What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] win32.zafi.b removal help...

7 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
i was infected with several trojans and i think they came packaged. So one day im browsing and clicked on a bad link or something and my computer restarted….once it did that i unplugged my internet connection as i knew what was up. sure enough while almost done rebooting i get this message saying your system has Win32.zafi.b and so i did the research on another computer to make this short. found out it was a fake alert and if i would download what it wanted me to download i would have more problems. so then i read to delete C:\Documents and Settings\Administrator\ApplicationData\Google\pzpsp23511834.exe or ptnmsnn.dll and vgwsn871850 i cant remember but i do remember that i deleted the files in google folder that i found. Then after installing mbam and renaming it something else. i got it to run in safe mode as i couldnt get any anti virus/maleware or n e thing to run. it found Trojans and quarantined them. i also ran super anti spyware as i read it was a good additional program to run for this virus/maleware . i have also ran combo fix and have all these logs . my question is. what additional steps should i take to make sure im good to surf once more ? my computer can now access the internet after running the scans and the pop up stopped after deleting the files in the google folder. any help would be much appreciated. also the hi jack this log is the last log and was scanned right before posting this.

Malwarebytes' Anti-Malware 1.34
Database version: 1749
Windows 5.1.2600 Service Pack 3

3/27/2009 3:50:54 PM
mbam-log-2009-03-27 (15-50-54).txt

Scan type: Full Scan (C:\|E:\|)
Objects scanned: 129458
Time elapsed: 38 minute(s), 47 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 8

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\tdss (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Documents and Settings\Don\Local Settings\Temp\TDSSddf7.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\TDSScfum.dll (Trojan.TDSS) -> Delete on reboot.
C:\WINDOWS\system32\TDSSnrsr.dll (Trojan.TDSS) -> Delete on reboot.
C:\WINDOWS\system32\TDSSofxh.dll (Trojan.TDSS) -> Delete on reboot.
C:\WINDOWS\system32\TDSSriqp.dll (Trojan.TDSS) -> Delete on reboot.
C:\WINDOWS\system32\drivers\TDSSpaxt.sys (Trojan.TDSS) -> Delete on reboot.
C:\WINDOWS\system32\TDSSfxmp.dll (Rootkit.Agent) -> Delete on reboot.
C:\WINDOWS\system32\TDSStkdv.log (Trojan.TDSS) -> Delete on reboot.


SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 03/27/2009 at 04:01 PM

Application Version : 4.25.1014

Core Rules Database Version : 3773
Trace Rules Database Version: 1732

Scan type : Complete Scan
Total Scan Time : 00:55:18

Memory items scanned : 544
Memory threats detected : 0
Registry items scanned : 4128
Registry threats detected : 83
File items scanned : 17304
File threats detected : 8

Rootkit.TDSServ/Fake
HKLM\system\controlset001\services\TDSSserv.sys
C:\WINDOWS\SYSTEM32\DRIVERS\TDSSPAXT.SYS
HKLM\system\controlset002\services\TDSSserv.sys
HKLM\system\controlset003\services\TDSSserv.sys
C:\DOCUMENTS AND SETTINGS\DON\LOCAL SETTINGS\TEMP\TDSSDDD8.TMP

Adware.Tracking Cookie
C:\Documents and Settings\Don\Cookies\don@mediaplex[1].txt
C:\Documents and Settings\Don\Cookies\don@atdmt[2].txt
C:\Documents and Settings\Don\Cookies\[removed][1].txt
C:\Documents and Settings\Don\Cookies\don@doubleclick[1].txt

Rootkit.TDSServ
HKLM\SOFTWARE\TDSS
HKLM\SOFTWARE\TDSS#build
HKLM\SOFTWARE\TDSS#type
HKLM\SOFTWARE\TDSS#affid
HKLM\SOFTWARE\TDSS#subid
HKLM\SOFTWARE\TDSS#cmddelay
HKLM\SOFTWARE\TDSS#serversdown
HKLM\SOFTWARE\TDSS\connections
HKLM\SOFTWARE\TDSS\connections#f6065612
HKLM\SOFTWARE\TDSS\connections#7e72e91c
HKLM\SOFTWARE\TDSS\disallowed
HKLM\SOFTWARE\TDSS\disallowed#trsetup.exe
HKLM\SOFTWARE\TDSS\disallowed#ViewpointService.exe
HKLM\SOFTWARE\TDSS\disallowed#ViewMgr.exe
HKLM\SOFTWARE\TDSS\disallowed#SpySweeper.exe
HKLM\SOFTWARE\TDSS\disallowed#SUPERAntiSpyware.exe
HKLM\SOFTWARE\TDSS\disallowed#SpySub.exe
HKLM\SOFTWARE\TDSS\disallowed#SpywareTerminatorShield.exe
HKLM\SOFTWARE\TDSS\disallowed#SpyHunter3.exe
HKLM\SOFTWARE\TDSS\disallowed#XoftSpy.exe
HKLM\SOFTWARE\TDSS\disallowed#SpyEraser.exe
HKLM\SOFTWARE\TDSS\disallowed#combofix.exe
HKLM\SOFTWARE\TDSS\disallowed#otscanit.exe
HKLM\SOFTWARE\TDSS\disallowed#mbam.exe
HKLM\SOFTWARE\TDSS\disallowed#mbam-setup.exe
HKLM\SOFTWARE\TDSS\disallowed#flash_disinfector.exe
HKLM\SOFTWARE\TDSS\disallowed#otmoveit2.exe
HKLM\SOFTWARE\TDSS\disallowed#smitfraudfix.exe
HKLM\SOFTWARE\TDSS\disallowed#prevxcsifree.exe
HKLM\SOFTWARE\TDSS\disallowed#download_mbam-setup.exe
HKLM\SOFTWARE\TDSS\disallowed#cbo_setup.exe
HKLM\SOFTWARE\TDSS\disallowed#spywareblastersetup.exe
HKLM\SOFTWARE\TDSS\disallowed#rminstall.exe
HKLM\SOFTWARE\TDSS\disallowed#sdsetup.exe
HKLM\SOFTWARE\TDSS\disallowed#vundofixsvc.exe
HKLM\SOFTWARE\TDSS\disallowed#daft.exe
HKLM\SOFTWARE\TDSS\disallowed#gmer.exe
HKLM\SOFTWARE\TDSS\disallowed#catchme.exe
HKLM\SOFTWARE\TDSS\disallowed#mcpr.exe
HKLM\SOFTWARE\TDSS\disallowed#sdfix.exe
HKLM\SOFTWARE\TDSS\disallowed#hjtinstall.exe
HKLM\SOFTWARE\TDSS\disallowed#fixpolicies.exe
HKLM\SOFTWARE\TDSS\disallowed#emergencyutil.exe
HKLM\SOFTWARE\TDSS\disallowed#techweb.exe
HKLM\SOFTWARE\TDSS\disallowed#GoogleUpdate.exe
HKLM\SOFTWARE\TDSS\disallowed#windowsdefender.exe
HKLM\SOFTWARE\TDSS\disallowed#spybotsd.exe
HKLM\SOFTWARE\TDSS\injector
HKLM\SOFTWARE\TDSS\injector#*
HKLM\SOFTWARE\TDSS\versions
HKLM\SOFTWARE\TDSS\versions#/tdss/crcmds/init
HKLM\SOFTWARE\TDSS\versions#/tdss2/crcmds/init
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata#affid
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata#subid
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata#control
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata#prov
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata#googleadserver
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata#flagged
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys#start
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys#type
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys#imagepath
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys#group
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\modules
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\modules#TDSSserv
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\modules#TDSSl
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\modules#tdssservers
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\modules#tdssmain
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\modules#tdsslog
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\modules#tdssadw
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\modules#tdssinit
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\modules#tdssurls
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\modules#tdsspanels
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\modules#tdsserrors
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\modules#TDSSproc
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\Enum
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\Enum#0
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\Enum#Count
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\Enum#NextInstance

Rootkit.TDSServ-Trace
C:\WINDOWS\SYSTEM32\TDSSOSVD.DAT
C:\WINDOWS\SYSTEM32\TDSSTKDV.LOG


ComboFix 09-03-29.02 - Don 2009-03-29 19:07:35.1 - NTFSx86 NETWORK
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2012.1734 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\Combo-Fix.exe
AV: CA Anti-Virus *On-access scanning disabled* (Updated)
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_TDSSSERV.SYS


((((((((((((((((((((((((( Files Created from 2009-02-28 to 2009-03-30 )))))))))))))))))))))))))))))))
.

2009-03-29 18:25 . 2009-03-29 18:25 268 –ah—– C:\sqmdata19.sqm
2009-03-29 18:25 . 2009-03-29 18:25 244 –ah—– C:\sqmnoopt19.sqm
2009-03-29 05:03 . 2009-03-29 05:03 268 –ah—– C:\sqmdata18.sqm
2009-03-29 05:03 . 2009-03-29 05:03 244 –ah—– C:\sqmnoopt18.sqm
2009-03-29 03:08 . 2009-03-29 03:11 d——– c:\documents and settings\Don\Application Data\utorrent
2009-03-29 01:14 . 2009-03-29 01:14 d——– c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-03-28 16:13 . 2009-03-28 16:13 268 –ah—– C:\sqmdata17.sqm
2009-03-28 16:13 . 2009-03-28 16:13 244 –ah—– C:\sqmnoopt17.sqm
2009-03-28 01:35 . 2009-03-29 04:50 d——– c:\documents and settings\Don\Application Data\HouseCall 6.6
2009-03-27 16:45 . 2009-03-27 16:45 268 –ah—– C:\sqmdata16.sqm
2009-03-27 16:45 . 2009-03-27 16:45 244 –ah—– C:\sqmnoopt16.sqm
2009-03-27 16:12 . 2009-03-29 05:02 d——– c:\windows\CAVTemp
2009-03-27 16:04 . 2009-03-27 16:04 268 –ah—– C:\sqmdata15.sqm
2009-03-27 16:04 . 2009-03-27 16:04 244 –ah—– C:\sqmnoopt15.sqm
2009-03-27 15:54 . 2009-03-27 15:54 880,560 –a—— c:\windows\system32\drivers\vetefile.sys
2009-03-27 15:54 . 2009-03-27 15:54 108,368 –a—— c:\windows\system32\drivers\veteboot.sys
2009-03-27 15:09 . 2009-03-27 15:09 d——– c:\documents and settings\Don\Application Data\Malwarebytes
2009-03-27 15:03 . 2009-03-27 15:03 d——– c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-03-27 15:01 . 2009-03-27 16:08 d——– c:\program files\supsup
2009-03-27 15:01 . 2009-03-27 15:01 d——– c:\documents and settings\Don\Application Data\SUPERAntiSpyware.com
2009-03-27 11:18 . 2009-03-27 11:18 d——– c:\program files\Common Files\Wise Installation Wizard
2009-03-25 04:17 . 2009-03-25 04:17 268 –ah—– C:\sqmdata14.sqm
2009-03-25 04:17 . 2009-03-25 04:17 244 –ah—– C:\sqmnoopt14.sqm
2009-03-25 04:09 . 2009-03-25 04:09 268 –ah—– C:\sqmdata13.sqm
2009-03-25 04:09 . 2009-03-25 04:09 244 –ah—– C:\sqmnoopt13.sqm
2009-03-25 04:04 . 2009-01-21 05:23 138,384 –a—— c:\windows\system32\drivers\tmcomm.sys
2009-03-25 03:15 . 2009-03-25 03:15 268 –ah—– C:\sqmdata12.sqm
2009-03-25 03:15 . 2009-03-25 03:15 244 –ah—– C:\sqmnoopt12.sqm
2009-03-25 03:13 . 2009-03-25 03:13 268 –ah—– C:\sqmdata11.sqm
2009-03-25 03:13 . 2009-03-25 03:13 244 –ah—– C:\sqmnoopt11.sqm
2009-03-10 01:59 . 2009-03-10 01:59 268 –ah—– C:\sqmdata10.sqm
2009-03-10 01:59 . 2009-03-10 01:59 244 –ah—– C:\sqmnoopt10.sqm
2009-03-10 01:35 . 2009-03-10 01:35 268 –ah—– C:\sqmdata09.sqm
2009-03-10 01:35 . 2009-03-10 01:35 244 –ah—– C:\sqmnoopt09.sqm

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-27 20:54 ——— d—–w c:\documents and settings\All Users\Application Data\CA
2009-03-26 21:49 38,496 —-a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-03-26 21:49 15,504 —-a-w c:\windows\system32\drivers\mbam.sys
2008-08-21 09:57 32,768 –sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008082120080822\index.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"msnmsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
"H/PC Connection Agent"="c:\downloads\Active Sync\wcescomm.exe" [2006-11-13 1289000]
"Yahoo! Pager"="c:\downloads\Yahoo Mssgr\Messenger\YahooMessenger.exe" [2007-08-30 4670704]
"Aim6"="c:\program files\AIM6\aim6.exe" [2008-03-25 50528]
"cdloader"="c:\documents and settings\Don\Application Data\mjusbsp\cdloader2.exe" [2008-06-12 50520]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232]
"SUPERAntiSpyware"="c:\program files\supsup\supsup.exe" [2009-02-17 1830128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IRW"="c:\windows\system32\IRW.exe" [2008-04-15 147456]
"Apple_KbdMgr"="c:\program files\Boot Camp\KbdMgr.exe" [2008-04-15 423216]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-14 644696]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-03 1603152]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4\OpwareSE4.exe" [2007-02-04 79400]
"Media Codec Update Service"="c:\downloads\windows codec pack1\Essentials Codec Pack\update.exe" [2007-04-08 303104]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-04-15 135168]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-04-15 159744]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-04-15 131072]
"EyelineRun"="c:\program files\NCH Software\Eyeline\eyeline.exe" [2008-06-27 425988]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2006-02-28 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2006-02-28 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2006-02-28 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2006-02-28 455168]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-06 413696]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-09-03 111936]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-09-08 289576]
"Adobe Reader Speed Launcher"="c:\downloads\AdobeReader\Reader\Reader_sl.exe" [2008-10-15 39792]
"mxomssmenu"="c:\downloads\Maxtor\installed here\OneTouch Status\maxmenumgr.exe" [2008-07-21 169312]
"cctray"="c:\downloads\ca internet security suite\cctray\cctray.exe" [2009-03-27 177392]
"QOELOADER"="c:\downloads\ca internet security suite\CA Anti-Spam\QSP-5.1.18.0\QOELoader.exe" [2009-01-14 14088]
"CAVRID"="c:\downloads\ca internet security suite\CA Anti-Virus\CAVRID.exe" [2007-08-20 230664]
"cafwc"="c:\downloads\ca internet security suite\CA Personal Firewall\cafw.exe" [2009-03-27 1193200]
"capfasem"="c:\downloads\ca internet security suite\CA Personal Firewall\capfasem.exe" [2009-03-27 173296]
"capfupgrade"="c:\downloads\ca internet security suite\CA Personal Firewall\capfupgrade.exe" [2009-03-27 259312]
"CaPPcl"="c:\downloads\ca internet security suite\CA Anti-Spyware\CAAntiSpyware.exe" [2007-08-16 410888]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-13 c:\windows\system32\bthprops.cpl]
"RTHDCPL"="RTHDCPL.EXE" [2008-04-15 c:\windows\RTHDCPL.exe]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\supsup\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 11:05 356352 c:\program files\supsup\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PFW]
2007-05-18 14:30 79368 c:\windows\system32\UmxWNP.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ComputerAssociatesAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Downloads\\Yahoo Mssgr\\Messenger\\YahooMessenger.exe"=
"c:\\Downloads\\Yahoo Mssgr\\Messenger\\YServer.exe"=
"c:\\Downloads\\U Torrent\\utorrent-1.8-beta-10431.upx.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\downloads\Active Sync\rapimgr.exe"= c:\downloads\Active Sync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\downloads\Active Sync\wcescomm.exe"= c:\downloads\Active Sync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\downloads\Active Sync\WCESMgr.exe"= c:\downloads\Active Sync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Downloads\\Rhapsody\\rhapsody.exe"=
"c:\\Program Files\\QuickTime\\QuickTimePlayer.exe"=
"c:\\Documents and Settings\\Don\\Application Data\\mjusbsp\\magicJack.exe"=
"c:\\Downloads\\FireFox beta 3 ver4\\firefox.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\system32\\drivers\\svchost.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R0 KmxStart;KmxStart;c:\windows\system32\drivers\KmxStart.sys [2008-06-24 93712]
R1 SASDIFSV;SASDIFSV;c:\program files\supsup\SASDIFSV.SYS [2009-02-17 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\supsup\SASKUTIL.SYS [2009-02-17 55024]
R2 AppleOSSMgr;Apple OS Switch Manager;c:\windows\system32\AppleOSSMgr.exe [2008-04-15 132400]
R2 AppleTimeSrv;Apple Time Service;c:\windows\system32\AppleTimeSrv.exe [2008-04-15 99632]
R2 EyelineService;Eyeline Service;c:\program files\NCH Software\Eyeline\eyeline.exe [2008-06-24 425988]
R2 KeyAgent;KeyAgent;c:\windows\system32\drivers\KeyAgent.sys [2008-04-15 5504]
R2 KmxCF;KmxCF;c:\windows\system32\drivers\KmxCF.sys [2008-06-24 134648]
R2 MacHALDriver;Mac HAL;c:\windows\system32\drivers\MacHALDriver.sys [2008-04-15 6528]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2008-06-06 24652]
R3 aapltctp;Apple Trackpad Enabler;c:\windows\system32\drivers\aapltctp.sys [2008-03-30 4224]
R3 aapltp;Apple Trackpad;c:\windows\system32\drivers\aapltp.sys [2008-03-30 35072]
R3 applebt;Apple Built-in Bluetooth;c:\windows\system32\drivers\applebt.sys [2008-03-30 9088]
R3 IRRemoteFlt;IR Receiver Filter Driver;c:\windows\system32\drivers\IRFilter.sys [2008-03-30 16512]
R3 KeyMagic;USB Keyboard HID Filter;c:\windows\system32\drivers\KeyMagic.sys [2008-03-30 19968]
R3 PPCtlPriv;PPCtlPriv;c:\downloads\ca internet security suite\CA Anti-Spyware\PPCtlPriv.exe [2007-08-16 189704]
R3 SASENUM;SASENUM;c:\program files\supsup\SASENUM.SYS [2009-02-17 7408]
S0 gtxnupcg;gtxnupcg;c:\windows\system32\drivers\axxbzIl.sys –> c:\windows\system32\drivers\axxbzIl.sys [?]
S0 zecjujn;zecjujn;c:\windows\system32\drivers\roecua.sys –> c:\windows\system32\drivers\roecua.sys [?]
S3 BthKicker;Apple Bluetooth Device Driver;c:\windows\system32\drivers\BthKicker.sys [2008-03-30 7424]
S3 iSightUpdate;iSight Update Driver;c:\windows\system32\drivers\iSightUP.sys [2008-03-30 17664]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a54b4ee0-635c-11dd-b18d-001ec2a9b965}]
\Shell\AutoRun\command - E:\autorun.exe
\Shell\phone\command - E:\autorun.exe
.
Contents of the 'Scheduled Tasks' folder

2009-01-15 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]

2009-01-14 c:\windows\Tasks\CAAntiSpywareScan_Daily as Don at 3 29 AM.job
- c:\downloads\ca internet security suite\CA Anti-Spyware\CAAntiSpyware.exe [2007-08-16 22:10]
.
.
——- Supplementary Scan ——-
.
uInternet Settings,ProxyOverride = *.local
LSP: c:\windows\system32\VetRedir.dll
FF - ProfilePath - c:\documents and settings\Don\Application Data\Mozilla\Firefox\Profiles\0t9xt73q.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - component: c:\documents and settings\Don\Application Data\Mozilla\Firefox\Profiles\0t9xt73q.default\extensions\[removed]\components\coolirisstub.dll
FF - plugin: c:\downloads\AdobeReader\Reader\browser\nppdf32.dll
FF - plugin: c:\downloads\FireFox beta 3 ver4\plugins\npViewpoint.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-29 19:10:18
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(924)
c:\program files\supsup\SASWINLO.dll
c:\windows\system32\UmxWnp.Dll
c:\program files\CA\SharedComponents\PPRT\bin\CACheck.dll
c:\program files\CA\SharedComponents\PPRT\bin\CAHook.dll
c:\program files\CA\SharedComponents\PPRT\bin\CAServer.dll

- - - - - - - > 'lsass.exe'(980)
c:\windows\system32\VetRedir.dll
c:\windows\system32\ISafeIf.dll
.
———————— Other Running Processes ————————
.
c:\program files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\downloads\ca internet security suite\CA Anti-Virus\isafe.exe
c:\program files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
c:\downloads\Maxtor\installed here\Sync\SyncServices.exe
c:\downloads\ca internet security suite\CA Anti-Virus\vetmsg.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\igfxsrvc.exe
c:\downloads\ca internet security suite\CA Anti-Spyware\CAPPActiveProtection.exe
c:\program files\iPod\bin\iPodService.exe
c:\downloads\ca internet security suite\ccprovsp.exe
c:\downlo~1\ACTIVE~1\rapimgr.exe
c:\program files\AIM6\aolsoftware.exe
c:\downloads\Yahoo Mssgr\Messenger\Ymsgr_tray.exe
c:\windows\system32\taskmgr.exe
.
**************************************************************************
.
Completion time: 2009-03-29 19:13:19 - machine was rebooted
ComboFix-quarantined-files.txt 2009-03-30 00:13:17

Pre-Run: 11,334,643,712 bytes free
Post-Run: 12,164,206,592 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(3)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(3)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

228 — E O F — 2009-03-25 09:18:48

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:31:19 AM, on 3/30/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\AppleOSSMgr.exe
C:\WINDOWS\system32\AppleTimeSrv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Downloads\ca internet security suite\CA Anti-Virus\ISafe.exe
C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
C:\Downloads\Maxtor\installed here\Sync\SyncServices.exe
C:\WINDOWS\system32\svchost.exe
C:\Downloads\ca internet security suite\CA Anti-Virus\VetMsg.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\IRW.exe
C:\Program Files\Boot Camp\KbdMgr.exe
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\igfxsrvc.exe
C:\Downloads\ca internet security suite\cctray\cctray.exe
C:\Downloads\ca internet security suite\CA Anti-Spam\QSP-5.1.18.0\QOELoader.exe
C:\Downloads\ca internet security suite\CA Anti-Virus\CAVRID.exe
C:\Downloads\ca internet security suite\CA Anti-Spyware\CAPPActiveProtection.exe
C:\Downloads\ca internet security suite\CA Anti-Spyware\PPCtlPriv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Downloads\ca internet security suite\ccprovsp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Downloads\Active Sync\wcescomm.exe
C:\DOWNLO~1\ACTIVE~1\rapimgr.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\supsup\supsup.exe
C:\Downloads\Yahoo Mssgr\Messenger\ymsgr_tray.exe
C:\WINDOWS\explorer.exe
C:\Program Files\NCH Software\Eyeline\eyeline.exe
C:\Downloads\Repair Tool Box\SpybotSearchandDestroy\Spybot - Search & Destroy\TeaTimer.exe
C:\Downloads\FireFox beta 3 ver4\firefox.exe
C:\Downloads\Conquer\Conquer.exe
C:\Downloads\Conquer\zftqat\TQAT.exe
C:\Documents and Settings\Don\My Documents\New Folder\Malwarebytes' Anti-Malware\mbam.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\DOWNLO~1\YAHOOM~1\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\DOWNLO~1\YAHOOM~1\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\DOWNLO~1\REPAIR~1\SPYBOT~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\DOWNLO~1\YAHOOM~1\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [IRW] C:\WINDOWS\system32\IRW.exe
O4 - HKLM\..\Run: [Apple_KbdMgr] C:\Program Files\Boot Camp\KbdMgr.exe
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"
O4 - HKLM\..\Run: [Media Codec Update Service] C:\Downloads\windows codec pack1\Essentials Codec Pack\update.exe -silent
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [EyelineRun] "C:\Program Files\NCH Software\Eyeline\eyeline.exe" -logon
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Downloads\AdobeReader\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [mxomssmenu] "C:\Downloads\Maxtor\installed here\OneTouch Status\maxmenumgr.exe"
O4 - HKLM\..\Run: [cctray] "C:\Downloads\ca internet security suite\cctray\cctray.exe"
O4 - HKLM\..\Run: [QOELOADER] "C:\Downloads\ca internet security suite\CA Anti-Spam\QSP-5.1.18.0\QOELoader.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Downloads\ca internet security suite\CA Anti-Virus\CAVRID.exe"
O4 - HKLM\..\Run: [cafwc] C:\Downloads\ca internet security suite\CA Personal Firewall\cafw.exe -cl
O4 - HKLM\..\Run: [capfasem] C:\Downloads\ca internet security suite\CA Personal Firewall\capfasem.exe
O4 - HKLM\..\Run: [capfupgrade] C:\Downloads\ca internet security suite\CA Personal Firewall\capfupgrade.exe
O4 - HKLM\..\Run: [CaPPcl] C:\Downloads\ca internet security suite\CA Anti-Spyware\CAAntiSpyware.exe /scan /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Downloads\Active Sync\wcescomm.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Downloads\Yahoo Mssgr\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [cdloader] "C:\Documents and Settings\Don\Application Data\mjusbsp\cdloader2.exe" MAGICJACK
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\supsup\supsup.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Downloads\Repair Tool Box\SpybotSearchandDestroy\Spybot - Search & Destroy\TeaTimer.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\DOWNLO~1\ACTIVE~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\DOWNLO~1\ACTIVE~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\DOWNLO~1\ACTIVE~1\INetRepl.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\DOWNLO~1\REPAIR~1\SPYBOT~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\DOWNLO~1\REPAIR~1\SPYBOT~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\supsup\SASWINLO.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Apple OS Switch Manager (AppleOSSMgr) - Unknown owner - C:\WINDOWS\system32\AppleOSSMgr.exe
O23 - Service: Apple Time Service (AppleTimeSrv) - Apple Inc. - C:\WINDOWS\system32\AppleTimeSrv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CaCCProvSP - CA, Inc. - C:\Downloads\ca internet security suite\ccprovsp.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Downloads\ca internet security suite\CA Anti-Virus\ISafe.exe
O23 - Service: Eyeline Service (EyelineService) - Unknown owner - C:\Program Files\NCH Software\Eyeline\eyeline.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
O23 - Service: Maxtor Service (Maxtor Sync Service) - Seagate Technology LLC - C:\Downloads\Maxtor\installed here\Sync\SyncServices.exe
O23 - Service: PPCtlPriv - CA, Inc. - C:\Downloads\ca internet security suite\CA Anti-Spyware\PPCtlPriv.exe
O23 - Service: HIPS Firewall Helper (UmxFwHlp) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe
O23 - Service: VET Message Service (VETMSGNT) - CA, Inc. - C:\Downloads\ca internet security suite\CA Anti-Virus\VetMsg.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

–
End of file - 11293 bytes

also on another thread one guy said to delete these files http://discussions.virtualdr.com/showthrea…6506&page=2
7. Delete following files/folders (if present):

- ALCMTR.EXE file from C:\Windows
- cijwg16225165.exe file from C:\Documents and Settings\Owner\Application Data\Google
- {7C7A6649-0BB8-1033-0927-040517200001} folder from C:\Program Files\Common Files

i wanna know if i should do that also?
Post #2
Hi -PrimeTime-,

:welcome:

My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

  • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.

COMBOFIX-Script

  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

    File::
C:\sqmdata19.sqm
C:\sqmnoopt19.sqm
C:\sqmdata18.sqm
C:\sqmnoopt18.sqm
C:\sqmdata17.sqm
C:\sqmnoopt17.sqm
C:\sqmdata16.sqm
C:\sqmnoopt16.sqm
C:\sqmdata15.sqm
C:\sqmnoopt15.sqm
C:\sqmdata14.sqm
C:\sqmnoopt14.sqm
C:\sqmdata13.sqm
C:\sqmnoopt13.sqm
C:\sqmdata12.sqm
C:\sqmnoopt12.sqm
C:\sqmdata11.sqm
C:\sqmnoopt11.sqm
C:\sqmdata10.sqm
C:\sqmnoopt10.sqm
C:\sqmdata09.sqm
C:\sqmnoopt09.sqm
c:\windows\system32\drivers\axxbzIl.sys
c:\windows\system32\drivers\roecua.sys

Folder::

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a54b4ee0-635c-11dd-b18d-001ec2a9b965}]

Driver::
gtxnupcg
zecjujn
  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

    [external image: Posted Image]
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Post #3
hey tom much appreciation for helping me, and i apologize for the delay in my response as i was away for a few days. upon returning i finally had time to sit down to carry out your advice…and my dang CA antivirus further delays me with this 4/9/2009 3:08:43 AM File infection: C:\Documents and Settings\Don\Desktop\Combo-Fix.exe is Win32/Nircmd.A trojan. Deleted 4/9/2009 3:08:43 AM File infection: C:\Documents and Settings\Don\Desktop\Combo-Fix.exe is Win32/Nircmd.A trojan. 4/9/2009 3:08:43 AM File infection: C:\Documents and Settings\Don\Desktop\Combo-Fix.exe is Win32/Nircmd.A trojan. 4/9/2009 3:08:43 AM File infection: C:\Documents and Settings\Don\Desktop\Combo-Fix.exe is Win32/Nircmd.A trojan. 4/9/2009 13:20:37 PM File infection: C:\System Volume Information\_restore{FFD33F0B-0941-440C-BF0E-4F08E37CE028}\RP6\A0001484.exe is Win32/Nircmd.A trojan. Deleted i had my computer on overnight and ca updated itself….then i read…that it had deleted these files….i'm guessing its a false positive from what i read onine.. so my question is…do i just re install combo-fix ? because certainly i cannot run it now with these missing files. also on a side note(originally upon download i had to rename ComboFix to Combo-Fix so it would run . ) should i rename it as i did the first time if i am to install it again?
Post #4
-PrimeTime-,

Yep. Drag the copy you have to the recycle bin.

Download ComboFix from one of these locations:

Link 1
Link 2
Link 3

* IMPORTANT !!! Save ComboFix.exe to your Desktop (you shouldn't have to rename it this time).


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link –> http://forums.whatthetech.com/How_Disable_…ams_t96260.html


  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

    File::
C:\sqmdata19.sqm
C:\sqmnoopt19.sqm
C:\sqmdata18.sqm
C:\sqmnoopt18.sqm
C:\sqmdata17.sqm
C:\sqmnoopt17.sqm
C:\sqmdata16.sqm
C:\sqmnoopt16.sqm
C:\sqmdata15.sqm
C:\sqmnoopt15.sqm
C:\sqmdata14.sqm
C:\sqmnoopt14.sqm
C:\sqmdata13.sqm
C:\sqmnoopt13.sqm
C:\sqmdata12.sqm
C:\sqmnoopt12.sqm
C:\sqmdata11.sqm
C:\sqmnoopt11.sqm
C:\sqmdata10.sqm
C:\sqmnoopt10.sqm
C:\sqmdata09.sqm
C:\sqmnoopt09.sqm
c:\windows\system32\drivers\axxbzIl.sys
c:\windows\system32\drivers\roecua.sys

Folder::

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a54b4ee0-635c-11dd-b18d-001ec2a9b965}]

Driver::
gtxnupcg
zecjujn
  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

    [external image: Posted Image]
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Post #6 last edited
this is the first post titled Win32.zafi.b removal helpso tomk was helping me before and now im back after a few days. i had lots of things going on so my apoligies on taking so dang long . here is my current combo fix log and hi jack this log ..i couldn't get the pop up saying my anti virus real time was still running …i even went into services and ended all ca related programs so i dunno but heres the logs…
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:26:36 AM, on 4/19/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\AppleOSSMgr.exe
C:\WINDOWS\system32\AppleTimeSrv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Downloads\ca internet security suite\CA Anti-Virus\ISafe.exe
C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
C:\Downloads\Maxtor\installed here\Sync\SyncServices.exe
C:\WINDOWS\system32\svchost.exe
C:\Downloads\ca internet security suite\CA Anti-Virus\VetMsg.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\IRW.exe
C:\Program Files\Boot Camp\KbdMgr.exe
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Downloads\Maxtor\installed here\OneTouch Status\maxmenumgr.exe
C:\Downloads\ca internet security suite\cctray\cctray.exe
C:\Downloads\ca internet security suite\CA Anti-Spam\QSP-5.1.18.0\QOELoader.exe
C:\Downloads\ca internet security suite\CA Anti-Virus\CAVRID.exe
C:\Downloads\ca internet security suite\CA Anti-Spyware\CAPPActiveProtection.exe
C:\Downloads\ca internet security suite\CA Anti-Spyware\PPCtlPriv.exe
C:\Downloads\ca internet security suite\ccprovsp.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Downloads\Active Sync\wcescomm.exe
C:\DOWNLO~1\ACTIVE~1\rapimgr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\supsup\supsup.exe
C:\Downloads\Repair Tool Box\SpybotSearchandDestroy\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\DOWNLO~1\YAHOOM~1\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\DOWNLO~1\YAHOOM~1\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\DOWNLO~1\REPAIR~1\SPYBOT~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\DOWNLO~1\YAHOOM~1\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [IRW] C:\WINDOWS\system32\IRW.exe
O4 - HKLM\..\Run: [Apple_KbdMgr] C:\Program Files\Boot Camp\KbdMgr.exe
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"
O4 - HKLM\..\Run: [Media Codec Update Service] C:\Downloads\windows codec pack1\Essentials Codec Pack\update.exe -silent
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [EyelineRun] "C:\Program Files\NCH Software\Eyeline\eyeline.exe" -logon
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Downloads\AdobeReader\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [mxomssmenu] "C:\Downloads\Maxtor\installed here\OneTouch Status\maxmenumgr.exe"
O4 - HKLM\..\Run: [cctray] "C:\Downloads\ca internet security suite\cctray\cctray.exe"
O4 - HKLM\..\Run: [QOELOADER] "C:\Downloads\ca internet security suite\CA Anti-Spam\QSP-5.1.18.0\QOELoader.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Downloads\ca internet security suite\CA Anti-Virus\CAVRID.exe"
O4 - HKLM\..\Run: [cafwc] C:\Downloads\ca internet security suite\CA Personal Firewall\cafw.exe -cl
O4 - HKLM\..\Run: [capfasem] C:\Downloads\ca internet security suite\CA Personal Firewall\capfasem.exe
O4 - HKLM\..\Run: [capfupgrade] C:\Downloads\ca internet security suite\CA Personal Firewall\capfupgrade.exe
O4 - HKLM\..\Run: [CaPPcl] C:\Downloads\ca internet security suite\CA Anti-Spyware\CAAntiSpyware.exe /scan /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Downloads\Active Sync\wcescomm.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Downloads\Yahoo Mssgr\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [cdloader] "C:\Documents and Settings\Don\Application Data\mjusbsp\cdloader2.exe" MAGICJACK
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\supsup\supsup.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Downloads\Repair Tool Box\SpybotSearchandDestroy\Spybot - Search & Destroy\TeaTimer.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\DOWNLO~1\ACTIVE~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\DOWNLO~1\ACTIVE~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\DOWNLO~1\ACTIVE~1\INetRepl.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\DOWNLO~1\REPAIR~1\SPYBOT~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\DOWNLO~1\REPAIR~1\SPYBOT~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\supsup\SASWINLO.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Apple OS Switch Manager (AppleOSSMgr) - Unknown owner - C:\WINDOWS\system32\AppleOSSMgr.exe
O23 - Service: Apple Time Service (AppleTimeSrv) - Apple Inc. - C:\WINDOWS\system32\AppleTimeSrv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CaCCProvSP - CA, Inc. - C:\Downloads\ca internet security suite\ccprovsp.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Downloads\ca internet security suite\CA Anti-Virus\ISafe.exe
O23 - Service: Eyeline Service (EyelineService) - Unknown owner - C:\Program Files\NCH Software\Eyeline\eyeline.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
O23 - Service: Maxtor Service (Maxtor Sync Service) - Seagate Technology LLC - C:\Downloads\Maxtor\installed here\Sync\SyncServices.exe
O23 - Service: PPCtlPriv - CA, Inc. - C:\Downloads\ca internet security suite\CA Anti-Spyware\PPCtlPriv.exe
O23 - Service: HIPS Firewall Helper (UmxFwHlp) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe
O23 - Service: VET Message Service (VETMSGNT) - CA, Inc. - C:\Downloads\ca internet security suite\CA Anti-Virus\VetMsg.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

–
End of file - 11349 bytes


-heres the combo fix log after doing wat tomk asked to do

ComboFix 09-04-19.04 - Don 04/19/2009 5:06.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2012.1518 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Don\Desktop\CFScript.txt
AV: CA Anti-Virus *On-access scanning enabled* (Updated)
* Created a new restore point

FILE ::
C:\sqmdata09.sqm
C:\sqmdata10.sqm
C:\sqmdata11.sqm
C:\sqmdata12.sqm
C:\sqmdata13.sqm
C:\sqmdata14.sqm
C:\sqmdata15.sqm
C:\sqmdata16.sqm
C:\sqmdata17.sqm
C:\sqmdata18.sqm
C:\sqmdata19.sqm
C:\sqmnoopt09.sqm
C:\sqmnoopt10.sqm
C:\sqmnoopt11.sqm
C:\sqmnoopt12.sqm
C:\sqmnoopt13.sqm
C:\sqmnoopt14.sqm
C:\sqmnoopt15.sqm
C:\sqmnoopt16.sqm
C:\sqmnoopt17.sqm
C:\sqmnoopt18.sqm
C:\sqmnoopt19.sqm
c:\windows\system32\drivers\axxbzIl.sys
c:\windows\system32\drivers\roecua.sys
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\sqmdata09.sqm
C:\sqmdata10.sqm
C:\sqmdata11.sqm
C:\sqmdata12.sqm
C:\sqmdata13.sqm
C:\sqmdata14.sqm
C:\sqmdata15.sqm
C:\sqmdata16.sqm
C:\sqmdata17.sqm
C:\sqmdata18.sqm
C:\sqmdata19.sqm
C:\sqmnoopt09.sqm
C:\sqmnoopt10.sqm
C:\sqmnoopt11.sqm
C:\sqmnoopt12.sqm
C:\sqmnoopt13.sqm
C:\sqmnoopt14.sqm
C:\sqmnoopt15.sqm
C:\sqmnoopt16.sqm
C:\sqmnoopt17.sqm
C:\sqmnoopt18.sqm
C:\sqmnoopt19.sqm

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_gtxnupcg
——-\Service_zecjujn


((((((((((((((((((((((((( Files Created from 2009-03-19 to 2009-04-19 )))))))))))))))))))))))))))))))
.

2009-04-16 07:39 . 2009-03-06 14:22 284160 -c—-w c:\windows\system32\dllcache\pdh.dll
2009-04-16 07:39 . 2009-02-09 12:10 473600 -c—-w c:\windows\system32\dllcache\fastprox.dll
2009-04-16 07:39 . 2009-02-09 12:10 453120 -c—-w c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-16 07:39 . 2009-02-09 12:10 401408 -c—-w c:\windows\system32\dllcache\rpcss.dll
2009-04-16 07:39 . 2009-02-06 11:11 110592 -c—-w c:\windows\system32\dllcache\services.exe
2009-04-16 07:39 . 2009-02-06 10:10 227840 -c—-w c:\windows\system32\dllcache\wmiprvse.exe
2009-04-16 07:39 . 2009-02-09 12:10 729088 -c—-w c:\windows\system32\dllcache\lsasrv.dll
2009-04-16 07:39 . 2009-02-09 12:10 714752 -c—-w c:\windows\system32\dllcache\ntdll.dll
2009-04-16 07:39 . 2009-02-09 12:10 617472 -c—-w c:\windows\system32\dllcache\advapi32.dll
2009-04-16 07:38 . 2008-05-03 11:55 2560 ——w c:\windows\system32\xpsp4res.dll
2009-04-16 07:38 . 2009-03-27 06:58 1203922 -c—-w c:\windows\system32\dllcache\sysmain.sdb
2009-04-16 07:38 . 2008-04-21 12:08 215552 -c—-w c:\windows\system32\dllcache\wordpad.exe
2009-03-30 14:00 . 2009-03-30 22:47 ——– d—–w c:\windows\BDOSCAN8
2009-03-30 05:14 . 2009-03-30 05:15 ——– d—–w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-03-30 00:04 . 2009-03-30 00:13 ——– d—–w C:\Combo-Fix
2009-03-29 21:27 . 2009-03-29 21:27 ——– d—–w c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2009-03-29 08:08 . 2009-03-29 08:11 ——– d—–w c:\documents and settings\Don\Application Data\utorrent
2009-03-29 06:14 . 2009-03-29 06:14 ——– d—–w c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-03-28 06:35 . 2009-03-29 09:50 ——– d—–w c:\documents and settings\Don\Application Data\HouseCall 6.6
2009-03-27 21:12 . 2009-04-16 07:43 ——– d—–w c:\windows\CAVTemp
2009-03-27 20:54 . 2009-03-27 20:54 880560 —-a-w c:\windows\system32\drivers\vetefile.sys
2009-03-27 20:54 . 2009-03-27 20:54 108368 —-a-w c:\windows\system32\drivers\veteboot.sys
2009-03-27 20:09 . 2009-03-27 20:09 ——– d—–w c:\documents and settings\Don\Application Data\Malwarebytes
2009-03-27 20:03 . 2009-03-27 20:03 ——– d—–w c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-03-27 20:01 . 2009-03-27 20:01 ——– d—–w c:\documents and settings\Don\Application Data\SUPERAntiSpyware.com
2009-03-25 09:04 . 2009-01-21 10:23 138384 —-a-w c:\windows\system32\drivers\tmcomm.sys
2009-03-21 14:06 . 2009-03-21 14:06 989696 -c—-w c:\windows\system32\dllcache\kernel32.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-19 09:44 . 2009-01-21 09:06 268 —ha-w C:\sqmdata05.sqm
2009-04-19 09:44 . 2009-01-21 09:06 244 —ha-w C:\sqmnoopt05.sqm
2009-04-18 21:07 . 2009-01-17 12:36 268 —ha-w C:\sqmdata04.sqm
2009-04-18 21:07 . 2009-01-17 12:36 244 —ha-w C:\sqmnoopt04.sqm
2009-03-31 05:15 . 2009-01-17 12:21 268 —ha-w C:\sqmdata03.sqm
2009-03-31 05:15 . 2009-01-17 12:21 244 —ha-w C:\sqmnoopt03.sqm
2009-03-31 00:58 . 2009-03-27 20:01 ——– d—–w c:\program files\supsup
2009-03-30 22:50 . 2009-01-17 12:07 268 —ha-w C:\sqmdata02.sqm
2009-03-30 22:50 . 2009-01-17 12:07 244 —ha-w C:\sqmnoopt02.sqm
2009-03-30 07:31 . 2009-03-30 07:31 ——– d—–w c:\program files\Trend Micro
2009-03-29 23:29 . 2008-05-29 03:35 268 —ha-w C:\sqmdata01.sqm
2009-03-29 23:29 . 2008-05-29 03:35 244 —ha-w C:\sqmnoopt01.sqm
2009-03-29 23:27 . 2008-05-28 17:57 268 —ha-w C:\sqmdata00.sqm
2009-03-29 23:27 . 2008-05-28 17:57 244 —ha-w C:\sqmnoopt00.sqm
2009-03-27 21:06 . 2009-01-14 09:02 27598 —-a-w C:\caisslog.txt
2009-03-27 20:54 . 2009-01-14 09:28 ——– d—–w c:\documents and settings\All Users\Application Data\CA
2009-03-27 16:18 . 2009-03-27 16:18 ——– d—–w c:\program files\Common Files\Wise Installation Wizard
2009-03-26 21:49 . 2009-01-17 12:43 38496 —-a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-03-26 21:49 . 2009-01-17 12:43 15504 —-a-w c:\windows\system32\drivers\mbam.sys
2009-03-06 14:22 . 2006-02-28 12:00 284160 —-a-w c:\windows\system32\pdh.dll
2009-03-03 00:18 . 2006-02-28 12:00 826368 —-a-w c:\windows\system32\wininet.dll
2009-02-20 18:09 . 2006-02-28 12:00 78336 —-a-w c:\windows\system32\ieencode.dll
2009-02-09 12:10 . 2006-02-28 12:00 729088 —-a-w c:\windows\system32\lsasrv.dll
2009-02-09 12:10 . 2006-02-28 12:00 714752 —-a-w c:\windows\system32\ntdll.dll
2009-02-09 12:10 . 2006-02-28 12:00 617472 —-a-w c:\windows\system32\advapi32.dll
2009-02-09 12:10 . 2006-02-28 12:00 401408 —-a-w c:\windows\system32\rpcss.dll
2009-02-09 11:13 . 2006-02-28 12:00 1846784 —-a-w c:\windows\system32\win32k.sys
2009-02-06 11:11 . 2006-02-28 12:00 110592 —-a-w c:\windows\system32\services.exe
2009-02-06 11:06 . 2006-02-28 12:00 2145280 —-a-w c:\windows\system32\ntoskrnl.exe
2009-02-06 10:39 . 2006-02-28 12:00 35328 —-a-w c:\windows\system32\sc.exe
2009-02-06 10:32 . 2004-08-03 22:59 2023936 —-a-w c:\windows\system32\ntkrnlpa.exe
2009-02-03 19:59 . 2006-02-28 12:00 56832 —-a-w c:\windows\system32\secur32.dll
2009-01-22 10:44 . 2009-01-22 10:44 268 —ha-w C:\sqmdata08.sqm
2009-01-22 10:44 . 2009-01-22 10:44 244 —ha-w C:\sqmnoopt08.sqm
2009-01-21 22:27 . 2009-01-21 22:27 268 —ha-w C:\sqmdata07.sqm
2009-01-21 22:27 . 2009-01-21 22:27 244 —ha-w C:\sqmnoopt07.sqm
2009-01-21 10:20 . 2009-01-21 10:20 268 —ha-w C:\sqmdata06.sqm
2009-01-21 10:20 . 2009-01-21 10:20 244 —ha-w C:\sqmnoopt06.sqm
2008-08-12 02:29 . 2008-04-26 16:00 34232 —-a-w c:\documents and settings\Don\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2008-08-21 09:57 . 2008-08-21 09:57 32768 –sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008082120080822\index.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"msnmsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
"H/PC Connection Agent"="c:\downloads\Active Sync\wcescomm.exe" [2006-11-13 1289000]
"Yahoo! Pager"="c:\downloads\Yahoo Mssgr\Messenger\YahooMessenger.exe" [2007-08-30 4670704]
"Aim6"="c:\program files\AIM6\aim6.exe" [2008-03-25 50528]
"cdloader"="c:\documents and settings\Don\Application Data\mjusbsp\cdloader2.exe" [2008-06-12 50520]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"SUPERAntiSpyware"="c:\program files\supsup\supsup.exe" [2009-02-17 1830128]
"SpybotSD TeaTimer"="c:\downloads\Repair Tool Box\SpybotSearchandDestroy\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IRW"="c:\windows\system32\IRW.exe" [2008-04-15 147456]
"Apple_KbdMgr"="c:\program files\Boot Camp\KbdMgr.exe" [2008-04-15 423216]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-15 644696]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-04 1603152]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4\OpwareSE4.exe" [2007-02-04 79400]
"Media Codec Update Service"="c:\downloads\windows codec pack1\Essentials Codec Pack\update.exe" [2007-04-08 303104]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-04-15 135168]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-04-15 159744]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-04-15 131072]
"EyelineRun"="c:\program files\NCH Software\Eyeline\eyeline.exe" [2008-06-28 425988]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2006-02-28 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2006-02-28 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2006-02-28 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2006-02-28 455168]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-06 413696]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-09-04 111936]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-09-09 289576]
"Adobe Reader Speed Launcher"="c:\downloads\AdobeReader\Reader\Reader_sl.exe" [2008-10-15 39792]
"mxomssmenu"="c:\downloads\Maxtor\installed here\OneTouch Status\maxmenumgr.exe" [2008-07-21 169312]
"cctray"="c:\downloads\ca internet security suite\cctray\cctray.exe" [2009-03-27 177392]
"QOELOADER"="c:\downloads\ca internet security suite\CA Anti-Spam\QSP-5.1.18.0\QOELoader.exe" [2009-01-14 14088]
"CAVRID"="c:\downloads\ca internet security suite\CA Anti-Virus\CAVRID.exe" [2007-08-20 230664]
"cafwc"="c:\downloads\ca internet security suite\CA Personal Firewall\cafw.exe" [2009-03-27 1193200]
"capfasem"="c:\downloads\ca internet security suite\CA Personal Firewall\capfasem.exe" [2009-03-27 173296]
"capfupgrade"="c:\downloads\ca internet security suite\CA Personal Firewall\capfupgrade.exe" [2009-03-27 259312]
"CaPPcl"="c:\downloads\ca internet security suite\CA Anti-Spyware\CAAntiSpyware.exe" [2007-08-17 410888]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2008-04-14 110592]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2008-04-15 16855552]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\supsup\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 16:05 356352 —-a-w c:\program files\supsup\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PFW]
2007-05-18 19:30 79368 —-a-w c:\windows\system32\UmxWNP.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ComputerAssociatesAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Downloads\\Yahoo Mssgr\\Messenger\\YahooMessenger.exe"=
"c:\\Downloads\\Yahoo Mssgr\\Messenger\\YServer.exe"=
"c:\\Downloads\\U Torrent\\utorrent-1.8-beta-10431.upx.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\downloads\Active Sync\rapimgr.exe"= c:\downloads\Active Sync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\downloads\Active Sync\wcescomm.exe"= c:\downloads\Active Sync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\downloads\Active Sync\WCESMgr.exe"= c:\downloads\Active Sync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Downloads\\Rhapsody\\rhapsody.exe"=
"c:\\Program Files\\QuickTime\\QuickTimePlayer.exe"=
"c:\\Documents and Settings\\Don\\Application Data\\mjusbsp\\magicJack.exe"=
"c:\\Downloads\\FireFox beta 3 ver4\\firefox.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\system32\\drivers\\svchost.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R2 EyelineService;Eyeline Service;c:\program files\NCH Software\Eyeline\eyeline.exe [2008-06-28 425988]
R3 BthKicker;Apple Bluetooth Device Driver;c:\windows\system32\DRIVERS\BthKicker.sys [2007-10-09 7424]
R3 iSightUpdate;iSight Update Driver;c:\windows\system32\DRIVERS\iSightUP.sys [2008-04-15 17664]
R3 MEMSWEEP2;MEMSWEEP2; [x]
S0 KmxStart;KmxStart;c:\windows\System32\DRIVERS\kmxstart.sys [2008-06-25 93712]
S1 SASDIFSV;SASDIFSV;c:\program files\supsup\SASDIFSV.SYS [2009-03-27 9968]
S1 SASKUTIL;SASKUTIL;c:\program files\supsup\SASKUTIL.sys [2009-02-17 55024]
S2 AppleOSSMgr;Apple OS Switch Manager;c:\windows\system32\AppleOSSMgr.exe [2008-04-15 132400]
S2 AppleTimeSrv;Apple Time Service;c:\windows\system32\AppleTimeSrv.exe [2008-04-15 99632]
S2 KeyAgent;KeyAgent;c:\windows\system32\drivers\KeyAgent.sys [2008-04-15 5504]
S2 KmxCF;KmxCF;c:\windows\system32\DRIVERS\KmxCF.sys [2008-06-25 134648]
S2 MacHALDriver;Mac HAL;c:\windows\system32\drivers\MacHALDriver.sys [2008-04-15 6528]
S2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2007-01-04 24652]
S3 aapltctp;Apple Trackpad Enabler;c:\windows\system32\DRIVERS\aapltctp.sys [2008-04-15 4224]
S3 aapltp;Apple Trackpad;c:\windows\system32\DRIVERS\aapltp.sys [2008-04-15 35072]
S3 applebt;Apple Built-in Bluetooth;c:\windows\system32\DRIVERS\applebt.sys [2008-04-15 9088]
S3 IRRemoteFlt;IR Receiver Filter Driver;c:\windows\system32\DRIVERS\IRFilter.sys [2008-04-15 16512]
S3 KeyMagic;USB Keyboard HID Filter;c:\windows\system32\DRIVERS\KeyMagic.sys [2008-04-15 19968]
S3 PPCtlPriv;PPCtlPriv;c:\downloads\ca internet security suite\CA Anti-Spyware\PPCtlPriv.exe [2007-08-17 189704]
S3 SASENUM;SASENUM;c:\program files\supsup\SASENUM.SYS [2009-02-17 7408]

.
Contents of the 'Scheduled Tasks' folder

2009-04-16 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2009-04-14 c:\windows\Tasks\CAAntiSpywareScan_Daily as Don at 3 29 AM.job
- c:\downloads\ca internet security suite\CA Anti-Spyware\CAAntiSpyware.exe [2007-08-17 03:10]
.
.
——- Supplementary Scan ——-
.
uInternet Settings,ProxyOverride = *.local
LSP: c:\windows\system32\VetRedir.dll
FF - ProfilePath - c:\documents and settings\Don\Application Data\Mozilla\Firefox\Profiles\0t9xt73q.default\
FF - component: c:\documents and settings\Don\Application Data\Mozilla\Firefox\Profiles\0t9xt73q.default\extensions\[removed]\components\coolirisstub.dll
FF - plugin: c:\downloads\AdobeReader\Reader\browser\nppdf32.dll
FF - plugin: c:\downloads\FireFox beta 3 ver4\plugins\npViewpoint.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-19 05:10
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\gtxnupcg]
"ImagePath"="system32\drivers\axxbzIl.sys"
–

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\zecjujn]
"ImagePath"="system32\drivers\roecua.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\MEMSWEEP2]
"ImagePath"="\??\c:\windows\system32\D6.tmp"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(920)
c:\program files\supsup\SASWINLO.dll
c:\windows\system32\UmxWnp.Dll
c:\program files\CA\SharedComponents\PPRT\bin\CACheck.dll
c:\program files\CA\SharedComponents\PPRT\bin\CAHook.dll
c:\program files\CA\SharedComponents\PPRT\bin\CAServer.dll

- - - - - - - > 'lsass.exe'(976)
c:\windows\system32\VetRedir.dll
c:\windows\system32\ISafeIf.dll

- - - - - - - > 'explorer.exe'(3256)
c:\program files\CA\SharedComponents\PPRT\bin\CACheck.dll
c:\program files\CA\SharedComponents\PPRT\bin\CAHook.dll
c:\program files\CA\SharedComponents\PPRT\bin\CAServer.dll
c:\program files\ScanSoft\OmniPageSE4\OpHookSE4.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\downloads\ca internet security suite\CA Anti-Virus\isafe.exe
c:\program files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
c:\downloads\Maxtor\installed here\Sync\SyncServices.exe
c:\downloads\ca internet security suite\CA Anti-Virus\vetmsg.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\igfxsrvc.exe
c:\downloads\ca internet security suite\CA Anti-Spyware\CAPPActiveProtection.exe
c:\downloads\ca internet security suite\ccprovsp.exe
c:\program files\iPod\bin\iPodService.exe
c:\downlo~1\ACTIVE~1\rapimgr.exe
c:\windows\system32\wbem\wmiadap.exe
.
**************************************************************************
.
Completion time: 2009-04-19 5:14 - machine was rebooted
ComboFix-quarantined-files.txt 2009-04-19 10:14

Pre-Run: 8,147,795,968 bytes free
Post-Run: 8,237,715,456 bytes free

311 — E O F — 2009-04-16 08:03
Post #8
-PrimeTime-,

Your Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older version Java components and update:
  • Download the latest version of Java Runtime Environment (JRE) Version 6 and save it to your desktop.
  • Scroll down to where it says "JRE 6 Update 13.
  • Click the "Download" button to the right.
  • Select your Platform: "Windows".
  • Select your Language: "Multi-language".
  • Read the License Agreement, and then check the box that says: "Accept License Agreement".
  • Click Continue and the page will refresh.
  • Click on the link to download Windows Offline Installation and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button and follow the onscreen instructions for the Java uninstaller.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u13-windows-i586-p.exe to install the newest version.
Now to Clean out the Java cache:

Go into the Control Panel and double-click the Java Icon. [external image: Posted Image]
  • Under Temporary Internet Files, click the Settings… button
  • click the Delete Files button.
  • There are two options in the window to clear the cache - Leave both Checked
    • Applications and Applets
      Trace and Log Files
  • Click OK on Delete Temporary Files Window
    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
  • Click OK to leave the Temporary Files Settings
  • Click OK to leave the Java Control Panel.

Please go to http://virusscan.jotti.org , click on Browse, and upload the following file for analysis:

C:\Program Files\supsup\supsup.exe <===this file

Then click Submit. Allow the file to be scanned, and then please copy and paste the results here for me to see.

COMBOFIX-Script

  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

    File::
C:\sqmdata05.sqm
C:\sqmnoopt05.sqm
C:\sqmdata04.sqm
C:\sqmnoopt04.sqm
C:\sqmdata03.sqm
C:\sqmnoopt03.sqm
C:\sqmdata02.sqm
C:\sqmnoopt02.sqm
C:\sqmdata01.sqm
C:\sqmnoopt01.sqm
C:\sqmdata00.sqm
C:\sqmnoopt00.sqm
C:\sqmdata08.sqm
C:\sqmnoopt08.sqm
C:\sqmdata07.sqm
C:\sqmnoopt07.sqm
C:\sqmdata06.sqm
C:\sqmnoopt06.sqm

Registry::
[-HKEY_LOCAL_MACHINE\system\ControlSet003\Services\zecjujn]
[-HKEY_LOCAL_MACHINE\system\ControlSet003\Services\gtxnupcg]

Driver::
MEMSWEEP2
  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

    [external image: Posted Image]
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

Then also let me know how things are running now.
Post #9
tomk thanks for the patience help and knowledge on this maleware thread. lol just to info u on the file C:\Program Files\supsup\supsup.exe …i named it that upon downloading it because of the malware, it is the process also known as SuperantiSpyware and i thought id cut the super to sup and then repeated as i figured it was a good rename. out of curiosity i scanned it and here are the results.


Scan taken on 24 Apr 2009 08:40:26 (GMT)
A-Squared
Found nothing
AntiVir
Found nothing
ArcaVir
Found nothing
Avast
Found nothing
AVG Antivirus
Found nothing
BitDefender
Found nothing
ClamAV
Found nothing
CPsecure
Found nothing
Dr.Web
Found nothing
F-Prot Antivirus
Found nothing
F-Secure Anti-Virus
Found nothing
Ikarus
Found nothing
Kaspersky Anti-Virus
Found nothing
NOD32
Found nothing
Norman Virus Control
Found nothing
Panda Antivirus
Found nothing
Quick Heal
Found nothing
Sophos Antivirus
Found nothing
VirusBuster
Found nothing
VBA32
Found Win32 Shadow Service Install (probable variant)

ok with that out of the way i followed your other directions and did here is the combo fix log

ComboFix 09-04-24.01 - Don 04/24/2009 3:18.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2012.1456 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Don\Desktop\CFScript.txt
AV: CA Anti-Virus *On-access scanning disabled* (Updated)
* Created a new restore point

FILE ::
C:\sqmdata00.sqm
C:\sqmdata01.sqm
C:\sqmdata02.sqm
C:\sqmdata03.sqm
C:\sqmdata04.sqm
C:\sqmdata05.sqm
C:\sqmdata06.sqm
C:\sqmdata07.sqm
C:\sqmdata08.sqm
C:\sqmnoopt00.sqm
C:\sqmnoopt01.sqm
C:\sqmnoopt02.sqm
C:\sqmnoopt03.sqm
C:\sqmnoopt04.sqm
C:\sqmnoopt05.sqm
C:\sqmnoopt06.sqm
C:\sqmnoopt07.sqm
C:\sqmnoopt08.sqm
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\sqmdata00.sqm
C:\sqmdata01.sqm
C:\sqmdata02.sqm
C:\sqmdata03.sqm
C:\sqmdata04.sqm
C:\sqmdata05.sqm
C:\sqmdata06.sqm
C:\sqmdata07.sqm
C:\sqmdata08.sqm
C:\sqmnoopt00.sqm
C:\sqmnoopt01.sqm
C:\sqmnoopt02.sqm
C:\sqmnoopt03.sqm
C:\sqmnoopt04.sqm
C:\sqmnoopt05.sqm
C:\sqmnoopt06.sqm
C:\sqmnoopt07.sqm
C:\sqmnoopt08.sqm

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_MEMSWEEP2
——-\Service_MEMSWEEP2


((((((((((((((((((((((((( Files Created from 2009-05-24 to 2009-4-24 )))))))))))))))))))))))))))))))
.

2009-04-23 10:00 . 2009-04-23 10:00 73728 —-a-w c:\windows\system32\javacpl.cpl
2009-04-23 10:00 . 2009-04-23 10:00 410984 —-a-w c:\windows\system32\deploytk.dll
2009-04-19 10:12 . 2009-04-19 10:12 268 —ha-w C:\sqmdata09.sqm
2009-04-19 10:12 . 2009-04-19 10:12 244 —ha-w C:\sqmnoopt09.sqm
2009-04-16 07:39 . 2009-03-06 14:22 284160 -c—-w c:\windows\system32\dllcache\pdh.dll
2009-04-16 07:39 . 2009-02-09 12:10 473600 -c—-w c:\windows\system32\dllcache\fastprox.dll
2009-04-16 07:39 . 2009-02-09 12:10 453120 -c—-w c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-16 07:39 . 2009-02-09 12:10 401408 -c—-w c:\windows\system32\dllcache\rpcss.dll
2009-04-16 07:39 . 2009-02-06 11:11 110592 -c—-w c:\windows\system32\dllcache\services.exe
2009-04-16 07:39 . 2009-02-06 10:10 227840 -c—-w c:\windows\system32\dllcache\wmiprvse.exe
2009-04-16 07:39 . 2009-02-09 12:10 729088 -c—-w c:\windows\system32\dllcache\lsasrv.dll
2009-04-16 07:39 . 2009-02-09 12:10 714752 -c—-w c:\windows\system32\dllcache\ntdll.dll
2009-04-16 07:39 . 2009-02-09 12:10 617472 -c—-w c:\windows\system32\dllcache\advapi32.dll
2009-04-16 07:38 . 2008-05-03 11:55 2560 ——w c:\windows\system32\xpsp4res.dll
2009-04-16 07:38 . 2009-03-27 06:58 1203922 -c—-w c:\windows\system32\dllcache\sysmain.sdb
2009-04-16 07:38 . 2008-04-21 12:08 215552 -c—-w c:\windows\system32\dllcache\wordpad.exe
2009-03-30 14:00 . 2009-03-30 22:47 ——– d—–w c:\windows\BDOSCAN8
2009-03-30 05:14 . 2009-03-30 05:15 ——– d—–w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-03-30 00:04 . 2009-03-30 00:13 ——– d—–w C:\Combo-Fix
2009-03-29 21:27 . 2009-03-29 21:27 ——– d—–w c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2009-03-29 08:08 . 2009-03-29 08:11 ——– d—–w c:\documents and settings\Don\Application Data\utorrent
2009-03-29 06:14 . 2009-03-29 06:14 ——– d—–w c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-03-28 06:35 . 2009-03-29 09:50 ——– d—–w c:\documents and settings\Don\Application Data\HouseCall 6.6
2009-03-27 21:12 . 2009-04-16 07:43 ——– d—–w c:\windows\CAVTemp
2009-03-27 20:54 . 2009-03-27 20:54 880560 —-a-w c:\windows\system32\drivers\vetefile.sys
2009-03-27 20:54 . 2009-03-27 20:54 108368 —-a-w c:\windows\system32\drivers\veteboot.sys
2009-03-27 20:09 . 2009-03-27 20:09 ——– d—–w c:\documents and settings\Don\Application Data\Malwarebytes
2009-03-27 20:03 . 2009-03-27 20:03 ——– d—–w c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-03-27 20:01 . 2009-03-27 20:01 ——– d—–w c:\documents and settings\Don\Application Data\SUPERAntiSpyware.com
2009-03-25 09:04 . 2009-01-21 10:23 138384 —-a-w c:\windows\system32\drivers\tmcomm.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-23 09:59 . 2008-04-27 09:59 ——– d—–w c:\program files\Java
2009-04-06 20:32 . 2009-01-17 12:43 38496 —-a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-06 20:32 . 2009-01-17 12:43 15504 —-a-w c:\windows\system32\drivers\mbam.sys
2009-03-31 00:58 . 2009-03-27 20:01 ——– d—–w c:\program files\supsup
2009-03-30 07:31 . 2009-03-30 07:31 ——– d—–w c:\program files\Trend Micro
2009-03-27 21:06 . 2009-01-14 09:02 27598 —-a-w C:\caisslog.txt
2009-03-27 20:54 . 2009-01-14 09:28 ——– d—–w c:\documents and settings\All Users\Application Data\CA
2009-03-27 16:18 . 2009-03-27 16:18 ——– d—–w c:\program files\Common Files\Wise Installation Wizard
2009-03-06 14:22 . 2006-02-28 12:00 284160 —-a-w c:\windows\system32\pdh.dll
2009-03-03 00:18 . 2006-02-28 12:00 826368 —-a-w c:\windows\system32\wininet.dll
2009-02-20 18:09 . 2006-02-28 12:00 78336 —-a-w c:\windows\system32\ieencode.dll
2009-02-09 12:10 . 2006-02-28 12:00 729088 —-a-w c:\windows\system32\lsasrv.dll
2009-02-09 12:10 . 2006-02-28 12:00 714752 —-a-w c:\windows\system32\ntdll.dll
2009-02-09 12:10 . 2006-02-28 12:00 617472 —-a-w c:\windows\system32\advapi32.dll
2009-02-09 12:10 . 2006-02-28 12:00 401408 —-a-w c:\windows\system32\rpcss.dll
2009-02-09 11:13 . 2006-02-28 12:00 1846784 —-a-w c:\windows\system32\win32k.sys
2009-02-06 11:11 . 2006-02-28 12:00 110592 —-a-w c:\windows\system32\services.exe
2009-02-06 11:06 . 2006-02-28 12:00 2145280 —-a-w c:\windows\system32\ntoskrnl.exe
2009-02-06 10:39 . 2006-02-28 12:00 35328 —-a-w c:\windows\system32\sc.exe
2009-02-06 10:32 . 2004-08-03 22:59 2023936 —-a-w c:\windows\system32\ntkrnlpa.exe
2009-02-03 19:59 . 2006-02-28 12:00 56832 —-a-w c:\windows\system32\secur32.dll
2008-08-12 02:29 . 2008-04-26 16:00 34232 —-a-w c:\documents and settings\Don\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2008-08-21 09:57 . 2008-08-21 09:57 32768 –sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008082120080822\index.dat
.

((((((((((((((((((((((((((((( SnapShot@2009-04-19_10.10.27 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-04-24 08:21 . 2009-04-24 08:21 16384 c:\windows\temp\Perflib_Perfdata_210.dat
+ 2006-02-28 12:00 . 2009-04-23 09:52 40394 c:\windows\system32\perfc009.dat
- 2006-02-28 12:00 . 2009-04-19 09:47 40394 c:\windows\system32\perfc009.dat
+ 2008-03-30 23:13 . 2006-02-28 12:00 19429 c:\windows\system32\MsDtc\Trace\msdtcvtr.bat
+ 2008-08-16 21:31 . 2008-01-18 15:13 2247 c:\windows\ServicePackFiles\i386\tscdsbl.bat
+ 2008-08-16 21:31 . 2008-01-18 15:13 2247 c:\windows\Installer\tsclientmsitrans\tscdsbl.bat
- 2006-02-28 12:00 . 2009-04-19 09:47 312172 c:\windows\system32\perfh009.dat
+ 2006-02-28 12:00 . 2009-04-23 09:52 312172 c:\windows\system32\perfh009.dat
+ 2009-04-23 10:00 . 2009-04-23 10:00 148888 c:\windows\system32\javaws.exe
+ 2009-04-23 10:00 . 2009-04-23 10:00 144792 c:\windows\system32\javaw.exe
+ 2009-04-23 10:00 . 2009-04-23 10:00 144792 c:\windows\system32\java.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"msnmsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
"H/PC Connection Agent"="c:\downloads\Active Sync\wcescomm.exe" [2006-11-13 1289000]
"Yahoo! Pager"="c:\downloads\Yahoo Mssgr\Messenger\YahooMessenger.exe" [2007-08-30 4670704]
"Aim6"="c:\program files\AIM6\aim6.exe" [2008-03-25 50528]
"cdloader"="c:\documents and settings\Don\Application Data\mjusbsp\cdloader2.exe" [2008-06-12 50520]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"SUPERAntiSpyware"="c:\program files\supsup\supsup.exe" [2009-02-17 1830128]
"SpybotSD TeaTimer"="c:\downloads\Repair Tool Box\SpybotSearchandDestroy\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IRW"="c:\windows\system32\IRW.exe" [2008-04-15 147456]
"Apple_KbdMgr"="c:\program files\Boot Camp\KbdMgr.exe" [2008-04-15 423216]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-15 644696]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-04 1603152]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4\OpwareSE4.exe" [2007-02-04 79400]
"Media Codec Update Service"="c:\downloads\windows codec pack1\Essentials Codec Pack\update.exe" [2007-04-08 303104]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-04-15 135168]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-04-15 159744]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-04-15 131072]
"EyelineRun"="c:\program files\NCH Software\Eyeline\eyeline.exe" [2008-06-28 425988]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2006-02-28 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2006-02-28 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2006-02-28 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2006-02-28 455168]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-06 413696]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-09-04 111936]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-09-09 289576]
"Adobe Reader Speed Launcher"="c:\downloads\AdobeReader\Reader\Reader_sl.exe" [2008-10-15 39792]
"mxomssmenu"="c:\downloads\Maxtor\installed here\OneTouch Status\maxmenumgr.exe" [2008-07-21 169312]
"cctray"="c:\downloads\ca internet security suite\cctray\cctray.exe" [2009-03-27 177392]
"QOELOADER"="c:\downloads\ca internet security suite\CA Anti-Spam\QSP-5.1.18.0\QOELoader.exe" [2009-01-14 14088]
"CAVRID"="c:\downloads\ca internet security suite\CA Anti-Virus\CAVRID.exe" [2007-08-20 230664]
"cafwc"="c:\downloads\ca internet security suite\CA Personal Firewall\cafw.exe" [2009-03-27 1193200]
"capfasem"="c:\downloads\ca internet security suite\CA Personal Firewall\capfasem.exe" [2009-03-27 173296]
"capfupgrade"="c:\downloads\ca internet security suite\CA Personal Firewall\capfupgrade.exe" [2009-03-27 259312]
"CaPPcl"="c:\downloads\ca internet security suite\CA Anti-Spyware\CAAntiSpyware.exe" [2007-08-17 410888]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-23 148888]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2008-04-14 110592]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2008-04-15 16855552]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\supsup\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 16:05 356352 —-a-w c:\program files\supsup\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PFW]
2007-05-18 19:30 79368 —-a-w c:\windows\system32\UmxWNP.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ComputerAssociatesAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Downloads\\Yahoo Mssgr\\Messenger\\YahooMessenger.exe"=
"c:\\Downloads\\Yahoo Mssgr\\Messenger\\YServer.exe"=
"c:\\Downloads\\U Torrent\\utorrent-1.8-beta-10431.upx.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\downloads\Active Sync\rapimgr.exe"= c:\downloads\Active Sync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\downloads\Active Sync\wcescomm.exe"= c:\downloads\Active Sync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\downloads\Active Sync\WCESMgr.exe"= c:\downloads\Active Sync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Downloads\\Rhapsody\\rhapsody.exe"=
"c:\\Program Files\\QuickTime\\QuickTimePlayer.exe"=
"c:\\Documents and Settings\\Don\\Application Data\\mjusbsp\\magicJack.exe"=
"c:\\Downloads\\FireFox beta 3 ver4\\firefox.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\system32\\drivers\\svchost.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R2 EyelineService;Eyeline Service;c:\program files\NCH Software\Eyeline\eyeline.exe [2008-06-28 425988]
R3 BthKicker;Apple Bluetooth Device Driver;c:\windows\system32\DRIVERS\BthKicker.sys [2007-10-09 7424]
R3 iSightUpdate;iSight Update Driver;c:\windows\system32\DRIVERS\iSightUP.sys [2008-04-15 17664]
S0 KmxStart;KmxStart;c:\windows\System32\DRIVERS\kmxstart.sys [2008-06-25 93712]
S1 SASDIFSV;SASDIFSV;c:\program files\supsup\SASDIFSV.SYS [2009-03-27 9968]
S1 SASKUTIL;SASKUTIL;c:\program files\supsup\SASKUTIL.sys [2009-02-17 55024]
S2 AppleOSSMgr;Apple OS Switch Manager;c:\windows\system32\AppleOSSMgr.exe [2008-04-15 132400]
S2 AppleTimeSrv;Apple Time Service;c:\windows\system32\AppleTimeSrv.exe [2008-04-15 99632]
S2 KeyAgent;KeyAgent;c:\windows\system32\drivers\KeyAgent.sys [2008-04-15 5504]
S2 KmxCF;KmxCF;c:\windows\system32\DRIVERS\KmxCF.sys [2008-06-25 134648]
S2 MacHALDriver;Mac HAL;c:\windows\system32\drivers\MacHALDriver.sys [2008-04-15 6528]
S2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2007-01-04 24652]
S3 aapltctp;Apple Trackpad Enabler;c:\windows\system32\DRIVERS\aapltctp.sys [2008-04-15 4224]
S3 aapltp;Apple Trackpad;c:\windows\system32\DRIVERS\aapltp.sys [2008-04-15 35072]
S3 applebt;Apple Built-in Bluetooth;c:\windows\system32\DRIVERS\applebt.sys [2008-04-15 9088]
S3 IRRemoteFlt;IR Receiver Filter Driver;c:\windows\system32\DRIVERS\IRFilter.sys [2008-04-15 16512]
S3 KeyMagic;USB Keyboard HID Filter;c:\windows\system32\DRIVERS\KeyMagic.sys [2008-04-15 19968]
S3 PPCtlPriv;PPCtlPriv;c:\downloads\ca internet security suite\CA Anti-Spyware\PPCtlPriv.exe [2007-08-17 189704]
S3 SASENUM;SASENUM;c:\program files\supsup\SASENUM.SYS [2009-02-17 7408]

.
Contents of the 'Scheduled Tasks' folder

2009-04-23 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2009-04-14 c:\windows\Tasks\CAAntiSpywareScan_Daily as Don at 3 29 AM.job
- c:\downloads\ca internet security suite\CA Anti-Spyware\CAAntiSpyware.exe [2007-08-17 03:10]
.
.
——- Supplementary Scan ——-
.
uInternet Settings,ProxyOverride = *.local
LSP: c:\windows\system32\VetRedir.dll
FF - ProfilePath - c:\documents and settings\Don\Application Data\Mozilla\Firefox\Profiles\0t9xt73q.default\
FF - component: c:\documents and settings\Don\Application Data\Mozilla\Firefox\Profiles\0t9xt73q.default\extensions\[removed]\components\coolirisstub.dll
FF - plugin: c:\downloads\AdobeReader\Reader\browser\nppdf32.dll
FF - plugin: c:\downloads\FireFox beta 3 ver4\plugins\npViewpoint.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-24 03:22
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(920)
c:\program files\supsup\SASWINLO.dll
c:\windows\system32\UmxWnp.Dll
c:\program files\CA\SharedComponents\PPRT\bin\CACheck.dll
c:\program files\CA\SharedComponents\PPRT\bin\CAHook.dll
c:\program files\CA\SharedComponents\PPRT\bin\CAServer.dll

- - - - - - - > 'lsass.exe'(976)
c:\windows\system32\VetRedir.dll
c:\windows\system32\ISafeIf.dll

- - - - - - - > 'explorer.exe'(2720)
c:\program files\CA\SharedComponents\PPRT\bin\CACheck.dll
c:\program files\CA\SharedComponents\PPRT\bin\CAHook.dll
c:\program files\CA\SharedComponents\PPRT\bin\CAServer.dll
c:\program files\ScanSoft\OmniPageSE4\OpHookSE4.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\downloads\ca internet security suite\CA Anti-Virus\isafe.exe
c:\program files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\downloads\Maxtor\installed here\Sync\SyncServices.exe
c:\downloads\ca internet security suite\CA Anti-Virus\vetmsg.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\igfxsrvc.exe
c:\downloads\ca internet security suite\CA Anti-Spyware\CAPPActiveProtection.exe
c:\downloads\ca internet security suite\ccprovsp.exe
c:\program files\iPod\bin\iPodService.exe
c:\downlo~1\ACTIVE~1\rapimgr.exe
c:\windows\system32\wbem\wmiadap.exe
.
**************************************************************************
.
Completion time: 2009-04-24 3:25 - machine was rebooted
ComboFix-quarantined-files.txt 2009-04-24 08:25
ComboFix2.txt 2009-04-19 10:14

Pre-Run: 7,998,828,544 bytes free
Post-Run: 8,077,066,240 bytes free

295 — E O F — 2009-04-16 08:03


and lastly the computer seems to be behaving normally i'm running Process Explorer and i dont notice anything unusual. i do however see a process in add/remove programs called HuGo .27mb and then theres one named Generator .89mb im not familiar with this so i'll look it up. i'll also scan often with malewarebytes and super antispyware…and spybot search and destroy…would u also suggest a good firewall for me or any other helpful tools? i want to download one soon. again thanks aloooot!
Post #10
-PrimeTime-,

A little advise:

utorrent
You have utorrent, a P2P/file sharing programs installed on your computer. P2P applications like it are the largest source of malware we see. You'll be doing yourself a favor by removing it.

References for the risk of these programs can be found in these links:
http://www.microsoft.com/windows/ie/commun…protection.mspx
http://www.techweb.com/wire/160500554
http://www.internetworldstats.com/articles/art053.htm://http://www.techweb.com/wire/1605005…cles/art053.htm


I would recommend that you uninstall utorrent, however that choice is up to you. If you choose to remove these programs, you can do so via Control Panel >> Add or Remove Programs.

Log looks good :D


Time for some housekeeping
  • Click START then RUN
  • Now type Combofix /u in the runbox and click OK
  • Note the space between the X and the U, it needs to be there.
  • [external image: Posted Image]
The above procedure will:
  • Implement some cleanup procedures.
  • Reset System Restore.

Please re-enable any security that was disabled.


The following is my standard advice for the future. Use what you can and pat yourself on the back for what you're already doing.

Please take time to read Preventing Malware - Tools and Practices for Safe Computing. Very important information for your consideration is contained therein.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein


Also: "How to prevent malware"
by miekiemoes

Please respond back that you understand the above and let me know if you have any questions. Otherwise, this thread will be closed Resolved. :thumbup:
Post #11
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI