What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] PC is infected - hijackthis log

26 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
My PC has been infected while downloading some file, AVG has cleaned most of the mess but when I reboot and rescan, AVG says it found and blocked some trojan/virus that includes the texts: dglcxlcfmk and/or ftp_non_crp.exe
Can anyone analyze this log ?
Thanks in advance

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:32:33 PM, on 16/04/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Realtek\Diagnostics Utility\8169Diag.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\Samsung\PanelMgr\ssmmgr.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
C:\PROGRA~1\MUSICM~1\MUSICM~1\MMDiag.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\DellAutomatedPCTuneUp\PTAgnt.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mim.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\jack\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Dell Network Assistant\ezi_hnm2.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Broderbund\Mavis Beacon Teaches Typing 15\minimavis.exe
C:\Corel\Office7\Dad7\QUICK.EXE
C:\Program Files\palmOne\HOTSYNC.EXE
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Dell Network Assistant\hnm_svc.exe
C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\AVG\AVG8\avgui.exe
C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe
C:\Program Files\Microsoft Office\Office10\OUTLOOK.EXE
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://partnerpage.google.com/smallbiz.del…amp;ibd=6080709
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www1.ca.dell.com/content/default.as…;l=en&s=gen
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www1.ca.dell.com/content/default.as…;l=en&s=gen
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = http://partnerpage.google.com/smallbiz.del…amp;ibd=6080709
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - (no file)
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: (no name) - {ada8d399-0c4f-4f3f-b3f1-c13347cac1d6} - C:\WINDOWS\system32\pemuwiru.dll (file missing)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [8169Diag] C:\Program Files\Realtek\Diagnostics Utility\8169Diag.exe /hw
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [ECenter] C:\Dell\E-Center\EULALauncher.exe
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [Samsung PanelMgr] C:\WINDOWS\Samsung\PanelMgr\ssmmgr.exe /autorun
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [DellAutomatedPCTuneUp] "C:\Program Files\DellAutomatedPCTuneUp\PTAgnt.exe" /startup
O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\jack\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [wozuyinipe] Rundll32.exe "C:\WINDOWS\system32\zogapero.dll",s (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [wozuyinipe] Rundll32.exe "C:\WINDOWS\system32\zogapero.dll",s (User 'NETWORK SERVICE')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Corel Desktop Application Director.LNK = C:\Corel\Office7\Dad7\QUICK.EXE
O4 - Startup: HotSync Manager.lnk = C:\Program Files\palmOne\HOTSYNC.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Dell Network Assistant.lnk = ?
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Personal Coach.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: http://*.mcafee.com
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} -
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} (Java Plug-in 1.6.0_07) -
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} -
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL C:\WINDOWS\system32\bowagina.dll C:\WINDOWS\system32\samadehi.dll c:\windows\system32\gavapufa.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\gavapufa.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: DellAMBrokerService - Unknown owner - C:\Program Files\DellAutomatedPCTuneUp\brkrsvc.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Advanced Networking Service (hnmsvc) - SingleClick Systems - C:\Program Files\Dell Network Assistant\hnm_svc.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

–
End of file - 10820 bytes
Post #2
Hi

Please do the following:

Download ComboFix from one of these locations:
Link 1
Link 2
Link 3

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
  • Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]
  • Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please advise.
5. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.


Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now
Post #3
Hi CatByte
Sorry for the late response, I was out of town

I have installed and run the ComboFix
After scanning and fixing with ComboFix, I rescanned with AVG and with MSFT malicious Software remobval tool and nothing is coming up. 2 external usb ports that had benn disabled by the malware are now running smoothly.
As far as I can see, everything works fine.
Thanks d\for your time

Here is the scan produced by ComboFix

ComboFix 09-04-21.A8 - jack 21/04/2009 12:15.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.3070.2638 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: a-squared Anti-Malware *On-access scanning disabled* (Updated)
AV: AVG Anti-Virus *On-access scanning disabled* (Updated)
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\IE4 Error Log.txt
c:\windows\system32\drivers\ovfsthiqejuckamdungriputltmitbhejiynke.sys
c:\windows\system32\ovfsthmplamoljtainxsopkhtffnsoyjixrnsb.dll
c:\windows\system32\ovfsthovpcxnxwtdgoyodacnbontrhlxvpxacm.dll
c:\windows\system32\ovfsthpkkminlkklmbirptmlxfwyejpivvbscd.dat
c:\windows\system32\ovfsthwbkmvkajukjsgowblkpfeaxjxswkhxdu.dll
c:\windows\system32\ovfsthyhanjcfbuuwakrwnxhiaofvwacfpoerl.dat
c:\windows\winhelp.ini

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_ovfsthtqoyvttdouwomykvjlabgrdfqmmnyvve
——-\Legacy_PACKET
——-\Service_Packet


((((((((((((((((((((((((( Files Created from 2009-03-21 to 2009-04-21 )))))))))))))))))))))))))))))))
.

2009-04-17 22:15 . 2009-04-17 22:23 ——– d—–w C:\26e618e46facf93f794dc6449946a1
2009-04-17 21:03 . 2008-04-21 10:02 215552 ——w c:\windows\system32\dllcache\wordpad.exe
2009-04-17 21:03 . 2009-03-06 14:00 284160 ——w c:\windows\system32\dllcache\pdh.dll
2009-04-17 21:03 . 2009-02-09 10:01 473088 ——w c:\windows\system32\dllcache\fastprox.dll
2009-04-17 21:03 . 2009-02-09 10:01 401408 ——w c:\windows\system32\dllcache\rpcss.dll
2009-04-17 21:03 . 2009-02-06 10:22 110592 ——w c:\windows\system32\dllcache\services.exe
2009-04-17 21:03 . 2009-02-06 09:54 35328 ——w c:\windows\system32\dllcache\sc.exe
2009-04-17 21:03 . 2009-02-06 09:41 227840 ——w c:\windows\system32\dllcache\wmiprvse.exe
2009-04-17 21:03 . 2005-07-26 04:20 60416 ——w c:\windows\system32\dllcache\colbact.dll
2009-04-17 21:03 . 2009-02-09 10:01 617984 ——w c:\windows\system32\dllcache\advapi32.dll
2009-04-17 21:03 . 2009-02-09 10:01 715264 ——w c:\windows\system32\dllcache\ntdll.dll
2009-04-16 20:04 . 2009-04-16 20:04 0 —-a-w C:\feyadtq.exe
2009-04-16 20:04 . 2009-04-16 20:04 0 —-a-w C:\swww.exe
2009-04-16 20:04 . 2009-04-16 20:04 0 —-a-w C:\tmpl.exe
2009-04-16 19:53 . 2009-04-16 19:53 2098 –sh–w c:\windows\system32\fipijuza.dll
2009-04-16 19:44 . 2009-04-16 19:48 ——– d—–w C:\a3972505d59c5967e49a044f
2009-04-07 16:19 . 2009-04-07 16:19 ——– d—–w C:\My Music
2009-04-07 16:07 . 2009-04-07 16:07 ——– d—–w c:\documents and settings\jack\Application Data\Winamp
2009-04-02 21:08 . 2009-04-02 21:53 69 —-a-w c:\windows\NeroDigital.ini
2009-04-02 21:06 . 2009-04-02 21:06 ——– d—–w c:\documents and settings\jack\Application Data\Nero
2009-04-02 20:46 . 2009-04-02 20:50 ——– d—–w c:\documents and settings\All Users\Application Data\Nero
2009-04-02 18:01 . 2009-04-02 18:01 ——– d—–w c:\documents and settings\jack\Application Data\AccurateRip
2009-04-02 18:01 . 2009-04-02 18:01 ——– d—–w c:\documents and settings\jack\Application Data\AD ON Multimedia
2009-03-25 17:32 . 2009-03-25 17:32 ——– d—–w c:\documents and settings\jack\Application Data\Apple Computer
2009-03-25 17:26 . 2009-03-25 17:26 ——– d—–w c:\documents and settings\All Users\Application Data\Apple Computer
2009-03-25 17:25 . 2009-03-25 17:25 ——– d—–w c:\documents and settings\jack\Local Settings\Application Data\Apple
2009-03-25 17:25 . 2009-03-25 17:25 ——– d—–w c:\documents and settings\All Users\Application Data\Apple
2009-03-25 17:25 . 2009-03-25 17:25 ——– d—–w c:\documents and settings\jack\Local Settings\Application Data\Apple Computer

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-21 16:19 . 2008-07-09 05:35 ——– d—a-w c:\documents and settings\All Users\Application Data\TEMP
2009-04-21 16:19 . 2008-07-09 05:35 512 —-a-w C:\RTHDCPL_Dump.txt
2009-04-21 12:59 . 2008-09-15 13:54 ——– d—–w c:\documents and settings\All Users\Application Data\Google Updater
2009-04-18 14:46 . 2009-04-17 23:29 ——– d—–w c:\program files\a-squared Anti-Malware
2009-04-17 20:29 . 2008-08-04 20:20 ——– d—–w c:\documents and settings\jack\Application Data\CoreFTP
2009-04-16 20:51 . 2008-08-04 21:08 ——– d—–w c:\documents and settings\All Users\Application Data\avg8
2009-04-16 19:43 . 2009-03-11 14:36 ——– d—–w c:\documents and settings\jack\Application Data\uTorrent
2009-04-09 15:33 . 2009-04-09 15:33 ——– d—–w c:\program files\PowerISO
2009-04-07 16:19 . 2009-04-07 16:19 ——– d—–w c:\program files\AudioConverter Studio
2009-04-07 16:14 . 2009-04-07 16:07 ——– d—–w c:\program files\Winamp
2009-04-02 21:01 . 2009-04-02 20:46 ——– d—–w c:\program files\Common Files\Nero
2009-04-02 20:54 . 2009-04-02 20:46 ——– d—–w c:\program files\Nero
2009-04-02 20:53 . 2009-04-02 20:53 ——– d—–w c:\program files\Windows Sidebar
2009-04-02 18:17 . 2009-04-02 18:17 ——– d—–w c:\program files\FLAC
2009-04-02 18:01 . 2009-04-02 18:01 ——– d—–w c:\program files\Exact Audio Copy
2009-03-25 17:26 . 2009-03-25 17:26 ——– d—–w c:\program files\QuickTime
2009-03-25 17:25 . 2009-03-25 17:25 ——– d—–w c:\program files\Apple Software Update
2009-03-23 22:08 . 2008-08-04 21:08 10520 —-a-w c:\windows\system32\avgrsstx.dll
2009-03-23 22:08 . 2008-08-04 21:08 325640 —-a-w c:\windows\system32\drivers\avgldx86.sys
2009-03-23 22:08 . 2008-08-04 21:08 108552 —-a-w c:\windows\system32\drivers\avgtdix.sys
2009-03-21 14:18 . 2008-07-09 05:22 986112 ——w c:\windows\system32\dllcache\kernel32.dll
2009-03-18 14:47 . 2008-07-09 05:33 ——– d—–w c:\documents and settings\All Users\Application Data\Dell
2009-03-17 22:36 . 2009-03-17 22:36 ——– d—–w c:\program files\Need4 Video Converter 5.9
2009-03-17 22:36 . 2009-03-17 22:36 ——– d—–w c:\program files\Need4 Software Launcher
2009-03-17 21:54 . 2008-07-09 05:35 93096 —-a-w c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-03-17 21:53 . 2009-03-17 21:07 ——– d—–w c:\program files\Pinnacle
2009-03-17 21:53 . 2009-03-17 21:03 ——– d—–w c:\documents and settings\All Users\Application Data\Pinnacle
2009-03-17 21:10 . 2009-03-17 21:10 ——– d—–w c:\program files\Common Files\Pinnacle
2009-03-17 21:10 . 2009-03-17 21:10 ——– d—–w c:\documents and settings\All Users\Application Data\Pinnacle Studio Ultimate
2009-03-17 21:07 . 2009-03-17 21:07 ——– d—–w c:\program files\Common Files\Yahoo!
2009-03-17 21:07 . 2009-03-17 21:07 ——– d—–w c:\documents and settings\All Users\Application Data\Studio 12
2009-03-17 21:07 . 2009-03-17 21:07 ——– d—–w c:\documents and settings\All Users\Application Data\Pinnacle Studio Plus
2009-03-15 10:25 . 2009-03-15 10:25 56268 —-a-w c:\windows\system32\drivers\scdemu.sys
2009-03-12 15:10 . 2009-03-12 15:10 ——– d—–w c:\program files\Windows Media Connect 2
2009-03-11 17:30 . 2009-03-11 17:30 ——– d—–w c:\program files\dvdXsoft
2009-03-11 15:58 . 2009-03-11 15:58 ——– d—–w c:\documents and settings\All Users\Application Data\Adobe Systems
2009-03-11 15:51 . 2008-08-01 20:35 ——– d—–w c:\program files\Common Files\Adobe
2009-03-11 15:50 . 2009-03-11 15:50 ——– d—–w c:\program files\Common Files\Adobe Systems Shared
2009-03-11 14:36 . 2009-03-11 14:36 ——– d—–w c:\program files\uTorrent
2009-03-06 21:02 . 2009-03-06 21:02 ——– d—–w c:\program files\Movavi Video Converter 7
2009-03-06 20:22 . 2009-03-06 20:17 ——– d—–w c:\program files\Common Files\AVSMedia
2009-03-06 20:22 . 2009-03-06 20:16 ——– d—–w c:\program files\AVS4YOU
2009-03-06 20:18 . 2009-03-06 20:18 ——– d—–w c:\documents and settings\jack\Application Data\AVS4YOU
2009-03-06 20:17 . 2009-03-06 20:17 ——– d—–w c:\documents and settings\All Users\Application Data\AVS4YOU
2009-03-06 14:00 . 2004-08-11 22:00 284160 —-a-w c:\windows\system32\pdh.dll
2009-03-02 23:52 . 2008-07-09 05:22 1495552 ——w c:\windows\system32\dllcache\shdocvw.dll
2009-03-02 22:06 . 2008-07-09 05:31 ——– d—–w c:\program files\Google
2009-02-19 09:58 . 2008-07-09 05:22 18432 ——w c:\windows\system32\dllcache\iedw.exe
2009-02-10 22:31 . 2009-02-10 22:31 453120 ——w c:\windows\system32\dllcache\wmiprvsd.dll
2009-02-09 10:19 . 2008-07-09 05:23 1846272 ——w c:\windows\system32\dllcache\win32k.sys
2009-02-09 10:19 . 2004-08-11 22:00 1846272 —-a-w c:\windows\system32\win32k.sys
2009-02-09 10:01 . 2008-07-09 05:21 728576 ——w c:\windows\system32\dllcache\lsasrv.dll
2009-02-09 10:01 . 2004-08-11 22:00 401408 —-a-w c:\windows\system32\rpcss.dll
2009-02-09 10:01 . 2004-08-11 22:00 728576 —-a-w c:\windows\system32\lsasrv.dll
2009-02-09 10:01 . 2004-08-11 22:00 617984 —-a-w c:\windows\system32\advapi32.dll
2009-02-09 10:01 . 2004-08-11 22:00 715264 —-a-w c:\windows\system32\ntdll.dll
2009-02-06 10:32 . 2008-07-09 05:23 2186112 ——w c:\windows\system32\dllcache\ntoskrnl.exe
2009-02-06 10:29 . 2008-07-09 05:23 2142720 ——w c:\windows\system32\dllcache\ntkrnlmp.exe
2009-02-06 10:29 . 2004-08-11 22:00 2142720 —-a-w c:\windows\system32\ntoskrnl.exe
2009-02-06 10:22 . 2004-08-11 22:00 110592 —-a-w c:\windows\system32\services.exe
2009-02-06 09:54 . 2004-08-11 22:00 35328 —-a-w c:\windows\system32\sc.exe
2009-02-06 09:49 . 2008-07-09 05:23 2020864 ——w c:\windows\system32\dllcache\ntkrpamp.exe
2009-02-06 09:49 . 2004-08-04 03:59 2020864 —-a-w c:\windows\system32\ntkrnlpa.exe
2009-02-06 09:49 . 2008-07-09 05:23 2062976 ——w c:\windows\system32\dllcache\ntkrnlpa.exe
2009-02-03 20:08 . 2009-02-03 20:08 55808 ——w c:\windows\system32\dllcache\secur32.dll
2009-02-03 20:08 . 2004-08-11 22:00 55808 —-a-w c:\windows\system32\secur32.dll
2009-01-29 00:49 . 2009-03-06 20:16 974848 —-a-w c:\windows\system32\mfc70.dll
2009-01-29 00:49 . 2009-03-06 20:16 487424 —-a-w c:\windows\system32\msvcp70.dll
2009-01-29 00:49 . 2009-03-06 20:16 344064 —-a-w c:\windows\system32\msvcr70.dll
2009-01-29 00:49 . 2009-03-06 20:16 1700352 —-a-w c:\windows\system32\GdiPlus.dll
2009-01-29 00:49 . 2009-03-06 20:16 24576 —-a-w c:\windows\system32\msxml3a.dll
2008-11-21 22:06 . 2008-09-26 14:17 69304 —-a-w c:\documents and settings\jack\Application Data\GDIPFONTCACHEV1.DAT
2008-07-09 05:35 . 2008-07-31 20:37 12328 —-a-w c:\documents and settings\jack\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2006-10-11 08:2008-08-08 14:28 04:58 . c:\program files\mozilla firefox\components\jar50.dll
2006-10-11 08:2008-08-08 14:28 04:59 . c:\program files\mozilla firefox\components\jsd3250.dll
2006-10-11 08:2008-08-08 14:28 05:03 . c:\program files\mozilla firefox\components\myspell.dll
2006-10-11 08:2008-08-08 14:28 05:03 . c:\program files\mozilla firefox\components\spellchk.dll
2006-10-11 08:2008-08-08 14:28 04:58 . c:\program files\mozilla firefox\components\xpinstal.dll
2009-01-16 19:53 . 2009-01-16 19:53 16520 –sha-w c:\windows\system32\tumuwaku.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-09-11 218032]
"DellAutomatedPCTuneUp"="c:\program files\DellAutomatedPCTuneUp\PTAgnt.exe" [2007-10-11 465136]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-14 206064]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"Google Update"="c:\documents and settings\jack\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-09 133104]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-09-15 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-09 8523776]
"8169Diag"="c:\program files\Realtek\Diagnostics Utility\8169Diag.exe" [2008-02-26 909312]
"ECenter"="c:\dell\E-Center\EULALauncher.exe" [2008-02-28 17920]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2008-03-11 16384]
"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2008-02-26 128296]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-14 206064]
"Samsung PanelMgr"="c:\windows\Samsung\PanelMgr\ssmmgr.exe" [2005-10-31 503808]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-08-08 185896]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"MimBoot"="c:\progra~1\MUSICM~1\MUSICM~1\mimboot.exe" [2005-03-12 11776]
"MMTray"="c:\program files\Musicmatch\Musicmatch Jukebox\mm_tray.exe" [2005-03-12 110592]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2009-03-15 180224]
"MSConfig"="c:\windows\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2005-09-27 169984]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2008-01-31 16860672]

c:\documents and settings\jack\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-8-1 113664]
Corel Desktop Application Director.LNK - c:\corel\Office7\Dad7\QUICK.EXE [2008-8-5 165888]
HotSync Manager.lnk - c:\program files\palmOne\HOTSYNC.EXE [2004-4-13 299008]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-8-1 113664]
Dell Network Assistant.lnk - c:\windows\Installer\{0240BDFB-2995-4A3F-8C96-18D41282B716}\Icon0240BDFB3.exe [2008-7-9 7168]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2008-7-9 49152]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
Personal Coach.lnk - c:\program files\Broderbund\Mavis Beacon Teaches Typing 15\minimavis.exe [2008-8-4 2392064]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-03-23 22:08 10520 —-a-w c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD DX\\PowerDVD.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD DX\\PDVDDXSrv.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\RM.exe"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\Studio.exe"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\umi.exe"=
"c:\\Program Files\\Dell Network Assistant\\ezi_hnm2.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"10421:UDP"= 10421:UDP:SingleClick Discovery Protocol
"10426:UDP"= 10426:UDP:SingleClick ICC

R2 LANPkt;Realtek LANPkt Protocol Driver;c:\windows\system32\DRIVERS\LANPkt.sys [2007-11-20 8960]
R3 Diag69xp;Diag69xp;c:\windows\system32\Drivers\Diag69xp.sys [2007-12-03 11264]
R3 RTLVLAN;Realtek VLAN Intermediate Driver;c:\windows\system32\DRIVERS\RTLVLAN.SYS [2007-11-20 16640]
S0 AvgRkx86;avgrkx86.sys;c:\windows\System32\Drivers\avgrkx86.sys [2009-01-08 12552]
S1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\System32\Drivers\avgldx86.sys [2009-03-23 325640]
S1 AvgTdiX;AVG8 Network Redirector;c:\windows\System32\Drivers\avgtdix.sys [2009-03-23 108552]
S2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-03-23 298264]
S2 datunidr;DellAutomatedPCTuneUp UniDriver;c:\windows\system32\DRIVERS\datunidr.sys [2007-08-23 5376]


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1a0f0bcc-1ae6-11de-bc12-001d09a186fb}]
\Shell\AutoRun\command - F:\setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{64601a98-6310-11dd-b518-001d09a186fb}]
\Shell\AutoRun\command - f:\wd_windows_tools\setup.exe
.
Contents of the 'Scheduled Tasks' folder

2009-03-25 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]

2009-04-21 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-08-20 22:12]

2009-04-21 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3512600427-2933964712-1627061413-1006.job
- c:\documents and settings\jack\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-09 17:15]
.
- - - - ORPHANS REMOVED - - - -

BHO-{ada8d399-0c4f-4f3f-b3f1-c13347cac1d6} - c:\windows\system32\pemuwiru.dll
HKLM-Run-Adobe Reader Speed Launcher - c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe
SharedTaskScheduler-{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\gavapufa.dll


.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
mStart Page = hxxp://www1.ca.dell.com/content/default.aspx?c=ca&l=en&s=gen
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
Trusted Zone: desjardins.com\accesd
Trusted Zone: internet
Trusted Zone: mcafee.com
Trusted Zone: musicmatch.com\online
Name-Space Handler: ftp\* - {419A0123-4312-1122-A0C0-434FDA6DA542} - c:\program files\CoreFTP\pftpns.dll
FF - ProfilePath - c:\documents and settings\jack\Application Data\Mozilla\Firefox\Profiles\mdbhzioj.default\
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\program files\AVG\AVG8\ToolbarFF\components\vmAVGConnector.dll
FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbar.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\metrics.dll
FF - component: c:\program files\Mozilla Firefox\extensions\[removed]\components\qfaservices.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-21 12:20
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-3512600427-2933964712-1627061413-1006\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{8BC8CE2E-0850-192A-6E00-29775917E38D}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"iaaambepchjlgbcfam"=hex:6b,61,63,62,6d,6a,64,6a,62,6b,6d,6f,64,64,68,62,64,6a,
6e,6c,63,6c,00,00
"hagaadnbnidccmjj"=hex:6b,61,63,62,6d,6a,64,6a,62,6b,6d,6f,64,64,68,62,64,6a,
6e,6c,63,6c,00,00

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:c8,28,51,af,b0,29,a3,98,d4,7b,86,f6,99,
49,87,fa,c8,28,51,af,b0,29,a3,98,d5,5d,ba,af,b5,3a,47,f0,e2,63,26,f1,3f,c8,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:6a,9c,d6,61,af,45,84,18,95,4e,29,2c,36,
a5,62,b1,71,3b,04,66,8b,46,0d,96,1c,56,97,38,6f,10,70,30,6a,9c,d6,61,af,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:25,da,ec,7e,55,20,c9,26,ea,87,db,e0,31,
7b,ab,32,25,da,ec,7e,55,20,c9,26,d3,0b,31,93,cd,cb,44,58,ff,7c,85,e0,43,d4,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:3e,1e,9e,e0,57,5a,93,61,61,79,84,6e,65,
ce,2c,45,3e,1e,9e,e0,57,5a,93,61,f7,0e,11,6a,c8,c6,cf,ee,86,8c,21,01,be,91,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:e9,02,6c,fa,fb,1d,47,57,3d,94,27,78,a5,
e4,93,d3,cd,44,cd,b9,a6,33,6c,cd,49,d1,bd,eb,29,be,ea,4a,f5,1d,4d,73,a8,13,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:b0,18,ed,a7,3f,8d,37,a4,61,fa,73,a7,32,
80,52,87,b0,18,ed,a7,3f,8d,37,a4,7a,20,20,a0,dc,d3,85,40,df,20,58,62,78,6b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:97,20,4e,9a,c7,f1,35,ee,83,d7,87,ab,97,
61,d2,25,31,77,e1,ba,b1,f8,68,02,35,e1,92,77,40,2e,07,e7,fb,a7,78,e6,12,2f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:aa,52,c6,00,84,3c,26,64,c7,2e,9f,2f,fa,
14,7e,8e,83,6c,56,8b,a0,85,96,ab,ce,f6,90,f6,08,30,04,30,01,3a,48,fc,e8,04,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:51,fa,6e,91,28,9e,14,cc,a2,dc,82,61,17,
bb,48,2e,51,fa,6e,91,28,9e,14,cc,ec,ff,a8,b9,7f,e1,7b,a3,f6,0f,4e,58,98,5b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:b1,cd,45,5a,a8,c4,f8,b9,1d,58,4a,b9,14,
5e,b7,b5,b1,cd,45,5a,a8,c4,f8,b9,f8,38,ea,3d,d5,da,a9,64,3d,ce,ea,26,2d,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:e3,0e,66,d5,eb,bc,2f,6b,bf,54,47,05,eb,
58,74,18,e3,0e,66,d5,eb,bc,2f,6b,2f,94,c7,03,a1,0b,38,88,2a,b7,cc,b5,b9,7f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:fa,ea,66,7f,d4,3b,6b,70,3d,88,61,df,a9,
2c,91,a0,fa,ea,66,7f,d4,3b,6b,70,11,7c,60,5a,1b,08,03,6c,6c,43,2d,1e,aa,22,\
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(2140)
c:\program files\Broderbund\Mavis Beacon Teaches Typing 15\KeyHook.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\Roxio\Drag-to-Disc\Shellex.dll
c:\program files\Common Files\Roxio Shared\9.0\DLLShared\DLAAPI_W.DLL
c:\program files\Roxio\Drag-to-Disc\ShellRes.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\progra~1\MUSICM~1\MUSICM~1\MMDiag.exe
c:\program files\Dell Network Assistant\hnm_svc.exe
c:\program files\Musicmatch\Musicmatch Jukebox\mim.exe
c:\program files\Common Files\Nero\Nero BackItUp 4\NBService.exe
c:\progra~1\AVG\AVG8\avgam.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Dell Support Center\bin\sprtsvc.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-04-21 12:22 - machine was rebooted
ComboFix-quarantined-files.txt 2009-04-21 16:22

Pre-Run: 185,654,345,728 bytes free
Post-Run: 185,598,459,904 bytes free

352 — E O F — 2009-04-18 15:31
Post #4
Hi,

please do the following:

  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
  • They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box, put your mouse cursor at the very beginning of the text and then hold down the left button and drag your mouse so that all of the text is highlighted. Press Ctrl+C (or right click on the highlighted section and choose 'copy')

Collect::
C:\feyadtq.exe
C:\swww.exe
C:\tmpl.exe
c:\windows\system32\fipijuza.dll
c:\windows\system32\tumuwaku.dll

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1a0f0bcc-1ae6-11de-bc12-001d09a186fb}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{64601a98-6310-11dd-b518-001d09a186fb}]

Now paste the copied text into the open notepad. To do this click in the blank page so that your cursor is flashing there and press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

* Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
* ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
* When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Post #5
This morning I ran a scan with AVG and it returned that it had found and deleted alureon.c
I then rebooted rescanned and AVG found no trace of alureon.c
This afternoon after rebooting a third time I reran the scan and again found the message that AVG had found and deleted alureon.c
Here's the latest ComboFix scan

ComboFix 09-04-21.A8 - jack 21/04/2009 18:11.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.3070.2541 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\jack\Desktop\CFScript.txt
AV: a-squared Anti-Malware *On-access scanning disabled* (Updated)
AV: AVG Anti-Virus *On-access scanning disabled* (Updated)
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\feyadtq.exe
C:\swww.exe
C:\tmpl.exe
c:\windows\system32\fipijuza.dll
c:\windows\system32\tumuwaku.dll
F:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2009-03-21 to 2009-04-21 )))))))))))))))))))))))))))))))
.

2009-04-17 22:15 . 2009-04-17 22:23 ——– d—–w C:\26e618e46facf93f794dc6449946a1
2009-04-17 21:03 . 2008-04-21 10:02 215552 ——w c:\windows\system32\dllcache\wordpad.exe
2009-04-17 21:03 . 2009-03-06 14:00 284160 ——w c:\windows\system32\dllcache\pdh.dll
2009-04-17 21:03 . 2009-02-09 10:01 473088 ——w c:\windows\system32\dllcache\fastprox.dll
2009-04-17 21:03 . 2009-02-09 10:01 401408 ——w c:\windows\system32\dllcache\rpcss.dll
2009-04-17 21:03 . 2009-02-06 10:22 110592 ——w c:\windows\system32\dllcache\services.exe
2009-04-17 21:03 . 2009-02-06 09:54 35328 ——w c:\windows\system32\dllcache\sc.exe
2009-04-17 21:03 . 2009-02-06 09:41 227840 ——w c:\windows\system32\dllcache\wmiprvse.exe
2009-04-17 21:03 . 2005-07-26 04:20 60416 ——w c:\windows\system32\dllcache\colbact.dll
2009-04-17 21:03 . 2009-02-09 10:01 617984 ——w c:\windows\system32\dllcache\advapi32.dll
2009-04-17 21:03 . 2009-02-09 10:01 715264 ——w c:\windows\system32\dllcache\ntdll.dll
2009-04-16 19:44 . 2009-04-16 19:48 ——– d—–w C:\a3972505d59c5967e49a044f
2009-04-07 16:19 . 2009-04-07 16:19 ——– d—–w C:\My Music
2009-04-07 16:07 . 2009-04-07 16:07 ——– d—–w c:\documents and settings\jack\Application Data\Winamp
2009-04-02 21:08 . 2009-04-02 21:53 69 —-a-w c:\windows\NeroDigital.ini
2009-04-02 21:06 . 2009-04-02 21:06 ——– d—–w c:\documents and settings\jack\Application Data\Nero
2009-04-02 20:46 . 2009-04-02 20:50 ——– d—–w c:\documents and settings\All Users\Application Data\Nero
2009-04-02 18:01 . 2009-04-02 18:01 ——– d—–w c:\documents and settings\jack\Application Data\AccurateRip
2009-04-02 18:01 . 2009-04-02 18:01 ——– d—–w c:\documents and settings\jack\Application Data\AD ON Multimedia
2009-03-25 17:32 . 2009-03-25 17:32 ——– d—–w c:\documents and settings\jack\Application Data\Apple Computer
2009-03-25 17:26 . 2009-03-25 17:26 ——– d—–w c:\documents and settings\All Users\Application Data\Apple Computer
2009-03-25 17:25 . 2009-03-25 17:25 ——– d—–w c:\documents and settings\jack\Local Settings\Application Data\Apple
2009-03-25 17:25 . 2009-03-25 17:25 ——– d—–w c:\documents and settings\All Users\Application Data\Apple
2009-03-25 17:25 . 2009-03-25 17:25 ——– d—–w c:\documents and settings\jack\Local Settings\Application Data\Apple Computer

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-21 21:03 . 2008-07-09 05:35 ——– d—a-w c:\documents and settings\All Users\Application Data\TEMP
2009-04-21 21:03 . 2008-07-09 05:35 512 —-a-w C:\RTHDCPL_Dump.txt
2009-04-21 20:54 . 2008-08-04 20:20 ——– d—–w c:\documents and settings\jack\Application Data\CoreFTP
2009-04-21 12:59 . 2008-09-15 13:54 ——– d—–w c:\documents and settings\All Users\Application Data\Google Updater
2009-04-18 14:46 . 2009-04-17 23:29 ——– d—–w c:\program files\a-squared Anti-Malware
2009-04-16 20:51 . 2008-08-04 21:08 ——– d—–w c:\documents and settings\All Users\Application Data\avg8
2009-04-16 19:43 . 2009-03-11 14:36 ——– d—–w c:\documents and settings\jack\Application Data\uTorrent
2009-04-09 15:33 . 2009-04-09 15:33 ——– d—–w c:\program files\PowerISO
2009-04-07 16:19 . 2009-04-07 16:19 ——– d—–w c:\program files\AudioConverter Studio
2009-04-07 16:14 . 2009-04-07 16:07 ——– d—–w c:\program files\Winamp
2009-04-02 21:01 . 2009-04-02 20:46 ——– d—–w c:\program files\Common Files\Nero
2009-04-02 20:54 . 2009-04-02 20:46 ——– d—–w c:\program files\Nero
2009-04-02 20:53 . 2009-04-02 20:53 ——– d—–w c:\program files\Windows Sidebar
2009-04-02 18:17 . 2009-04-02 18:17 ——– d—–w c:\program files\FLAC
2009-04-02 18:01 . 2009-04-02 18:01 ——– d—–w c:\program files\Exact Audio Copy
2009-03-25 17:26 . 2009-03-25 17:26 ——– d—–w c:\program files\QuickTime
2009-03-25 17:25 . 2009-03-25 17:25 ——– d—–w c:\program files\Apple Software Update
2009-03-23 22:08 . 2008-08-04 21:08 10520 —-a-w c:\windows\system32\avgrsstx.dll
2009-03-23 22:08 . 2008-08-04 21:08 325640 —-a-w c:\windows\system32\drivers\avgldx86.sys
2009-03-23 22:08 . 2008-08-04 21:08 108552 —-a-w c:\windows\system32\drivers\avgtdix.sys
2009-03-21 14:18 . 2008-07-09 05:22 986112 ——w c:\windows\system32\dllcache\kernel32.dll
2009-03-18 14:47 . 2008-07-09 05:33 ——– d—–w c:\documents and settings\All Users\Application Data\Dell
2009-03-17 22:36 . 2009-03-17 22:36 ——– d—–w c:\program files\Need4 Video Converter 5.9
2009-03-17 22:36 . 2009-03-17 22:36 ——– d—–w c:\program files\Need4 Software Launcher
2009-03-17 21:54 . 2008-07-09 05:35 93096 —-a-w c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-03-17 21:53 . 2009-03-17 21:07 ——– d—–w c:\program files\Pinnacle
2009-03-17 21:53 . 2009-03-17 21:03 ——– d—–w c:\documents and settings\All Users\Application Data\Pinnacle
2009-03-17 21:10 . 2009-03-17 21:10 ——– d—–w c:\program files\Common Files\Pinnacle
2009-03-17 21:10 . 2009-03-17 21:10 ——– d—–w c:\documents and settings\All Users\Application Data\Pinnacle Studio Ultimate
2009-03-17 21:07 . 2009-03-17 21:07 ——– d—–w c:\program files\Common Files\Yahoo!
2009-03-17 21:07 . 2009-03-17 21:07 ——– d—–w c:\documents and settings\All Users\Application Data\Studio 12
2009-03-17 21:07 . 2009-03-17 21:07 ——– d—–w c:\documents and settings\All Users\Application Data\Pinnacle Studio Plus
2009-03-15 10:25 . 2009-03-15 10:25 56268 —-a-w c:\windows\system32\drivers\scdemu.sys
2009-03-12 15:10 . 2009-03-12 15:10 ——– d—–w c:\program files\Windows Media Connect 2
2009-03-11 17:30 . 2009-03-11 17:30 ——– d—–w c:\program files\dvdXsoft
2009-03-11 15:58 . 2009-03-11 15:58 ——– d—–w c:\documents and settings\All Users\Application Data\Adobe Systems
2009-03-11 15:51 . 2008-08-01 20:35 ——– d—–w c:\program files\Common Files\Adobe
2009-03-11 15:50 . 2009-03-11 15:50 ——– d—–w c:\program files\Common Files\Adobe Systems Shared
2009-03-11 14:36 . 2009-03-11 14:36 ——– d—–w c:\program files\uTorrent
2009-03-06 21:02 . 2009-03-06 21:02 ——– d—–w c:\program files\Movavi Video Converter 7
2009-03-06 20:22 . 2009-03-06 20:17 ——– d—–w c:\program files\Common Files\AVSMedia
2009-03-06 20:22 . 2009-03-06 20:16 ——– d—–w c:\program files\AVS4YOU
2009-03-06 20:18 . 2009-03-06 20:18 ——– d—–w c:\documents and settings\jack\Application Data\AVS4YOU
2009-03-06 20:17 . 2009-03-06 20:17 ——– d—–w c:\documents and settings\All Users\Application Data\AVS4YOU
2009-03-06 14:00 . 2004-08-11 22:00 284160 —-a-w c:\windows\system32\pdh.dll
2009-03-02 23:52 . 2008-07-09 05:22 1495552 ——w c:\windows\system32\dllcache\shdocvw.dll
2009-03-02 22:06 . 2008-07-09 05:31 ——– d—–w c:\program files\Google
2009-02-19 09:58 . 2008-07-09 05:22 18432 ——w c:\windows\system32\dllcache\iedw.exe
2009-02-10 22:31 . 2009-02-10 22:31 453120 ——w c:\windows\system32\dllcache\wmiprvsd.dll
2009-02-09 10:19 . 2008-07-09 05:23 1846272 ——w c:\windows\system32\dllcache\win32k.sys
2009-02-09 10:19 . 2004-08-11 22:00 1846272 —-a-w c:\windows\system32\win32k.sys
2009-02-09 10:01 . 2008-07-09 05:21 728576 ——w c:\windows\system32\dllcache\lsasrv.dll
2009-02-09 10:01 . 2004-08-11 22:00 401408 —-a-w c:\windows\system32\rpcss.dll
2009-02-09 10:01 . 2004-08-11 22:00 728576 —-a-w c:\windows\system32\lsasrv.dll
2009-02-09 10:01 . 2004-08-11 22:00 617984 —-a-w c:\windows\system32\advapi32.dll
2009-02-09 10:01 . 2004-08-11 22:00 715264 —-a-w c:\windows\system32\ntdll.dll
2009-02-06 10:32 . 2008-07-09 05:23 2186112 ——w c:\windows\system32\dllcache\ntoskrnl.exe
2009-02-06 10:29 . 2008-07-09 05:23 2142720 ——w c:\windows\system32\dllcache\ntkrnlmp.exe
2009-02-06 10:29 . 2004-08-11 22:00 2142720 —-a-w c:\windows\system32\ntoskrnl.exe
2009-02-06 10:22 . 2004-08-11 22:00 110592 —-a-w c:\windows\system32\services.exe
2009-02-06 09:54 . 2004-08-11 22:00 35328 —-a-w c:\windows\system32\sc.exe
2009-02-06 09:49 . 2008-07-09 05:23 2020864 ——w c:\windows\system32\dllcache\ntkrpamp.exe
2009-02-06 09:49 . 2004-08-04 03:59 2020864 —-a-w c:\windows\system32\ntkrnlpa.exe
2009-02-06 09:49 . 2008-07-09 05:23 2062976 ——w c:\windows\system32\dllcache\ntkrnlpa.exe
2009-02-03 20:08 . 2009-02-03 20:08 55808 ——w c:\windows\system32\dllcache\secur32.dll
2009-02-03 20:08 . 2004-08-11 22:00 55808 —-a-w c:\windows\system32\secur32.dll
2009-01-29 00:49 . 2009-03-06 20:16 974848 —-a-w c:\windows\system32\mfc70.dll
2009-01-29 00:49 . 2009-03-06 20:16 487424 —-a-w c:\windows\system32\msvcp70.dll
2009-01-29 00:49 . 2009-03-06 20:16 344064 —-a-w c:\windows\system32\msvcr70.dll
2009-01-29 00:49 . 2009-03-06 20:16 1700352 —-a-w c:\windows\system32\GdiPlus.dll
2009-01-29 00:49 . 2009-03-06 20:16 24576 —-a-w c:\windows\system32\msxml3a.dll
2008-11-21 22:06 . 2008-09-26 14:17 69304 —-a-w c:\documents and settings\jack\Application Data\GDIPFONTCACHEV1.DAT
2008-07-09 05:35 . 2008-07-31 20:37 12328 —-a-w c:\documents and settings\jack\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2006-10-11 08:2008-08-08 14:28 04:58 . c:\program files\mozilla firefox\components\jar50.dll
2006-10-11 08:2008-08-08 14:28 04:59 . c:\program files\mozilla firefox\components\jsd3250.dll
2006-10-11 08:2008-08-08 14:28 05:03 . c:\program files\mozilla firefox\components\myspell.dll
2006-10-11 08:2008-08-08 14:28 05:03 . c:\program files\mozilla firefox\components\spellchk.dll
2006-10-11 08:2008-08-08 14:28 04:58 . c:\program files\mozilla firefox\components\xpinstal.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-04-21_16.20.10 )))))))))))))))))))))))))))))))))))))))))
.
+ 2004-08-11 22:00 . 2009-04-21 21:07 63220 c:\windows\system32\perfc009.dat
- 2004-08-11 22:00 . 2009-04-21 16:09 63220 c:\windows\system32\perfc009.dat
+ 2004-08-11 22:00 . 2009-04-21 21:07 402736 c:\windows\system32\perfh009.dat
- 2004-08-11 22:00 . 2009-04-21 16:09 402736 c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-09-11 218032]
"DellAutomatedPCTuneUp"="c:\program files\DellAutomatedPCTuneUp\PTAgnt.exe" [2007-10-11 465136]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-14 206064]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"Google Update"="c:\documents and settings\jack\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-09 133104]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-09-15 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-09 8523776]
"8169Diag"="c:\program files\Realtek\Diagnostics Utility\8169Diag.exe" [2008-02-26 909312]
"ECenter"="c:\dell\E-Center\EULALauncher.exe" [2008-02-28 17920]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2008-03-11 16384]
"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2008-02-26 128296]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-14 206064]
"Samsung PanelMgr"="c:\windows\Samsung\PanelMgr\ssmmgr.exe" [2005-10-31 503808]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-08-08 185896]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"MimBoot"="c:\progra~1\MUSICM~1\MUSICM~1\mimboot.exe" [2005-03-12 11776]
"MMTray"="c:\program files\Musicmatch\Musicmatch Jukebox\mm_tray.exe" [2005-03-12 110592]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2009-03-15 180224]
"MSConfig"="c:\windows\pchealth\helpctr\Binaries\MSCONFIG.EXE" [2005-09-27 169984]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2008-01-31 16860672]

c:\documents and settings\jack\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-8-1 113664]
Corel Desktop Application Director.LNK - c:\corel\Office7\Dad7\QUICK.EXE [2008-8-5 165888]
HotSync Manager.lnk - c:\program files\palmOne\HOTSYNC.EXE [2004-4-13 299008]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-8-1 113664]
Dell Network Assistant.lnk - c:\windows\Installer\{0240BDFB-2995-4A3F-8C96-18D41282B716}\Icon0240BDFB3.exe [2008-7-9 7168]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2008-7-9 49152]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
Personal Coach.lnk - c:\program files\Broderbund\Mavis Beacon Teaches Typing 15\minimavis.exe [2008-8-4 2392064]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-03-23 22:08 10520 —-a-w c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD DX\\PowerDVD.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD DX\\PDVDDXSrv.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\RM.exe"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\Studio.exe"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\umi.exe"=
"c:\\Program Files\\Dell Network Assistant\\ezi_hnm2.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"10421:UDP"= 10421:UDP:SingleClick Discovery Protocol
"10426:UDP"= 10426:UDP:SingleClick ICC

R2 LANPkt;Realtek LANPkt Protocol Driver;c:\windows\system32\DRIVERS\LANPkt.sys [2007-11-20 8960]
R3 Diag69xp;Diag69xp;c:\windows\system32\Drivers\Diag69xp.sys [2007-12-03 11264]
R3 RTLVLAN;Realtek VLAN Intermediate Driver;c:\windows\system32\DRIVERS\RTLVLAN.SYS [2007-11-20 16640]
S0 AvgRkx86;avgrkx86.sys;c:\windows\System32\Drivers\avgrkx86.sys [2009-01-08 12552]
S1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\System32\Drivers\avgldx86.sys [2009-03-23 325640]
S1 AvgTdiX;AVG8 Network Redirector;c:\windows\System32\Drivers\avgtdix.sys [2009-03-23 108552]
S2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-03-23 298264]
S2 datunidr;DellAutomatedPCTuneUp UniDriver;c:\windows\system32\DRIVERS\datunidr.sys [2007-08-23 5376]

.
Contents of the 'Scheduled Tasks' folder

2009-03-25 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]

2009-04-21 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-08-20 22:12]

2009-04-21 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3512600427-2933964712-1627061413-1006.job
- c:\documents and settings\jack\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-09 17:15]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
mStart Page = hxxp://www1.ca.dell.com/content/default.aspx?c=ca&l=en&s=gen
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
Trusted Zone: desjardins.com\accesd
Trusted Zone: internet
Trusted Zone: mcafee.com
Trusted Zone: musicmatch.com\online
Name-Space Handler: ftp\* - {419A0123-4312-1122-A0C0-434FDA6DA542} - c:\program files\CoreFTP\pftpns.dll
FF - ProfilePath - c:\documents and settings\jack\Application Data\Mozilla\Firefox\Profiles\mdbhzioj.default\
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\program files\AVG\AVG8\ToolbarFF\components\vmAVGConnector.dll
FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbar.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\metrics.dll
FF - component: c:\program files\Mozilla Firefox\extensions\[removed]\components\qfaservices.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-21 18:13
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-3512600427-2933964712-1627061413-1006\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{8BC8CE2E-0850-192A-6E00-29775917E38D}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"iaaambepchjlgbcfam"=hex:6b,61,63,62,6d,6a,64,6a,62,6b,6d,6f,64,64,68,62,64,6a,
6e,6c,63,6c,00,00
"hagaadnbnidccmjj"=hex:6b,61,63,62,6d,6a,64,6a,62,6b,6d,6f,64,64,68,62,64,6a,
6e,6c,63,6c,00,00

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:c8,28,51,af,b0,29,a3,98,d4,7b,86,f6,99,
49,87,fa,c8,28,51,af,b0,29,a3,98,d5,5d,ba,af,b5,3a,47,f0,e2,63,26,f1,3f,c8,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:6a,9c,d6,61,af,45,84,18,95,4e,29,2c,36,
a5,62,b1,71,3b,04,66,8b,46,0d,96,1c,56,97,38,6f,10,70,30,6a,9c,d6,61,af,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:25,da,ec,7e,55,20,c9,26,ea,87,db,e0,31,
7b,ab,32,25,da,ec,7e,55,20,c9,26,d3,0b,31,93,cd,cb,44,58,ff,7c,85,e0,43,d4,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:3e,1e,9e,e0,57,5a,93,61,61,79,84,6e,65,
ce,2c,45,3e,1e,9e,e0,57,5a,93,61,f7,0e,11,6a,c8,c6,cf,ee,86,8c,21,01,be,91,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:e9,02,6c,fa,fb,1d,47,57,3d,94,27,78,a5,
e4,93,d3,cd,44,cd,b9,a6,33,6c,cd,49,d1,bd,eb,29,be,ea,4a,f5,1d,4d,73,a8,13,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:b0,18,ed,a7,3f,8d,37,a4,61,fa,73,a7,32,
80,52,87,b0,18,ed,a7,3f,8d,37,a4,7a,20,20,a0,dc,d3,85,40,df,20,58,62,78,6b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:97,20,4e,9a,c7,f1,35,ee,83,d7,87,ab,97,
61,d2,25,31,77,e1,ba,b1,f8,68,02,35,e1,92,77,40,2e,07,e7,fb,a7,78,e6,12,2f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:aa,52,c6,00,84,3c,26,64,c7,2e,9f,2f,fa,
14,7e,8e,83,6c,56,8b,a0,85,96,ab,ce,f6,90,f6,08,30,04,30,01,3a,48,fc,e8,04,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:51,fa,6e,91,28,9e,14,cc,a2,dc,82,61,17,
bb,48,2e,51,fa,6e,91,28,9e,14,cc,ec,ff,a8,b9,7f,e1,7b,a3,f6,0f,4e,58,98,5b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:b1,cd,45,5a,a8,c4,f8,b9,1d,58,4a,b9,14,
5e,b7,b5,b1,cd,45,5a,a8,c4,f8,b9,f8,38,ea,3d,d5,da,a9,64,3d,ce,ea,26,2d,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:e3,0e,66,d5,eb,bc,2f,6b,bf,54,47,05,eb,
58,74,18,e3,0e,66,d5,eb,bc,2f,6b,2f,94,c7,03,a1,0b,38,88,2a,b7,cc,b5,b9,7f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:fa,ea,66,7f,d4,3b,6b,70,3d,88,61,df,a9,
2c,91,a0,fa,ea,66,7f,d4,3b,6b,70,11,7c,60,5a,1b,08,03,6c,6c,43,2d,1e,aa,22,\
.
Completion time: 2009-04-21 18:15
ComboFix-quarantined-files.txt 2009-04-21 22:14
ComboFix2.txt 2009-04-21 16:22

Pre-Run: 185,506,893,824 bytes free
Post-Run: 185,494,818,816 bytes free

317 — E O F — 2009-04-21 17:31
Post #6
Hi,

The malware on your system is known as a Rootkit…this type of malware can be very dangerous These programs have the ability to steal passwords and other information from your system. If you use your computer for sensitive purposes such as internet banking then I recommend you take the following steps immediately:
  • Use another, uninfected computer to change all your internet passwords, especially ones with financial implications such as banks, paypal, ebay, etc. You should also change the passwords for any other site you use.
  • Call your bank(s), credit card company or any other institution which may be affected and advise them that your login/password or credit card information may have been compromised.
  • Consider what other private information could possibly have been taken from your computer and take appropriate steps

A lot of this malware has already been cleaned from your computer and I will continue to clean it, however you should be aware of the possibility. If this is unacceptable to you the only sure way is to completely reformat and reinstall your operating system.
Please advise in your next post what your wishes are.

Meantime I will continue to clean it.

Please do the following:

Download RootRepeal.zip and unzip it to your Desktop.
  • Double click RootRepeal.exe to start the program
  • Click on the Report tab at the bottom of the program window
  • Click the Scan button
  • In the Select Scan dialog, check:
    • Drivers
    • Files
    • Processes
    • SSDT
    • Stealth Objects
    • Hidden Services
  • Click the OK button
  • In the next dialog, select all drives showing
  • Click OK to start the scan

    Note: The scan can take some time. DO NOT run any other programs while the scan is running

  • When the scan is complete, the Save Report button will become available
  • Click this and save the report to your Desktop as RootRepeal.txt
If the report is not too long, post the contents of RootRepeal.txt in your next reply. If the report is very long, it will not be complete if you post it, so please attach it to your reply instead.

To attach a file, do the following:
  • Click Add Reply
  • Under the reply panel is the Attachments Panel
  • Browse for the attachment file you want to upload, then click the green Upload button
  • Once it has uploaded, click the Manage Current Attachments drop down box
  • Click on [external image: Posted Image] to insert the attachment into your post
Post #7
Hi catbyte I am using another pc to do my password sensitive work. I have changed all passwords that I use and I'm quite sure I became aware of these malwares the moment I got infected. I do not want to reformat at this point and would like to continue cleaning the pc. This is the scan from RootRepeal Thanks for your time ROOTREPEAL © AD, 2007-2008 ================================================== Scan Time: 2009/04/22 10:17 Program Version: Version 1.2.3.0 Windows Version: Windows XP SP2 ================================================== Drivers ——————- Name: dump_atapi.sys Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys Address: 0xB6634000 Size: 98304 File Visible: No Status: - Name: dump_WMILIB.SYS Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS Address: 0xBA668000 Size: 8192 File Visible: No Status: - Name: RKREVEAL150.SYS Image Path: C:\WINDOWS\system32\Drivers\RKREVEAL150.SYS Address: 0xBA644000 Size: 4128 File Visible: No Status: - Name: rootrepeal.sys Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys Address: 0xB514C000 Size: 45056 File Visible: No Status: - Hidden/Locked Files ——————- Path: C:\hiberfil.sys Status: Locked to the Windows API! Path: Volume F:\ Status: MBR Rootkit Detected! Path: Volume F:\, Sector 1 Status: Sector mismatch Path: F:\autorun Status: Visible to the Windows API, but not on disk. Path: F:\WD_Windows_tools Status: Visible to the Windows API, but not on disk. Path: F:\System Volume Information Status: Visible to the Windows API, but not on disk. Path: F:\Recycled Status: Visible to the Windows API, but not on disk. Path: F:\photo Status: Visible to the Windows API, but not on disk. Path: F:\download Status: Visible to the Windows API, but not on disk. Path: F:\Jack Status: Visible to the Windows API, but not on disk. Path: F:\tornade Status: Visible to the Windows API, but not on disk. Path: F:\Palm.aba Status: Visible to the Windows API, but not on disk. Path: F:\$AVG8.VAULT$ Status: Visible to the Windows API, but not on disk. Path: F:\Nat-Geo-The-Living-Edens-Costa.Rica.mkv Status: Visible to the Windows API, but not on disk. Path: F:\Nat-Geo-The-Living-Edens-Manu-Peru.mkv Status: Visible to the Windows API, but not on disk. Path: F:\Nat-Geo-Worlds-Deadliest-Animals-Costa-Rica.avi Status: Visible to the Windows API, but not on disk. Path: F:\Slumdog-Millionaire.avi Status: Visible to the Windows API, but not on disk. Path: F:\Twilight[2008]DvDrip-aXXo.avi Status: Visible to the Windows API, but not on disk. Path: F:\Bear Grylls Born Survivor-Costa Rica.avi Status: Visible to the Windows API, but not on disk. Path: F:\Nat-Geo-Gabon-The-Last-Eden.avi Status: Visible to the Windows API, but not on disk. Path: F:\Man.vs.Wild.02.Costa.Rican.Rain.Forest.WS[goat].avi Status: Visible to the Windows API, but not on disk. Path: F:\Nat-Geo-Colombia-Hostage-Rescue.avi Status: Visible to the Windows API, but not on disk. Path: F:\Hearts.and.Minds.(1974).Won.Oscar.for.Best.Documentary.avi Status: Visible to the Windows API, but not on disk. Path: F:\National.Geographic.The.Living.Edens.05of24.Etosha.Africa.DVB.x264.AAC.www. mvgroup.org.mkv Status: Visible to the Windows API, but not on disk. Path: F:\National.Geographic.The.Living.Edens.24of24.The.Lost.World.DVB.x264.AAC.www .mvgroup.org.mkv Status: Visible to the Windows API, but not on disk. Path: F:\Milk[2008]DvDrip[Eng]-FXG.avi Status: Visible to the Windows API, but not on disk. Path: F:\Quantum.Of.Solace[2008]DvDrip-aXXo.avi Status: Visible to the Windows API, but not on disk. Path: F:\Yes.Man.2008.DvDRip-FxM.avi Status: Visible to the Windows API, but not on disk. Path: F:\No.Country.For.Old.Men[2007]DvDrip-aXXo.avi Status: Visible to the Windows API, but not on disk. Path: F:\dich-national.geographic.worlds.most.dangerous.roads.hh.720p.hdtv.x264.mkv Status: Visible to the Windows API, but not on disk. Stealth Objects ——————- Object: Hidden Module [Name: sprtmessage.dll] Process: sprtcmd.exe (PID: 408) Address: 0x00d90000 Size: 77824 Object: Hidden Module [Name: SupportSoft.Agent.Sprocket.SupportMessage.dll] Process: sprtcmd.exe (PID: 408) Address: 0x00eb0000 Size: 45056 Object: Hidden Module [Name: SupportSoft.Agent.Sprocket.dll] Process: sprtcmd.exe (PID: 408) Address: 0x00ed0000 Size: 28672
Post #8
Hi,

Looks like there is a MBR rootkit on board:


Please do the following:

Go to> Start > run
type cmd into the run box and hit the ok button.
At the DOS prompt type mbr.exe -f
(make sure you have a space before the -f)
hit the enter key.

Type exit at the prompt and hit the enter key.

Restart the computer normally.

Now run the Rooter program again and post the fresh Rooter Log.

Thanks
Post #9
When I ran: Go to> Start > run type cmd into the run box and hit the ok button. At the DOS prompt type mbr.exe -f I received the message: mbr.exe is not recognized as an internal o r external command Here's the log from rootrepeal ROOTREPEAL © AD, 2007-2008 ================================================== Scan Time: 2009/04/22 14:38 Program Version: Version 1.2.3.0 Windows Version: Windows XP SP2 ================================================== Drivers ——————- Name: dump_atapi.sys Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys Address: 0xB62DE000 Size: 98304 File Visible: No Status: - Name: dump_WMILIB.SYS Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS Address: 0xBA5F6000 Size: 8192 File Visible: No Status: - Name: rootrepeal.sys Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys Address: 0xB606E000 Size: 45056 File Visible: No Status: - Hidden/Locked Files ——————- Path: C:\hiberfil.sys Status: Locked to the Windows API! Path: Volume F:\ Status: MBR Rootkit Detected! Path: Volume F:\, Sector 1 Status: Sector mismatch Path: F:\autorun Status: Visible to the Windows API, but not on disk. Path: F:\WD_Windows_tools Status: Visible to the Windows API, but not on disk. Path: F:\System Volume Information Status: Visible to the Windows API, but not on disk. Path: F:\Recycled Status: Visible to the Windows API, but not on disk. Path: F:\photo Status: Visible to the Windows API, but not on disk. Path: F:\download Status: Visible to the Windows API, but not on disk. Path: F:\Jack Status: Visible to the Windows API, but not on disk. Path: F:\tornade Status: Visible to the Windows API, but not on disk. Path: F:\Palm.aba Status: Visible to the Windows API, but not on disk. Path: F:\$AVG8.VAULT$ Status: Visible to the Windows API, but not on disk. Path: F:\Nat-Geo-The-Living-Edens-Costa.Rica.mkv Status: Visible to the Windows API, but not on disk. Path: F:\Nat-Geo-The-Living-Edens-Manu-Peru.mkv Status: Visible to the Windows API, but not on disk. Path: F:\Nat-Geo-Worlds-Deadliest-Animals-Costa-Rica.avi Status: Visible to the Windows API, but not on disk. Path: F:\Slumdog-Millionaire.avi Status: Visible to the Windows API, but not on disk. Path: F:\Twilight[2008]DvDrip-aXXo.avi Status: Visible to the Windows API, but not on disk. Path: F:\Bear Grylls Born Survivor-Costa Rica.avi Status: Visible to the Windows API, but not on disk. Path: F:\Nat-Geo-Gabon-The-Last-Eden.avi Status: Visible to the Windows API, but not on disk. Path: F:\Man.vs.Wild.02.Costa.Rican.Rain.Forest.WS[goat].avi Status: Visible to the Windows API, but not on disk. Path: F:\Nat-Geo-Colombia-Hostage-Rescue.avi Status: Visible to the Windows API, but not on disk. Path: F:\Hearts.and.Minds.(1974).Won.Oscar.for.Best.Documentary.avi Status: Visible to the Windows API, but not on disk. Path: F:\National.Geographic.The.Living.Edens.05of24.Etosha.Africa.DVB.x264.AAC.www. mvgroup.org.mkv Status: Visible to the Windows API, but not on disk. Path: F:\National.Geographic.The.Living.Edens.24of24.The.Lost.World.DVB.x264.AAC.www .mvgroup.org.mkv Status: Visible to the Windows API, but not on disk. Path: F:\Milk[2008]DvDrip[Eng]-FXG.avi Status: Visible to the Windows API, but not on disk. Path: F:\Quantum.Of.Solace[2008]DvDrip-aXXo.avi Status: Visible to the Windows API, but not on disk. Path: F:\Yes.Man.2008.DvDRip-FxM.avi Status: Visible to the Windows API, but not on disk. Path: F:\No.Country.For.Old.Men[2007]DvDrip-aXXo.avi Status: Visible to the Windows API, but not on disk. Path: F:\dich-national.geographic.worlds.most.dangerous.roads.hh.720p.hdtv.x264.mkv Status: Visible to the Windows API, but not on disk. Stealth Objects ——————- Object: Hidden Module [Name: sprtmessage.dll] Process: sprtcmd.exe (PID: 412) Address: 0x00d90000 Size: 77824 Object: Hidden Module [Name: SupportSoft.Agent.Sprocket.SupportMessage.dll] Process: sprtcmd.exe (PID: 412) Address: 0x00eb0000 Size: 45056 Object: Hidden Module [Name: SupportSoft.Agent.Sprocket.dll] Process: sprtcmd.exe (PID: 412) Address: 0x00ed0000 Size: 28672
Post #10
My mistake, I hadn't given you it to you to download yet :smack:

Please download mbr.exe and save it to your root directory, (usually C:\ )

But if you are using F: as your root directory then download it to F: (that is where the MBR rootkit is located)

If you have any questions regarding where to download it to, please ask

Go to Start > Run and type: cmd.exe (is the command prompt showing C: or F: ? (you need to be in the drive where you saved mbr.exe)
press Ok.
At the command prompt type: mbr.exe -f
press Enter.
A "DOS" box will open and quickly disappear. That is normal.
Post #11
My root directory is c:\ The f:\ directory is an external drive on which I keep files with no software at all on it Does this change anything in our approach to this ? Should I run the scan on c:\ or f:\
Post #12
the rootkit is showing in the F: drive, so I would download it and run it on F…see if that takes care of it. Run rooter on the F drive afterwards and post the new log
Post #13
1- I downloaded mbr.exe first to the f:\ I tried running the command from f:\ but the browse button only opens the drive and will not let me run the commande from there 2- I then downloaded mbr.exe to c:\ when I try to run the command, I received the message: mbr.exe is not recognized as an internal o r external command Any suggestions ?
Post #14
Hi,

not sure why that's not working for you, but we can use Rootrepeal to delete it:


Open RootRepeal,

click the hidden file tab, click Scan.
Right click and select Force Delete on this:

Path: Volume F:\
Status: MBR Rootkit Detected!

Then run rootrepeal again and post the fresh log
Post #15
After running Rootrepeal, I get this message 18:05:10: Could not enumerate files in dir '\\?\F:\¼@d\*' with the Windows API! Error code - 0x00000003 18:05:10: Could not enumerate files in dir '\\?\F:\¼@d\<°ËóbVÜI.àç\*' with the Windows API! Error code - 0x00000003 18:05:10: Could not enumerate files in dir '\\?\F:\¼@d\ÿ\*' with the Windows API! Error code - 0x00000003 18:05:10: Could not enumerate files in dir '\\?\F:\¼@d\?©Ofl®±s.?îD\*' with the Windows API! Error code - 0x00000003 18:05:10: Could not enumerate files in dir '\\?\F:\¼@d\}§¡~qÇsP.è\*' with the Windows API! Error code - 0x00000003 18:05:10: Could not enumerate files in dir '\\?\F:\¼@d\?????????????\*' with the Windows API! Error code - 0x00000003 18:05:10: Could not enumerate files in dir '\\?\F:\¼@d\????????????'\*' with the Windows API! Error code - 0x00000003 18:05:10: Could not enumerate files in dir '\\?\F:\¼@d\VÝòï.>`p\*' with the Windows API! Error code - 0x00000003 18:05:10: Could not enumerate files in dir '\\?\F:\¼@d\g?|=à{øô.{Ä×\*' with the Windows API! Error code - 0x00000003 18:05:10: Could not enumerate files in dir '\\?\F:\¼@d\?????????????\*' with the Windows API! Error code - 0x00000003 18:05:10: Could not enumerate files in dir '\\?\F:\¼@d\??ïõ¡©.+ã\*' with the Windows API! Error code - 0x00000003 18:05:10: Could not enumerate files in dir '\\?\F:\¼@d\=Ü?Iàø9.­¬\*' with the Windows API! Error code - 0x00000003 18:05:10: Could not enumerate files in dir '\\?\F:\¼@d\ôúÔ*?#%?.$Ô»\*' with the Windows API! Error code - 0x00000003 18:05:10: Could not enumerate files in dir '\\?\F:\¼@d\ØñMÀ|Ö.?R{\*' with the Windows API! Error code - 0x00000003 18:05:10: Could not enumerate files in dir '\\?\F:\¼@d\Mfè)0z ?.pyà\*' with the Windows API! Error code - 0x00000003 18:05:10: Could not enumerate files in dir '\\?\F:\¼@d\â?.?­[.?I¤\*' with the Windows API! Error code - 0x00000003 18:05:10: Could not enumerate files in dir '\\?\F:\¼@d\ï}?_H?.`ðj\*' with the Windows API! Error code - 0x00000003 18:05:10: Could not enumerate files in dir '\\?\F:\¼@d\?????????????\*' with the Windows API! Error code - 0x00000003 18:05:10: Could not enumerate files in dir '\\?\F:\¼@d\R8uÉèú.ÕgN\*' with the Windows API! Error code - 0x00000003 18:05:10: Could not enumerate files in dir '\\?\F:\¼@d\|}åͧ+­.[Oj\*' with the Windows API! Error code - 0x00000003 18:05:10: Could not enumerate files in dir '\\?\F:\¼@d\FRå .á5º\*' with the Windows API! Error code - 0x00000003 18:05:10: Could not enumerate files in dir '\\?\F:\¼@d\Z¿¤¬s.ÚÜ\*' with the Windows API! Error code - 0x00000003 There is a line that says Vlume f:\ MBR rootkit detected If I right click on it, I get the choice between 1- restore and reboot immediately 2- restore 3- dump What do you suggest ? This is the rootrepeal log ROOTREPEAL © AD, 2007-2008 ================================================== Scan Time: 2009/04/22 18:20 Program Version: Version 1.2.3.0 Windows Version: Windows XP SP2 ================================================== Hidden/Locked Files ——————- Path: C:\hiberfil.sys Status: Locked to the Windows API! Path: Volume F:\ Status: MBR Rootkit Detected! Path: F:\¼@d Status: Invisible to the Windows API! Path: F:\autorun Status: Visible to the Windows API, but not on disk. Path: F:\WD_Windows_tools Status: Visible to the Windows API, but not on disk. Path: F:\System Volume Information Status: Visible to the Windows API, but not on disk. Path: F:\Recycled Status: Visible to the Windows API, but not on disk. Path: F:\photo Status: Visible to the Windows API, but not on disk. Path: F:\download Status: Visible to the Windows API, but not on disk. Path: F:\Jack Status: Visible to the Windows API, but not on disk. Path: F:\tornade Status: Visible to the Windows API, but not on disk. Path: F:\Palm.aba Status: Visible to the Windows API, but not on disk. Path: F:\$AVG8.VAULT$ Status: Visible to the Windows API, but not on disk. Path: F:\Nat-Geo-The-Living-Edens-Costa.Rica.mkv Status: Visible to the Windows API, but not on disk. Path: F:\Nat-Geo-The-Living-Edens-Manu-Peru.mkv Status: Visible to the Windows API, but not on disk. Path: F:\Nat-Geo-Worlds-Deadliest-Animals-Costa-Rica.avi Status: Visible to the Windows API, but not on disk. Path: F:\Slumdog-Millionaire.avi Status: Visible to the Windows API, but not on disk. Path: F:\Twilight[2008]DvDrip-aXXo.avi Status: Visible to the Windows API, but not on disk. Path: F:\Bear Grylls Born Survivor-Costa Rica.avi Status: Visible to the Windows API, but not on disk. Path: F:\Nat-Geo-Gabon-The-Last-Eden.avi Status: Visible to the Windows API, but not on disk. Path: F:\Man.vs.Wild.02.Costa.Rican.Rain.Forest.WS[goat].avi Status: Visible to the Windows API, but not on disk. Path: F:\Nat-Geo-Colombia-Hostage-Rescue.avi Status: Visible to the Windows API, but not on disk. Path: F:\Hearts.and.Minds.(1974).Won.Oscar.for.Best.Documentary.avi Status: Visible to the Windows API, but not on disk. Path: F:\National.Geographic.The.Living.Edens.05of24.Etosha.Africa.DVB.x264.AAC.www. mvgroup.org.mkv Status: Visible to the Windows API, but not on disk. Path: F:\National.Geographic.The.Living.Edens.24of24.The.Lost.World.DVB.x264.AAC.www .mvgroup.org.mkv Status: Visible to the Windows API, but not on disk. Path: F:\Milk[2008]DvDrip[Eng]-FXG.avi Status: Visible to the Windows API, but not on disk. Path: F:\Quantum.Of.Solace[2008]DvDrip-aXXo.avi Status: Visible to the Windows API, but not on disk. Path: F:\Yes.Man.2008.DvDRip-FxM.avi Status: Visible to the Windows API, but not on disk. Path: F:\No.Country.For.Old.Men[2007]DvDrip-aXXo.avi Status: Visible to the Windows API, but not on disk. Path: F:\dich-national.geographic.worlds.most.dangerous.roads.hh.720p.hdtv.x264.mkv Status: Visible to the Windows API, but not on disk. Path: F:\mbr.exe Status: Visible to the Windows API, but not on disk. Path: F:\mbr.log Status: Visible to the Windows API, but not on disk. Path: F:\¼@d\<°ËóbVÜI.àç Status: Invisible to the Windows API! Path: F:\¼@d\ÿ Status: Invisible to the Windows API! Path: F:\¼@d\Š©Ofl®±s.‰îD Status: Invisible to the Windows API! Path: F:\¼@d\}§¡~qÇsP.è Status: Invisible to the Windows API! Path: F:\¼@d\逢驑∠Ḥ➸릮呫䮧慶᱙ Status: Invisible to the Windows API! Path: F:\¼@d\x7GKakqu.öû9 Status: Invisible to the Windows API! Path: F:\¼@d\齎턲䎞殧毩罸鹔嵷拞첬༤ࡲ' Status: Invisible to the Windows API! Path: F:\¼@d\VÝòï.>`p Status: Invisible to the Windows API! Path: F:\¼@d\hØ5».@Ü Status: Invisible to the Windows API! Path: F:\¼@d\gˆ|=à{øô.{Ä× Status: Invisible to the Windows API! Path: F:\¼@d\菺士๞緱쏏ṷ锝獖帪쟘鐪澓檛 Status: Invisible to the Windows API! Path: F:\¼@d\ƒ‘ïõ¡©.+ã Status: Invisible to the Windows API! Path: F:\¼@d\=ÜžIàø9.­¬ Status: Invisible to the Windows API! Path: F:\¼@d\ôúÔ*›#%‰.$Ô» Status: Invisible to the Windows API! Path: F:\¼@d\Òûö¤òÛ.Óô Status: Invisible to the Windows API! Path: F:\¼@d\þE9r?1E.†7Œ Status: Invisible to the Windows API! Path: F:\¼@d\ØñMÀ|Ö.†R{ Status: Invisible to the Windows API! Path: F:\¼@d\Mfè)0z Œ.pyà Status: Invisible to the Windows API! Path: F:\¼@d\â….‡­[.›I¤ Status: Invisible to the Windows API! Path: F:\¼@d\ï}Ž_H†.`ðj Status: Invisible to the Windows API! Path: F:\¼@d\粗뉔ㆫ궙烘躌ᦇꟜ㎮췉⵽㝫绺 Status: Invisible to the Windows API! Path: F:\¼@d\R8uÉèú.ÕgN Status: Invisible to the Windows API! Path: F:\¼@d\|}åͧ+­.[Oj Status: Invisible to the Windows API! Path: F:\¼@d\FRå .á5º Status: Invisible to the Windows API! Path: F:\¼@d\žœ×¡èß î.¯5ý Status: Invisible to the Windows API! Path: F:\¼@d\Z¿¤¬s.ÚÜ Status: Invisible to the Windows API!

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI