Spyware / Malware / Virus Removal

[Closed] Unable to log in into Live Messenger, open up regedit, a

6 min read

Looking for the outcome? Ask AI

Lucernal Topic Starter

Post #1May 5, 2009, 8:11 AM UTC last edited May 5, 2009, 8:26 AM UTC

Hi everyone, I'm seeing some symptoms of Malware infection in my computer, I was wondering if you'd be so kind as to help me out:

1) When trying to run regedit, explorer crashes (restarts)
2) Can't connect to Microsoft Live Messenger (aka MSN Messenger)
3) Couldn't get Avast! or MalwareBytes to do updates… I've uninstalled and installed Norton 15 day trial. None of the AVs I've tried have detected anything out of the ordinary, even with offline updates.
UPDATE: 4) Can't run DOS console cmd.exe

Here is my HJT log… I'd really appreciate any help

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:19:22 AM, on 5/5/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Norton AntiVirus\Engine\16.5.0.134\ccSvcHst.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Sandboxie\SbieSvc.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe
C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WUSB54GC.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\Norton AntiVirus\Engine\16.5.0.134\ccSvcHst.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\PixArt\PAC207\Monitor.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SlickRun\sr.exe
C:\Program Files\Sandboxie\SbieCtrl.exe
C:\Program Files\Marble Mouse Wheel\MarbleScroll.exe
C:\Program Files\Interwise\Participant\pull.exe
C:\Program Files\PowerMenu\PowerMenu.exe
C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.live.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton AntiVirus\Engine\16.5.0.134\IPSBHO.DLL
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Monitor] C:\WINDOWS\PixArt\PAC207\Monitor.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SlickRun] "C:\Program Files\SlickRun\sr.exe"
O4 - HKCU\..\Run: [SandboxieControl] "C:\Program Files\Sandboxie\SbieCtrl.exe"
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2009] C:\Program Files\Uniblue\RegistryBooster\RegistryBooster.exe /S
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: PowerMenu.lnk = C:\Program Files\PowerMenu\PowerMenu.exe
O4 - Global Startup: Marble Mouse Wheel.lnk = C:\Program Files\Marble Mouse Wheel\MarbleScroll.exe
O4 - Global Startup: Push Client.LNK = C:\Program Files\Interwise\Participant\pull.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {8731163E-77B9-4F91-9122-F112521C28AF} (MMSPlayerX Class) - http://mmbox.itelcel.com/mmawap/jsp/compos…r/mmsPlayer.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://emeetings.webex.com/client/T26L10NS…bex/ieatgpc.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O22 - SharedTaskScheduler: Fences - {EC654325-1273-C2A9-2B7C-45A29BCE2FBD} - C:\Program Files\Stardock\Fences\DesktopDock.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Norton AntiVirus - Symantec Corporation - C:\Program Files\Norton AntiVirus\Engine\16.5.0.134\ccSvcHst.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Sandboxie Service (SbieSvc) - tzuk - C:\Program Files\Sandboxie\SbieSvc.exe
O23 - Service: WUSB54GCSVC - GEMTEKS - C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe

–
End of file - 9520 bytes

jpshortstuff

Post #2May 5, 2009, 12:02 PM UTC

Hi,

Please download DaonolFix from the link below and save it to your Desktop
Download Mirror #1

Double-click DaonolFix.exe to run it.
Select 1. Find Daonol (no fix) by typing 1 and pressing Enter.
You will see a lot of files being listed - don't worry, they are just being scanned.
A log will open, please post the contents of that log in your next reply (it can also be found on your desktop, called DaonolFix.txt).

Download ComboFix by sUBs from here or here

Note: If you already have a copy of ComboFix on your system it is essential that you delete it before downloading this copy.

**Save it to your desktop**

We need to disable one or more of your security programs so that they do not interfere with ComboFix.

Please disable Norton via the system tray icon if possible.

Double click on ComboFix.exe & follow the prompts. If you are prompted to install the Recovery Console I recommend you go ahead and hit yes.
When finished, it shall produce a log for you. Please save that log to post in your next reply along with a fresh HJT log

Notes:

Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you - please let me know.
ComboFix disconnects your machine from the internet when it runs. This connection should be automatically restored when ComboFix completes its run. If ComboFix runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

I need to see another log from HijackThis.

Run Hijackthis.
Click on Open the Misc Tools section.
Next click on Open uninstall manager.
Press the Save list button.
Save the file to your desktop, with the default name of uninstall_list
Copy & Paste the entire contents of that file in your in your next post.

Thanks.

Lucernal

Post #3May 5, 2009, 7:18 PM UTC last edited May 5, 2009, 7:43 PM UTC

Hi! Thanks so much for your help.

Here are the logs…

HJT Log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:28:35 PM, on 5/5/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Norton AntiVirus\Engine\16.5.0.134\ccSvcHst.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Sandboxie\SbieSvc.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe
C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WUSB54GC.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\Norton AntiVirus\Engine\16.5.0.134\ccSvcHst.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\PixArt\PAC207\Monitor.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Marble Mouse Wheel\MarbleScroll.exe
C:\Program Files\PowerMenu\PowerMenu.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.live.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton AntiVirus\Engine\16.5.0.134\IPSBHO.DLL
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Monitor] C:\WINDOWS\PixArt\PAC207\Monitor.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SlickRun] "C:\Program Files\SlickRun\sr.exe"
O4 - HKCU\..\Run: [SandboxieControl] "C:\Program Files\Sandboxie\SbieCtrl.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: PowerMenu.lnk = C:\Program Files\PowerMenu\PowerMenu.exe
O4 - Global Startup: Marble Mouse Wheel.lnk = C:\Program Files\Marble Mouse Wheel\MarbleScroll.exe
O4 - Global Startup: Push Client.LNK = C:\Program Files\Interwise\Participant\pull.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {8731163E-77B9-4F91-9122-F112521C28AF} (MMSPlayerX Class) - http://mmbox.itelcel.com/mmawap/jsp/compos…r/mmsPlayer.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://emeetings.webex.com/client/T26L10NS…bex/ieatgpc.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O22 - SharedTaskScheduler: Fences - {EC654325-1273-C2A9-2B7C-45A29BCE2FBD} - C:\Program Files\Stardock\Fences\DesktopDock.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Norton AntiVirus - Symantec Corporation - C:\Program Files\Norton AntiVirus\Engine\16.5.0.134\ccSvcHst.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Sandboxie Service (SbieSvc) - tzuk - C:\Program Files\Sandboxie\SbieSvc.exe
O23 - Service: WUSB54GCSVC - GEMTEKS - C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe

–
End of file - 9133 bytes

uninstall_list
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
Adobe AIR
Adobe AIR
Adobe Anchor Service CS3
Adobe Anchor Service CS4
Adobe Asset Services CS3
Adobe Bridge 1.0
Adobe Bridge CS3
Adobe Bridge CS4
Adobe Bridge Start Meeting
Adobe Camera Raw 4.0
Adobe CMaps CS4
Adobe Color EU Extra Settings CS4
Adobe Color JA Extra Settings CS4
Adobe Color NA Recommended Settings CS4
Adobe Common File Installer
Adobe CSI CS4
Adobe Default Language CS4
Adobe Device Central CS3
Adobe Device Central CS4
Adobe Dreamweaver CS3
Adobe Dreamweaver CS3
Adobe Drive CS4
Adobe Dynamiclink Support
Adobe ExtendScript Toolkit 2
Adobe ExtendScript Toolkit CS4
Adobe Extension Manager CS3
Adobe Extension Manager CS4
Adobe Flash CS4
Adobe Flash CS4 Extension - Flash Lite STI en
Adobe Flash CS4 Professional
Adobe Flash CS4 STI-en
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Help Center 1.0
Adobe Help Viewer CS3
Adobe Linguistics CS4
Adobe Media Encoder CS4
Adobe Media Encoder CS4 Importer
Adobe Media Player
Adobe Output Module
Adobe PDF Library Files CS4
Adobe Photoshop CS2
Adobe Reader 7.0.8
Adobe Search for Help
Adobe Service Manager Extension
Adobe Setup
Adobe Setup
Adobe Stock Photos 1.0
Adobe Type Support CS4
Adobe Update Manager CS3
Adobe Update Manager CS4
Adobe Version Cue CS3 Client
Adobe WinSoft Linguistics Plugin
Adobe XMP Panels CS4
AdobeColorCommonSetCMYK
AdobeColorCommonSetRGB
AmpliTube2
Arturia Minimoog V v1.0
ASIO4ALL
Audacity 1.2.6
AutoHotkey 1.0.48.00
Batch File Renamer 2.51
Bayden SlickRun (remove only)
CamStudio
CamStudio Lossless Codec v1.4
CB Model Pro 1.0 beta
CCleaner (remove only)
Choice Guard
Compact Wireless-G USB Adapter
Conexant D850 56K V.9x DFVc Modem
Connect
Critical Update for Windows Media Player 11 (KB959772)
DAEMON Tools
Digsby
DivX Codec
Doom 3
DVD Flick
eMule
ERUNT 1.1j
Eye 110
Eye 110
EZdrummer
EZXCocktail
EZXDfh
Fences
Fences
FileZilla Client [removed]
FlashDevelop 3.0.0
GameMain
GCFScape 1.7.0
Guitar Synth
Half Life 2
High Definition Audio Driver Package - KB888111
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB946040)
Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB946308)
Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB946344)
Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB947540)
Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB947789)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB942288-v3)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB961118)
ID3-TagIT 3
ImgBurn
Interwise Participant
Izotope Spectron DX v1.0
iZotope Trash DX v1.0.181
iZotope Vinyl 1.6
J2SE Development Kit 5.0 Update 1
Java™ 6 Update 10
Java™ 6 Update 7
K-Lite Codec Pack 4.2.5 (Full)
Korg Legacy Collection v1.0.0.2
kuler
Macromedia Extension Manager
Macromedia Flash 8
Macromedia Flash 8 Video Encoder
Macromedia Flash Player 8
Malwarebytes' Anti-Malware
Marble Mouse Scroll Wheel 0.9
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft SQL Server 2005
Microsoft SQL Server 2005 Express Edition (SQLEXPRESS)
Microsoft SQL Server 2005 Tools Express Edition
Microsoft SQL Server Management Studio Express
Microsoft SQL Server Native Client
Microsoft SQL Server Setup Support Files (English)
Microsoft SQL Server VSS Writer
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual Studio Tools for Applications 2.0 - ENU
Mozilla Firefox (3.0.10)
MSVCRT
MSXML 4.0 SP2 (KB954430)
MSXML 6.0 Parser (KB933579)
MusicLab RealGuitar v1.5
my1stAir
Native Instruments Absynth 2
Norton AntiVirus
Notepad++
NVIDIA Drivers
NVIDIA ForceWare Network Access Manager
Open Subtitle Editor 0.1.1.0
OpenOffice.org 3.0
Ozone DX
Paint.NET v3.22
Panda ActiveScan 2.0
PDF Settings CS4
pdf2image v7.0
Photoshop Camera Raw
Pixel Bender Toolkit
PowerMenu 1.51
QuickTime
RealStrat 1.0
Realtek High Definition Audio Driver
REAPER
ReFX Beast VSTi v1.0
ReFX Junox2 VSTi v1.4
ReFX PlastiCZ VSTi v1.02
ReFX QuadraSID 6581 v1.41
ReFX Vanguard VSTi v1.03 Retail
rgc:audio sfz VSTi v1.96
SampleTank 2.5
Sandboxie 3.34
Security Update for 2007 Microsoft Office System (KB951550)
Security Update for 2007 Microsoft Office System (KB951944)
Security Update for 2007 Microsoft Office System (KB960003)
Security Update for Microsoft Office Excel 2007 (KB959997)
Security Update for Microsoft Office OneNote 2007 (KB950130)
Security Update for Microsoft Office PowerPoint 2007 (KB951338)
Security Update for Microsoft Office Publisher 2007 (KB950114)
Security Update for Microsoft Office system 2007 (KB954326)
Security Update for Microsoft Office system 2007 (KB956828)
Security Update for Microsoft Office Word 2007 (KB956358)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB938127-v2)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Media Encoder (KB954156)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953838)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB961373)
Segoe UI
Series II MIDI
sfArk
shortcircuit
shortcircuit²
Songbird 1.0.0 (20081124)
SPORE™
SSL X-ORCISM v1.1
Steinberg Cubase LE
Subtitle Workshop 2.51
Suite Shared Configuration CS4
TBL BassLine v1.3 VSTi
TestDrive Client
The Sims 2
Toontrack solo
TreeSize Free V2.2.1
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft Office Outlook 2007 (KB952142)
Update for Outlook 2007 Junk Email Filter (kb968503)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update for Windows XP (KB961503)
Update for Windows XP (KB967715)
US122 Driver 3.40
VLC media player 0.9.4
VOCALOID Editor V1.1.1.0
VOCALOID Expression DB (Miriam)
VOCALOID Expression DB (Standard)
VOCALOID SKIN (Zero-G MIRIAM)
VOCALOID Voice DB (Miriam)
VOCALOID VSTi V1.1.1.0
VST Bridge 1.1
Wave Arts MasterVerb
WebEx
Windows Imaging Component
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Essentials
Windows Live Messenger
Windows Live Sign-in Assistant
Windows Live Upload Tool
Windows Media Encoder 9 Series
Windows Media Encoder 9 Series
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
Windows PowerShell™ 1.0
Windows XP Service Pack 3
Wings 3D 0.99.04a
WinRAR archiver
XML Notepad 2007
ZIP PASSWORD FINDER

daonolfix
=====Find Daonol=====

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"aux"="wdmaud.drv"
"aux1"="wdmaud.drv"
"aux2"="wdmaud.drv"
"aux3"="C:\WINDOWS\system32\..\pdvjyrf.drd"
"Midi"="wdmaud.drv"
"midi1"="ma_cmidn.dll"
"midi2"="wdmaud.drv"
"midi3"="wdmaud.drv"
"midi4"="wdmaud.drv"
"midi5"="wdmaud.drv"
"midimapper"="midimap.dll"
"mixer"="wdmaud.drv"
"mixer1"="wdmaud.drv"
"mixer2"="wdmaud.drv"
"mixer3"="wdmaud.drv"
"mixer4"="wdmaud.drv"
"mixer5"="wdmaud.drv"
"msacm.iac2"="C:\WINDOWS\system32\iac25_32.ax"
"msacm.imaadpcm"="imaadp32.acm"
"msacm.l3acm"="C:\WINDOWS\system32\l3codeca.acm"
"msacm.msadpcm"="msadp32.acm"
"msacm.msaudio1"="msaud32.acm"
"msacm.msg711"="msg711.acm"
"msacm.msg723"="msg723.acm"
"msacm.msgsm610"="msgsm32.acm"
"msacm.siren"="sirenacm.dll"
"msacm.sl_anet"="sl_anet.acm"
"msacm.trspch"="tssoft32.acm"
"msacm.vorbis"="vorbis.acm"
"MSVideo8"="VfWWDM32.dll"
"vidc.CSCD"="camcodec.dll"
"vidc.cvid"="iccvid.dll"
"vidc.DIVX"="DivX.dll"
"VIDC.I420"="msh263.drv"
"vidc.iv31"="ir32_32.dll"
"vidc.iv32"="ir32_32.dll"
"vidc.iv41"="ir41_32.ax"
"vidc.iv50"="ir50_32.dll"
"VIDC.IYUV"="iyuv_32.dll"
"vidc.M261"="msh261.drv"
"vidc.M263"="msh263.drv"
"vidc.mrle"="msrle32.dll"
"vidc.msvc"="msvidc32.dll"
"VIDC.UYVY"="msyuv.dll"
"vidc.VP60"="C:\WINDOWS\system32\vp6vfw.dll"
"vidc.VP61"="C:\WINDOWS\system32\vp6vfw.dll"
"VIDC.VP70"="vp7vfw.dll"
"VIDC.YUY2"="msyuv.dll"
"VIDC.YVU9"="tsbyuv.dll"
"VIDC.YVYU"="msyuv.dll"
"wave"="wdmaud.drv"
"wave1"="serwvdrv.dll"
"wave2"="wdmaud.drv"
"wave3"="wdmaud.drv"
"wave4"="wdmaud.drv"
"wave5"="wdmaud.drv"
"wave6"="wdmaud.drv"
"wavemapper"="msacm32.drv"

-=Daonol Files=-
(none found)

-=End Of File=-

Combofix
ComboFix 09-05-04.A3 - Unpoetic Circle 05/05/2009 14:17.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3006.2209 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Norton AntiVirus *On-access scanning disabled* (Updated)
FW: ActiveArmor Firewall *disabled*
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\lsprst7.dll
c:\windows\system32\msvcsv60.dll
c:\windows\system32\ssprs.dll

.
((((((((((((((((((((((((( Files Created from 2009-04-05 to 2009-05-05 )))))))))))))))))))))))))))))))
.

2009-05-05 08:53 . 2009-05-05 08:53 ——– d—–w c:\program files\ERUNT
2009-05-05 08:31 . 2009-05-05 08:31 ——– d—–w C:\Rooter$
2009-05-04 23:11 . 2009-05-04 23:11 ——– d—–w c:\documents and settings\Unpoetic Circle\Local Settings\Application Data\{32A3A4F2-B792-11D6-A78A-00B0D0150010}
2009-05-04 22:40 . 2009-05-04 22:40 ——– d—–w c:\program files\BlazeDS
2009-05-04 09:30 . 2009-05-04 09:30 ——– d—–w c:\documents and settings\Unpoetic Circle\Application Data\Uniblue
2009-05-04 08:15 . 2009-05-04 08:15 ——– d—–w c:\documents and settings\Unpoetic Circle\Local Settings\Application Data\Symantec
2009-05-04 08:13 . 2009-05-04 08:13 36400 —-a-r c:\windows\system32\drivers\SymIM.sys
2009-05-04 08:13 . 2009-05-04 08:13 60808 —-a-w c:\windows\system32\S32EVNT1.DLL
2009-05-04 08:13 . 2009-05-04 08:13 124464 —-a-w c:\windows\system32\drivers\SYMEVENT.SYS
2009-05-04 08:13 . 2009-05-04 08:25 ——– d—–w c:\program files\Common Files\Symantec Shared
2009-05-04 08:13 . 2009-05-04 08:13 ——– d—–w c:\program files\Symantec
2009-05-04 08:13 . 2009-05-04 08:13 ——– d—–w c:\windows\system32\drivers\NAV
2009-05-04 08:13 . 2009-05-04 08:13 ——– d—–w c:\program files\Norton AntiVirus
2009-05-04 08:13 . 2009-05-04 08:13 ——– d—–w c:\program files\Windows Sidebar
2009-05-04 08:13 . 2009-05-04 14:17 ——– d—–w c:\documents and settings\All Users\Application Data\Symantec
2009-05-04 08:13 . 2009-05-04 08:17 ——– d—–w c:\documents and settings\All Users\Application Data\Norton
2009-05-04 08:12 . 2009-05-04 08:12 ——– d—–w c:\program files\NortonInstaller
2009-05-04 07:47 . 2009-05-04 07:47 ——– d—–w c:\documents and settings\All Users\Application Data\NortonInstaller
2009-05-04 07:22 . 2009-05-04 08:02 ——– d—–w c:\documents and settings\Unpoetic Circle\Application Data\GetRightToGo
2009-05-04 06:31 . 2009-05-04 08:37 ——– d–h–w c:\windows\system32\GroupPolicy
2009-05-04 02:36 . 2009-05-04 08:04 ——– d—–w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-05-04 02:29 . 2009-05-04 02:29 ——– d—–w c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2009-05-04 00:17 . 2009-05-04 00:17 ——– d—–w c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2009-05-03 23:38 . 2009-05-03 23:38 ——– d—–w c:\documents and settings\Administrator\Application Data\Stardock
2009-05-02 20:07 . 2004-03-18 00:54 163840 —-a-w c:\windows\system32\ArtFfct.dll
2009-05-02 20:07 . 2009-05-02 20:07 ——– d—–w c:\program files\Arturia
2009-05-01 22:41 . 2009-05-01 22:43 4909440 —-a-w c:\temp\Silverlight.2.0.exe
2009-04-30 00:47 . 2009-04-30 00:47 ——– d—–w c:\documents and settings\Unpoetic Circle\Library
2009-04-30 00:02 . 2009-04-30 00:02 ——– d—–w c:\program files\GameMain
2009-04-29 23:17 . 2009-04-29 23:17 ——– d—–w c:\program files\my1stAir
2009-04-29 16:06 . 2009-05-04 02:27 1324 —-a-w c:\windows\system32\d3d9caps.dat
2009-04-29 01:54 . 2009-04-29 01:54 ——– d—–w c:\documents and settings\Unpoetic Circle\Local Settings\Application Data\TechSmith
2009-04-29 01:15 . 2009-04-29 01:15 ——– d—–w c:\temp\gs
2009-04-28 18:30 . 2009-04-28 18:30 ——– d—–w c:\documents and settings\All Users\Application Data\Digsby
2009-04-28 18:28 . 2009-04-28 18:32 ——– d—–w c:\documents and settings\Unpoetic Circle\Local Settings\Application Data\Digsby
2009-04-28 18:28 . 2009-04-28 18:30 ——– d—–w c:\documents and settings\Unpoetic Circle\Application Data\Digsby
2009-04-28 18:28 . 2009-04-28 18:30 ——– d—–w c:\program files\Digsby
2009-04-27 23:11 . 2000-05-16 15:40 83968 —-a-w c:\windows\UnGins.exe
2009-04-27 23:11 . 2009-04-27 23:11 ——– d—–w c:\program files\ZIP PASSWORD FINDER
2009-04-21 05:52 . 2009-04-21 05:52 ——– d—–w c:\documents and settings\Unpoetic Circle\Application Data\JAM Software
2009-04-21 05:52 . 2009-04-21 05:52 ——– d—–w c:\program files\JAM Software
2009-04-21 05:31 . 2009-04-21 05:31 ——– d—–w c:\windows\system32\windows media
2009-04-21 05:30 . 2009-04-21 05:31 ——– d–h–w c:\windows\msdownld.tmp
2009-04-21 05:30 . 2009-04-21 05:30 ——– d—–w c:\program files\Windows Media Components
2009-04-20 17:42 . 2009-04-20 17:42 ——– d—–w c:\program files\Adobe Media Player
2009-04-20 05:15 . 2009-04-20 05:23 ——– d—–w c:\documents and settings\All Users\Application Data\WinZip
2009-04-20 04:56 . 2009-04-20 04:56 ——– d—–w c:\temp\container
2009-04-20 00:43 . 2009-04-20 00:43 ——– d—–w c:\program files\Batch File Renamer 2.51
2009-04-20 00:42 . 2009-04-20 00:43 ——– d—–w c:\documents and settings\Unpoetic Circle\Application Data\ID3-TagIT 3
2009-04-20 00:42 . 2009-04-20 00:42 ——– d—–w c:\program files\ID3-TagIT 3
2009-04-20 00:42 . 2009-04-20 00:42 ——– d—–w c:\documents and settings\All Users\Application Data\ID3-TagIT 3
2009-04-18 23:09 . 2009-04-18 23:09 1024 —-a-w c:\windows\system32\PDF2IMG.dat
2009-04-18 23:02 . 2009-04-18 23:02 ——– d—–w c:\program files\Visual Integrity
2009-04-18 22:26 . 2006-10-27 00:56 32592 —-a-w c:\windows\system32\msonpmon.dll
2009-04-18 22:25 . 2009-04-18 22:25 ——– d—–w c:\program files\Microsoft Works
2009-04-18 22:23 . 2009-04-18 22:23 ——– d—–w c:\program files\Microsoft Visual Studio 8
2009-04-18 22:21 . 2009-04-18 22:21 ——– d–h–r C:\MSOCache
2009-04-16 04:23 . 2009-03-06 14:22 284160 -c—-w c:\windows\system32\dllcache\pdh.dll
2009-04-16 04:23 . 2009-02-09 12:10 401408 -c—-w c:\windows\system32\dllcache\rpcss.dll
2009-04-16 04:23 . 2009-02-06 11:11 110592 -c—-w c:\windows\system32\dllcache\services.exe
2009-04-16 04:23 . 2009-02-09 12:10 473600 -c—-w c:\windows\system32\dllcache\fastprox.dll
2009-04-16 04:23 . 2009-02-06 10:10 227840 -c—-w c:\windows\system32\dllcache\wmiprvse.exe
2009-04-16 04:23 . 2009-02-09 12:10 453120 -c—-w c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-16 04:23 . 2009-02-09 12:10 729088 -c—-w c:\windows\system32\dllcache\lsasrv.dll
2009-04-16 04:23 . 2009-02-09 12:10 617472 -c—-w c:\windows\system32\dllcache\advapi32.dll
2009-04-16 04:23 . 2009-02-09 12:10 714752 -c—-w c:\windows\system32\dllcache\ntdll.dll
2009-04-16 04:20 . 2008-05-03 11:55 2560 ——w c:\windows\system32\xpsp4res.dll
2009-04-16 04:20 . 2008-04-21 12:08 215552 -c—-w c:\windows\system32\dllcache\wordpad.exe
2009-04-16 00:56 . 2009-04-16 00:57 ——– d—–w c:\documents and settings\Unpoetic Circle\Local Settings\Application Data\ATT Connect
2009-04-16 00:56 . 2009-04-16 00:56 ——– d—–w c:\documents and settings\Unpoetic Circle\Local Settings\Application Data\Downloaded Installations
2009-04-15 05:51 . 2009-05-04 09:13 ——– d—–w c:\program files\vanBasco's Karaoke Player
2009-04-15 05:48 . 2004-08-04 12:00 11907 —-a-w c:\windows\Rop12.exe
2009-04-15 05:48 . 2004-08-04 12:00 12955 —-a-w c:\windows\Guxbpi.dll
2009-04-15 05:48 . 2004-08-04 12:00 14643 —-a-w c:\windows\system\Pcisys32.drv
2009-04-15 05:48 . 2004-08-04 12:00 18466 —-a-w c:\windows\system\Mxp32z.dll
2009-04-14 01:49 . 2009-04-14 01:54 ——– d—–w c:\program files\VOCALOID
2009-04-13 05:21 . 2009-04-20 01:33 ——– d—–w c:\program files\Abyss Web Server
2009-04-13 02:11 . 2009-04-13 02:11 ——– d—–w c:\documents and settings\Unpoetic Circle\Application Data\Stardock
2009-04-13 02:10 . 2009-04-13 02:10 ——– dc-h–w c:\documents and settings\All Users\Application Data\{067CEB81-A49B-4597-9505-A5515881D672}
2009-04-13 02:10 . 2009-04-13 02:10 ——– d—–w c:\program files\Stardock
2009-04-12 17:20 . 2009-04-12 17:20 ——– d—–w c:\program files\Common Files\Adobe AIR
2009-04-11 23:59 . 2008-10-01 00:35 65536 —-a-w c:\windows\system32\camcodec.dll
2009-04-11 23:59 . 2009-04-11 23:59 695578 —-a-w c:\windows\system32\unins000.exe
2009-04-11 23:59 . 2009-04-11 23:59 1081 —-a-w c:\windows\system32\unins000.dat
2009-04-11 23:59 . 2009-04-21 00:43 ——– d—–w c:\program files\CamStudio
2009-04-11 21:24 . 2009-04-20 06:34 ——– d—–w c:\documents and settings\Unpoetic Circle\Application Data\FileZilla
2009-04-11 21:23 . 2009-04-11 21:23 ——– d—–w c:\program files\FileZilla FTP Client
2009-04-08 07:56 . 2009-04-08 07:56 ——– d—–w c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-04-08 05:47 . 2009-04-08 05:47 ——– d—–w c:\documents and settings\Unpoetic Circle\Application Data\Malwarebytes
2009-04-08 05:47 . 2009-04-06 20:32 15504 —-a-w c:\windows\system32\drivers\mbam.sys
2009-04-08 05:47 . 2009-04-06 20:32 38496 —-a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-08 05:47 . 2009-04-08 05:47 ——– d—–w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-04-08 05:47 . 2009-05-05 08:56 ——– d—–w c:\program files\Malwarebytes' Anti-Malware
2009-04-08 00:58 . 2009-04-08 00:58 ——– d—–w c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-04-08 00:58 . 2009-04-08 08:06 ——– d—–w c:\program files\SUPERAntiSpyware
2009-04-08 00:58 . 2009-04-08 08:06 ——– d—–w c:\documents and settings\Unpoetic Circle\Application Data\SUPERAntiSpyware.com
2009-04-07 05:47 . 2009-04-07 05:47 ——– d—–w c:\documents and settings\Unpoetic Circle\Application Data\OpenOffice.org
2009-04-07 03:51 . 2009-04-07 03:51 ——– d—–w c:\program files\JRE
2009-04-07 03:50 . 2009-04-07 03:51 ——– d—–w c:\program files\OpenOffice.org 3
2009-04-07 03:50 . 2009-04-07 03:50 ——– d—–w c:\program files\Common Files\Java
2009-04-07 02:39 . 2009-04-07 02:39 ——– d—–w c:\documents and settings\Unpoetic Circle\AbiSuite
2009-04-07 02:39 . 2009-04-13 02:27 ——– d—–w c:\program files\AbiSuite2
2009-04-07 01:42 . 2008-06-19 21:24 28544 —-a-w c:\windows\system32\drivers\pavboot.sys
2009-04-07 01:39 . 2009-04-07 01:39 ——– d—–w c:\program files\Panda Security
2009-04-06 03:57 . 2009-04-06 03:57 ——– d—–w c:\program files\Alwil Software
2009-04-06 03:42 . 2009-04-06 03:42 102664 —-a-w c:\windows\system32\drivers\tmcomm.sys
2009-04-06 03:41 . 2009-04-06 03:48 ——– d—–w c:\documents and settings\Unpoetic Circle\.housecall6.6

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-04 23:12 . 2008-11-26 13:50 ——– d—–w c:\program files\Java
2009-05-04 22:07 . 2009-02-27 05:58 ——– d—–w c:\program files\Songbird
2009-05-04 09:12 . 2008-12-14 23:22 ——– d—–w c:\program files\PicLensIE
2009-05-04 08:47 . 2008-10-26 00:38 ——– d—–w c:\program files\Common Files\Wise Installation Wizard
2009-05-04 08:13 . 2009-05-04 08:13 805 —-a-w c:\windows\system32\drivers\SYMEVENT.INF
2009-05-04 08:13 . 2009-05-04 08:13 7386 —-a-w c:\windows\system32\drivers\SYMEVENT.CAT
2009-05-03 22:33 . 2008-09-22 03:28 32 —-a-w c:\windows\msocreg32.dat
2009-05-03 21:44 . 2008-11-08 21:46 ——– d—–w c:\program files\DOSBox-0.72
2009-05-02 20:51 . 2008-09-22 03:17 ——– d—–w c:\program files\VstPlugins
2009-05-02 20:18 . 2008-09-22 02:50 ——– d—–w c:\program files\REAPER
2009-05-02 10:36 . 2008-09-23 01:56 261136 —-a-w c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-04-29 23:02 . 2008-08-14 13:57 73312 —-a-w c:\windows\system32\drivers\adfs.sys
2009-04-23 07:35 . 2009-03-19 09:09 ——– d—–w c:\program files\XML Notepad 2007
2009-04-23 07:35 . 2008-10-03 04:26 ——– d—–w c:\program files\Windows Media Connect 2
2009-04-21 04:31 . 2008-09-22 01:45 96464 —-a-w c:\documents and settings\Unpoetic Circle\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-20 01:33 . 2008-09-21 22:39 ——– d—–w c:\program files\Compact Wireless-G USB Adapter Wireless Network Monitor
2009-04-18 22:25 . 2008-09-23 01:56 ——– d—–w c:\program files\MSBuild
2009-04-14 01:54 . 2008-10-18 23:26 ——– d—–w c:\program files\Steinberg
2009-04-14 01:54 . 2008-09-21 22:40 ——– d–h–w c:\program files\InstallShield Installation Information
2009-04-08 06:04 . 2008-11-12 00:17 ——– d—–w c:\program files\Corel
2009-04-08 05:57 . 2008-11-10 07:32 ——– d—–w c:\program files\MeldaProduction MDrummer 2 Small
2009-04-08 01:06 . 2008-10-23 04:24 ——– d—–w c:\program files\gnucash
2009-03-22 19:42 . 2009-03-22 19:42 ——– d—–w c:\program files\AutoHotkey
2009-03-20 03:45 . 2008-10-05 00:47 ——– d—–w c:\program files\Common Files\Adobe
2009-03-20 03:43 . 2009-03-20 03:43 ——– d—–w c:\program files\Common Files\Adobe Systems Shared
2009-03-19 09:21 . 2009-03-19 09:21 ——– d—–w c:\program files\Bonjour
2009-03-19 09:12 . 2009-03-19 09:12 ——– d—–w c:\program files\Notepad++
2009-03-19 09:07 . 2008-09-23 05:46 ——– d—–w c:\program files\Microsoft SQL Server
2009-03-19 06:12 . 2009-03-19 06:11 ——– d—–w c:\program files\Common Files\Macromedia
2009-03-19 06:12 . 2009-03-19 06:11 ——– d—–w c:\program files\Macromedia
2009-03-18 05:36 . 2009-01-25 19:54 ——– d—–w c:\program files\Pass4sure Test Environment
2009-03-18 05:36 . 2009-02-20 07:04 ——– d—–w c:\program files\Myst
2009-03-17 10:42 . 2009-03-17 10:42 ——– d—–w c:\program files\FlashDevelop
2009-03-17 00:49 . 2009-03-17 00:49 ——– d—–w c:\program files\Marble Mouse Wheel
2009-03-16 06:38 . 2009-03-16 06:38 ——– d—–w c:\program files\Common Files\Macrovision Shared
2009-03-16 06:29 . 2008-11-01 20:09 ——– d—–w c:\program files\Sandboxie
2009-03-06 14:22 . 2004-08-04 12:00 284160 —-a-w c:\windows\system32\pdh.dll
2009-03-03 00:18 . 2004-08-04 12:00 826368 —-a-w c:\windows\system32\wininet.dll
2009-02-20 18:09 . 2004-08-04 12:00 78336 —-a-w c:\windows\system32\ieencode.dll
2009-02-17 05:17 . 2008-09-22 01:29 453152 —-a-w c:\windows\system32\NVUNINST.EXE
2009-02-09 12:10 . 2004-08-04 12:00 729088 —-a-w c:\windows\system32\lsasrv.dll
2009-02-09 12:10 . 2004-08-04 12:00 714752 —-a-w c:\windows\system32\ntdll.dll
2009-02-09 12:10 . 2004-08-04 12:00 617472 —-a-w c:\windows\system32\advapi32.dll
2009-02-09 12:10 . 2004-08-04 12:00 401408 —-a-w c:\windows\system32\rpcss.dll
2009-02-09 11:13 . 2004-08-04 12:00 1846784 —-a-w c:\windows\system32\win32k.sys
2009-02-07 00:52 . 2009-02-07 00:52 49504 —-a-w c:\windows\system32\sirenacm.dll
2009-02-06 11:11 . 2004-08-04 12:00 110592 —-a-w c:\windows\system32\services.exe
2009-02-06 11:06 . 2004-08-04 12:00 2145280 —-a-w c:\windows\system32\ntoskrnl.exe
2009-02-06 10:39 . 2004-08-04 12:00 35328 —-a-w c:\windows\system32\sc.exe
2009-02-06 10:32 . 2004-08-03 22:59 2023936 —-a-w c:\windows\system32\ntkrnlpa.exe
2009-02-15 22:35 . 2009-02-15 22:35 27976 —-a-w c:\program files\mozilla firefox\plugins\atgpcdec.dll
2009-02-15 22:35 . 2009-02-15 22:35 125848 —-a-w c:\program files\mozilla firefox\plugins\atgpcext.dll
2009-02-15 22:35 . 2009-02-15 22:36 46408 —-a-w c:\program files\mozilla firefox\plugins\atmccli.dll
2009-02-15 22:36 . 2009-02-15 22:36 98704 —-a-w c:\program files\mozilla firefox\plugins\ieatgpc.dll
2008-12-27 01:02 . 2008-11-12 00:21 56 –sh–r c:\windows\system32\A390807B96.sys
2008-12-27 01:02 . 2008-11-12 00:17 3766 –sha-w c:\windows\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"SlickRun"="c:\program files\SlickRun\sr.exe" [2007-03-21 187392]
"SandboxieControl"="c:\program files\Sandboxie\SbieCtrl.exe" [2009-01-05 336896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-02-18 13680640]
"Monitor"="c:\windows\PixArt\PAC207\Monitor.exe" [2006-11-03 319488]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-12-03 282624]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-26 136600]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-02-18 86016]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2009-03-11 611712]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"IMEKRMIG6.1"="c:\windows\ime\imkr6_1\IMEKRMIG.EXE" [2004-08-04 44032]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-07-05 16380416]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2009-02-18 1657376]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" - c:\windows\system32\narrator.exe [2008-04-14 53760]

c:\documents and settings\Unpoetic Circle\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
PowerMenu.lnk - c:\program files\PowerMenu\PowerMenu.exe [2002-12-19 57344]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Marble Mouse Wheel.lnk - c:\program files\Marble Mouse Wheel\MarbleScroll.exe [2009-3-16 761856]
Push Client.LNK - c:\program files\Interwise\Participant\pull.exe [2009-2-15 843776]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler]
"{EC654325-1273-C2A9-2B7C-45A29BCE2FBD}"= "c:\program files\Stardock\Fences\DesktopDock.dll" [2009-02-25 517480]

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32
"wave1"= serwvdrv.dll
"midi1"= ma_cmidn.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]
@="FSFilter Activity Monitor"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"=
"c:\\Program Files\\cognos\\c8\\bin\\cogconfigw.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\Valve\\Half Life 2\\hl2.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Songbird\\songbird.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"f:\\Games\\Black And White\\runblack.exe"=
"c:\\Temp\\games\\bw\\runblack.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Abyss Web Server\\abyssws.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Digsby\\lib\\digsby-app.exe"=
"c:\\Program Files\\Adobe\\Adobe Flash CS4\\Flash.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4

R3 EWAVE;EWAVE;c:\windows\system32\drivers\ew.sys [2004-09-30 1693344]
R3 FILESPY;FILESPY;c:\windows\system32\drivers\FILESPY.sys [2004-09-30 26992]
R3 GP2MPM;GP2MPM;c:\windows\system32\drivers\GP2MPM.SYS [2004-09-30 37600]
R3 NSTATION;NSTATION;c:\windows\system32\drivers\nstation.sys [2004-09-30 19808]
R3 PAC207;Eye 110;c:\windows\system32\DRIVERS\PFC027.SYS [2006-12-05 507136]
R3 US122;US122 Driver;c:\windows\system32\Drivers\US122.sys [2007-08-29 131968]
R3 US122DL;US122 Firmware Downloader;c:\windows\system32\Drivers\US122DL.sys [2007-08-29 18304]
R3 Us122WdmService;US122 Wdm Audio;c:\windows\system32\Drivers\US122Wdm.sys [2007-08-29 39168]
S0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2008-06-19 28544]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NAV\1005000.086\SYMEFA.SYS [2009-05-04 310320]
S1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\NAV\1005000.086\BHDrvx86.sys [2009-05-04 258608]
S1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NAV\1005000.086\ccHPx86.sys [2009-05-04 482352]
S1 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\ipsdefs\20090501.001\IDSxpx86.sys [2009-05-04 276344]
S2 Norton AntiVirus;Norton AntiVirus;c:\program files\Norton AntiVirus\Engine\16.5.0.134\ccSvcHst.exe [2009-05-04 115560]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2009-05-04 101936]
S3 SbieDrv;SbieDrv;c:\program files\Sandboxie\SbieDrv.sys [2009-01-05 103936]

— Other Services/Drivers In Memory —

*NewlyCreated* - GTNDIS5
*Deregistered* - TapiSrv
*Deregistered* - TermService
*Deregistered* - Themes
*Deregistered* - TrkWks
*Deregistered* - W32Time
*Deregistered* - WebClient
*Deregistered* - winmgmt
*Deregistered* - wscsvc
*Deregistered* - wuauserv
*Deregistered* - WudfSvc
*Deregistered* - WUSB54GCSVC
*Deregistered* - WZCSVC

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{72c45515-28a7-11de-b28b-001a70ad7b89}]
\Shell\AutoRun\command - J:\g1ljsm.com
\Shell\open\Command - J:\g1ljsm.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9c0c6ae4-b371-11dd-ab41-001aa08000ef}]
\Shell\AutoRun\command - G:\AutoTransfer.exe
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-Uniblue RegistryBooster 2009 - c:\program files\Uniblue\RegistryBooster\RegistryBooster.exe

.
——- Supplementary Scan ——-
.
uStart Page = hxxp://home.live.com/
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
DPF: {8731163E-77B9-4F91-9122-F112521C28AF} - hxxp://mmbox.itelcel.com/mmawap/jsp/composer/player/mmsPlayer.cab
FF - ProfilePath - c:\documents and settings\Unpoetic Circle\Application Data\Mozilla\Firefox\Profiles\jxyh7qke.default\
FF - prefs.js: browser.startup.homepage - hxxp://keyboardr.com/
FF - component: c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\IPSFFPlgn\components\IPSFFPl.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npatgpc.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-05 14:18
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Norton AntiVirus]
"ImagePath"="\"c:\program files\Norton AntiVirus\Engine\16.5.0.134\ccSvcHst.exe\" /s \"Norton AntiVirus\" /m \"c:\program files\Norton AntiVirus\Engine\16.5.0.134\diMaster.dll\" /prefetch:1"
.
Completion time: 2009-05-05 14:19
ComboFix-quarantined-files.txt 2009-05-05 19:19

Pre-Run: 23,864,889,344 bytes free
Post-Run: 23,855,558,656 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(3)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(3)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

320 — E O F — 2009-04-30 08:01

jpshortstuff

Post #4May 5, 2009, 7:49 PM UTC

Hi,

Before we perform the next step, I would just like to check a few things out.

Please go to this site:
Bleeping Computer Submission

Please paste a link to this topic in the first field. Browse to the following file:
C:\WINDOWS\pdvjyrf.drd

Click Send File.

We need to upload a file to Jotti

1. Click HERE to get to Jotti's site.

2. At the top of the Jotti window, use the Browse button to locate the following file on your system:

c:\windows\Rop12.exe

3. Once you have located the file, click SUBMIT and the content of the file will be uploaded by the site and analysed.

4. Please provide me with the results of the analysis.

5. Please repeat steps 2-4 for the following files:
c:\windows\system\Mxp32z.dll

Thanks.

Lucernal

Post #5May 5, 2009, 9:19 PM UTC

1. Uploaded drd file 2. Jotti's analysis on rop12.exe Scan taken on 05 May 2009 20:55:36 (GMT) A-Squared Found nothing AntiVir Found nothing ArcaVir Found nothing Avast Found nothing AVG Antivirus Found nothing BitDefender Found nothing ClamAV Found nothing CPsecure Found nothing Dr.Web Found nothing F-Prot Antivirus Found nothing F-Secure Anti-Virus Found nothing Ikarus Found nothing Kaspersky Anti-Virus Found nothing NOD32 Found nothing Norman Virus Control Found nothing Panda Antivirus Found nothing Quick Heal Found nothing Sophos Antivirus Found nothing VirusBuster Found nothing VBA32 Found nothing 3. Jotti on the dll file Scan taken on 05 May 2009 21:15:57 (GMT) A-Squared Found nothing AntiVir Found nothing ArcaVir Found nothing Avast Found nothing AVG Antivirus Found nothing BitDefender Found nothing ClamAV Found nothing CPsecure Found nothing Dr.Web Found nothing F-Prot Antivirus Found nothing F-Secure Anti-Virus Found nothing Ikarus Found nothing Kaspersky Anti-Virus Found nothing NOD32 Found nothing Norman Virus Control Found nothing Panda Antivirus Found nothing Quick Heal Found nothing Sophos Antivirus Found nothing VirusBuster Found nothing VBA32 Found nothing Thanks!!

jpshortstuff

Post #6May 6, 2009, 6:14 AM UTC

Hi,

Thanks for that.

1. Please open Notepad

Click Start , then Run
Type notepad.exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

File::
C:\WINDOWS\pdvjyrf.drd

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"aux3"=-
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{72c45515-28a7-11de-b28b-001a70ad7b89}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9c0c6ae4-b371-11dd-ab41-001aa08000ef}]

FileLook::
c:\windows\Rop12.exe

3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

[external image: Posted Image]

5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

Combofix.txt
A new HijackThis log.

Click Start >> Control Panel >> Add/Remove Programs and Remove this old version of Java:
Java™ 6 Update 7

I recommend you also Update Java to the latest version.

Please go to Kaspersky website and perform an online antivirus scan.

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
- Spyware, Adware, Dialers, and other potentially dangerous programs
  Archives
  Mail databases
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As….
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
Please post this log in your next reply.

Let me know how things are running.

Lucernal

Post #7May 6, 2009, 4:22 PM UTC last edited May 6, 2009, 6:05 PM UTC

Hi, here are the results:

Combofix
ComboFix 09-05-05.03 - Unpoetic Circle 05/06/2009 2:17.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3006.2268 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Unpoetic Circle\Desktop\CFScript.txt
AV: Norton AntiVirus *On-access scanning disabled* (Updated)
FW: ActiveArmor Firewall *disabled*

FILE ::
c:\windows\pdvjyrf.drd
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\pdvjyrf.drd

.
((((((((((((((((((((((((( Files Created from 2009-04-06 to 2009-05-06 )))))))))))))))))))))))))))))))
.

2009-05-05 08:31 . 2009-05-05 08:31 ——– d—–w C:\Rooter$
2009-05-04 23:11 . 2009-05-04 23:11 ——– d—–w c:\documents and settings\Unpoetic Circle\Local Settings\Application Data\{32A3A4F2-B792-11D6-A78A-00B0D0150010}
2009-05-04 22:40 . 2009-05-04 22:40 ——– d—–w c:\program files\BlazeDS
2009-05-04 09:30 . 2009-05-04 09:30 ——– d—–w c:\documents and settings\Unpoetic Circle\Application Data\Uniblue
2009-05-04 08:15 . 2009-05-04 08:15 ——– d—–w c:\documents and settings\Unpoetic Circle\Local Settings\Application Data\Symantec
2009-05-04 08:13 . 2009-05-04 08:13 36400 —-a-r c:\windows\system32\drivers\SymIM.sys
2009-05-04 08:13 . 2009-05-04 08:13 60808 —-a-w c:\windows\system32\S32EVNT1.DLL
2009-05-04 08:13 . 2009-05-04 08:13 124464 —-a-w c:\windows\system32\drivers\SYMEVENT.SYS
2009-05-04 08:13 . 2009-05-04 08:25 ——– d—–w c:\program files\Common Files\Symantec Shared
2009-05-04 08:13 . 2009-05-04 08:13 ——– d—–w c:\program files\Symantec
2009-05-04 08:13 . 2009-05-04 08:13 ——– d—–w c:\windows\system32\drivers\NAV
2009-05-04 08:13 . 2009-05-04 08:13 ——– d—–w c:\program files\Norton AntiVirus
2009-05-04 08:13 . 2009-05-04 08:13 ——– d—–w c:\program files\Windows Sidebar
2009-05-04 08:13 . 2009-05-04 14:17 ——– d—–w c:\documents and settings\All Users\Application Data\Symantec
2009-05-04 08:13 . 2009-05-04 08:17 ——– d—–w c:\documents and settings\All Users\Application Data\Norton
2009-05-04 08:12 . 2009-05-04 08:12 ——– d—–w c:\program files\NortonInstaller
2009-05-04 07:47 . 2009-05-04 07:47 ——– d—–w c:\documents and settings\All Users\Application Data\NortonInstaller
2009-05-04 07:22 . 2009-05-04 08:02 ——– d—–w c:\documents and settings\Unpoetic Circle\Application Data\GetRightToGo
2009-05-04 06:31 . 2009-05-04 08:37 ——– d–h–w c:\windows\system32\GroupPolicy
2009-05-04 02:36 . 2009-05-04 08:04 ——– d—–w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-05-04 02:29 . 2009-05-04 02:29 ——– d—–w c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2009-05-04 00:17 . 2009-05-04 00:17 ——– d—–w c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2009-05-03 23:38 . 2009-05-03 23:38 ——– d—–w c:\documents and settings\Administrator\Application Data\Stardock
2009-05-02 20:07 . 2004-03-18 00:54 163840 —-a-w c:\windows\system32\ArtFfct.dll
2009-05-02 20:07 . 2009-05-02 20:07 ——– d—–w c:\program files\Arturia
2009-05-01 22:41 . 2009-05-01 22:43 4909440 —-a-w c:\temp\Silverlight.2.0.exe
2009-04-30 00:47 . 2009-04-30 00:47 ——– d—–w c:\documents and settings\Unpoetic Circle\Library
2009-04-30 00:02 . 2009-04-30 00:02 ——– d—–w c:\program files\GameMain
2009-04-29 23:17 . 2009-04-29 23:17 ——– d—–w c:\program files\my1stAir
2009-04-29 16:06 . 2009-05-04 02:27 1324 —-a-w c:\windows\system32\d3d9caps.dat
2009-04-29 01:54 . 2009-04-29 01:54 ——– d—–w c:\documents and settings\Unpoetic Circle\Local Settings\Application Data\TechSmith
2009-04-29 01:15 . 2009-04-29 01:15 ——– d—–w c:\temp\gs
2009-04-28 18:30 . 2009-04-28 18:30 ——– d—–w c:\documents and settings\All Users\Application Data\Digsby
2009-04-28 18:28 . 2009-04-28 18:32 ——– d—–w c:\documents and settings\Unpoetic Circle\Local Settings\Application Data\Digsby
2009-04-28 18:28 . 2009-04-28 18:30 ——– d—–w c:\documents and settings\Unpoetic Circle\Application Data\Digsby
2009-04-28 18:28 . 2009-04-28 18:30 ——– d—–w c:\program files\Digsby
2009-04-27 23:11 . 2000-05-16 15:40 83968 —-a-w c:\windows\UnGins.exe
2009-04-27 23:11 . 2009-04-27 23:11 ——– d—–w c:\program files\ZIP PASSWORD FINDER
2009-04-21 05:52 . 2009-04-21 05:52 ——– d—–w c:\documents and settings\Unpoetic Circle\Application Data\JAM Software
2009-04-21 05:52 . 2009-04-21 05:52 ——– d—–w c:\program files\JAM Software
2009-04-21 05:31 . 2009-04-21 05:31 ——– d—–w c:\windows\system32\windows media
2009-04-21 05:30 . 2009-04-21 05:31 ——– d–h–w c:\windows\msdownld.tmp
2009-04-21 05:30 . 2009-04-21 05:30 ——– d—–w c:\program files\Windows Media Components
2009-04-20 17:42 . 2009-04-20 17:42 ——– d—–w c:\program files\Adobe Media Player
2009-04-20 05:15 . 2009-04-20 05:23 ——– d—–w c:\documents and settings\All Users\Application Data\WinZip
2009-04-20 04:56 . 2009-04-20 04:56 ——– d—–w c:\temp\container
2009-04-20 00:43 . 2009-04-20 00:43 ——– d—–w c:\program files\Batch File Renamer 2.51
2009-04-20 00:42 . 2009-04-20 00:43 ——– d—–w c:\documents and settings\Unpoetic Circle\Application Data\ID3-TagIT 3
2009-04-20 00:42 . 2009-04-20 00:42 ——– d—–w c:\program files\ID3-TagIT 3
2009-04-20 00:42 . 2009-04-20 00:42 ——– d—–w c:\documents and settings\All Users\Application Data\ID3-TagIT 3
2009-04-18 23:09 . 2009-04-18 23:09 1024 —-a-w c:\windows\system32\PDF2IMG.dat
2009-04-18 23:02 . 2009-04-18 23:02 ——– d—–w c:\program files\Visual Integrity
2009-04-18 22:26 . 2006-10-27 00:56 32592 —-a-w c:\windows\system32\msonpmon.dll
2009-04-18 22:25 . 2009-04-18 22:25 ——– d—–w c:\program files\Microsoft Works
2009-04-18 22:23 . 2009-04-18 22:23 ——– d—–w c:\program files\Microsoft Visual Studio 8
2009-04-18 22:21 . 2009-04-18 22:21 ——– d–h–r C:\MSOCache
2009-04-16 04:23 . 2009-03-06 14:22 284160 -c—-w c:\windows\system32\dllcache\pdh.dll
2009-04-16 04:23 . 2009-02-09 12:10 401408 -c—-w c:\windows\system32\dllcache\rpcss.dll
2009-04-16 04:23 . 2009-02-06 11:11 110592 -c—-w c:\windows\system32\dllcache\services.exe
2009-04-16 04:23 . 2009-02-09 12:10 473600 -c—-w c:\windows\system32\dllcache\fastprox.dll
2009-04-16 04:23 . 2009-02-06 10:10 227840 -c—-w c:\windows\system32\dllcache\wmiprvse.exe
2009-04-16 04:23 . 2009-02-09 12:10 453120 -c—-w c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-16 04:23 . 2009-02-09 12:10 729088 -c—-w c:\windows\system32\dllcache\lsasrv.dll
2009-04-16 04:23 . 2009-02-09 12:10 617472 -c—-w c:\windows\system32\dllcache\advapi32.dll
2009-04-16 04:23 . 2009-02-09 12:10 714752 -c—-w c:\windows\system32\dllcache\ntdll.dll
2009-04-16 04:20 . 2008-05-03 11:55 2560 ——w c:\windows\system32\xpsp4res.dll
2009-04-16 04:20 . 2008-04-21 12:08 215552 -c—-w c:\windows\system32\dllcache\wordpad.exe
2009-04-16 00:56 . 2009-04-16 00:57 ——– d—–w c:\documents and settings\Unpoetic Circle\Local Settings\Application Data\ATT Connect
2009-04-16 00:56 . 2009-04-16 00:56 ——– d—–w c:\documents and settings\Unpoetic Circle\Local Settings\Application Data\Downloaded Installations
2009-04-15 05:51 . 2009-05-04 09:13 ——– d—–w c:\program files\vanBasco's Karaoke Player
2009-04-15 05:48 . 2004-08-04 12:00 11907 —-a-w c:\windows\Rop12.exe
2009-04-15 05:48 . 2004-08-04 12:00 12955 —-a-w c:\windows\Guxbpi.dll
2009-04-15 05:48 . 2004-08-04 12:00 14643 —-a-w c:\windows\system\Pcisys32.drv
2009-04-15 05:48 . 2004-08-04 12:00 18466 —-a-w c:\windows\system\Mxp32z.dll
2009-04-14 01:49 . 2009-04-14 01:54 ——– d—–w c:\program files\VOCALOID
2009-04-13 05:21 . 2009-04-20 01:33 ——– d—–w c:\program files\Abyss Web Server
2009-04-13 02:11 . 2009-04-13 02:11 ——– d—–w c:\documents and settings\Unpoetic Circle\Application Data\Stardock
2009-04-13 02:10 . 2009-04-13 02:10 ——– dc-h–w c:\documents and settings\All Users\Application Data\{067CEB81-A49B-4597-9505-A5515881D672}
2009-04-13 02:10 . 2009-04-13 02:10 ——– d—–w c:\program files\Stardock
2009-04-12 17:20 . 2009-04-12 17:20 ——– d—–w c:\program files\Common Files\Adobe AIR
2009-04-11 23:59 . 2008-10-01 00:35 65536 —-a-w c:\windows\system32\camcodec.dll
2009-04-11 23:59 . 2009-04-11 23:59 695578 —-a-w c:\windows\system32\unins000.exe
2009-04-11 23:59 . 2009-04-11 23:59 1081 —-a-w c:\windows\system32\unins000.dat
2009-04-11 23:59 . 2009-04-21 00:43 ——– d—–w c:\program files\CamStudio
2009-04-11 21:24 . 2009-04-20 06:34 ——– d—–w c:\documents and settings\Unpoetic Circle\Application Data\FileZilla
2009-04-11 21:23 . 2009-04-11 21:23 ——– d—–w c:\program files\FileZilla FTP Client
2009-04-08 07:56 . 2009-04-08 07:56 ——– d—–w c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-04-08 05:47 . 2009-04-08 05:47 ——– d—–w c:\documents and settings\Unpoetic Circle\Application Data\Malwarebytes
2009-04-08 05:47 . 2009-04-06 20:32 15504 —-a-w c:\windows\system32\drivers\mbam.sys
2009-04-08 05:47 . 2009-04-06 20:32 38496 —-a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-08 05:47 . 2009-04-08 05:47 ——– d—–w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-04-08 05:47 . 2009-05-05 08:56 ——– d—–w c:\program files\Malwarebytes' Anti-Malware
2009-04-08 00:58 . 2009-04-08 00:58 ——– d—–w c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-04-08 00:58 . 2009-04-08 08:06 ——– d—–w c:\program files\SUPERAntiSpyware
2009-04-08 00:58 . 2009-04-08 08:06 ——– d—–w c:\documents and settings\Unpoetic Circle\Application Data\SUPERAntiSpyware.com
2009-04-07 05:47 . 2009-04-07 05:47 ——– d—–w c:\documents and settings\Unpoetic Circle\Application Data\OpenOffice.org
2009-04-07 03:51 . 2009-04-07 03:51 ——– d—–w c:\program files\JRE
2009-04-07 03:50 . 2009-04-07 03:51 ——– d—–w c:\program files\OpenOffice.org 3
2009-04-07 03:50 . 2009-04-07 03:50 ——– d—–w c:\program files\Common Files\Java
2009-04-07 02:39 . 2009-04-07 02:39 ——– d—–w c:\documents and settings\Unpoetic Circle\AbiSuite
2009-04-07 02:39 . 2009-04-13 02:27 ——– d—–w c:\program files\AbiSuite2
2009-04-07 01:42 . 2008-06-19 21:24 28544 —-a-w c:\windows\system32\drivers\pavboot.sys
2009-04-07 01:39 . 2009-04-07 01:39 ——– d—–w c:\program files\Panda Security

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-05 22:23 . 2009-02-27 05:58 ——– d—–w c:\program files\Songbird
2009-05-04 23:12 . 2008-11-26 13:50 ——– d—–w c:\program files\Java
2009-05-04 09:12 . 2008-12-14 23:22 ——– d—–w c:\program files\PicLensIE
2009-05-04 08:47 . 2008-10-26 00:38 ——– d—–w c:\program files\Common Files\Wise Installation Wizard
2009-05-04 08:13 . 2009-05-04 08:13 805 —-a-w c:\windows\system32\drivers\SYMEVENT.INF
2009-05-04 08:13 . 2009-05-04 08:13 7386 —-a-w c:\windows\system32\drivers\SYMEVENT.CAT
2009-05-03 22:33 . 2008-09-22 03:28 32 —-a-w c:\windows\msocreg32.dat
2009-05-03 21:44 . 2008-11-08 21:46 ——– d—–w c:\program files\DOSBox-0.72
2009-05-02 20:51 . 2008-09-22 03:17 ——– d—–w c:\program files\VstPlugins
2009-05-02 20:18 . 2008-09-22 02:50 ——– d—–w c:\program files\REAPER
2009-05-02 10:36 . 2008-09-23 01:56 261136 —-a-w c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-04-29 23:02 . 2008-08-14 13:57 73312 —-a-w c:\windows\system32\drivers\adfs.sys
2009-04-23 07:35 . 2009-03-19 09:09 ——– d—–w c:\program files\XML Notepad 2007
2009-04-23 07:35 . 2008-10-03 04:26 ——– d—–w c:\program files\Windows Media Connect 2
2009-04-21 04:31 . 2008-09-22 01:45 96464 —-a-w c:\documents and settings\Unpoetic Circle\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-20 01:33 . 2008-09-21 22:39 ——– d—–w c:\program files\Compact Wireless-G USB Adapter Wireless Network Monitor
2009-04-18 22:25 . 2008-09-23 01:56 ——– d—–w c:\program files\MSBuild
2009-04-14 01:54 . 2008-10-18 23:26 ——– d—–w c:\program files\Steinberg
2009-04-14 01:54 . 2008-09-21 22:40 ——– d–h–w c:\program files\InstallShield Installation Information
2009-04-08 06:04 . 2008-11-12 00:17 ——– d—–w c:\program files\Corel
2009-04-08 05:57 . 2008-11-10 07:32 ——– d—–w c:\program files\MeldaProduction MDrummer 2 Small
2009-04-08 01:06 . 2008-10-23 04:24 ——– d—–w c:\program files\gnucash
2009-04-06 03:57 . 2009-04-06 03:57 ——– d—–w c:\program files\Alwil Software
2009-04-06 03:42 . 2009-04-06 03:42 102664 —-a-w c:\windows\system32\drivers\tmcomm.sys
2009-03-22 19:42 . 2009-03-22 19:42 ——– d—–w c:\program files\AutoHotkey
2009-03-20 03:45 . 2008-10-05 00:47 ——– d—–w c:\program files\Common Files\Adobe
2009-03-20 03:43 . 2009-03-20 03:43 ——– d—–w c:\program files\Common Files\Adobe Systems Shared
2009-03-19 09:21 . 2009-03-19 09:21 ——– d—–w c:\program files\Bonjour
2009-03-19 09:12 . 2009-03-19 09:12 ——– d—–w c:\program files\Notepad++
2009-03-19 09:07 . 2008-09-23 05:46 ——– d—–w c:\program files\Microsoft SQL Server
2009-03-19 06:12 . 2009-03-19 06:11 ——– d—–w c:\program files\Common Files\Macromedia
2009-03-19 06:12 . 2009-03-19 06:11 ——– d—–w c:\program files\Macromedia
2009-03-18 05:36 . 2009-01-25 19:54 ——– d—–w c:\program files\Pass4sure Test Environment
2009-03-18 05:36 . 2009-02-20 07:04 ——– d—–w c:\program files\Myst
2009-03-17 10:42 . 2009-03-17 10:42 ——– d—–w c:\program files\FlashDevelop
2009-03-17 00:49 . 2009-03-17 00:49 ——– d—–w c:\program files\Marble Mouse Wheel
2009-03-16 06:38 . 2009-03-16 06:38 ——– d—–w c:\program files\Common Files\Macrovision Shared
2009-03-16 06:29 . 2008-11-01 20:09 ——– d—–w c:\program files\Sandboxie
2009-03-06 14:22 . 2004-08-04 12:00 284160 —-a-w c:\windows\system32\pdh.dll
2009-03-03 00:18 . 2004-08-04 12:00 826368 —-a-w c:\windows\system32\wininet.dll
2009-02-20 18:09 . 2004-08-04 12:00 78336 —-a-w c:\windows\system32\ieencode.dll
2009-02-17 05:17 . 2008-09-22 01:29 453152 —-a-w c:\windows\system32\NVUNINST.EXE
2009-02-09 12:10 . 2004-08-04 12:00 729088 —-a-w c:\windows\system32\lsasrv.dll
2009-02-09 12:10 . 2004-08-04 12:00 714752 —-a-w c:\windows\system32\ntdll.dll
2009-02-09 12:10 . 2004-08-04 12:00 617472 —-a-w c:\windows\system32\advapi32.dll
2009-02-09 12:10 . 2004-08-04 12:00 401408 —-a-w c:\windows\system32\rpcss.dll
2009-02-09 11:13 . 2004-08-04 12:00 1846784 —-a-w c:\windows\system32\win32k.sys
2009-02-07 00:52 . 2009-02-07 00:52 49504 —-a-w c:\windows\system32\sirenacm.dll
2009-02-06 11:11 . 2004-08-04 12:00 110592 —-a-w c:\windows\system32\services.exe
2009-02-06 11:06 . 2004-08-04 12:00 2145280 —-a-w c:\windows\system32\ntoskrnl.exe
2009-02-06 10:39 . 2004-08-04 12:00 35328 —-a-w c:\windows\system32\sc.exe
2009-02-06 10:32 . 2004-08-03 22:59 2023936 —-a-w c:\windows\system32\ntkrnlpa.exe
2009-02-15 22:35 . 2009-02-15 22:35 27976 —-a-w c:\program files\mozilla firefox\plugins\atgpcdec.dll
2009-02-15 22:35 . 2009-02-15 22:35 125848 —-a-w c:\program files\mozilla firefox\plugins\atgpcext.dll
2009-02-15 22:35 . 2009-02-15 22:36 46408 —-a-w c:\program files\mozilla firefox\plugins\atmccli.dll
2009-02-15 22:36 . 2009-02-15 22:36 98704 —-a-w c:\program files\mozilla firefox\plugins\ieatgpc.dll
2008-12-27 01:02 . 2008-11-12 00:21 56 –sh–r c:\windows\system32\A390807B96.sys
2008-12-27 01:02 . 2008-11-12 00:17 3766 –sha-w c:\windows\system32\KGyGaAvL.sys
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\Rop12.exe – Not a PE file.
File Size: 11907
Created Time: 2009-04-15 05:48
Modified Time: 2004-08-04 12:00
Accessed Time: 2009-05-06 07:17
MD5: 4BD6F621B54BB3F0EAC3F18E8A5ACC4F
SHA: FDDB05872C4D84A269E68C510676FE36C6E614EA

((((((((((((((((((((((((((((( SnapShot@2009-05-05_19.18.24 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-05-05 19:42 . 2009-05-05 19:42 16384 c:\windows\Temp\Perflib_Perfdata_408.dat
+ 2009-05-05 19:43 . 2009-05-05 19:43 16384 c:\windows\Temp\Perflib_Perfdata_3a8.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"SlickRun"="c:\program files\SlickRun\sr.exe" [2007-03-21 187392]
"SandboxieControl"="c:\program files\Sandboxie\SbieCtrl.exe" [2009-01-05 336896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-02-18 13680640]
"Monitor"="c:\windows\PixArt\PAC207\Monitor.exe" [2006-11-03 319488]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-12-03 282624]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-26 136600]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-02-18 86016]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2009-03-11 611712]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"IMEKRMIG6.1"="c:\windows\ime\imkr6_1\IMEKRMIG.EXE" [2004-08-04 44032]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-07-05 16380416]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2009-02-18 1657376]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" - c:\windows\system32\narrator.exe [2008-04-14 53760]

c:\documents and settings\Unpoetic Circle\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
PowerMenu.lnk - c:\program files\PowerMenu\PowerMenu.exe [2002-12-19 57344]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Marble Mouse Wheel.lnk - c:\program files\Marble Mouse Wheel\MarbleScroll.exe [2009-3-16 761856]
Push Client.LNK - c:\program files\Interwise\Participant\pull.exe [2009-2-15 843776]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler]
"{EC654325-1273-C2A9-2B7C-45A29BCE2FBD}"= "c:\program files\Stardock\Fences\DesktopDock.dll" [2009-02-25 517480]

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32
"wave1"= serwvdrv.dll
"midi1"= ma_cmidn.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]
@="FSFilter Activity Monitor"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"=
"c:\\Program Files\\cognos\\c8\\bin\\cogconfigw.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\Valve\\Half Life 2\\hl2.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Songbird\\songbird.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"f:\\Games\\Black And White\\runblack.exe"=
"c:\\Temp\\games\\bw\\runblack.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Abyss Web Server\\abyssws.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Digsby\\lib\\digsby-app.exe"=
"c:\\Program Files\\Adobe\\Adobe Flash CS4\\Flash.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [4/6/2009 8:42 PM 28544]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NAV\1005000.086\SymEFA.sys [5/4/2009 3:13 AM 310320]
R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\NAV\1005000.086\BHDrvx86.sys [5/4/2009 3:13 AM 258608]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NAV\1005000.086\cchpx86.sys [5/4/2009 3:13 AM 482352]
R1 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090501.001\IDSXpx86.sys [5/4/2009 3:23 AM 276344]
R2 Norton AntiVirus;Norton AntiVirus;c:\program files\Norton AntiVirus\Engine\16.5.0.134\ccSvcHst.exe [5/4/2009 3:13 AM 115560]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [5/4/2009 3:23 AM 101936]
R3 SbieDrv;SbieDrv;c:\program files\Sandboxie\SbieDrv.sys [1/5/2009 9:39 AM 103936]
S3 EWAVE;EWAVE;c:\windows\system32\drivers\ew.sys [10/18/2008 6:20 PM 1693344]
S3 FILESPY;FILESPY;c:\windows\system32\drivers\FileSpy.sys [10/18/2008 6:20 PM 26992]
S3 GP2MPM;GP2MPM;c:\windows\system32\drivers\Gp2mpm.sys [10/18/2008 6:20 PM 37600]
S3 NSTATION;NSTATION;c:\windows\system32\drivers\NSTATION.sys [10/18/2008 6:20 PM 19808]
S3 PAC207;Eye 110;c:\windows\system32\drivers\PFC027.SYS [12/5/2006 12:34 PM 507136]
S3 US122;US122 Driver;c:\windows\system32\drivers\US122.sys [10/18/2008 5:38 PM 131968]
S3 US122DL;US122 Firmware Downloader;c:\windows\system32\drivers\US122DL.sys [10/18/2008 5:38 PM 18304]
S3 Us122WdmService;US122 Wdm Audio;c:\windows\system32\drivers\US122Wdm.sys [10/18/2008 5:38 PM 39168]

— Other Services/Drivers In Memory —

*Deregistered* - TapiSrv
*Deregistered* - TermService
*Deregistered* - Themes
*Deregistered* - TrkWks
*Deregistered* - W32Time
*Deregistered* - WebClient
*Deregistered* - winmgmt
*Deregistered* - wscsvc
*Deregistered* - wuauserv
*Deregistered* - WudfSvc
*Deregistered* - WUSB54GCSVC
*Deregistered* - WZCSVC
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://home.live.com/
uInternet Settings,ProxyOverride = *.local
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
DPF: {8731163E-77B9-4F91-9122-F112521C28AF} - hxxp://mmbox.itelcel.com/mmawap/jsp/composer/player/mmsPlayer.cab
FF - ProfilePath - c:\documents and settings\Unpoetic Circle\Application Data\Mozilla\Firefox\Profiles\jxyh7qke.default\
FF - prefs.js: browser.startup.homepage - hxxp://keyboardr.com/
FF - component: c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\IPSFFPlgn\components\IPSFFPl.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npatgpc.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-06 02:22
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Norton AntiVirus]
"ImagePath"="\"c:\program files\Norton AntiVirus\Engine\16.5.0.134\ccSvcHst.exe\" /s \"Norton AntiVirus\" /m \"c:\program files\Norton AntiVirus\Engine\16.5.0.134\diMaster.dll\" /prefetch:1"
.
Completion time: 2009-05-06 2:23
ComboFix-quarantined-files.txt 2009-05-06 07:23
ComboFix2.txt 2009-05-05 19:19

Pre-Run: 23,068,721,152 bytes free
Post-Run: 23,075,880,960 bytes free

319 — E O F — 2009-04-30 08:01

HJT
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:35:20 AM, on 5/6/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Norton AntiVirus\Engine\16.5.0.134\ccSvcHst.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Sandboxie\SbieSvc.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WUSB54GC.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Norton AntiVirus\Engine\16.5.0.134\ccSvcHst.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\PixArt\PAC207\Monitor.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SlickRun\sr.exe
C:\Program Files\Sandboxie\SbieCtrl.exe
C:\Program Files\Marble Mouse Wheel\MarbleScroll.exe
C:\Program Files\Interwise\Participant\pull.exe
C:\Program Files\PowerMenu\PowerMenu.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Java\jre6\bin\java.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Microsoft Office\Office12\WINWORD.EXE
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\Program Files\Digsby\lib\digsby-app.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.live.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton AntiVirus\Engine\16.5.0.134\IPSBHO.DLL
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Monitor] C:\WINDOWS\PixArt\PAC207\Monitor.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SlickRun] "C:\Program Files\SlickRun\sr.exe"
O4 - HKCU\..\Run: [SandboxieControl] "C:\Program Files\Sandboxie\SbieCtrl.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: PowerMenu.lnk = C:\Program Files\PowerMenu\PowerMenu.exe
O4 - Global Startup: Marble Mouse Wheel.lnk = C:\Program Files\Marble Mouse Wheel\MarbleScroll.exe
O4 - Global Startup: Push Client.LNK = C:\Program Files\Interwise\Participant\pull.exe
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end; to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {8731163E-77B9-4F91-9122-F112521C28AF} (MMSPlayerX Class) - http://mmbox.itelcel.com/mmawap/jsp/compos…r/mmsPlayer.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://emeetings.webex.com/client/T26L10NS…bex/ieatgpc.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O22 - SharedTaskScheduler: Fences - {EC654325-1273-C2A9-2B7C-45A29BCE2FBD} - C:\Program Files\Stardock\Fences\DesktopDock.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Norton AntiVirus - Symantec Corporation - C:\Program Files\Norton AntiVirus\Engine\16.5.0.134\ccSvcHst.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Sandboxie Service (SbieSvc) - tzuk - C:\Program Files\Sandboxie\SbieSvc.exe
O23 - Service: WUSB54GCSVC - GEMTEKS - C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe

–
End of file - 9126 bytes

I Updated Java JRE, and Kaspersky didn't find anything…

I've found out that Regedit now opens up and cmd.exe does too!

I can't still login into my regular Live Messenger account… (It does log in to a 2nd acct I have)

Thanks!

jpshortstuff

Post #8May 6, 2009, 6:07 PM UTC

Hi,

Do you recognize any of these files?
c:\windows\Rop12.exe
c:\windows\Guxbpi.dll
c:\windows\system\Pcisys32.drv
c:\windows\system\Mxp32z.dll

Download the GMER Rootkit Scanner. Unzip it to your Desktop.

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

Double-click gmer.exe. The program will begin to run.

**Caution**
These types of scans can produce false positives. Do NOT take any action on any "<— ROOKIT" entries unless advised!

If possible rootkit activity is found, you will be asked if you would like to perform a full scan.

Click NO
In the right panel, you will see a bunch of boxes that have been checked … leave everything checked and ensure the Show all box is un-checked.
Now click the Scan button.
Once the scan is complete, you may receive another notice about rootkit activity.
Click OK.
GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "GMER.txt"
Save it where you can easily find it, such as your desktop.

Post the contents of GMER.txt in your next reply.

Any other problems other than Windows Messenger?

Lucernal

Post #9May 7, 2009, 9:09 AM UTC

Hi jpshortstuff, I don't recoognize any of those files… I also did a quick google search on rop12.exe… nothing. Kinda weird.

Here's the GMER log.

GMER 1.0.15.14972 - http://www.gmer.net
Rootkit scan 2009-05-07 04:10:58
Windows 5.1.2600 Service Pack 3


—- System - GMER 1.0.15 —-

SSDT			8A0B96D0																					ZwAlertResumeThread
SSDT			8A0BA6D0																					ZwAlertThread
SSDT			897D3A50																					ZwAllocateVirtualMemory
SSDT			8A0B16D0																					ZwAssignProcessToJobObject
SSDT			d347bus.sys (PnP BIOS Extension/ )														  ZwClose [0xB9F8E818]
SSDT			8A1A16F0																					ZwConnectPort
SSDT			\??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)  ZwCreateKey [0xB5807040]
SSDT			88DCB740																					ZwCreateMutant
SSDT			d347bus.sys (PnP BIOS Extension/ )														  ZwCreatePagingFile [0xB9F82A20]
SSDT			8973D6F8																					ZwCreateSymbolicLinkObject
SSDT			89DAE6F0																					ZwCreateThread
SSDT			8A0B26D0																					ZwDebugActiveProcess
SSDT			\??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)  ZwDeleteKey [0xB58072C0]
SSDT			\??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)  ZwDeleteValueKey [0xB5807820]
SSDT			897D3D68																					ZwDuplicateObject
SSDT			d347bus.sys (PnP BIOS Extension/ )														  ZwEnumerateKey [0xB9F832A8]
SSDT			d347bus.sys (PnP BIOS Extension/ )														  ZwEnumerateValueKey [0xB9F8E910]
SSDT			897D1B38																					ZwFreeVirtualMemory
SSDT			8A0B76D0																					ZwImpersonateAnonymousToken
SSDT			8A0B86D0																					ZwImpersonateThread
SSDT			8A18E6D0																					ZwLoadDriver
SSDT			8998AEE8																					ZwMapViewOfSection
SSDT			8A0B66D0																					ZwOpenEvent
SSDT			d347bus.sys (PnP BIOS Extension/ )														  ZwOpenKey [0xB9F8E794]
SSDT			89754128																					ZwOpenProcess
SSDT			8975DE08																					ZwOpenProcessToken
SSDT			8A0B46D0																					ZwOpenSection
SSDT			897D3EB8																					ZwOpenThread
SSDT			88D523F0																					ZwProtectVirtualMemory
SSDT			d347bus.sys (PnP BIOS Extension/ )														  ZwQueryKey [0xB9F832C8]
SSDT			d347bus.sys (PnP BIOS Extension/ )														  ZwQueryValueKey [0xB9F8E866]
SSDT			899A57D0																					ZwResumeThread
SSDT			8A0BD6D0																					ZwSetContextThread
SSDT			8998ABD0																					ZwSetInformationProcess
SSDT			8A0B36D0																					ZwSetSystemInformation
SSDT			d347bus.sys (PnP BIOS Extension/ )														  ZwSetSystemPowerState [0xB9F8E0B0]
SSDT			\??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)  ZwSetValueKey [0xB5807A70]
SSDT			8A0B56D0																					ZwSuspendProcess
SSDT			8A0BB6D0																					ZwSuspendThread
SSDT			8978A750																					ZwTerminateProcess
SSDT			8A0BC6D0																					ZwTerminateThread
SSDT			8A0BE6D0																					ZwUnmapViewOfSection
SSDT			897D4A38																					ZwWriteVirtualMemory

—- Kernel code sections - GMER 1.0.15 —-

.text		   ntkrnlpa.exe!ZwCallbackReturn + 2C28														805044C4 4 Bytes  CALL C8A8FEC1 
.text		   ntkrnlpa.exe!ZwCallbackReturn + 2CE8														80504584 4 Bytes  JMP BCEEFF81 
.text		   ntkrnlpa.exe!ZwCallbackReturn + 2D74														80504610 4 Bytes  CALL 80D9DEC3 
.text		   ntkrnlpa.exe!ZwCallbackReturn + 2E88														80504724 4 Bytes  CALL 0C870121 
?			   SYMEFA.SYS																				  The system cannot find the file specified. !
.text		   win32k.sys!EngCreateBitmap + D95F														   BF8457CB 5 Bytes  JMP 88823610 
.text		   win32k.sys!EngAlphaBlend + 9286															 BF8C3127 5 Bytes  JMP 888236B0 

—- Devices - GMER 1.0.15 —-

Device																									  Ntfs.sys (NT File System Driver/Microsoft Corporation)
Device																									  8AC21F58
Device																									  Fastfat.SYS (Fast FAT File System Driver/Microsoft Corporation)
Device																									  89883628

AttachedDevice  \Driver\Tcpip \Device\Ip																	SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice  \Driver\Tcpip \Device\Tcp																   SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)

Device		  \Driver\Cdrom \Device\CdRom0																8A7D59D0
Device		  \FileSystem\Rdbss \Device\FsWrap															89AD9848
Device		  \Driver\Cdrom \Device\CdRom1																8A7D59D0
Device		  \Driver\Cdrom \Device\CdRom2																8A7D59D0
Device		  \Driver\Cdrom \Device\CdRom3																8A7D59D0
Device		  \FileSystem\Srv \Device\LanmanServer														8A7BB0E0

AttachedDevice  \Driver\Tcpip \Device\Udp																   SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice  \Driver\Tcpip \Device\RawIp																 SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)

Device		  \Driver\nvata \Device\0000007a															  8A7DBCA8
Device		  \Driver\nvata \Device\NvAta0																8A7DBCA8
Device		  \Driver\nvata \Device\0000007b															  8A7DBCA8
Device		  \FileSystem\MRxSmb \Device\LanmanDatagramReceiver										   897C9860
Device																									  mrxsmb.sys (Windows NT SMB Minirdr/Microsoft Corporation)
Device																									  897C9860
Device		  \FileSystem\Npfs \Device\NamedPipe														  89971848
Device		  \FileSystem\Msfs \Device\Mailslot														   897D5848
Device		  \Driver\d347prt \Device\Scsi\d347prt1Port3Path0Target2Lun0								  8A7DA558
Device		  \Driver\d347prt \Device\Scsi\d347prt1Port3Path0Target0Lun0								  8A7DA558
Device		  \Driver\d347prt \Device\Scsi\d347prt1Port3Path0Target1Lun0								  8A7DA558
Device		  \Driver\d347prt \Device\Scsi\d347prt1													   8A7DA558

AttachedDevice																							  fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

Device		  \FileSystem\Fs_Rec \FileSystem\UdfsCdRomRecognizer										  897CA848
Device		  \FileSystem\Fs_Rec \FileSystem\CdfsRecognizer											   897CA848
Device		  \FileSystem\Fs_Rec \FileSystem\FatCdRomRecognizer										   897CA848
Device		  \FileSystem\Fs_Rec \FileSystem\FatDiskRecognizer											897CA848
Device		  \FileSystem\Fs_Rec \FileSystem\UdfsDiskRecognizer										   897CA848
Device		  \FileSystem\Cdfs \Cdfs																	  8848F240

—- Registry - GMER 1.0.15 —-

Reg			 HKLM\SYSTEM\CurrentControlSet\Services\d347prt\Cfg\0Jf40									
Reg			 HKLM\SYSTEM\CurrentControlSet\Services\d347prt\Cfg\0Jf41									
Reg			 HKLM\SYSTEM\CurrentControlSet\Services\d347prt\Cfg\0Jf42									

—- Files - GMER 1.0.15 —-

File			C:\Program Files\Valve\Half Life 2\hl2\scenes\npc\Alyx									  0 bytes

—- EOF - GMER 1.0.15 —-

Finally, I got this msg when GMER stopped … 🖼Click to load external image (Posted Image)

My main messenger acct still won't login, my 2nd one does. Wondering if I should re-install Messenger and see if that works?

Again, thanks so much for your help

jpshortstuff

Post #10May 7, 2009, 9:32 AM UTC

It couldn't hurt to re-install Messenger, could well be corrupt in some way.

Let's find out if you need those suspicious files.

1. Go to Start->Run and type in notepad and hit OK.

2. Then copy and paste the content of the following codebox into Notepad:

@echo off
for %%g in (
c:\windows\Rop12.exe
c:\windows\Guxbpi.dll
c:\windows\system\Pcisys32.drv
c:\windows\system\Mxp32z.dll
) do ren %%g %%~nxg.bak
del /Q %0

3. Save the file to your DESKTOP as "fix.bat". Make sure to save it with the quotes. Once saved, the icon to click should look like this on your desktop: [external image: Posted Image]

4. Double click fix.bat.

After this, please reboot your computer. Let me know how things are running, use your computer as you usually would and keep an eye out for any strange behaviour.

Lucernal

Post #11May 11, 2009, 9:05 AM UTC

I appreciate your help… I have not found any problems after renaming those files.

MSN still did not work, but I did found the solution to it… It seems it is a "normal" problem, here's how to solve it:

http://messenger-support.spaces.live.com/b…#33;13937.entry

jpshortstuff

Post #12May 11, 2009, 10:12 AM UTC

Hi,

OK, let's clean up those files then. Give the following batch file a run, the same as before:

@echo off
for %%g in (
c:\windows\Rop12.exe.bak
c:\windows\Guxbpi.dll.bak
c:\windows\system\Pcisys32.drv.bak
c:\windows\system\Mxp32z.dll.bak
) do del /Q %%g
del /Q %0

Please post one more HijackThis log for my review. If you are having no more problems and the log looks fine, we can wrap this one up.

jpshortstuff

Post #13May 16, 2009, 9:46 AM UTC

Due to inactivity this topic will be closed. If you need help please start a new thread and post a new HJT log

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Closed] Unable to log in into Live Messenger, open up regedit, a

✨ Ask AI

Ask AI