Spyware / Malware / Virus Removal

[Resolved] Work computer troubles

22 min read

Looking for the outcome? Ask AI

okieherper Topic Starter

Post #1April 22, 2009, 2:02 PM UTC last edited April 27, 2009, 9:51 PM UTC

I recently started a new job and "inherited" a computer from the guy I replaced. Well I think it has some issues. It has given me an error about "c:\windows\system32\scan.exe". It also has Comodo firewall. Lately it has popped up with stuff like 3832.exe trying to access stuff. There have been several other #.exe files do the same. It has popped up with stuff about programs trying to access the screen directly for screenshots and such. I'm not sure if someone is trying to hijack this PC or what. My HJT log is below. Thank you for your help.

Josh

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:50:02 AM, on 4/22/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\COMODO\Firewall\cmdagent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\cisvc.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\userinit.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\MultiMedia Keyboard\MultiMedia Keyboard\1.1\KbdAp32A.exe
C:\Program Files\Browser MOUSE\mouse32a.exe
C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe
C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe
C:\Program Files\COMODO\Firewall\cfp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe
C:\WINDOWS\system32\mstsc.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\calc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://education.dellnet.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sirius.com/siriusinternetradio
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [diagent] "C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" startup
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [LWBKEYBOARD] C:\Program Files\MultiMedia Keyboard\MultiMedia Keyboard\1.1\KbdAp32A.exe
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Browser MOUSE\mouse32a.exe
O4 - HKLM\..\Run: [StatusClient 2.6] C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe /auto
O4 - HKLM\..\Run: [TomcatStartup 2.5] C:\Program Files\Hewlett-Packard\Toolbox\hpbpsttp.exe
O4 - HKLM\..\Run: [FinishOptions] C:\DOCUME~1\Karen\LOCALS~1\Temp\hpbinxst.exe
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\Scansoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Mozilla Firefox.lnk = C:\Program Files\Mozilla Firefox\firefox.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1126109366984
O17 - HKLM\System\CCS\Services\Tcpip\..\{8269D2D1-06DF-4530-A7A8-FED624009ACE}: NameServer = 129.15.1.120,129.15.1.121
O20 - AppInit_DLLs:
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Domain Name Service (Domain) - Unknown owner - C:\Program Files\Domain.exe
O23 - Service: ComServer2009 (EntServer2009) - Unknown owner - C:\WINDOWS\EntSver.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: plication crashes to Microsof (reports service) - Unknown owner - C:\WINDOWS\system32\ctvhcst.exe (file missing)
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

–
End of file - 12373 bytes

Still need help.

Tomk

Post #2April 28, 2009, 4:39 AM UTC

Hi okieherper,

My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for the issues on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.

Then

Please download Malwarebytes' Anti-Malware to your desktop.

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot (shut down your computer then restart it).

Also "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.

okieherper

Post #3April 28, 2009, 2:27 PM UTC

The boot time was much quicker than usual. I think ATF cleaner helped a lot. I've always used CCleaner, but it seems that ATF cleared more. One strange thing that has started is that Firefox opens on boot. It didn't do that when I first started here. Also, when I boot, I have to choose between the users Conylee$, Quail(which is me, I raise quail at work), and Guest. I need to ask someone about the Conylee$. The strange thing is that I've only had to choose which user lately. It never prompted me to do that before unless I logged in with safe mode. When I did log in with safe mode, the only users was Admin. and Quail. Either way, thank you for helping me and here are my 2 logs:

Malwarebytes' Anti-Malware 1.36
Database version: 2053
Windows 5.1.2600 Service Pack 3

4/28/2009 9:09:29 AM
mbam-log-2009-04-28 (09-09-29).txt

Scan type: Quick Scan
Objects scanned: 90167
Time elapsed: 8 minute(s), 10 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 3
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EntServer2009 (Spyware.OnlineGames) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\entserver2009 (Spyware.OnlineGames) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\entserver2009 (Spyware.OnlineGames) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\EntSver.exe (Spyware.OnlineGames) -> Delete on reboot.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:21:08 AM, on 4/28/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\COMODO\Firewall\cmdagent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\cisvc.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\WINDOWS\system32\mstsc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\calc.exe
C:\WINDOWS\system32\userinit.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\MultiMedia Keyboard\MultiMedia Keyboard\1.1\KbdAp32A.exe
C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe
C:\Program Files\Browser MOUSE\mouse32a.exe
C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe
C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\COMODO\Firewall\cfp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://education.dellnet.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sirius.com/siriusinternetradio
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [diagent] "C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" startup
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [LWBKEYBOARD] C:\Program Files\MultiMedia Keyboard\MultiMedia Keyboard\1.1\KbdAp32A.exe
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Browser MOUSE\mouse32a.exe
O4 - HKLM\..\Run: [StatusClient 2.6] C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe /auto
O4 - HKLM\..\Run: [TomcatStartup 2.5] C:\Program Files\Hewlett-Packard\Toolbox\hpbpsttp.exe
O4 - HKLM\..\Run: [FinishOptions] C:\DOCUME~1\Karen\LOCALS~1\Temp\hpbinxst.exe
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\Scansoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Mozilla Firefox.lnk = C:\Program Files\Mozilla Firefox\firefox.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1126109366984
O17 - HKLM\System\CCS\Services\Tcpip\..\{8269D2D1-06DF-4530-A7A8-FED624009ACE}: NameServer = 129.15.1.120,129.15.1.121
O20 - AppInit_DLLs:
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Domain Name Service (Domain) - Unknown owner - C:\Program Files\Domain.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: plication crashes to Microsof (reports service) - Unknown owner - C:\WINDOWS\system32\ctvhcst.exe (file missing)
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

–
End of file - 11899 bytes

Tomk

Post #4April 28, 2009, 8:09 PM UTC

okieherper,

Please open HijackThis and run Do a system scan only
Check the boxes next to ONLY the entries listed below(if present):
- O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
  O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
  O20 - AppInit_DLLs:
  O23 - Service: plication crashes to Microsof (reports service) - Unknown owner - C:\WINDOWS\system32\ctvhcst.exe (file missing)
Close all programs except for HijackThis.
Click on Fix checked
A box will pop up asking you if you wish to fix the selected items. Please choose YES.
Once it has fixed them, please exit/close HijackThis.

Please go to Kaspersky website and perform an online antivirus scan.

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
- Spyware, Adware, Dialers, and other potentially dangerous programs
  Archives
  Mail databases
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As….
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
Please post this log in your next reply.

okieherper

Post #5April 29, 2009, 9:02 PM UTC

Below is my Kaspersky report. I want to add that as I type this, I have a process called 3632.exe running. Once in a while I get pop-ups saying that there is an error with scan.exe. All I can do is click "ok" and the error goes away for about 10-15 seconds. The only way I've been able to fix this is by rebooting. It's only done this 2 or 3 times, but all have been this week. As for the #.exe files. My firewall will pop-up saying "#.exe is attempting to access _____." The blank has included scan.exe, "the internet", etc. I saw that Kaspersky found several threats. Hopefully one of those is causing the issues and we can get this running somewhat smooth again. ——————————————————————————– KASPERSKY ONLINE SCANNER 7.0 REPORT Wednesday, April 29, 2009 Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Program database last update: Wednesday, April 29, 2009 18:54:17 Records in database: 2097149 ——————————————————————————– Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: A:\ C:\ D:\ E:\ Scan statistics: Files scanned: 89683 Threat name: 10 Infected objects: 32 Suspicious objects: 44 Duration of the scan: 02:49:47 File name / Threat name / Threats count c:\windows\system32\remxtqc.dll/c:\windows\system32\remxtqc.dll Infected: Backdoor.Win32.Agent.afxc 1 C:\Documents and Settings\Karen\Application Data\Mozilla\Profiles\default\exxk4or2.slt\Mail\pop.ou-1.edu\Junk Suspicious: Trojan-Spy.HTML.Fraud.gen 8 C:\Documents and Settings\Karen\Application Data\Mozilla\Profiles\default\exxk4or2.slt\Mail\pop.ou-1.edu\Junk Infected: Trojan-Spy.HTML.Paylap.dl 1 C:\Documents and Settings\Karen\Application Data\Mozilla\Profiles\default\exxk4or2.slt\Mail\pop.ou-1.edu\Junk Infected: Trojan-Spy.HTML.Paylap.m 1 C:\Documents and Settings\Karen\Application Data\Mozilla\Profiles\default\exxk4or2.slt\Mail\pop.ou-1.edu\Trash Suspicious: Trojan-Spy.HTML.Fraud.gen 5 C:\Documents and Settings\Karen\Application Data\Mozilla\Profiles\Default User\i5062m12.slt\Mail\pop.ou-1.edu\Junk Suspicious: Trojan-Spy.HTML.Fraud.gen 8 C:\Documents and Settings\Karen\Application Data\Mozilla\Profiles\Default User\i5062m12.slt\Mail\pop.ou-1.edu\Junk Infected: Trojan-Spy.HTML.Paylap.dl 1 C:\Documents and Settings\Karen\Application Data\Mozilla\Profiles\Default User\i5062m12.slt\Mail\pop.ou-1.edu\Junk Infected: Trojan-Spy.HTML.Paylap.m 1 C:\Documents and Settings\Karen\Application Data\Mozilla\Profiles\Default User\i5062m12.slt\Mail\pop.ou-1.edu\Trash Suspicious: Trojan-Spy.HTML.Fraud.gen 5 C:\Documents and Settings\Karen\Application Data\Mozilla\Profiles\Default User\i5062m12.slt\Mail\pop.ou.edu\Junk Suspicious: Trojan-Spy.HTML.Fraud.gen 8 C:\Documents and Settings\Karen\Application Data\Mozilla\Profiles\Default User\i5062m12.slt\Mail\pop.ou.edu\Junk Infected: Trojan-Spy.HTML.Paylap.dl 1 C:\Documents and Settings\Karen\Application Data\Mozilla\Profiles\Default User\i5062m12.slt\Mail\pop.ou.edu\Junk Infected: Trojan-Spy.HTML.Paylap.m 1 C:\Documents and Settings\Karen\Application Data\Mozilla\Profiles\Default User\i5062m12.slt\Mail\pop.ou.edu\Trash Suspicious: Trojan-Spy.HTML.Fraud.gen 10 C:\Documents and Settings\Karen\Application Data\Mozilla\Profiles\Default User\i5062m12.slt\Mail\pop.ou.edu\Trash Infected: Trojan-Spy.HTML.Paylap.m 1 C:\Program Files\Common Files\wen3.exe Infected: Trojan.Win32.AntiAV.bbp 1 C:\Program Files\Symantec AntiVirus\cte.exe Infected: Backdoor.Win32.Hupigon.gqbd 1 C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1364\A0282081.exe Infected: Backdoor.Win32.Hupigon.bmfk 1 C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1365\A0282183.exe Infected: Backdoor.Win32.PcClient.ajcc 1 C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1367\A0282318.exe Infected: not-a-virus:NetTool.Win32.TCPScan.a 1 C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1368\A0282349.exe Infected: not-a-virus:NetTool.Win32.TCPScan.a 1 C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1371\A0282580.exe Infected: not-a-virus:NetTool.Win32.TCPScan.a 1 C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1371\A0282581.exe Infected: HackTool.Win32.Agent.nd 1 C:\WINDOWS\SYSTEM32\ctvhcst.exe _k vetvcs Infected: Backdoor.Win32.Hupigon.gqbd 1 C:\WINDOWS\SYSTEM32\RcmxtoC.dll Infected: Backdoor.Win32.Agent.afxc 1 C:\WINDOWS\SYSTEM32\RemxtqC.dll Infected: Backdoor.Win32.Agent.afxc 1 C:\WINDOWS\SYSTEM32\RfmitpC.dll Infected: Backdoor.Win32.Agent.afxc 1 C:\WINDOWS\SYSTEM32\RgmjtsC.dll Infected: Backdoor.Win32.Agent.afxc 1 C:\WINDOWS\SYSTEM32\RgmvtwC.dll Infected: Backdoor.Win32.Agent.afxc 1 C:\WINDOWS\SYSTEM32\RimttcC.dll Infected: Backdoor.Win32.Agent.afxc 1 C:\WINDOWS\SYSTEM32\RjmothC.dll Infected: Backdoor.Win32.Agent.afxc 1 C:\WINDOWS\SYSTEM32\RnmctjC.dll Infected: Backdoor.Win32.Agent.afxc 1 C:\WINDOWS\SYSTEM32\RnmktpC.dll Infected: Backdoor.Win32.Agent.afxc 1 C:\WINDOWS\SYSTEM32\RombtwC.dll Infected: Backdoor.Win32.Agent.afxc 1 C:\WINDOWS\SYSTEM32\RpmqttC.dll Infected: Backdoor.Win32.Agent.afxc 1 C:\WINDOWS\SYSTEM32\RsmrtwC.dll Infected: Backdoor.Win32.Agent.afxc 1 C:\WINDOWS\SYSTEM32\RwmntgC.dll Infected: Backdoor.Win32.Agent.afxc 1 C:\WINDOWS\SYSTEM32\RwmvtoC.dll Infected: Backdoor.Win32.Agent.afxc 1 C:\WINDOWS\SYSTEM32\RymntkC.dll Infected: Backdoor.Win32.Agent.afxc 1 The selected area was scanned.

Tomk

Post #6April 29, 2009, 10:07 PM UTC

okieherper,

Your computer appears to have been infected by a backdoor trojan. These programs have the ability to steal passwords and other information from your system. If you use your computer for sensitive purposes such as internet banking then I recommend you take the following steps immediately:

Use another, uninfected computer to change all your internet passwords, especially ones with financial implications such as banks, paypal, ebay, etc. You should also change the passwords for any other site you use.
Call your bank(s), credit card company or any other institution which may be affected and advise them that your login/password or credit card information may have been stolen and ask what steps to take with regard to your account.
Consider what other private information could possibly have been taken from your computer and take appropriate steps

This infection can almost certainly be cleaned, but as the malware could be configured to run any program a remote attacker requires, it will be impossible to be 100% sure that the machine is clean, if this is unacceptable to you then you should consider reformatting the system partition and reinstalling Windows as this is the only 100% sure answer.

If you wish to reformat then please let me know in your next response, I'll now continue with instructions for cleaning.

Download ComboFix from one of these locations:

Link 1
Link 2
Link 3

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link –> http://forums.whatthetech.com/How_Disable_…ams_t96260.html
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
5. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

okieherper

Post #7April 30, 2009, 2:10 PM UTC

I started ComboFix and left for a while. When I got back, Firefox was opened and my firewall was back and stopping stuff. So I promptly closed both and CF appeared to complete fine. Here is the log.

ComboFix 09-04-29.07 - Karen 04/30/2009 8:10.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.564 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Outdated)
FW: COMODO Firewall *enabled*
FW: ZoneAlarm Firewall *disabled*
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\regedit32.exe
c:\windows\Temp\2948.exe
c:\windows\Temp\3388.exe
c:\windows\Temp\3420.exe
c:\windows\Temp\3632.exe
c:\windows\Temp\3960.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_BACKGROUND_SWITCH
——-\Legacy_ENTSERVER2009
——-\Service_BackGround switch

((((((((((((((((((((((((( Files Created from 2009-05-28 to 2009-4-30 )))))))))))))))))))))))))))))))
.

2009-04-29 17:06 . 2009-04-29 17:06 ——– d—–w c:\windows\Sun
2009-04-29 17:04 . 2009-04-29 17:04 410984 —-a-w c:\windows\system32\deploytk.dll
2009-04-28 14:10 . 2009-04-28 14:10 0 —-a-w c:\windows\system32\drivers\hihmt.sys
2009-04-28 13:59 . 2009-04-28 13:59 ——– d—–w c:\documents and settings\Karen\Application Data\Malwarebytes
2009-04-28 13:59 . 2009-04-06 20:32 15504 —-a-w c:\windows\system32\drivers\mbam.sys
2009-04-28 13:59 . 2009-04-06 20:32 38496 —-a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-28 13:59 . 2009-04-28 13:59 ——– d—–w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-04-28 13:59 . 2009-04-28 13:59 ——– d—–w c:\program files\Malwarebytes' Anti-Malware
2009-04-24 15:52 . 2009-04-24 15:52 33061 —-a-w c:\windows\king-uninstall.exe
2009-04-24 15:50 . 2009-04-24 15:53 ——– d—–w c:\documents and settings\Karen\Local Settings\Application Data\king.com
2009-04-22 13:45 . 2009-04-22 13:45 ——– d—–w c:\program files\Trend Micro
2009-04-22 13:39 . 2009-04-22 13:39 ——– d—–w c:\documents and settings\Guest\Local Settings\Application Data\Apple Computer
2009-04-21 02:53 . 2009-04-19 18:42 12288 —-a-w c:\windows\system32\Hide.exe
2009-04-21 02:53 . 2009-04-19 07:37 16384 –sha-w c:\windows\system32\userinet.exe
2009-04-20 14:36 . 2009-04-20 14:36 1 —-a-w c:\windows\system32\0005ca37.sys
2009-04-17 14:25 . 2009-04-17 20:15 127512 —-a-w c:\program files\Common Files\wenb.exe
2009-04-17 02:45 . 2009-04-17 14:00 833024 —-a-w c:\program files\Common Files\wend.exe
2009-04-17 02:20 . 2009-04-17 02:20 833024 –sh–w c:\program files\_Domain.exe
2009-04-17 02:20 . 2009-04-17 02:20 833024 –sh–w c:\program files\Domain.exe
2009-04-17 01:54 . 2009-04-17 01:54 38 —-a-w c:\windows\system32\install.dat
2009-04-17 01:54 . 2009-04-17 01:54 127512 —-a-w c:\program files\Common Files\wen3.exe
2009-04-17 01:54 . 2009-04-17 20:15 59904 —-a-w c:\windows\system32\Windows7.exe
2009-04-16 13:39 . 2009-04-16 13:39 ——– d—–w c:\documents and settings\Administrator\Application Data\PC Tools
2009-04-16 13:32 . 2009-04-16 13:32 ——– d—–w c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2009-04-15 16:46 . 2008-12-16 12:30 354304 ——w c:\windows\system32\dllcache\winhttp.dll
2009-04-15 03:28 . 2009-03-06 14:22 284160 ——w c:\windows\system32\dllcache\pdh.dll
2009-04-15 03:28 . 2009-02-06 10:39 35328 ——w c:\windows\system32\dllcache\sc.exe
2009-04-15 03:28 . 2009-02-09 12:10 401408 ——w c:\windows\system32\dllcache\rpcss.dll
2009-04-15 03:28 . 2009-02-06 11:11 110592 ——w c:\windows\system32\dllcache\services.exe
2009-04-15 03:28 . 2009-02-09 12:10 473600 ——w c:\windows\system32\dllcache\fastprox.dll
2009-04-15 03:28 . 2009-02-06 10:10 227840 ——w c:\windows\system32\dllcache\wmiprvse.exe
2009-04-15 03:28 . 2009-02-09 12:10 453120 ——w c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-15 03:28 . 2009-02-09 12:10 729088 ——w c:\windows\system32\dllcache\lsasrv.dll
2009-04-15 03:28 . 2009-02-09 12:10 617472 ——w c:\windows\system32\dllcache\advapi32.dll
2009-04-15 03:28 . 2009-02-09 12:10 714752 ——w c:\windows\system32\dllcache\ntdll.dll
2009-04-15 03:23 . 2008-05-03 11:55 2560 ——w c:\windows\system32\xpsp4res.dll
2009-04-15 03:23 . 2008-04-21 12:08 215552 ——w c:\windows\system32\dllcache\wordpad.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-30 13:21 . 2006-04-25 20:38 ——– d—–w c:\program files\Symantec AntiVirus
2009-04-30 13:15 . 2008-06-19 18:42 254204 –sha-w c:\windows\system32\drivers\fidbox.idx
2009-04-30 13:15 . 2008-06-19 18:42 21622816 –sha-w c:\windows\system32\drivers\fidbox.dat
2009-04-09 16:48 . 2003-01-14 16:55 ——– d—–w c:\program files\Java
2009-04-09 16:41 . 2002-11-10 14:25 ——– d–h–w c:\program files\InstallShield Installation Information
2009-03-18 13:10 . 2009-03-18 13:10 316672 —-a-w c:\windows\KingComIE.dll
2009-03-17 16:47 . 2009-03-17 16:45 ——– d—–w c:\program files\Yahoo!
2009-03-17 16:08 . 2008-07-14 17:06 24336 —-a-w c:\windows\system32\drivers\cmdhlp.sys
2009-03-17 16:08 . 2008-07-14 17:06 110992 —-a-w c:\windows\system32\drivers\cmdguard.sys
2009-03-17 16:08 . 2008-07-14 17:06 155384 —-a-w c:\windows\system32\guard32.dll
2009-03-12 19:37 . 2009-03-12 21:08 15688 —-a-w c:\windows\system32\lsdelete.exe
2009-03-12 19:36 . 2009-03-12 19:45 64160 —-a-w c:\windows\system32\drivers\Lbd.sys
2009-03-12 19:28 . 2006-02-07 16:19 ——– d—–w c:\program files\Lavasoft
2009-03-12 18:18 . 2009-03-12 18:18 ——– d—–w c:\program files\CCleaner
2009-03-06 14:22 . 2003-01-14 17:54 284160 —-a-w c:\windows\system32\pdh.dll
2009-03-03 00:18 . 2004-12-07 22:37 826368 —-a-w c:\windows\system32\wininet.dll
2009-02-20 18:09 . 2005-04-08 21:35 78336 ——w c:\windows\system32\ieencode.dll
2009-02-09 12:10 . 2001-08-18 13:00 729088 —-a-w c:\windows\system32\lsasrv.dll
2009-02-09 12:10 . 2005-01-14 05:33 401408 —-a-w c:\windows\system32\rpcss.dll
2009-02-09 12:10 . 2001-08-18 13:00 714752 —-a-w c:\windows\system32\ntdll.dll
2009-02-09 12:10 . 2001-08-18 13:00 617472 —-a-w c:\windows\system32\advapi32.dll
2009-02-09 11:13 . 2002-02-21 00:46 1846784 —-a-w c:\windows\system32\win32k.sys
2009-02-08 00:02 . 1980-01-01 06:00 2066048 —-a-w c:\windows\system32\ntkrnlpa.exe
2009-02-06 11:11 . 2001-08-18 13:00 110592 —-a-w c:\windows\system32\services.exe
2009-02-06 11:08 . 1980-01-01 06:00 2189056 —-a-w c:\windows\system32\ntoskrnl.exe
2009-02-06 10:39 . 2001-08-18 13:00 35328 —-a-w c:\windows\system32\sc.exe
2009-02-03 19:59 . 2003-01-14 17:54 56832 —-a-w c:\windows\system32\secur32.dll
2006-02-02 20:29 . 2006-02-02 20:28 32803463 —-a-w c:\program files\Symantec_av_full_version_win.exe
2006-01-16 01:55 . 2006-01-16 01:55 5225384 —-a-w c:\program files\Firefox Setup 1.5.exe
2005-10-18 20:46 . 2005-10-18 20:46 4839222 —-a-w c:\program files\syncbackse_setup.exe
2005-09-09 14:44 . 2005-09-09 14:44 49634 —-a-w c:\program files\POBS Kelly grass.jpg
2005-09-09 14:43 . 2005-09-09 14:43 29226 —-a-w c:\program files\POBS Kelly rodent.jpg
2005-08-13 00:14 . 2005-08-13 00:13 9308264 —-a-w c:\program files\zlsSetup_60_631_003.exe
2005-06-28 15:37 . 2005-06-28 15:37 10808151 —-a-w c:\program files\Inkscape-0.41-1.win32.exe
2005-05-22 01:22 . 2005-05-22 01:22 32803463 —-a-w c:\program files\Symantec_av_full_version.exe
2005-05-21 18:49 . 2005-05-21 18:48 493270 —-a-w c:\program files\FastDefrag2.exe
2005-05-21 18:41 . 2005-05-21 18:41 2020143 —-a-w c:\program files\iaa23_enu.exe
2005-05-21 18:40 . 2005-05-21 18:40 122880 —-a-w c:\program files\ChipUtil.exe
2005-05-21 18:38 . 2005-05-21 18:37 861059 —-a-w c:\program files\infinst_autol.exe
2004-12-10 19:51 . 2004-12-10 19:51 6655600 —-a-w c:\program files\zlsSetup_55_062_004.exe
2004-10-10 17:27 . 2004-10-10 17:27 5827728 —-a-w c:\program files\zlsSetup_51_033_000.exe
2004-04-20 18:09 . 2004-04-20 18:09 91628 —-a-w c:\program files\r040115e.pdf
2004-04-13 17:36 . 2004-04-13 17:30 63880198 —-a-w c:\program files\qxpress61updater.zip
2003-05-21 13:13 . 2003-05-21 13:12 10364928 —-a-w c:\program files\McAfee7.0.exe
2003-05-08 13:38 . 2003-05-08 13:37 3750576 —-a-w c:\program files\zaSetup_37_143.exe
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RambtsC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RbmytjC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RcmltgC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RcmntqC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RcmttmC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RcmxtoC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RdmgtlC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RemftiC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RemntiC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RemxtqC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RfmitpC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RfmutrC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RgmjtsC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RgmvtwC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RhmcttC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RimdtiC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RimftsC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RimttcC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RjmgtpC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RjmothC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RkmhtkC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RlmqtvC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RmmhtcC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RnmctjC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RnmktpC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RnmmtdC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RnmutjC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RnmwthC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RombtwC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RomttwC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RpmqttC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RpmwtxC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RrmitlC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RsmftoC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RsmhtcC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RsmrtwC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RsmvtoC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RtmyttC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RvmotdC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RwmntgC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RwmntqC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RwmtteC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RwmvtoC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RymntkC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RymxteC.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-10-06 5058560]
"diagent"="c:\program files\Creative\SBLive\Diagnostics\diagent.exe" [2002-04-03 135264]
"Microsoft Works Update Detection"="c:\program files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2001-08-17 28738]
"AdaptecDirectCD"="c:\program files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" [2002-04-10 679936]
"DwlClient"="c:\program files\Common Files\Dell\EUSW\Support.exe" [2003-05-15 245760]
"LWBKEYBOARD"="c:\program files\MultiMedia Keyboard\MultiMedia Keyboard\1.1\KbdAp32A.exe" [2002-04-02 371200]
"FLMOFFICE4DMOUSE"="c:\program files\Browser MOUSE\mouse32a.exe" [2004-04-26 360448]
"StatusClient 2.6"="c:\program files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe" [2004-02-27 61440]
"TomcatStartup 2.5"="c:\program files\Hewlett-Packard\Toolbox\hpbpsttp.exe" [2004-02-12 163840]
"PaperPort PTD"="c:\program files\Scansoft\PaperPort\pptd40nt.exe" [2002-12-17 45108]
"IndexSearch"="c:\program files\Scansoft\PaperPort\IndexSearch.exe" [2002-12-17 36864]
"McAfeeUpdaterUI"="c:\program files\Network Associates\Common Framework\UpdaterUI.exe" [2003-02-25 139347]
"Acrobat Assistant 7.0"="c:\program files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2008-04-23 483328]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2005-10-04 48752]
"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2005-11-15 85744]
"COMODO Firewall Pro"="c:\program files\COMODO\Firewall\cfp.exe" [2009-03-17 1851128]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-04-23 516440]
"COMODO Internet Security"="c:\program files\COMODO\Firewall\cfp.exe" [2009-03-17 1851128]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-29 148888]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - c:\windows\Installer\{AC76BA86-1033-0000-7760-100000000002}\SC_Acrobat.exe [2005-6-6 25214]
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-1-26 113664]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
Mozilla Firefox.lnk - c:\program files\Mozilla Firefox\firefox.exe [2006-1-15 307704]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"StartMenuLogOff"= 1 (0x1)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Hewlett-Packard\\Toolbox\\jre\\bin\\javaw.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=

2;2 WinErp; [x]
R2 DmPnSN;Portable Meda Number Service;c:\windows\system32\userinet.exe [2009-04-19 16384]
R2 Domain;Domain Name Service;c:\program files\Domain.exe [2009-04-17 833024]
R2 MediaSerial;Portable Media Number;c:\windows\System32\svchost.exe [2008-04-14 14336]
R2 MediaSoftware;MediaSoftware Control Center ;c:\windows\System32\svchost.exe [2008-04-14 14336]
R2 reports service;plication crashes to Microsof;c:\windows\system32\ctvhcst.exe _k vetvcs [2009-04-15 272384]
R3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-04-23 953168]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2009-03-12 64160]
S1 cmdGuard;COMODO Firewall Pro Sandbox Driver;c:\windows\system32\DRIVERS\cmdguard.sys [2009-03-17 110992]
S1 cmdHlp;COMODO Firewall Pro Helper Driver;c:\windows\system32\DRIVERS\cmdhlp.sys [2009-03-17 24336]
S2 PQfsmonNT ABE675CA-49DF-11d3-93F6-00104B64D07B;PowerQuest File System Monitor PQfsmonNT ABE675CA-49DF-11d3-93F6-00104B64D07B;c:\program files\PowerQuest\DataKeeper\pqfsmonnt.sys [2001-11-15 49096]
S2 SavRoam;SavRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [2005-11-15 169200]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2009-02-25 101936]

— Other Services/Drivers In Memory —

*Deregistered* - EraserUtilDrv10741

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WinErp REG_MULTI_SZ WinErp
winErs REG_MULTI_SZ winErs

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{09b9716a-3a0d-11dc-a7bc-00038a000015}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2bc9bc0f-36c2-11dc-a7b9-00038a000015}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2bc9bc13-36c2-11dc-a7b9-00038a000015}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{acac5a0d-e033-11da-a666-00038a000015}]
\Shell\AutoRun\command - setupSNK.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c91b0e26-67ba-11dc-a7e8-00038a000015}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7890g421-b1gf-14d0-89bb-0090ce808e85}]
c:\windows\system32\Windows7.exe
.
Contents of the 'Scheduled Tasks' folder

2009-04-27 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 19:46]

2009-04-22 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 22:57]
.
- - - - ORPHANS REMOVED - - - -

ShellExecuteHooks-{EDB0E980-90BD-11D4-8599-0008C7D3B6F8} - c:\program files\Qualcomm\Eudora\EuShlExt.dll

.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.sirius.com/siriusinternetradio
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = ;*.local
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000
TCP: {8269D2D1-06DF-4530-A7A8-FED624009ACE} = 129.15.1.120,129.15.1.121
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Karen\Application Data\Mozilla\Firefox\Profiles\q8zn4sem.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmidas.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-30 08:30
Windows 5.1.2600 Service Pack 3 NTFS

detected NTDLL code modification:
ZwClose, ZwOpenFile

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DwlClient = c:\program files\Common Files\Dell\EUSW\Support.exe?l?e?s?\?D?e?l?l?\?E?U?S?W?\?S?u?p?p?o?r?t?.?e?x?e???????X:??????x??? ???X??? ??????? ???P???? ?w? ?w)??p????????(???u????U?w????????????0??????w, ?w?M?wW??w???w)??p????????x'@?????????X????????"@?e?????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(788)
c:\windows\system32\guard32.dll

- - - - - - - > 'lsass.exe'(848)
c:\windows\system32\guard32.dll

- - - - - - - > 'explorer.exe'(2644)
c:\windows\system32\guard32.dll
c:\program files\Browser MOUSE\MOUDL32A.DLL
.
———————— Other Running Processes ————————
.
c:\program files\COMODO\Firewall\cmdagent.exe
c:\program files\Common Files\Symantec Shared\ccSetMgr.exe
c:\program files\Common Files\Symantec Shared\ccEvtMgr.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\SYSTEM32\CTsvcCDA.EXE
c:\program files\Symantec AntiVirus\DefWatch.exe
c:\windows\SYSTEM32\userinit.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Network Associates\Common Framework\FrameworkService.exe
c:\windows\SYSTEM32\mstsc.exe
c:\program files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe
c:\windows\SYSTEM32\nvsvc32.exe
c:\progra~1\NETWOR~1\COMMON~1\naPrdMgr.exe
c:\windows\SYSTEM32\CALC.EXE
c:\program files\Symantec AntiVirus\Rtvscan.exe
c:\windows\wanmpsvc.exe
c:\windows\SYSTEM32\MsPMSPSv.exe
c:\windows\SYSTEM32\wscntfy.exe
c:\windows\SYSTEM32\userinit.exe
c:\windows\SYSTEM32\HPBPRO.EXE
.
**************************************************************************
.
Completion time: 2009-04-30 8:35 - machine was rebooted
ComboFix-quarantined-files.txt 2009-04-30 13:35

Pre-Run: 34,884,067,328 bytes free
Post-Run: 34,911,981,568 bytes free

324 — E O F — 2009-04-29 17:01

Tomk

Post #8April 30, 2009, 3:41 PM UTC

okieherper,

FW: COMODO Firewall *enabled*
FW: ZoneAlarm Firewall *disabled*

You have two firewalls. I reccomend that you uninstall one of them.

Please go to http://virusscan.jotti.org , click on Browse, and upload the following file for analysis:

c:\windows\SYSTEM32\RambtsC.dll <===this file

Then click Submit. Allow the file to be scanned, and then please copy and paste the results here for me to see.

COMBOFIX-Script

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

File::

Folder::

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{09b9716a-3a0d-11dc-a7bc-00038a000015}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2bc9bc0f-36c2-11dc-a7b9-00038a000015}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2bc9bc13-36c2-11dc-a7b9-00038a000015}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{acac5a0d-e033-11da-a666-00038a000015}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c91b0e26-67ba-11dc-a7e8-00038a000015}]
[-HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7890g421-b1gf-14d0-89bb-0090ce808e85}]

Driver::
2 WinErp

Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

okieherper

Post #9April 30, 2009, 4:40 PM UTC

Here ya go.

ComboFix 09-04-29.07 - Karen 04/30/2009 11:20.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.556 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Karen\Desktop\CFScript.txt
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Outdated)
FW: COMODO Firewall *disabled*
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_6TO4
——-\Service_6to4

((((((((((((((((((((((((( Files Created from 2009-05-28 to 2009-4-30 )))))))))))))))))))))))))))))))
.

2009-04-30 13:38 . 2009-04-30 13:38 730624 —-a-w c:\program files\Common Files\wen4.exe
2009-04-30 13:38 . 2009-04-30 13:38 33480 –sh–w c:\program files\Common Files\Serial.exe
2009-04-30 13:38 . 2009-04-30 13:38 127512 —-a-w c:\program files\Common Files\wen1.exe
2009-04-29 17:06 . 2009-04-29 17:06 ——– d—–w c:\windows\Sun
2009-04-29 17:04 . 2009-04-29 17:04 410984 —-a-w c:\windows\system32\deploytk.dll
2009-04-28 14:10 . 2009-04-28 14:10 0 —-a-w c:\windows\system32\drivers\hihmt.sys
2009-04-28 13:59 . 2009-04-28 13:59 ——– d—–w c:\documents and settings\Karen\Application Data\Malwarebytes
2009-04-28 13:59 . 2009-04-06 20:32 15504 —-a-w c:\windows\system32\drivers\mbam.sys
2009-04-28 13:59 . 2009-04-06 20:32 38496 —-a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-28 13:59 . 2009-04-28 13:59 ——– d—–w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-04-28 13:59 . 2009-04-28 13:59 ——– d—–w c:\program files\Malwarebytes' Anti-Malware
2009-04-24 15:52 . 2009-04-24 15:52 33061 —-a-w c:\windows\king-uninstall.exe
2009-04-24 15:50 . 2009-04-24 15:53 ——– d—–w c:\documents and settings\Karen\Local Settings\Application Data\king.com
2009-04-22 13:45 . 2009-04-22 13:45 ——– d—–w c:\program files\Trend Micro
2009-04-22 13:39 . 2009-04-22 13:39 ——– d—–w c:\documents and settings\Guest\Local Settings\Application Data\Apple Computer
2009-04-21 02:53 . 2009-04-19 18:42 12288 —-a-w c:\windows\system32\Hide.exe
2009-04-21 02:53 . 2009-04-19 07:37 16384 –sha-w c:\windows\system32\userinet.exe
2009-04-20 14:36 . 2009-04-20 14:36 1 —-a-w c:\windows\system32\0005ca37.sys
2009-04-17 14:25 . 2009-04-17 20:15 127512 —-a-w c:\program files\Common Files\wenb.exe
2009-04-17 02:45 . 2009-04-17 14:00 833024 —-a-w c:\program files\Common Files\wend.exe
2009-04-17 02:20 . 2009-04-17 02:20 833024 –sh–w c:\program files\_Domain.exe
2009-04-17 02:20 . 2009-04-17 02:20 833024 –sh–w c:\program files\Domain.exe
2009-04-17 01:54 . 2009-04-17 01:54 38 —-a-w c:\windows\system32\install.dat
2009-04-17 01:54 . 2009-04-17 20:15 59904 —-a-w c:\windows\system32\Windows7.exe
2009-04-16 13:39 . 2009-04-16 13:39 ——– d—–w c:\documents and settings\Administrator\Application Data\PC Tools
2009-04-16 13:32 . 2009-04-16 13:32 ——– d—–w c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2009-04-15 16:46 . 2008-12-16 12:30 354304 ——w c:\windows\system32\dllcache\winhttp.dll
2009-04-15 03:28 . 2009-03-06 14:22 284160 ——w c:\windows\system32\dllcache\pdh.dll
2009-04-15 03:28 . 2009-02-06 10:39 35328 ——w c:\windows\system32\dllcache\sc.exe
2009-04-15 03:28 . 2009-02-09 12:10 401408 ——w c:\windows\system32\dllcache\rpcss.dll
2009-04-15 03:28 . 2009-02-06 11:11 110592 ——w c:\windows\system32\dllcache\services.exe
2009-04-15 03:28 . 2009-02-09 12:10 473600 ——w c:\windows\system32\dllcache\fastprox.dll
2009-04-15 03:28 . 2009-02-06 10:10 227840 ——w c:\windows\system32\dllcache\wmiprvse.exe
2009-04-15 03:28 . 2009-02-09 12:10 453120 ——w c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-15 03:28 . 2009-02-09 12:10 729088 ——w c:\windows\system32\dllcache\lsasrv.dll
2009-04-15 03:28 . 2009-02-09 12:10 617472 ——w c:\windows\system32\dllcache\advapi32.dll
2009-04-15 03:28 . 2009-02-09 12:10 714752 ——w c:\windows\system32\dllcache\ntdll.dll
2009-04-15 03:23 . 2008-05-03 11:55 2560 ——w c:\windows\system32\xpsp4res.dll
2009-04-15 03:23 . 2008-04-21 12:08 215552 ——w c:\windows\system32\dllcache\wordpad.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-30 16:27 . 2006-04-25 20:38 ——– d—–w c:\program files\Symantec AntiVirus
2009-04-09 16:48 . 2003-01-14 16:55 ——– d—–w c:\program files\Java
2009-04-09 16:41 . 2002-11-10 14:25 ——– d–h–w c:\program files\InstallShield Installation Information
2009-03-18 13:10 . 2009-03-18 13:10 316672 —-a-w c:\windows\KingComIE.dll
2009-03-17 16:47 . 2009-03-17 16:45 ——– d—–w c:\program files\Yahoo!
2009-03-17 16:08 . 2008-07-14 17:06 24336 —-a-w c:\windows\system32\drivers\cmdhlp.sys
2009-03-17 16:08 . 2008-07-14 17:06 110992 —-a-w c:\windows\system32\drivers\cmdguard.sys
2009-03-17 16:08 . 2008-07-14 17:06 155384 —-a-w c:\windows\system32\guard32.dll
2009-03-12 19:37 . 2009-03-12 21:08 15688 —-a-w c:\windows\system32\lsdelete.exe
2009-03-12 19:36 . 2009-03-12 19:45 64160 —-a-w c:\windows\system32\drivers\Lbd.sys
2009-03-12 19:28 . 2006-02-07 16:19 ——– d—–w c:\program files\Lavasoft
2009-03-12 18:18 . 2009-03-12 18:18 ——– d—–w c:\program files\CCleaner
2009-03-06 14:22 . 2003-01-14 17:54 284160 —-a-w c:\windows\system32\pdh.dll
2009-03-03 00:18 . 2004-12-07 22:37 826368 —-a-w c:\windows\system32\wininet.dll
2009-02-20 18:09 . 2005-04-08 21:35 78336 ——w c:\windows\system32\ieencode.dll
2009-02-09 12:10 . 2001-08-18 13:00 729088 —-a-w c:\windows\system32\lsasrv.dll
2009-02-09 12:10 . 2005-01-14 05:33 401408 —-a-w c:\windows\system32\rpcss.dll
2009-02-09 12:10 . 2001-08-18 13:00 714752 —-a-w c:\windows\system32\ntdll.dll
2009-02-09 12:10 . 2001-08-18 13:00 617472 —-a-w c:\windows\system32\advapi32.dll
2009-02-09 11:13 . 2002-02-21 00:46 1846784 —-a-w c:\windows\system32\win32k.sys
2009-02-08 00:02 . 1980-01-01 06:00 2066048 —-a-w c:\windows\system32\ntkrnlpa.exe
2009-02-06 11:11 . 2001-08-18 13:00 110592 —-a-w c:\windows\system32\services.exe
2009-02-06 11:08 . 1980-01-01 06:00 2189056 —-a-w c:\windows\system32\ntoskrnl.exe
2009-02-06 10:39 . 2001-08-18 13:00 35328 —-a-w c:\windows\system32\sc.exe
2009-02-03 19:59 . 2003-01-14 17:54 56832 —-a-w c:\windows\system32\secur32.dll
2006-02-02 20:29 . 2006-02-02 20:28 32803463 —-a-w c:\program files\Symantec_av_full_version_win.exe
2006-01-16 01:55 . 2006-01-16 01:55 5225384 —-a-w c:\program files\Firefox Setup 1.5.exe
2005-10-18 20:46 . 2005-10-18 20:46 4839222 —-a-w c:\program files\syncbackse_setup.exe
2005-09-09 14:44 . 2005-09-09 14:44 49634 —-a-w c:\program files\POBS Kelly grass.jpg
2005-09-09 14:43 . 2005-09-09 14:43 29226 —-a-w c:\program files\POBS Kelly rodent.jpg
2005-08-13 00:14 . 2005-08-13 00:13 9308264 —-a-w c:\program files\zlsSetup_60_631_003.exe
2005-06-28 15:37 . 2005-06-28 15:37 10808151 —-a-w c:\program files\Inkscape-0.41-1.win32.exe
2005-05-22 01:22 . 2005-05-22 01:22 32803463 —-a-w c:\program files\Symantec_av_full_version.exe
2005-05-21 18:49 . 2005-05-21 18:48 493270 —-a-w c:\program files\FastDefrag2.exe
2005-05-21 18:41 . 2005-05-21 18:41 2020143 —-a-w c:\program files\iaa23_enu.exe
2005-05-21 18:40 . 2005-05-21 18:40 122880 —-a-w c:\program files\ChipUtil.exe
2005-05-21 18:38 . 2005-05-21 18:37 861059 —-a-w c:\program files\infinst_autol.exe
2004-12-10 19:51 . 2004-12-10 19:51 6655600 —-a-w c:\program files\zlsSetup_55_062_004.exe
2004-10-10 17:27 . 2004-10-10 17:27 5827728 —-a-w c:\program files\zlsSetup_51_033_000.exe
2004-04-20 18:09 . 2004-04-20 18:09 91628 —-a-w c:\program files\r040115e.pdf
2004-04-13 17:36 . 2004-04-13 17:30 63880198 —-a-w c:\program files\qxpress61updater.zip
2003-05-21 13:13 . 2003-05-21 13:12 10364928 —-a-w c:\program files\McAfee7.0.exe
2003-05-08 13:38 . 2003-05-08 13:37 3750576 —-a-w c:\program files\zaSetup_37_143.exe
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RambtsC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RamptkC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RamttuC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RbmitxC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RbmktnC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RbmytjC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RcmdteC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RcmdtoC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RcmltgC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RcmntqC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RcmptkC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RcmttmC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RcmxtoC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RdmgtlC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RdmmtjC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RembtmC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RemftiC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RemntiC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RemxtqC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RfmitpC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RfmutrC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RgmhtsC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RgmjtsC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RgmvtmC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RgmvtwC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RhmcttC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RhmutpC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RimdtiC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RimftsC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RimlteC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RimttcC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RjmgtpC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RjmothC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RjmwtlC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RkmhtkC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RkmhtmC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RkmrtsC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RkmvtmC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RlmqtvC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RmmhtcC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RmmvtmC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RmmxteC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RnmctjC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RnmktpC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RnmmtdC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RnmutjC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RnmwthC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RombtwC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RomdtmC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RomftcC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RomttwC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RpmittC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RpmqttC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RpmwtxC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RrmctjC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RrmitlC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RrmktlC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RrmutdC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RsmbtqC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RsmdteC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RsmftoC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RsmhtcC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RsmrtwC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RsmttcC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RsmvtoC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RsmxtsC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RtmyttC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RumhtqC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RvmotdC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RvmstvC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RwmntgC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RwmntqC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RwmpteC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RwmtteC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RwmvtoC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RxmettC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RxmgtrC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RxmmtlC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RxmqtpC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RxmstnC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RymntkC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RymxteC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RzmctdC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RzmmtdC.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-04-30_13.30.31 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-04-30 16:25 . 2009-04-30 16:25 16384 c:\windows\Temp\Perflib_Perfdata_988.dat
+ 2001-08-18 13:00 . 2008-04-14 00:12 87352 c:\windows\SYSTEM32\ntvdvd.dll
+ 2003-01-14 17:54 . 2008-04-14 00:12 409088 c:\windows\SYSTEM32\DLLCACHE\qmgr.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-10-06 5058560]
"diagent"="c:\program files\Creative\SBLive\Diagnostics\diagent.exe" [2002-04-03 135264]
"Microsoft Works Update Detection"="c:\program files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2001-08-17 28738]
"AdaptecDirectCD"="c:\program files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" [2002-04-10 679936]
"DwlClient"="c:\program files\Common Files\Dell\EUSW\Support.exe" [2003-05-15 245760]
"LWBKEYBOARD"="c:\program files\MultiMedia Keyboard\MultiMedia Keyboard\1.1\KbdAp32A.exe" [2002-04-02 371200]
"FLMOFFICE4DMOUSE"="c:\program files\Browser MOUSE\mouse32a.exe" [2004-04-26 360448]
"StatusClient 2.6"="c:\program files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe" [2004-02-27 61440]
"TomcatStartup 2.5"="c:\program files\Hewlett-Packard\Toolbox\hpbpsttp.exe" [2004-02-12 163840]
"PaperPort PTD"="c:\program files\Scansoft\PaperPort\pptd40nt.exe" [2002-12-17 45108]
"IndexSearch"="c:\program files\Scansoft\PaperPort\IndexSearch.exe" [2002-12-17 36864]
"McAfeeUpdaterUI"="c:\program files\Network Associates\Common Framework\UpdaterUI.exe" [2003-02-25 139347]
"Acrobat Assistant 7.0"="c:\program files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2008-04-23 483328]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2005-10-04 48752]
"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2005-11-15 85744]
"COMODO Firewall Pro"="c:\program files\COMODO\Firewall\cfp.exe" [2009-03-17 1851128]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-04-23 516440]
"COMODO Internet Security"="c:\program files\COMODO\Firewall\cfp.exe" [2009-03-17 1851128]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-29 148888]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - c:\windows\Installer\{AC76BA86-1033-0000-7760-100000000002}\SC_Acrobat.exe [2005-6-6 25214]
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-1-26 113664]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
Mozilla Firefox.lnk - c:\program files\Mozilla Firefox\firefox.exe [2006-1-15 307704]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"StartMenuLogOff"= 1 (0x1)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Hewlett-Packard\\Toolbox\\jre\\bin\\javaw.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=

2;2 WinErp; [x]
R2 DmPnSN;Portable Meda Number Service;c:\windows\system32\userinet.exe [2009-04-19 16384]
R2 Domain;Domain Name Service;c:\program files\Domain.exe [2009-04-17 833024]
R2 MediaPlayer Serial;Portable MediaPlayer Serial Number;c:\windows\System32\svchost.exe [2008-04-14 14336]
R2 MediaSerial;Portable Media Number;c:\windows\System32\svchost.exe [2008-04-14 14336]
R2 MediaSoftware;MediaSoftware Control Center ;c:\windows\System32\svchost.exe [2008-04-14 14336]
R2 reports service;plication crashes to Microsof;c:\windows\system32\ctvhcst.exe _k vetvcs [2009-04-15 272384]
R2 Serial Number Service loaded to the device.;Serial Number Service loaded to the device.;c:\program files\Common Files\Serial.exe [2009-04-30 33480]
R3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-04-23 953168]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2009-03-12 64160]
S1 cmdGuard;COMODO Firewall Pro Sandbox Driver;c:\windows\system32\DRIVERS\cmdguard.sys [2009-03-17 110992]
S1 cmdHlp;COMODO Firewall Pro Helper Driver;c:\windows\system32\DRIVERS\cmdhlp.sys [2009-03-17 24336]
S2 PQfsmonNT ABE675CA-49DF-11d3-93F6-00104B64D07B;PowerQuest File System Monitor PQfsmonNT ABE675CA-49DF-11d3-93F6-00104B64D07B;c:\program files\PowerQuest\DataKeeper\pqfsmonnt.sys [2001-11-15 49096]
S2 SavRoam;SavRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [2005-11-15 169200]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2009-02-25 101936]

— Other Services/Drivers In Memory —

*Deregistered* - EraserUtilDrv10741

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WinErp REG_MULTI_SZ WinErp
winErs REG_MULTI_SZ winErs
.
Contents of the 'Scheduled Tasks' folder

2009-04-27 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 19:46]

2009-04-22 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 22:57]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.sirius.com/siriusinternetradio
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = ;*.local
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000
TCP: {8269D2D1-06DF-4530-A7A8-FED624009ACE} = 129.15.1.120,129.15.1.121
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Karen\Application Data\Mozilla\Firefox\Profiles\q8zn4sem.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmidas.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-30 11:27
Windows 5.1.2600 Service Pack 3 NTFS

detected NTDLL code modification:
ZwClose, ZwOpenFile

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DwlClient = c:\program files\Common Files\Dell\EUSW\Support.exe?l?e?s?\?D?e?l?l?\?E?U?S?W?\?S?u?p?p?o?r?t?.?e?x?e???????X:??????x??? ???X??? ??????? ???P???? ?w? ?w)??p????????(???u????U?w????????????0??????w, ?w?M?wW??w???w)??p????????x'@?????????X????????"@?e?????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(776)
c:\windows\system32\guard32.dll

- - - - - - - > 'lsass.exe'(836)
c:\windows\system32\guard32.dll

- - - - - - - > 'explorer.exe'(3012)
c:\windows\system32\guard32.dll
c:\program files\Browser MOUSE\MOUDL32A.DLL
.
———————— Other Running Processes ————————
.
c:\program files\COMODO\Firewall\cmdagent.exe
c:\program files\Common Files\Symantec Shared\ccSetMgr.exe
c:\program files\Common Files\Symantec Shared\ccEvtMgr.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\SYSTEM32\CTsvcCDA.EXE
c:\program files\Symantec AntiVirus\DefWatch.exe
c:\program files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\SYSTEM32\mstsc.exe
c:\program files\Network Associates\Common Framework\FrameworkService.exe
c:\progra~1\NETWOR~1\COMMON~1\naPrdMgr.exe
c:\windows\SYSTEM32\nvsvc32.exe
c:\windows\SYSTEM32\CALC.EXE
c:\program files\Symantec AntiVirus\Rtvscan.exe
c:\windows\wanmpsvc.exe
c:\windows\SYSTEM32\MsPMSPSv.exe
c:\windows\SYSTEM32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-04-30 11:32 - machine was rebooted
ComboFix-quarantined-files.txt 2009-04-30 16:32
ComboFix2.txt 2009-04-30 13:35

Pre-Run: 35,169,136,640 bytes free
Post-Run: 35,165,741,056 bytes free

344 — E O F — 2009-04-29 17:01

okieherper

Post #10April 30, 2009, 8:16 PM UTC

Just wanted to let you know that I have to go out of town for a few days. I won't be back on this computer until Tuesday. Just didn't want the thread to get closed because you thought I had abandoned it. Josh

Tomk

Post #11April 30, 2009, 8:58 PM UTC

okieherper,

I still need that report from Jotti on that file, meanwhile, I'd like you to scan a few more files at Jotti also:
c:\program files\Common Files\wen4.exe
c:\program files\Common Files\Serial.exe
c:\program files\Common Files\wen1.exe

okieherper

Post #12May 5, 2009, 1:48 PM UTC

Ok I'm back in town now. Thanks for being patient and not closing my thread. I can't locate "c:\windows\SYSTEM32\RambtsC.dll" to do the jotti scan. I even did a search for the file and found nothing. There are several similar files in ….\common files. They are wena.exe, wen4.exe, wen1.exe, wenb.exe, and wend.exe. Serial.exe isn't there. This is for wen4.exe Scan taken on 05 May 2009 13:22:03 (GMT) A-Squared Found Trojan-PWS.Win32.QQPass!IK AntiVir Found TR/Hijacker.Gen ArcaVir Found nothing Avast Found Win32:Trojan-gen {Other} AVG Antivirus Found Dropper.Generic.AMDA BitDefender Found Gen:Trojan.Heur.C242BD8808 ClamAV Found nothing CPsecure Found nothing Dr.Web Found BackDoor.Pigeon.22223 F-Prot Antivirus Found W32/Agent.S.gen!Eldorado F-Secure Anti-Virus Found Trojan.Win32.Buzus.axee Ikarus Found Trojan-PWS.Win32.QQPass Kaspersky Anti-Virus Found Trojan.Win32.Buzus.axee NOD32 Found probably a variant of Win32/TrojanDropper.Delf.AAH (probable variant) Norman Virus Control Found nothing Panda Antivirus Found nothing Quick Heal Found Trojan.Buzus.axee Sophos Antivirus Found Mal/Dropper-G VirusBuster Found nothing VBA32 Found MalwareScope.Trojan-PSW.Game.16 Last file scanned at least one scanner reported something about: msngr.exe (MD5: bdf3413124f8f67a887f0eeb409e3993, size: 356352 bytes), detected by: Scanner Malware name A-Squared Riskware.Win32.Vtub!IK AntiVir TR/Dropper.Gen ArcaVir X Avast X AVG Antivirus Dropper.Generic.ALNU BitDefender Gen:Trojan.Heur.51659ABBBB ClamAV X CPsecure X Dr.Web X F-Prot Antivirus X F-Secure Anti-Virus X Ikarus VirTool.Win32.Vtub Kaspersky Anti-Virus X NOD32 X Norman Virus Control X Panda Antivirus X Quick Heal X Sophos Antivirus X VirusBuster X VBA32 X Now for wena.exe can taken on 05 May 2009 13:27:13 (GMT) A-Squared Found Trojan.Win32.AntiAV!IK AntiVir Found nothing ArcaVir Found nothing Avast Found Win32:Trojan-gen {Other} AVG Antivirus Found nothing BitDefender Found nothing ClamAV Found nothing CPsecure Found nothing Dr.Web Found DLOADER.Trojan (probable variant) F-Prot Antivirus Found W32/OnlineGames.BX.gen!Eldorado F-Secure Anti-Virus Found Trojan.Win32.AntiAV.bdv Ikarus Found Trojan.Win32.AntiAV Kaspersky Anti-Virus Found Trojan.Win32.AntiAV.bdv NOD32 Found nothing Norman Virus Control Found nothing Panda Antivirus Found nothing Quick Heal Found nothing Sophos Antivirus Found Mal/Whybo-A VirusBuster Found nothing VBA32 Found nothing Statistics Last file scanned at least one scanner reported something about: r3b0rn.exe (MD5: b50bf5224601e9aff2658188f037efd1, size: 274432 bytes), detected by: Scanner Malware name A-Squared Trojan.Hijacker!IK AntiVir X ArcaVir X Avast Win32:Trojan-gen {Other} AVG Antivirus X BitDefender X ClamAV X CPsecure X Dr.Web X F-Prot Antivirus W32/SecRisk-ProcessPatcher-based!Maximus F-Secure Anti-Virus X Ikarus Trojan.Hijacker Kaspersky Anti-Virus X NOD32 X Norman Virus Control X Panda Antivirus X Quick Heal X Sophos Antivirus X VirusBuster X VBA32 X Here is wen1.exe Scanner results Scan taken on 05 May 2009 13:33:41 (GMT) A-Squared Found Trojan.Win32.AntiAV!IK AntiVir Found TR/AntiAV.bel ArcaVir Found nothing Avast Found Win32:Trojan-gen {Other} AVG Antivirus Found KillAV.AAB BitDefender Found nothing ClamAV Found nothing CPsecure Found nothing Dr.Web Found DLOADER.Trojan (probable variant) F-Prot Antivirus Found W32/OnlineGames.BX.gen!Eldorado F-Secure Anti-Virus Found Trojan.Win32.AntiAV.bge Ikarus Found Trojan.Win32.AntiAV Kaspersky Anti-Virus Found Trojan.Win32.AntiAV.bge NOD32 Found nothing Norman Virus Control Found nothing Panda Antivirus Found nothing Quick Heal Found nothing Sophos Antivirus Found Mal/Whybo-A VirusBuster Found nothing VBA32 Found Embedded.Trojan.Win32.AntiAV.bel (probable variant) Statistics Last file scanned at least one scanner reported something about: iemate_shubiao.zip (MD5: 7ad7125a961a6386611229cb68f8d21f, size: 906466 bytes), detected by: Scanner Malware name A-Squared X AntiVir X ArcaVir X Avast X AVG Antivirus X BitDefender X ClamAV X CPsecure Rootkit.W32.Fuzen.b Dr.Web X F-Prot Antivirus X F-Secure Anti-Virus X Ikarus X Kaspersky Anti-Virus X NOD32 X Norman Virus Control X Panda Antivirus X Quick Heal X Sophos Antivirus Mal/RootKit-A VirusBuster X VBA32 X Now wenb.exe Scanner results Scan taken on 05 May 2009 13:36:21 (GMT) A-Squared Found Trojan.Win32.AntiAV!IK AntiVir Found nothing ArcaVir Found nothing Avast Found nothing AVG Antivirus Found Dropper.Generic.ALKM BitDefender Found nothing ClamAV Found nothing CPsecure Found nothing Dr.Web Found DLOADER.Trojan (probable variant) F-Prot Antivirus Found W32/OnlineGames.BX.gen!Eldorado F-Secure Anti-Virus Found nothing Ikarus Found Trojan.Win32.AntiAV Kaspersky Anti-Virus Found nothing NOD32 Found nothing Norman Virus Control Found nothing Panda Antivirus Found nothing Quick Heal Found nothing Sophos Antivirus Found Mal/Whybo-A VirusBuster Found nothing VBA32 Found nothing Statistics Last file scanned at least one scanner reported something about: wen1.exe (MD5: 88b392de3829b61a3b5af8f34bbfac19, size: 127512 bytes), detected by: Scanner Malware name A-Squared Trojan.Win32.AntiAV!IK AntiVir TR/AntiAV.bel ArcaVir X Avast Win32:Trojan-gen {Other} AVG Antivirus KillAV.AAB BitDefender X ClamAV X CPsecure X Dr.Web DLOADER.Trojan F-Prot Antivirus W32/OnlineGames.BX.gen!Eldorado F-Secure Anti-Virus Trojan.Win32.AntiAV.bge Ikarus Trojan.Win32.AntiAV Kaspersky Anti-Virus Trojan.Win32.AntiAV.bge NOD32 X Norman Virus Control X Panda Antivirus X Quick Heal X Sophos Antivirus Mal/Whybo-A VirusBuster X VBA32 Embedded.Trojan.Win32.AntiAV.bel And finally wend.exe Scanner results Scan taken on 05 May 2009 13:44:35 (GMT) A-Squared Found nothing AntiVir Found TR/Crypt.XPACK.Gen ArcaVir Found nothing Avast Found nothing AVG Antivirus Found SHeur2.ABKG BitDefender Found Gen:Trojan.Heur.GM.1404852000 ClamAV Found nothing CPsecure Found nothing Dr.Web Found nothing F-Prot Antivirus Found nothing F-Secure Anti-Virus Found nothing Ikarus Found nothing Kaspersky Anti-Virus Found nothing NOD32 Found a variant of Win32/Kryptik.NX Norman Virus Control Found nothing Panda Antivirus Found nothing Quick Heal Found Trojan.Agent.ATV Sophos Antivirus Found Sus/UnkPacker (probable variant) VirusBuster Found nothing VBA32 Found nothing Statistics Last file scanned at least one scanner reported something about: svchost.exe (MD5: fb4f3fbaae5c7905601da65712607b3f, size: 611840 bytes), detected by: Scanner Malware name A-Squared Backdoor.Win32.ServU-based!IK AntiVir SPR/Serv-U.1 ArcaVir X Avast Win32:ServU-AT AVG Antivirus ServU.AIU BitDefender Backdoor.Generic.155372 ClamAV Trojan.Servu-33 CPsecure Server-FTP.W32.Serv-U.gen Dr.Web BackDoor.Servu.60 F-Prot Antivirus W32/SysVenFak.B.gen!Eldorado F-Secure Anti-Virus not-a-virus:Server-FTP.Win32.Serv-U.gen (6, 2, 607) Ikarus Backdoor.Win32.ServU-based Kaspersky Anti-Virus not-a-virus:Server-FTP.Win32.Serv-U.gen NOD32 a variant of Win32/ServU-Daemon application Norman Virus Control W32/Smalldoor.AXPT Panda Antivirus X Quick Heal X Sophos Antivirus Troj/ServU-Gen VirusBuster X VBA32 Backdoor.XiaoBird.29 (paranoid heuristics) Hope I did all that correctly. If not, I'll be happy to try again. Thanks.

Tomk

Post #13May 5, 2009, 3:34 PM UTC

okieherper,

COMBOFIX-Script

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

File::
c:\program files\Common Files\wena.exe 
c:\program files\Common Files\wen4.exe 
c:\program files\Common Files\wen1.exe 
c:\program files\Common Files\wenb.exe
c:\program files\Common Files\wend.exe
c:\program files\Common Files\Serial.exe

Folder::

Registry::

Driver::

Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

okieherper

Post #14May 5, 2009, 4:20 PM UTC

New log:

ComboFix 09-05-04.A3 - Karen 05/05/2009 10:47.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.548 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Karen\Desktop\CFScript.txt
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Outdated)
FW: COMODO Firewall *disabled*

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
c:\program files\Common Files\Serial.exe
c:\program files\Common Files\wen1.exe
c:\program files\Common Files\wen4.exe
c:\program files\Common Files\wena.exe
c:\program files\Common Files\wenb.exe
c:\program files\Common Files\wend.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Common Files\Serial.exe
c:\program files\Common Files\wen1.exe
c:\program files\Common Files\wen4.exe
c:\program files\Common Files\wena.exe
c:\program files\Common Files\wenb.exe
c:\program files\Common Files\wend.exe
c:\windows\Temp\1232.exe
c:\windows\Temp\4024.exe
c:\windows\Temp\488.exe

.
((((((((((((((((((((((((( Files Created from 2009-04-05 to 2009-05-05 )))))))))))))))))))))))))))))))
.

2009-04-30 20:17 . 2009-04-30 20:17 74295 —-a-w c:\windows\system32\Down(1).exe
2009-04-29 17:06 . 2009-04-29 17:06 ——– d—–w c:\windows\Sun
2009-04-29 17:04 . 2009-04-29 17:04 410984 —-a-w c:\windows\system32\deploytk.dll
2009-04-28 14:10 . 2009-04-28 14:10 0 —-a-w c:\windows\system32\drivers\hihmt.sys
2009-04-28 13:59 . 2009-04-28 13:59 ——– d—–w c:\documents and settings\Karen\Application Data\Malwarebytes
2009-04-28 13:59 . 2009-04-06 20:32 15504 —-a-w c:\windows\system32\drivers\mbam.sys
2009-04-28 13:59 . 2009-04-06 20:32 38496 —-a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-28 13:59 . 2009-04-28 13:59 ——– d—–w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-04-28 13:59 . 2009-04-28 13:59 ——– d—–w c:\program files\Malwarebytes' Anti-Malware
2009-04-24 15:52 . 2009-04-24 15:52 33061 —-a-w c:\windows\king-uninstall.exe
2009-04-24 15:50 . 2009-04-24 15:53 ——– d—–w c:\documents and settings\Karen\Local Settings\Application Data\king.com
2009-04-22 13:45 . 2009-04-22 13:45 ——– d—–w c:\program files\Trend Micro
2009-04-22 13:39 . 2009-04-22 13:39 ——– d—–w c:\documents and settings\Guest\Local Settings\Application Data\Apple Computer
2009-04-21 02:53 . 2009-04-19 18:42 12288 —-a-w c:\windows\system32\Hide.exe
2009-04-21 02:53 . 2009-04-19 07:37 16384 –sha-w c:\windows\system32\userinet.exe
2009-04-20 14:36 . 2009-04-20 14:36 1 —-a-w c:\windows\system32\0005ca37.sys
2009-04-17 02:20 . 2009-04-17 02:20 833024 –sh–w c:\program files\_Domain.exe
2009-04-17 02:20 . 2009-04-17 02:20 833024 –sh–w c:\program files\Domain.exe
2009-04-17 01:54 . 2009-04-30 20:18 38 —-a-w c:\windows\system32\install.dat
2009-04-17 01:54 . 2009-04-17 20:15 59904 —-a-w c:\windows\system32\Windows7.exe
2009-04-16 13:39 . 2009-04-16 13:39 ——– d—–w c:\documents and settings\Administrator\Application Data\PC Tools
2009-04-16 13:32 . 2009-04-16 13:32 ——– d—–w c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2009-04-15 16:46 . 2008-12-16 12:30 354304 ——w c:\windows\system32\dllcache\winhttp.dll
2009-04-15 03:28 . 2009-03-06 14:22 284160 ——w c:\windows\system32\dllcache\pdh.dll
2009-04-15 03:28 . 2009-02-06 10:39 35328 ——w c:\windows\system32\dllcache\sc.exe
2009-04-15 03:28 . 2009-02-09 12:10 401408 ——w c:\windows\system32\dllcache\rpcss.dll
2009-04-15 03:28 . 2009-02-06 11:11 110592 ——w c:\windows\system32\dllcache\services.exe
2009-04-15 03:28 . 2009-02-09 12:10 473600 ——w c:\windows\system32\dllcache\fastprox.dll
2009-04-15 03:28 . 2009-02-06 10:10 227840 ——w c:\windows\system32\dllcache\wmiprvse.exe
2009-04-15 03:28 . 2009-02-09 12:10 453120 ——w c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-15 03:28 . 2009-02-09 12:10 729088 ——w c:\windows\system32\dllcache\lsasrv.dll
2009-04-15 03:28 . 2009-02-09 12:10 617472 ——w c:\windows\system32\dllcache\advapi32.dll
2009-04-15 03:28 . 2009-02-09 12:10 714752 ——w c:\windows\system32\dllcache\ntdll.dll
2009-04-15 03:23 . 2008-05-03 11:55 2560 ——w c:\windows\system32\xpsp4res.dll
2009-04-15 03:23 . 2008-04-21 12:08 215552 ——w c:\windows\system32\dllcache\wordpad.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-05 15:44 . 2006-04-25 20:38 ——– d—–w c:\program files\Symantec AntiVirus
2009-04-09 16:48 . 2003-01-14 16:55 ——– d—–w c:\program files\Java
2009-04-09 16:41 . 2002-11-10 14:25 ——– d–h–w c:\program files\InstallShield Installation Information
2009-03-18 13:10 . 2009-03-18 13:10 316672 —-a-w c:\windows\KingComIE.dll
2009-03-17 16:47 . 2009-03-17 16:45 ——– d—–w c:\program files\Yahoo!
2009-03-17 16:08 . 2008-07-14 17:06 24336 —-a-w c:\windows\system32\drivers\cmdhlp.sys
2009-03-17 16:08 . 2008-07-14 17:06 110992 —-a-w c:\windows\system32\drivers\cmdguard.sys
2009-03-17 16:08 . 2008-07-14 17:06 155384 —-a-w c:\windows\system32\guard32.dll
2009-03-12 19:37 . 2009-03-12 21:08 15688 —-a-w c:\windows\system32\lsdelete.exe
2009-03-12 19:36 . 2009-03-12 19:45 64160 —-a-w c:\windows\system32\drivers\Lbd.sys
2009-03-12 19:28 . 2006-02-07 16:19 ——– d—–w c:\program files\Lavasoft
2009-03-12 18:18 . 2009-03-12 18:18 ——– d—–w c:\program files\CCleaner
2009-03-06 14:22 . 2003-01-14 17:54 284160 —-a-w c:\windows\system32\pdh.dll
2009-03-03 00:18 . 2004-12-07 22:37 826368 —-a-w c:\windows\system32\wininet.dll
2009-02-20 18:09 . 2005-04-08 21:35 78336 ——w c:\windows\system32\ieencode.dll
2009-02-09 12:10 . 2001-08-18 13:00 729088 —-a-w c:\windows\system32\lsasrv.dll
2009-02-09 12:10 . 2005-01-14 05:33 401408 —-a-w c:\windows\system32\rpcss.dll
2009-02-09 12:10 . 2001-08-18 13:00 714752 —-a-w c:\windows\system32\ntdll.dll
2009-02-09 12:10 . 2001-08-18 13:00 617472 —-a-w c:\windows\system32\advapi32.dll
2009-02-09 11:13 . 2002-02-21 00:46 1846784 —-a-w c:\windows\system32\win32k.sys
2009-02-08 00:02 . 1980-01-01 06:00 2066048 —-a-w c:\windows\system32\ntkrnlpa.exe
2009-02-06 11:11 . 2001-08-18 13:00 110592 —-a-w c:\windows\system32\services.exe
2009-02-06 11:08 . 1980-01-01 06:00 2189056 —-a-w c:\windows\system32\ntoskrnl.exe
2009-02-06 10:39 . 2001-08-18 13:00 35328 —-a-w c:\windows\system32\sc.exe
2006-02-02 20:29 . 2006-02-02 20:28 32803463 —-a-w c:\program files\Symantec_av_full_version_win.exe
2006-01-16 01:55 . 2006-01-16 01:55 5225384 —-a-w c:\program files\Firefox Setup 1.5.exe
2005-10-18 20:46 . 2005-10-18 20:46 4839222 —-a-w c:\program files\syncbackse_setup.exe
2005-09-09 14:44 . 2005-09-09 14:44 49634 —-a-w c:\program files\POBS Kelly grass.jpg
2005-09-09 14:43 . 2005-09-09 14:43 29226 —-a-w c:\program files\POBS Kelly rodent.jpg
2005-08-13 00:14 . 2005-08-13 00:13 9308264 —-a-w c:\program files\zlsSetup_60_631_003.exe
2005-06-28 15:37 . 2005-06-28 15:37 10808151 —-a-w c:\program files\Inkscape-0.41-1.win32.exe
2005-05-22 01:22 . 2005-05-22 01:22 32803463 —-a-w c:\program files\Symantec_av_full_version.exe
2005-05-21 18:49 . 2005-05-21 18:48 493270 —-a-w c:\program files\FastDefrag2.exe
2005-05-21 18:41 . 2005-05-21 18:41 2020143 —-a-w c:\program files\iaa23_enu.exe
2005-05-21 18:40 . 2005-05-21 18:40 122880 —-a-w c:\program files\ChipUtil.exe
2005-05-21 18:38 . 2005-05-21 18:37 861059 —-a-w c:\program files\infinst_autol.exe
2004-12-10 19:51 . 2004-12-10 19:51 6655600 —-a-w c:\program files\zlsSetup_55_062_004.exe
2004-10-10 17:27 . 2004-10-10 17:27 5827728 —-a-w c:\program files\zlsSetup_51_033_000.exe
2004-04-20 18:09 . 2004-04-20 18:09 91628 —-a-w c:\program files\r040115e.pdf
2004-04-13 17:36 . 2004-04-13 17:30 63880198 —-a-w c:\program files\qxpress61updater.zip
2003-05-21 13:13 . 2003-05-21 13:12 10364928 —-a-w c:\program files\McAfee7.0.exe
2003-05-08 13:38 . 2003-05-08 13:37 3750576 —-a-w c:\program files\zaSetup_37_143.exe
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RambtsC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RamptkC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RamttuC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RbmitxC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RbmktnC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RbmytjC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RcmdteC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RcmdtoC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RcmltgC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RcmntqC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RcmptkC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RcmttmC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RcmxtoC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RdmgtlC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RdmmtjC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RembtmC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RemftiC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RemntiC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RemxtqC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RfmitpC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RfmutrC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RgmhtsC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RgmjtsC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RgmvtmC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RgmvtwC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RhmcttC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RhmutpC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RimdtiC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RimftsC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RimlteC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RimttcC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RjmgtpC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RjmothC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RjmwtlC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RkmhtkC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RkmhtmC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RkmrtsC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RkmvtmC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RlmqtvC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RmmhtcC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RmmvtmC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RmmxteC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RnmctjC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RnmktpC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RnmmtdC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RnmutjC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RnmwthC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RombtwC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RomdtmC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RomftcC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RomttwC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RpmittC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RpmqttC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RpmwtxC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RrmctjC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RrmitlC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RrmktlC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RrmutdC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RsmbtqC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RsmdteC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RsmftoC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RsmhtcC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RsmrtwC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RsmttcC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RsmvtoC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RsmxtsC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RtmyttC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RumhtqC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RvmotdC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RvmstvC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RwmntgC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RwmntqC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RwmpteC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RwmtteC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RwmvtoC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RxmettC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RxmgtrC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RxmmtlC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RxmqtpC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RxmstnC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RymntkC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RymxteC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RzmctdC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RzmmtdC.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-04-30_13.30.31 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-05-05 13:08 . 2009-05-05 13:08 16384 c:\windows\Temp\Perflib_Perfdata_8fc.dat
+ 2001-08-18 13:00 . 2008-04-14 00:12 87352 c:\windows\SYSTEM32\ntvdvd.dll
+ 2003-01-14 17:54 . 2004-08-18 01:00 112128 c:\windows\SYSTEM32\qmgr.dll
+ 2003-01-14 17:54 . 2004-08-18 01:00 112128 c:\windows\SYSTEM32\DLLCACHE\qmgr.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-10-06 5058560]
"diagent"="c:\program files\Creative\SBLive\Diagnostics\diagent.exe" [2002-04-03 135264]
"Microsoft Works Update Detection"="c:\program files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2001-08-17 28738]
"AdaptecDirectCD"="c:\program files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" [2002-04-10 679936]
"DwlClient"="c:\program files\Common Files\Dell\EUSW\Support.exe" [2003-05-15 245760]
"LWBKEYBOARD"="c:\program files\MultiMedia Keyboard\MultiMedia Keyboard\1.1\KbdAp32A.exe" [2002-04-02 371200]
"FLMOFFICE4DMOUSE"="c:\program files\Browser MOUSE\mouse32a.exe" [2004-04-26 360448]
"StatusClient 2.6"="c:\program files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe" [2004-02-27 61440]
"TomcatStartup 2.5"="c:\program files\Hewlett-Packard\Toolbox\hpbpsttp.exe" [2004-02-12 163840]
"PaperPort PTD"="c:\program files\Scansoft\PaperPort\pptd40nt.exe" [2002-12-17 45108]
"IndexSearch"="c:\program files\Scansoft\PaperPort\IndexSearch.exe" [2002-12-17 36864]
"McAfeeUpdaterUI"="c:\program files\Network Associates\Common Framework\UpdaterUI.exe" [2003-02-25 139347]
"Acrobat Assistant 7.0"="c:\program files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2008-04-23 483328]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2005-10-04 48752]
"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2005-11-15 85744]
"COMODO Firewall Pro"="c:\program files\COMODO\Firewall\cfp.exe" [2009-03-17 1851128]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-04-23 516440]
"COMODO Internet Security"="c:\program files\COMODO\Firewall\cfp.exe" [2009-03-17 1851128]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-29 148888]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - c:\windows\Installer\{AC76BA86-1033-0000-7760-100000000002}\SC_Acrobat.exe [2005-6-6 25214]
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-1-26 113664]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
Mozilla Firefox.lnk - c:\program files\Mozilla Firefox\firefox.exe [2006-1-15 307704]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"StartMenuLogOff"= 1 (0x1)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Hewlett-Packard\\Toolbox\\jre\\bin\\javaw.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=

R0 Lbd;Lbd;c:\windows\SYSTEM32\DRIVERS\Lbd.sys [3/12/2009 2:45 PM 64160]
R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;c:\windows\SYSTEM32\DRIVERS\cmdguard.sys [7/14/2008 12:06 PM 110992]
R1 cmdHlp;COMODO Firewall Pro Helper Driver;c:\windows\SYSTEM32\DRIVERS\cmdhlp.sys [7/14/2008 12:06 PM 24336]
R2 PQfsmonNT ABE675CA-49DF-11d3-93F6-00104B64D07B;PowerQuest File System Monitor PQfsmonNT ABE675CA-49DF-11d3-93F6-00104B64D07B;c:\program files\PowerQuest\DataKeeper\PqFsmonNt.sys [4/26/2005 1:33 PM 49096]
R2 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [11/15/2005 1:27 PM 169200]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2/26/2009 11:20 AM 101936]
S2 DmPnSN;Portable Meda Number Service;c:\windows\SYSTEM32\userinet.exe [4/20/2009 9:53 PM 16384]
S2 Domain;Domain Name Service;c:\program files\Domain.exe [4/16/2009 9:20 PM 833024]
S2 MediaPlayer Serial;Portable MediaPlayer Serial Number;c:\windows\System32\svchost.exe -k krnlsrvc [8/18/2001 8:00 AM 14336]
S2 MediaSerial;Portable Media Number;c:\windows\System32\svchost.exe -k krnlsrvc [8/18/2001 8:00 AM 14336]
S2 MediaSoftware;MediaSoftware Control Center ;c:\windows\System32\svchost.exe -k krnlsrvc [8/18/2001 8:00 AM 14336]
S2 reports service;plication crashes to Microsof;c:\windows\SYSTEM32\ctvhcst.exe _k vetvcs [4/15/2009 4:31 PM 272384]
S2 Serial Number Service loaded to the device.;Serial Number Service loaded to the device.;c:\program files\Common Files\Serial.exe –> c:\program files\Common Files\Serial.exe [?]
S2 WinErp;Windows System Event reporting;c:\windows\system32\svchost.exe -KWinErp –> c:\windows\system32\svchost.exe -KWinErp [?]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [1/18/2009 4:34 PM 953168]

— Other Services/Drivers In Memory —

*Deregistered* - EraserUtilDrv10741

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WinErp REG_MULTI_SZ WinErp
winErs REG_MULTI_SZ winErs
.
Contents of the 'Scheduled Tasks' folder

2009-05-05 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 19:46]

2009-04-22 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 22:57]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.sirius.com/siriusinternetradio
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = ;*.local
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000
TCP: {8269D2D1-06DF-4530-A7A8-FED624009ACE} = 129.15.1.120,129.15.1.121
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Karen\Application Data\Mozilla\Firefox\Profiles\q8zn4sem.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmidas.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-05 10:50
Windows 5.1.2600 Service Pack 3 NTFS

detected NTDLL code modification:
ZwClose, ZwOpenFile

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DwlClient = c:\program files\Common Files\Dell\EUSW\Support.exe?l?e?s?\?D?e?l?l?\?E?U?S?W?\?S?u?p?p?o?r?t?.?e?x?e???????X:??????x??? ???X??? ??????? ???P???? ?w? ?w)??p????????(???u????U?w????????????0??????w, ?w?M?wW??w???w)??p????????x'@?????????X????????"@?e?????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(772)
c:\windows\system32\guard32.dll

- - - - - - - > 'lsass.exe'(832)
c:\windows\system32\guard32.dll
.
Completion time: 2009-05-05 10:53
ComboFix-quarantined-files.txt 2009-05-05 15:53
ComboFix2.txt 2009-04-30 16:32
ComboFix3.txt 2009-04-30 13:35

Pre-Run: 34,866,782,208 bytes free
Post-Run: 34,935,820,288 bytes free

326 — E O F — 2009-04-29 17:01

Tomk

Post #15May 5, 2009, 5:01 PM UTC

okieherper,

Let's check out some more files:

Please go to http://virusscan.jotti.org , click on Browse, and upload the following file for analysis:

c:\windows\system32\Down(1).exe <===this file

Then click Submit. Allow the file to be scanned, and then please copy and paste the results here for me to see.

Also check these:
c:\windows\system32\drivers\hihmt.sys
c:\windows\system32\Hide.exe
c:\windows\system32\0005ca37.sys

Please download SDFix and save it to your Desktop.

You should print out these instructions, or copy them to a NotePad file for reading while in Safe Mode, because you will not be able to connect to the Internet to read from this site.

Double click on SDFix.exe. It should automatically extract a folder called SDFix to your system drive (usually C:\). Please reboot your computer in Safe Mode by doing the following :

Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key repeatedly;
Instead of Windows loading as normal, a menu with options should appear;
Select the first option, to run Windows in Safe Mode, then press "Enter".
Choose your usual user account.
Open the SDFix folder and double click on RunThis.bat to start the script.
Type Y and press Enter to begin the script.
It will start cleaning your PC and then prompt you to press any key to Reboot.
Press any key to restart the PC.
Your system will take longer than normal to restart as the fixtool will be removing files.
When the desktop loads the Fixtool will complete the removal and display Finished.
Press any key to end the script and to load your desktop icons.
A text file should automatically open, so please copy the contents and post them here. We also need you to post a new HijackThis log

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] Work computer troubles

✨ Ask AI

Ask AI