a—— c:\windows\system32\drivers\TVICHW32.SYS
2009-02-15 00:13 . 2009-02-15 15:57 3,844 –a—— c:\windows\ecppolmr
2009-02-13 19:05 . 2009-02-13 19:05 d——– c:\documents and settings\All Users\Application Data\ATI
2009-02-13 19:00 . 2009-02-13 19:00 d——– c:\program files\Common Files\ATI Technologies
2009-02-13 18:59 . 2008-12-01 14:35 593,920 –a—— c:\windows\system32\ati2sgag.exe
2009-02-13 18:59 . 2009-01-05 09:20 93,184 -ra—— c:\windows\system32\drivers\AtiHdmi.sys
2009-02-13 18:58 . 2009-01-05 09:19 3,107,788 -ra—— c:\windows\system32\ativvaxx.dat
2009-02-13 18:58 . 2009-01-05 09:18 3,107,788 -ra—— c:\windows\system32\ativva5x.dat
2009-02-13 18:58 . 2009-01-05 09:18 887,724 -ra—— c:\windows\system32\ativva6x.dat
2009-02-13 18:58 . 2009-01-05 09:17 425,984 -ra—— c:\windows\system32\ATIDEMGX.dll
2009-02-13 18:58 . 2009-01-05 09:17 307,200 -ra—— c:\windows\system32\atiiiexx.dll
2009-02-13 18:58 . 2009-01-05 09:17 180,720 -ra—— c:\windows\system32\atiicdxx.dat
2009-02-13 18:58 . 2009-01-05 09:17 15,079 -ra—— c:\windows\atiogl.xml
2009-02-13 18:58 . 2009-01-05 09:17 7,167 -ra—— c:\windows\system32\atifglpf.xml
2009-02-13 18:58 . 2009-01-05 09:17 529 -ra—— c:\windows\system32\ATIODCLI.exe.manifest
2009-02-13 18:58 . 2009-01-05 09:17 527 -ra—— c:\windows\system32\ATIODE.exe.manifest
2009-02-12 19:41 . 2009-02-12 19:40 102,664 –a—— c:\windows\system32\drivers\tmcomm.sys
2009-02-12 18:57 . 2009-02-12 18:57 d——– c:\documents and settings\All Users\Application Data\PC Drivers HeadQuarters
2009-02-08 19:44 . 2009-02-08 19:44 682,280 –a—— c:\windows\system32\pbsvc.exe
2009-02-08 19:44 . 2009-02-08 19:44 22,328 –a—— c:\documents and settings\jeremy\Application Data\PnkBstrK.sys
2009-02-01 18:21 . 2009-02-01 18:21 d——– c:\documents and settings\All Users\Application Data\NVIDIA Corporation
2009-02-01 18:20 . 2005-06-13 16:28 671,744 –a—— c:\windows\system32\DolbyHph.dll
2009-02-01 18:20 . 2005-06-13 16:29 60,416 –a—— c:\windows\system32\DSETUP.dll
2009-02-01 18:20 . 2005-06-30 12:23 4,608 –a—— c:\windows\system32\drivers\nvport.sys
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-16 22:11 ——— d—–w c:\program files\Google
2009-02-16 21:55 ——— d—–w c:\program files\QUICKENW
2009-02-16 21:45 ——— d—–w c:\documents and settings\All Users\Application Data\WildTangent
2009-02-16 21:36 ——— d—–w c:\program files\Common Files\Adobe
2009-02-16 20:21 ——— d—–w c:\documents and settings\All Users\Application Data\Symantec
2009-02-16 04:38 96,384 —-a-w c:\windows\system32\drivers\sptd5869.sys
2009-02-15 17:44 ——— d—–w c:\documents and settings\All Users\Application Data\Viewpoint
2009-02-15 13:23 ——— d—–w c:\documents and settings\All Users\Application Data\AOL
2009-02-15 13:19 ——— d—–w c:\program files\Creative
2009-02-15 13:18 ——— d–h–w c:\program files\InstallShield Installation Information
2009-02-15 13:16 ——— d—–w c:\program files\MAIET
2009-02-14 00:02 ——— d—–w c:\program files\ATI Technologies
2009-02-13 03:42 ——— d—–w c:\program files\World of Warcraft
2009-02-13 01:37 4,649 —-a-w c:\windows\compaq.reg
2009-02-09 00:47 138,624 -c–a-w c:\windows\system32\drivers\PnkBstrK.sys
2009-02-09 00:27 ——— d—–w c:\program files\America's Army
2009-02-08 23:32 ——— d—–w c:\program files\America's Army Deploy Client
2009-02-01 23:20 ——— d—–w c:\program files\NVIDIA Corporation
2009-02-01 23:11 ——— d—–w c:\documents and settings\jeremy\Application Data\LimeWire
2009-01-13 23:58 ——— d—–w c:\program files\DivX
2009-01-07 22:12 ——— d—–w c:\program files\ComcastToolbar
2009-01-07 22:10 ——— d—–w c:\documents and settings\jeremy\Application Data\Petroglyph
2009-01-07 19:06 ——— d—–w c:\documents and settings\jeremy\Application Data\ATI
2009-01-07 19:03 ——— d—–w c:\documents and settings\Guest\Application Data\ATI
2009-01-05 14:16 3,452,928 —-a-w c:\windows\system32\drivers\ati2mtag.sys
2009-01-05 14:15 53,248 —-a-w c:\windows\system32\drivers\ati2erec.dll
2008-12-27 22:30 ——— d—–w c:\documents and settings\jeremy\Application Data\Ventrilo
2008-12-27 22:26 ——— d—–w c:\program files\Ventrilo
2008-12-27 22:26 ——— d—–w c:\program files\Common Files\Wise Installation Wizard
2008-12-17 05:34 ——— d—–w c:\program files\TrackMania Nations ESWC
2006-11-23 06:19 24,192 -c–a-w c:\documents and settings\jeremy\usbsermptxp.sys
2006-11-23 06:19 22,768 -c–a-w c:\documents and settings\jeremy\usbsermpt.sys
.
((((((((((((((((((((((((((((( SnapShot@2009-02-16_19.18.34.07 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-10-21 01:02:28 163,328 —-a-w c:\windows\ERDNT\subs\ERDNT.EXE
+ 2009-02-17 01:09:09 16,384 —-atw c:\windows\temp\Perflib_Perfdata_518.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"prunnet"="c:\windows\system32\prunnet.exe" [BU]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="c:\windows\system32\logonuiX.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.SP54"= SP5X_32.DLL
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Belkin Wireless G USB Adapter Client Utility.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Belkin Wireless G USB Adapter Client Utility.lnk
backup=c:\windows\pss\Belkin Wireless G USB Adapter Client Utility.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^PI Monitor.lnk]
[HKLM\~\startupfolder\C:^Documents and Settings^jeremy^Start Menu^Programs^Startup^Adobe Gamma.lnk]
[HKLM\~\startupfolder\C:^Documents and Settings^jeremy^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
path=c:\documents and settings\jeremy\Start Menu\Programs\Startup\LimeWire On Startup.lnk
backup=c:\windows\pss\LimeWire On Startup.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^jeremy^Start Menu^Programs^Startup^Xfire.lnk]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
–a–c— 2008-07-03 01:23 116040 c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CPQEASYACC]
–a–c— 2001-12-15 00:01 32768 c:\program files\compaq\Easy Access Button Support\STARTEAK.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ddoctorv2]
–a—— 2008-04-24 12:25 202560 c:\program files\Comcast\Desktop Doctor\bin\sprtcmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EA Core]
–a—— 2008-07-21 13:07 2752512 c:\program files\Electronic Arts\EADM\Core.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
–a–c— 2002-05-15 05:20 114688 c:\windows\system32\hkcmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpsysdrv]
–a–c— 1998-05-07 18:04 52736 c:\windows\system\hpsysdrv.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
–a–c— 2002-05-15 05:29 155648 c:\windows\system32\igfxtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
–a–c— 2008-07-09 12:30 289064 c:\program files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogonStudio]
–a–c— 2002-09-03 17:38 987187 c:\program files\WinCustomize\LogonStudio\LogonStudio.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MRT]
–a–c— 2009-02-11 20:56 21244872 c:\windows\system32\MRT.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
——— 2008-04-13 19:12 1695232 c:\program files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a–c— 2008-05-27 09:50 413696 c:\program files\QuickTime\QTTask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Recguard]
–a–c— 2002-07-04 19:55 212992 c:\windows\SMINST\Recguard.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\srmclean]
–a–c— 2001-07-24 23:34 36864 c:\cpqs\scom\srmclean.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
–a—— 2008-08-29 17:11 61440 c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StorageGuard]
–a–c— 2002-05-09 10:01 155648 c:\program files\VERITAS Software\Update Manager\sgtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
–a–c— 2005-11-10 12:03 36975 c:\program files\Java\jre1.5.0_06\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
–a–c— 2006-05-17 18:42 180269 c:\program files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WCOLOREAL]
–a–c— 2002-02-20 21:40 143360 c:\program files\compaq\Coloreal\COLOREAL.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
—–c— 2006-10-18 20:05 204288 c:\program files\Windows Media Player\wmpnscfg.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcxMonitor]
–a—— 2004-09-07 13:47 57344 c:\windows\ALCXMNTR.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\P17Helper]
–a–c— 2005-05-03 19:38 64512 c:\windows\system32\P17.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Bonjour Service"=2 (0x2)
"x10nets"=3 (0x3)
"WMPNetworkSvc"=2 (0x2)
"Viewpoint Manager Service"=2 (0x2)
"StarWindService"=2 (0x2)
"sprtsvc_ddoctorv2"=2 (0x2)
"PnkBstrB"=2 (0x2)
"PnkBstrA"=2 (0x2)
"msCMTSrvc"=3 (0x3)
"iPod Service"=3 (0x3)
"ImapiService"=3 (0x3)
"gusvc"=2 (0x2)
"GameConsoleService"=3 (0x3)
"Fax"=2 (0x2)
"Compaq_RBA"=2 (0x2)
"Apple Mobile Device"=2 (0x2)
"Adobe LM Service"=3 (0x3)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
"SpybotSD TeaTimer"=c:\program files\Spybot - Search & Destroy\TeaTimer.exe
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" -osboot
"WMPNSCFG"=c:\program files\Windows Media Player\WMPNSCFG.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
"prunnet"="c:\windows\system32\prunnet.exe"
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" -osboot
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Westwood\\Renegade\\Game.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\America's Army\\System\\ArmyOps.exe"=
"c:\\Program Files\\TrackMania Nations ESWC\\TmNationsESWC.exe"=
"c:\\Program Files\\TrackMania Nations ESWC\\TrackManiaServer.exe"=
"c:\\Program Files\\America's Army\\System\\Server.exe"=
"c:\\Westwood\\Renegade\\Game2.exe"=
"c:\\Program Files\\Real\\RealOne Player\\realplay.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Sony\\Station\\LaunchPad\\LaunchPad.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Electronic Arts\\EADM\\Core.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\America's Army Deploy Client\\AADeployClient.exe"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\World of Warcraft\\Launcher.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724
"1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015
"1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016
"500:UDP"= 500:UDP:@xpsp2res.dll,-22017
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-02-15 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-02-15 20560]
R2 SVKP;SVKP;c:\windows\system32\SVKP.sys [2006-08-31 2368]
R3 AtiHdmiService;ATI Function Driver for HDMI Service;c:\windows\system32\drivers\AtiHdmi.sys [2009-02-13 93184]
S3 BELKIN;Belkin Wireless G USB Network Adapter;c:\windows\system32\drivers\BLKWGU.sys [2007-12-18 238848]
S3 JSINMIS;JSINMIS;c:\docume~1\jeremy\LOCALS~1\Temp\JSINMIS.exe –> c:\docume~1\jeremy\LOCALS~1\Temp\JSINMIS.exe [?]
S3 PBDOWNFORCE_SERVICE;PBDOWNFORCE_SERVICE;c:\documents and settings\jeremy\Desktop\gamefiles\PBDownForce.sys [2006-08-05 20480]
S3 PBDOWNFORCE_TEST_SERVICE;PBDOWNFORCE_TEST_SERVICE;\??\c:\documents and settings\jeremy\Desktop\gamefiles\Test.sys –> c:\documents and settings\jeremy\Desktop\gamefiles\Test.sys [?]
.
Contents of the 'Scheduled Tasks' folder
2009-02-03 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:57]
2005-12-07 c:\windows\Tasks\Registration reminder 3.job
- c:\windows\System32\OOBE\oobebaln.exe [2008-04-13 19:12]
2007-06-24 c:\windows\Tasks\Uniblue SpeedUpMyPC.job
- c:\program files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe []
.
.
——- Supplementary Scan ——-
.
mWindow Title = Windows Internet Explorer provided by Comcast
uInternet Connection Wizard,ShellNext = iexplore
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\jeremy\Application Data\Mozilla\Firefox\Profiles\b5n4lzny.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.e30tech.com/forum/index.php
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava11.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava12.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava13.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava14.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava32.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJPI150_06.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPOJI610.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npagent.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nppl3260.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nprjplug.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nprpjplug.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-16 20:10:22
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
[HKEY_USERS\S-1-5-21-4021508746-488748980-3615762775-1006\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
[HKEY_USERS\S-1-5-21-4021508746-488748980-3615762775-1006\Software\SecuROM\License information*]
"datasecu"=hex:a9,30,38,3a,49,dd,3a,96,79,df,7d,08,47,ee,64,48,f7,5e,f5,7c,44,
5b,c3,54,ab,ba,3c,9f,27,e0,1d,cc,3d,75,2b,d1,ec,2e,97,4b,f6,51,3d,9e,8d,16,\
"rkeysecu"=hex:e2,26,6d,94,9c,ba,ad,1d,64,79,70,1b,d8,19,de,23
.
——————— DLLs Loaded Under Running Processes ———————
- - - - - - - > 'winlogon.exe'(580)
c:\windows\system32\Ati2evxx.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\taskmgr.exe
.
**************************************************************************
.
Completion time: 2009-02-16 20:16:35 - machine was rebooted
ComboFix-quarantined-files.txt 2009-02-17 01:16:32
ComboFix2.txt 2009-02-17 00:21:09
ComboFix3.txt 2009-02-16 18:22:21
Pre-Run: 56,012,894,208 bytes free
Post-Run: 55,943,835,648 bytes free
Current=5 Default=5 Failed=4 LastKnownGood=6 Sets=1,2,3,4,5,6
320 — E O F — 2009-02-16 08:02:47
And here is the hijackthis log
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:19:14, on 2/16/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
O2 - BHO: (no name) - AutorunsDisabled - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [prunnet] "C:\WINDOWS\system32\prunnet.exe"
O9 - Extra button: (no name) - AutorunsDisabled - (no file)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=2c02&lc=0409
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: JSINMIS - Unknown owner - C:\DOCUME~1\jeremy\LOCALS~1\Temp\JSINMIS.exe (file missing)
–
End of file - 3859 bytes
LDTate
To set your time format in Windows XP go to the Start Button then select the Control Panel. In the Control Panel select the Regional and Language Options.
Now select the Customize button in the Standards and formats section, notice the legend for the different time formats on the bottom of the window. Now select the Time tab and then click on the drop down menu arrow next to the Time format box.
Choose the h:mm:ss tt select to change to the default windows format. Then click on Apply or OK.
thses 3 files aren't showing any extensions.
Can you find and tell me what the file extensions are?
c:\windows\zkvyrebe
c:\windows\qeietljl
c:\windows\ecppolmr
Now select the Customize button in the Standards and formats section, notice the legend for the different time formats on the bottom of the window. Now select the Time tab and then click on the drop down menu arrow next to the Time format box.
Choose the h:mm:ss tt select to change to the default windows format. Then click on Apply or OK.
thses 3 files aren't showing any extensions.
Can you find and tell me what the file extensions are?
c:\windows\zkvyrebe
c:\windows\qeietljl
c:\windows\ecppolmr
meintool
ok time is fixed..now how do i find file extentions? for those files?
Nevermind i have to o into c:\windows and find them brb
LDTate
Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Uncheck "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Uncheck "Hide protected operating system files."
Click Apply, and then click OK.
Go to c:\windows and the files should be listed
c:\windows\zkvyrebe
c:\windows\qeietljl
c:\windows\ecppolmr
By Extensions, I'm looking for would be like: c:\windows\zkvyrebe.dll
Click the Tools menu, and then click Folder Options.
Click the View tab.
Uncheck "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Uncheck "Hide protected operating system files."
Click Apply, and then click OK.
Go to c:\windows and the files should be listed
c:\windows\zkvyrebe
c:\windows\qeietljl
c:\windows\ecppolmr
By Extensions, I'm looking for would be like: c:\windows\zkvyrebe.dll
meintool
they have no extensions just the file name
LDTate
1. Please download The Avenger by Swandog46 to your Desktop.
http://swandog46.geekstogo.com/avenger.zip
Click on Avenger.zip to open the file
Extract avenger.exe to your desktop
2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):
Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.
3. Now, start The Avenger program by clicking on its icon on your desktop.
Under "Script file to execute" choose "Input Script Manually".
Now click on the Magnifying Glass icon which will open a new window titled "View/edit script"
Paste the text copied to clipboard into this window by pressing (Ctrl+V).
Click Done
Now click on the Green Light to begin execution of the script
Answer "Yes" twice when prompted.
4. The Avenger will automatically do the following:
It will Restart your computer. ( In cases where the code to execute contains "Drivers to Unload", The Avenger will actually restart your system twice.)
On reboot, it will briefly open a black command window on your desktop, this is normal.
After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
5. Please copy/paste the content of c:\avenger.txt into your reply.
http://swandog46.geekstogo.com/avenger.zip
Click on Avenger.zip to open the file
Extract avenger.exe to your desktop
2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):
Files to delete:
C:\WINDOWS\system32\prunnet.exe
c:\windows\zkvyrebe
c:\windows\qeietljl
c:\windows\ecppolmr
Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.
3. Now, start The Avenger program by clicking on its icon on your desktop.
Under "Script file to execute" choose "Input Script Manually".
Now click on the Magnifying Glass icon which will open a new window titled "View/edit script"
Paste the text copied to clipboard into this window by pressing (Ctrl+V).
Click Done
Now click on the Green Light to begin execution of the script
Answer "Yes" twice when prompted.
4. The Avenger will automatically do the following:
It will Restart your computer. ( In cases where the code to execute contains "Drivers to Unload", The Avenger will actually restart your system twice.)
On reboot, it will briefly open a black command window on your desktop, this is normal.
After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
5. Please copy/paste the content of c:\avenger.txt into your reply.
meintool
ok i think thats a different version of avenger because those directions dont apply to the version i just downloaded as soon as i open the avenger.exe there is no "script file to execute" there is no magnifying glass the only thing that happens when it opens is it goes to a box with 3 buttons up top which are "load script from file" "load script from internet url" and paste script from clipboard the top tool bar says File- edit- load script- help ????
meintool
it also has a box that says input script here a check box that says scsan for rootkits a check box for automatically disable any rootkits found and an execute button should i just paste the code there as soon as the program opens and hit execute?
LDTate
Sorry about that.
Copy/paste the below into the Input Script Here and select Execute
Files to delete:
C:\WINDOWS\system32\prunnet.exe
c:\windows\zkvyrebe
c:\windows\qeietljl
c:\windows\ecppolmr
Copy/paste the below into the Input Script Here and select Execute
Files to delete:
C:\WINDOWS\system32\prunnet.exe
c:\windows\zkvyrebe
c:\windows\qeietljl
c:\windows\ecppolmr
meintool
ok rebooting now be back with log in a moment
meintool
ok here is the log…still taking a while to load firefox and boot computer but getting better also i noticed a new file on my desktop named thumbs.db which ive never seen before
Logfile of The Avenger Version 2.0, © by Swandog46
http://swandog46.geekstogo.com
Platform: Windows XP
*******************
Script file opened successfully.
Script file read successfully.
Backups directory opened successfully at C:\Avenger
*******************
Beginning to process script file:
Rootkit scan active.
No rootkits found!
Error: file "C:\WINDOWS\system32\prunnet.exe" not found!
Deletion of file "C:\WINDOWS\system32\prunnet.exe" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
–> the object does not exist
File "c:\windows\zkvyrebe" deleted successfully.
File "c:\windows\qeietljl" deleted successfully.
File "c:\windows\ecppolmr" deleted successfully.
Completed script processing.
*******************
Finished! Terminate.
Logfile of The Avenger Version 2.0, © by Swandog46
http://swandog46.geekstogo.com
Platform: Windows XP
*******************
Script file opened successfully.
Script file read successfully.
Backups directory opened successfully at C:\Avenger
*******************
Beginning to process script file:
Rootkit scan active.
No rootkits found!
Error: file "C:\WINDOWS\system32\prunnet.exe" not found!
Deletion of file "C:\WINDOWS\system32\prunnet.exe" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
–> the object does not exist
File "c:\windows\zkvyrebe" deleted successfully.
File "c:\windows\qeietljl" deleted successfully.
File "c:\windows\ecppolmr" deleted successfully.
Completed script processing.
*******************
Finished! Terminate.
LDTate
Post a new HijackThis log please.
meintool
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:51:44 PM, on 2/16/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
O2 - BHO: (no name) - AutorunsDisabled - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [prunnet] "C:\WINDOWS\system32\prunnet.exe"
O9 - Extra button: (no name) - AutorunsDisabled - (no file)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=2c02&lc=0409
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: JSINMIS - Unknown owner - C:\DOCUME~1\jeremy\LOCALS~1\Temp\JSINMIS.exe (file missing)
–
End of file - 3934 bytes
Scan saved at 8:51:44 PM, on 2/16/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
O2 - BHO: (no name) - AutorunsDisabled - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [prunnet] "C:\WINDOWS\system32\prunnet.exe"
O9 - Extra button: (no name) - AutorunsDisabled - (no file)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=2c02&lc=0409
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: JSINMIS - Unknown owner - C:\DOCUME~1\jeremy\LOCALS~1\Temp\JSINMIS.exe (file missing)
–
End of file - 3934 bytes
Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI