Spyware / Malware / Virus Removal

[Resolved] inetinfo.exe crashes

21 min read

Looking for the outcome? Ask AI

lin0056 Topic Starter

Post #1June 11, 2009, 6:08 AM UTC last edited June 11, 2009, 7:20 AM UTC

I was referred to here by appleoddity from this link: http://forums.whatthetech.com/inetinfo_exe…es_t103828.html
Please read the topic and post help.
Regards

Edit: I just realised I can't view hidden folders. Everytime I turn that option on, it automatically turns it back off.

CatByte

Post #2June 12, 2009, 12:20 PM UTC

Hi,

NOTE:

Malware removal is NOT instantaneous.
Most infections require more than one round to properly eradicate.
Absence of symptoms does not always mean the job is complete.
You can be certain that I will advise you when the computer is clean.
Kindly follow my instructions in the order posted.
Please resist the urge to run further scans or fix items on your own without my direction.

NEXT

Please download DDS from one of the following links and save it to your desktop.

- DDS.scr
- DDS.pif
Disable any script blocking protection (How to Disable your Security Programs)
Double click DDS icon to run the tool (may take up to 3 minutes to run)
When done, DDS.txt will open.
After a few moments, attach.txt will open in a second window.
Save both reports to your desktop.

Post the contents of the DDS.txt report in your next reply
Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and then click UPLOAD.

NEXT

Download the GMER Rootkit Scanner. Unzip it to your Desktop.
Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.
Double-click gmer.exe. The program will begin to run.
**Caution**
These types of scans can produce false positives. Do NOT take any action on any "<— ROOKIT" entries unless advised!
If possible rootkit activity is found, you will be asked if you would like to perform a full scan.

Click NO
In the right panel, you will see a bunch of boxes that have been checked … leave everything checked and ensure the Show all box is un-checked.
Now click the Scan button.
Once the scan is complete, you may receive another notice about rootkit activity.
Click OK.
GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "GMER.txt"
Save it where you can easily find it, such as your desktop.

Post the contents of GMER.txt in your next reply.

lin0056

Post #3June 13, 2009, 7:45 AM UTC

DDS Log:

DDS (Ver_09-05-14.01) - NTFSx86
Run by [removed] at 11:24:37.84 on Sat 13/06/2009
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Professional 5.1.2600.3.1252.61.1033.18.1977.1229 [GMT 10:00]

AV: Sophos Anti-Virus *On-access scanning disabled* (Updated) {3F13C776-3CBE-4DE9-8BF6-09E5183CA2BD}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
svchost.exe
svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\ifxspmgt.exe
C:\WINDOWS\system32\IFXTCS.exe
C:\Program Files\Acer\Acer Bio Protection\BASVC.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\WINDOWS\system32\IfxPsdSv.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe
C:\Program Files\Sophos\AutoUpdate\ALsvc.exe
C:\Program Files\Sophos\Remote Management System\RouterNT.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Acer\Acer Bio Protection\PdtWzd.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\PLFSetI.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\PROGRA~1\LAUNCH~1\LManager.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Sophos\AutoUpdate\ALMon.exe
C:\Program Files\Infineon\Security Platform Software\PSDrt.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Infineon\Security Platform Software\SpTna.exe
C:\WINDOWS\system32\igfxext.exe
C:\DOCUME~1\12linnz\LOCALS~1\Temp\RtkBtMnt.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Sophos\Remote Management System\ManagementAgentNT.exe
C:\WINDOWS\inetinfo.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\12linnz\Desktop\dds.pif

============== Pseudo HJT Report ===============

uStart Page = hxxp://intranet.cgs.vic.edu.au
uDefault_Page_URL = hxxp://intranet.cgs.vic.edu.au
mDefault_Page_URL = hxxp://intranet.cgs.vic.edu.au
uInternet Settings,ProxyServer = proxy.cgs.vic.edu.au:8081
uInternet Settings,ProxyOverride = intranet.cgs.vic.edu.au;www.cgs.vic.edu.au;mail.cgs.vic.edu.au;homepages.cgs.vic
.edu.au;maintreq.cgs.vic.edu.au;icdl.cgs.vic.edu.au;10.1.0.10;
uWindows: load=c:\windows\system32\drivers\etc\networks.exe
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
BHO: Sophos Web Content Scanner: {39ea7695-b3f2-4c44-a4bc-297ada8fd235} - c:\program files\sophos\sophos anti-virus\SophosBHO.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: SmartSelect Class: {f4971ee7-daa0-4053-9964-665d8ee6a077} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
uRun: [MaxBSLoad] c:\windows\system32\MaxBSLoad.exe
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [AzMixerSel] c:\program files\realtek\audio\installshield\AzMixerSel.exe
mRun: [ZPdtWzdVitaKey MC3000] "c:\program files\acer\acer bio protection\PdtWzd.exe" show
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [IFXSPMGT] c:\windows\system32\ifxspmgt.exe /NotifyLogon
mRun: [PLFSetI] c:\windows\PLFSetI.exe
mRun: [PLFSetL] c:\windows\PLFSetL.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [LManager] c:\progra~1\launch~1\LManager.exe
mRun: [PaperCut NG Client] c:\program files\papercut ng client\pc-client.exe /silent
mRun: []
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [networks] c:\windows\winlogon.exe
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
uExplorerRun: [ctfmon] c:\windows\ctfmon.exe
mExplorerRun: [inetinfo] c:\windows\inetinfo.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\autoup~1.lnk - c:\program files\sophos\autoupdate\ALMon.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\blueto~1.lnk - c:\program files\widcomm\bluetooth software\BTTray.exe
IE: Append Link Target to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: Send to &Bluetooth Device… - c:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm
IE: Send To Bluetooth - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
IE: {10954C80-4F0F-11d3-B17C-00C0DFE39736} - c:\program files\acer\acer bio protection\PwdBank.exe
IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
Notify: AWinNotifyVitaKey MC3000 - c:\program files\acer\acer bio protection\WinNotify.dll
Notify: igfxcui - igfxdev.dll
AppInit_DLLs: c:\progra~1\sophos\sophos~1\SOPHOS~1.DLL
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
LSA: Notification Packages = scecli c:\program files\acer\acer bio protection\PwdFilter

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\12linnz\applic~1\mozilla\firefox\profiles\nc3mmks4.default\
FF - plugin: c:\program files\microsoft\office live\npOLW.dll

============= SERVICES / DRIVERS ===============

R0 AlfaFF;AlfaFF File System mini-filter;c:\windows\system32\drivers\AlfaFF.sys [2008-10-22 43184]
R1 PersonalSecureDrive;PersonalSecureDrive;c:\windows\system32\drivers\psd.sys [2007-7-24 38816]
R1 SAVOnAccessControl;SAVOnAccessControl;c:\windows\system32\drivers\savonaccesscontrol.sys [2009-6-10 110848]
R1 SAVOnAccessFilter;SAVOnAccessFilter;c:\windows\system32\drivers\savonaccessfilter.sys [2009-6-10 38528]
R2 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B};c:\program files\cyberlink\powerdvd\000.fcl [2008-11-20 13560]
R2 aawservice;Ad-Aware 2007 Service;c:\program files\lavasoft\ad-aware 2007\aawservice.exe [2007-9-25 574808]
R2 FPSensor;LTT-Corp Fingerprint Reader Driver (FPSensor.sys);c:\windows\system32\drivers\FPSensor.sys [2008-10-22 20352]
R2 IGBASVC;iGroupTec Service;c:\program files\acer\acer bio protection\BASVC.exe [2008-10-22 3481600]
R2 SAVAdminService;Sophos Anti-Virus status reporter;c:\program files\sophos\sophos anti-virus\SAVAdminService.exe [2009-6-10 80936]
R2 SAVService;Sophos Anti-Virus;c:\program files\sophos\sophos anti-virus\SavService.exe [2009-6-10 98304]
R2 Sophos Agent;Sophos Agent;c:\program files\sophos\remote management system\ManagementAgentNT.exe [2009-6-10 266240]
R2 Sophos AutoUpdate Service;Sophos AutoUpdate Service;c:\program files\sophos\autoupdate\ALsvc.exe [2009-1-28 172032]
R2 Sophos Message Router;Sophos Message Router;c:\program files\sophos\remote management system\RouterNT.exe [2009-6-10 794624]
R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [2007-7-24 41216]
R3 ITEIRDA;ITE Infrared Device Driver;c:\windows\system32\drivers\ITEirda.sys [2008-10-22 24576]
R3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.12.1;c:\windows\system32\drivers\libusb0.sys [2009-5-28 28672]
S3 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\program files\common files\adobe\adobe version cue cs4\server\bin\VersionCueCS4.exe [2008-8-15 284016]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\gamemon.des -service –> c:\windows\system32\GameMon.des -service [?]
S4 SophosBootDriver;SophosBootDriver;c:\windows\system32\drivers\SophosBootDriver.sys [2009-6-10 14976]

============== File Associations ===============

txtfile=c:\windows\system32\drivers\etc\networks.exe %1

=============== Created Last 30 ================

2009-06-11 17:23 57,856 ac—— c:\windows\system32\MSWINSCK.OCX
2009-06-10 23:09 -cd—– c:\docume~1\12linnz\applic~1\Red Kawa
2009-06-10 08:55 130,104 ac—— c:\windows\system32\sdccoinstaller.dll
2009-06-10 08:54 -cd—– c:\program files\common files\Cisco Systems
2009-06-10 08:54 23,552 ac—— c:\windows\system32\sophosboottasks.exe
2009-06-10 08:53 -cd—– c:\docume~1\alluse~1\applic~1\Sophos
2009-06-10 08:52 14,976 ac—— c:\windows\system32\drivers\SophosBootDriver.sys
2009-06-10 08:52 38,528 ac—— c:\windows\system32\drivers\savonaccessfilter.sys
2009-06-10 08:52 110,848 ac—— c:\windows\system32\drivers\savonaccesscontrol.sys
2009-06-10 08:50 -cd—– c:\program files\Sophos
2009-06-09 23:55 664 ac—— c:\windows\system32\d3d9caps.dat
2009-06-09 23:18 -cd—– c:\program files\Regensoft
2009-06-09 23:18 -cd—– c:\program files\Red Kawa
2009-06-09 21:43 -cd—– c:\windows\system32\appmgmt
2009-06-09 17:39 442,368 ac—— c:\windows\system32\vp6vfw.dll
2009-06-07 18:17 -cd—– c:\windows\Universal Forum Poster
2009-06-07 18:17 -cd—– c:\program files\Universal Forum Poster
2009-06-07 14:21 -cd—– c:\docume~1\12linnz\applic~1\WindowsApplication1
2009-06-06 21:13 -cd—– c:\program files\common files\xing shared
2009-06-05 09:32 -cd—– c:\program files\common files\Real
2009-06-03 11:12 1,089,593 -c—— c:\windows\system32\dllcache\ntprint.cat
2009-06-03 11:12 5,632 ac—— c:\windows\system32\ptpusb.dll
2009-06-03 11:12 159,232 ac—— c:\windows\system32\ptpusd.dll
2009-06-03 11:12 15,104 ac—— c:\windows\system32\drivers\usbscan.sys
2009-06-03 11:12 15,104 ac—— c:\windows\system32\dllcache\usbscan.sys
2009-06-01 19:32 -cd—– c:\windows\system32\wbem\Repository
2009-06-01 19:18 -cd—– c:\windows\LastGood(2)
2009-05-31 20:44 -cd—– c:\docume~1\12linnz\applic~1\Uniblue
2009-05-29 12:21 -cd—– c:\documents and settings\12linnz\Bluetooth Software
2009-05-28 16:34 43,520 ac—— c:\windows\system32\libusb0.dll
2009-05-28 16:34 28,672 ac—— c:\windows\system32\drivers\libusb0.sys
2009-05-28 16:34 -cd—– c:\program files\LibUSB-Win32
2009-05-28 16:33 933,888 ac—— c:\windows\system32\SENXPCTL.OCX
2009-05-28 16:33 212,240 ac—— c:\windows\system32\RICHTX32.OCX
2009-05-28 16:33 65,536 ac—— c:\windows\system32\device.OCX
2009-05-28 16:33 32,768 ac—— c:\windows\system32\Bar.OCX
2009-05-28 16:33 -cd—– c:\program files\QuickFreedom
2009-05-25 14:32 177,152 -c—— c:\windows\system32\dllcache\msctfime.ime
2009-05-25 14:32 268,288 -c—— c:\windows\system32\dllcache\iertutil.dll
2009-05-25 14:32 63,488 -c—— c:\windows\system32\dllcache\icardie.dll
2009-05-25 14:32 52,224 -c—— c:\windows\system32\dllcache\msfeedsbs.dll
2009-05-25 14:32 13,824 -c—— c:\windows\system32\dllcache\ieudinit.exe
2009-05-25 14:32 459,264 -c—— c:\windows\system32\dllcache\msfeeds.dll
2009-05-25 14:32 991,232 -c—— c:\windows\system32\dllcache\ieframe.dll.mui
2009-05-25 14:32 2,455,488 -c—— c:\windows\system32\dllcache\ieapfltr.dat
2009-05-25 14:32 383,488 -c—— c:\windows\system32\dllcache\ieapfltr.dll
2009-05-25 14:31 6,066,176 -c—— c:\windows\system32\dllcache\ieframe.dll
2009-05-24 21:34 -cd—– c:\windows\system32\Adobe
2009-05-22 13:08 484 ac—— c:\windows\FOE2.ini
2009-05-22 12:00 2,735,133 ac—— c:\windows\system32\GameMon.des
2009-05-22 11:57 5,174 ac—— c:\windows\system32\nppt9x.vxd
2009-05-22 11:57 4,682 ac—— c:\windows\system32\npptNT2.sys
2009-05-22 11:56 -cd—– c:\program files\common files\INCA Shared
2009-05-21 22:23 -cd—– c:\docume~1\alluse~1\applic~1\Messenger Plus!
2009-05-21 19:24 -cd—– c:\program files\EA Sports
2009-05-21 18:57 721,904 a——- c:\windows\system32\drivers\sptd.sys
2009-05-21 18:57 -cd—– c:\docume~1\12linnz\applic~1\DAEMON Tools Lite
2009-05-21 18:53 -cd-h— c:\windows\PIF
2009-05-21 18:47 -cd—– c:\docume~1\12linnz\applic~1\LimeWire
2009-05-21 18:44 -cd—– c:\program files\PowerISO
2009-05-21 18:44 -cd—– c:\program files\LimeWire
2009-05-21 18:37 -cd—– c:\program files\Messenger Plus! Live
2009-05-21 18:33 -cd—– c:\program files\uTorrent
2009-05-21 18:33 -cd—– c:\docume~1\12linnz\applic~1\uTorrent
2009-05-21 18:33 107,368 ac—— c:\windows\system32\GEARAspi.dll
2009-05-21 18:33 23,400 ac—— c:\windows\system32\drivers\GEARAspiWDM.sys
2009-05-21 18:32 -cd—– c:\program files\iPod
2009-05-21 18:32 -cd—– c:\program files\iTunes
2009-05-21 18:32 -cd—– c:\docume~1\alluse~1\applic~1\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-05-21 18:32 -cd—– c:\program files\Bonjour
2009-05-21 18:31 1,900,544 ac—— c:\windows\system32\usbaaplrc.dll
2009-05-21 18:31 36,864 ac—— c:\windows\system32\drivers\usbaapl.sys
2009-05-21 18:12 -cd—– c:\program files\DVD Decrypter
2009-05-21 18:12 43,602 ac—— c:\windows\system32\xvid-uninstall.exe
2009-05-21 18:12 -cd—– c:\program files\AviSynth 2.5
2009-05-21 18:12 -cd—– c:\program files\AutoGK
2009-05-21 18:00 -cd—– c:\documents and settings\12linnz\Tracing
2009-05-21 17:58 -cd—– c:\program files\Microsoft
2009-05-21 17:58 -cd—– c:\program files\Windows Live SkyDrive
2009-05-21 17:55 -cd—– c:\program files\common files\Windows Live
2009-05-21 17:46 10,368 ac—— c:\windows\system32\drivers\hidusb.sys
2009-05-21 17:46 10,368 ac—— c:\windows\system32\dllcache\hidusb.sys
2009-05-21 15:19 -cd—– c:\program files\Combined Community Codec Pack
2009-05-21 15:19 -cd—– c:\program files\CCleaner
2009-05-21 14:58 163 -c-shr– C:\AutoRun.inf
2009-05-21 14:57 989,696 -c—— c:\windows\system32\dllcache\kernel32.dll
2009-05-21 14:57 56,832 -c—— c:\windows\system32\dllcache\secur32.dll
2009-05-21 14:57 144,896 -c—— c:\windows\system32\dllcache\schannel.dll
2009-05-21 14:57 401,408 -c—— c:\windows\system32\dllcache\rpcss.dll
2009-05-21 14:57 284,160 -c—— c:\windows\system32\dllcache\pdh.dll
2009-05-21 14:57 729,088 -c—— c:\windows\system32\dllcache\lsasrv.dll
2009-05-21 14:57 714,752 -c—— c:\windows\system32\dllcache\ntdll.dll
2009-05-21 14:57 617,472 -c—— c:\windows\system32\dllcache\advapi32.dll
2009-05-21 14:57 473,600 -c—— c:\windows\system32\dllcache\fastprox.dll
2009-05-21 14:57 453,120 -c—— c:\windows\system32\dllcache\wmiprvsd.dll
2009-05-21 14:57 110,592 -c—— c:\windows\system32\dllcache\services.exe
2009-05-21 14:56 66,560 -c—— c:\windows\system32\dllcache\mtxclu.dll
2009-05-21 14:56 8,461,312 -c—— c:\windows\system32\dllcache\shell32.dll
2009-05-21 14:55 354,304 -c—— c:\windows\system32\dllcache\winhttp.dll
2009-05-21 14:55 286,720 -c—— c:\windows\system32\dllcache\gdi32.dll
2009-05-21 14:14 2,560 -c—— c:\windows\system32\xpsp4res.dll
2009-05-21 14:13 -cd—– c:\docume~1\12linnz\applic~1\Infineon
2009-05-21 14:10 -cd—– c:\documents and settings\12linnz
2009-05-21 12:21 4,444 ac—— c:\windows\system32\pid.PNF

==================== Find3M ====================

2009-06-06 21:13 499,712 ac—— c:\windows\system32\msvcp71.dll
2009-06-06 21:13 348,160 ac—— c:\windows\system32\msvcr71.dll
2007-10-04 09:55 69,296 -c-shr– c:\windows\ctfmon.exe
2007-10-04 09:55 69,296 —shr– c:\windows\inetinfo.exe
2007-10-04 09:55 69,296 —shr– c:\windows\winlogon.exe
2007-10-04 09:55 69,296 -c-shr– c:\windows\system32\MaxBSLoad.exe
2007-10-04 09:55 69,296 -c-shr– c:\windows\system32\drivers\etc\networks.exe

============= FINISH: 11:25:03.35 ===============

GMER Log:

GMER 1.0.15.14972 - http://www.gmer.net
Rootkit scan 2009-06-13 17:44:24
Windows 5.1.2600 Service Pack 3

—- System - GMER 1.0.15 —-

SSDT sppq.sys ZwCreateKey [0xB9EA70E0]
SSDT sppq.sys ZwEnumerateKey [0xB9EC5CA4]
SSDT sppq.sys ZwEnumerateValueKey [0xB9EC6032]
SSDT sppq.sys ZwOpenKey [0xB9EA70C0]
SSDT sppq.sys ZwQueryKey [0xB9EC610A]
SSDT sppq.sys ZwQueryValueKey [0xB9EC5F8A]
SSDT sppq.sys ZwSetValueKey [0xB9EC619C]

INT 0x63 ? 89D4FBF8
INT 0x73 ? 89D4FBF8
INT 0x74 ? 89D4FBF8
INT 0x94 ? 89D4FBF8
INT 0xB4 ? 8A39BBF8
INT 0xB4 ? 8A39BBF8
INT 0xB4 ? 8A39BBF8
INT 0xB4 ? 8A39BBF8
INT 0xB4 ? 89D4FBF8
INT 0xB4 ? 89D4FBF8
INT 0xB4 ? 8A39BBF8

—- Kernel code sections - GMER 1.0.15 —-

? sppq.sys The system cannot find the file specified. !
.text USBPORT.SYS!DllUnload B7C118AC 5 Bytes JMP 89D4F1D8

—- User code sections - GMER 1.0.15 —-

UPX1 C:\WINDOWS\winlogon.exe[3928] C:\WINDOWS\winlogon.exe entry point in "UPX1" section [0x0041D250]
.code C:\WINDOWS\winlogon.exe[3928] C:\WINDOWS\winlogon.exe unknown last section [0x0041E000, 0x1000, 0xC0000040]

—- Kernel IAT/EAT - GMER 1.0.15 —-

IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] [B9EA8042] sppq.sys
IAT atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] [B9EA813E] sppq.sys
IAT atapi.sys[HAL.dll!READ_PORT_USHORT] [B9EA80C0] sppq.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] [B9EA8800] sppq.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_UCHAR] [B9EA86D6] sppq.sys
IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [B9EB7E9C] sppq.sys

—- Devices - GMER 1.0.15 —-

Device \FileSystem\Ntfs \Ntfs 8A39A1F8

AttachedDevice \FileSystem\Ntfs \Ntfs savonaccessfilter.sys (SAV On-access and HIPS for Windows XP (x86)/Sophos Plc)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)

Device \Driver\usbuhci \Device\USBPDO-0 89D4E1F8
Device \Driver\usbuhci \Device\USBPDO-1 89D4E1F8
Device \Driver\dmio \Device\DmControl\DmIoDaemon 8A32C1F8
Device \Driver\dmio \Device\DmControl\DmConfig 8A32C1F8
Device \Driver\dmio \Device\DmControl\DmPnP 8A32C1F8
Device \Driver\dmio \Device\DmControl\DmInfo 8A32C1F8
Device \Driver\usbehci \Device\USBPDO-2 89CE41F8
Device \Driver\usbuhci \Device\USBPDO-3 89D4E1F8
Device \Driver\usbuhci \Device\USBPDO-4 89D4E1F8
Device \Driver\NetBT \Device\NetBT_Tcpip_{3DD6D719-BC89-4019-AFD8-5A3D2650B992} 86895500
Device \Driver\usbuhci \Device\USBPDO-5 89D4E1F8
Device \Driver\usbehci \Device\USBPDO-6 89CE41F8
Device \Driver\Ftdisk \Device\HarddiskVolume1 8A39C1F8
Device \Driver\Cdrom \Device\CdRom0 89BA21F8
Device \Driver\NetBT \Device\NetBt_Wins_Export 86895500
Device \Driver\NetBT \Device\NetbiosSmb 86895500
Device \Driver\NetBT \Device\NetBT_Tcpip_{CA646FBE-1708-4D21-BA53-CB8BFF5901EE} 86895500
Device \Driver\usbuhci \Device\USBFDO-0 89D4E1F8
Device \Driver\usbuhci \Device\USBFDO-1 89D4E1F8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 868F3500
Device \Driver\usbehci \Device\USBFDO-2 89CE41F8
Device \FileSystem\MRxSmb \Device\LanmanRedirector 868F3500
Device \Driver\usbuhci \Device\USBFDO-3 89D4E1F8
Device \Driver\usbuhci \Device\USBFDO-4 89D4E1F8
Device \Driver\Ftdisk \Device\FtControl 8A39C1F8
Device \Driver\usbuhci \Device\USBFDO-5 89D4E1F8
Device \Driver\usbehci \Device\USBFDO-6 89CE41F8
Device \FileSystem\Cdfs \Cdfs 89635500

—- Registry - GMER 1.0.15 —-

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@cd042efbbd7f7af1647644e76e06692b 0xC8 0x28 0x51 0xAF …
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@bca643cdc5c2726b20d2ecedcc62c59b 0x6A 0x9C 0xD6 0x61 …
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@2c81e34222e8052573023a60d06dd016 0x7A 0x45 0x05 0xFD …
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@2582ae41fb52324423be06337561aa48 0x86 0x8C 0x21 0x01 …
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@caaeda5fd7a9ed7697d9686d4b818472 0xF5 0x1D 0x4D 0x73 …
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@a4a1bcf2cc2b8bc3716b74b2b4522f5d 0x50 0x93 0xE5 0xAB …
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@4d370831d2c43cd13623e232fed27b7b 0xFB 0xA7 0x78 0xE6 …
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@1d68fe701cdea33e477eb204b76f993d 0x01 0x3A 0x48 0xFC …
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@1fac81b91d8e3c5aa4b0a51804d844a3 0xB2 0x46 0x9A 0xE2 …
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@f5f62a6129303efb32fbe080bb27835b 0x3D 0xCE 0xEA 0x26 …
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@fd4e2e1a3940b94dceb5a6a021f2e3c6 0xE3 0x0E 0x66 0xD5 …
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@8a8aec57dd6508a385616fbc86791ec2 0xFA 0xEA 0x66 0x7F …

—- EOF - GMER 1.0.15 —-

Attachments:

📎Attach.txt

CatByte

Post #4June 13, 2009, 1:19 PM UTC

Hi,

P2P - I see you have P2P software utorrent and Limewire installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information.
Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares.
Please see this topic for more information:
Perils of P2P File Sharing.
I would strongly recommend that you uninstall these now. You can do so via Control Panel >> Add or Remove Programs.

NEXT

Download Flash_Disinfector.exe from HERE and save it to your desktop.

Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear.
The utility may ask you to insert your flash drive and/or other removable drives including your mobile phone. Please do so and allow the utility to clean up those drives as well.
Wait until it has finished scanning and then exit the program.
Reboot your computer when done.

NEXT

Download ComboFix from one of these locations:
Link 1
Link 2
Link 3

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

Double click on ComboFix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

lin0056

Post #5June 14, 2009, 7:42 AM UTC

I have used uTorrent and Limewire for years without viruses and I've had them long enough to distinguish the difference between possible infected files and clean ones. I have not removed them.
I ran the Flash Disinfector successfully.
I also ran ComboFix successfully.
After ComboFix restarted my computer, I realised my desktop background was changed, so I changed it to the previous one.
I also made Firefox the default browser again (I believe ComboFix changed this during the restart).
I have not made any other changes.

Here's my ComboFix log:

ComboFix 09-06-13.09 - 12LinNZ 14/06/2009 17:14.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.61.1033.18.1977.1435 [GMT 10:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Sophos Anti-Virus *On-access scanning disabled* (Updated) {3F13C776-3CBE-4DE9-8BF6-09E5183CA2BD}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\AutoRun.inf
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\windows\ctfmon.exe
c:\windows\winlogon.exe
F:\Autorun.inf
C:\AutoRun.inf
c:\windows\ctfmon.exe
c:\windows\winlogon.exe
F:\Autorun.inf

—– BITS: Possible infected sites —–

hxxp://cgsremote6
.
((((((((((((((((((((((((( Files Created from 2009-05-14 to 2009-06-14 )))))))))))))))))))))))))))))))
.

2009-06-13 13:22 . 2009-06-13 13:22 ——– dc—-w- C:\finalburner
2009-06-13 13:08 . 2009-06-13 13:09 ——– dc—-w- c:\program files\FinalBurner
2009-06-13 12:20 . 2009-06-13 12:20 ——– dc—-w- c:\program files\Common Files\xing shared
2009-06-11 21:10 . 2009-06-11 21:10 ——– dc—-w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple
2009-06-10 13:09 . 2009-06-10 13:09 ——– dc—-w- c:\documents and settings\12linnz\Application Data\Red Kawa
2009-06-09 22:59 . 2009-06-10 04:54 ——– dc—-w- c:\documents and settings\12linnz\Local Settings\Application Data\Google
2009-06-09 22:59 . 2009-06-09 22:59 ——– dc—-w- c:\program files\Google
2009-06-09 22:55 . 2009-06-09 22:52 130104 -c–a-w- c:\windows\system32\sdccoinstaller.dll
2009-06-09 22:54 . 2009-06-09 22:54 ——– dc—-w- c:\program files\Common Files\Cisco Systems
2009-06-09 22:54 . 2009-06-09 22:52 23552 -c–a-w- c:\windows\system32\sophosboottasks.exe
2009-06-09 22:53 . 2009-06-09 22:54 ——– dc—-w- c:\documents and settings\All Users\Application Data\Sophos
2009-06-09 22:52 . 2009-06-09 22:52 14976 -c–a-w- c:\windows\system32\drivers\SophosBootDriver.sys
2009-06-09 22:52 . 2009-06-09 22:52 38528 -c–a-w- c:\windows\system32\drivers\savonaccessfilter.sys
2009-06-09 22:52 . 2009-06-09 22:52 110848 -c–a-w- c:\windows\system32\drivers\savonaccesscontrol.sys
2009-06-09 22:50 . 2009-06-09 22:54 ——– dc—-w- c:\program files\Sophos
2009-06-09 13:55 . 2009-06-09 13:55 664 -c–a-w- c:\windows\system32\d3d9caps.dat
2009-06-09 13:18 . 2009-06-09 13:18 ——– dc—-w- c:\program files\Regensoft
2009-06-09 13:18 . 2009-06-09 13:18 ——– dc—-w- c:\program files\Red Kawa
2009-06-09 07:39 . 2004-08-18 02:14 442368 -c–a-w- c:\windows\system32\vp6vfw.dll
2009-06-07 08:17 . 2009-06-07 10:39 ——– dc—-w- c:\program files\Universal Forum Poster
2009-06-07 08:17 . 2009-06-07 08:17 ——– dc—-w- c:\windows\Universal Forum Poster
2009-06-07 04:21 . 2009-06-07 04:21 ——– dc—-w- c:\documents and settings\12linnz\Application Data\WindowsApplication1
2009-06-07 04:02 . 2009-06-07 04:04 ——– dc—-w- c:\documents and settings\12linnz\Application Data\Media Player Classic
2009-06-07 03:43 . 2009-06-08 00:31 ——– dc—-w- c:\documents and settings\12linnz\Local Settings\Application Data\Deployment
2009-06-07 01:15 . 2009-06-07 01:15 ——– dc—-w- c:\documents and settings\12linnz\Application Data\CyberLink
2009-06-04 23:32 . 2009-06-13 12:20 ——– dc—-w- c:\program files\Common Files\Real
2009-06-04 23:31 . 2009-06-04 23:31 ——– dc—-w- c:\program files\Real
2009-06-03 01:12 . 2001-08-17 12:36 5632 -c–a-w- c:\windows\system32\ptpusb.dll
2009-06-03 01:12 . 2008-04-13 19:42 159232 -c–a-w- c:\windows\system32\ptpusd.dll
2009-06-03 01:12 . 2008-04-13 14:15 15104 -c–a-w- c:\windows\system32\drivers\usbscan.sys
2009-06-03 01:12 . 2008-04-13 14:15 15104 -c–a-w- c:\windows\system32\dllcache\usbscan.sys
2009-06-01 09:32 . 2009-06-01 09:32 ——– dc—-w- c:\windows\system32\wbem\Repository
2009-06-01 09:18 . 2009-06-01 09:18 ——– dc—-w- c:\windows\LastGood(2)
2009-05-31 10:44 . 2009-05-31 10:44 ——– dc—-w- c:\documents and settings\12linnz\Application Data\Uniblue
2009-05-29 02:21 . 2009-05-29 02:21 ——– dc—-w- c:\documents and settings\12linnz\Bluetooth Software
2009-05-28 06:34 . 2009-05-28 06:34 ——– dc—-w- c:\program files\LibUSB-Win32
2009-05-28 06:34 . 2007-03-20 01:33 28672 -c–a-w- c:\windows\system32\drivers\libusb0.sys
2009-05-28 06:34 . 2007-03-20 01:33 43520 -c–a-w- c:\windows\system32\libusb0.dll
2009-05-28 06:33 . 2009-06-03 02:04 ——– dc—-w- c:\program files\QuickFreedom
2009-05-26 05:10 . 2009-05-26 05:10 ——– dc—-w- c:\documents and settings\12linnz\Application Data\DivX
2009-05-25 04:32 . 2009-02-20 18:09 268288 -c—-w- c:\windows\system32\dllcache\iertutil.dll
2009-05-25 04:32 . 2009-02-20 18:09 63488 -c—-w- c:\windows\system32\dllcache\icardie.dll
2009-05-25 04:32 . 2009-02-20 18:09 52224 -c—-w- c:\windows\system32\dllcache\msfeedsbs.dll
2009-05-25 04:32 . 2009-02-20 10:20 13824 -c—-w- c:\windows\system32\dllcache\ieudinit.exe
2009-05-25 04:32 . 2009-02-20 18:09 459264 -c—-w- c:\windows\system32\dllcache\msfeeds.dll
2009-05-25 04:32 . 2008-07-09 14:25 2455488 -c—-w- c:\windows\system32\dllcache\ieapfltr.dat
2009-05-25 04:32 . 2009-02-20 18:09 383488 -c—-w- c:\windows\system32\dllcache\ieapfltr.dll
2009-05-25 04:31 . 2009-02-20 18:09 6066176 -c—-w- c:\windows\system32\dllcache\ieframe.dll
2009-05-24 11:34 . 2009-05-24 11:34 ——– dc—-w- c:\windows\system32\Adobe
2009-05-23 10:00 . 2009-05-23 10:00 ——– dc—-w- c:\documents and settings\12linnz\Application Data\Leadertech
2009-05-22 01:57 . 2005-01-03 06:43 4682 -c–a-w- c:\windows\system32\npptNT2.sys
2009-05-22 01:56 . 2009-05-22 01:56 ——– dc—-w- c:\program files\Common Files\INCA Shared
2009-05-21 12:23 . 2009-05-21 12:23 ——– dc—-w- c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-05-21 09:24 . 2009-06-13 22:59 ——– dc—-w- c:\program files\EA Sports
2009-05-21 09:07 . 2009-05-21 09:07 ——– dc—-w- c:\documents and settings\12linnz\Local Settings\Application Data\Sophos
2009-05-21 08:57 . 2009-05-21 08:57 721904 —-a-w- c:\windows\system32\drivers\sptd.sys
2009-05-21 08:57 . 2009-05-21 08:57 ——– dc—-w- c:\documents and settings\12linnz\Application Data\DAEMON Tools Lite
2009-05-21 08:53 . 2009-05-21 08:53 ——– dc-h–w- c:\windows\PIF
2009-05-21 08:47 . 2009-06-04 11:38 ——– dc—-w- c:\documents and settings\12linnz\Application Data\LimeWire
2009-05-21 08:44 . 2009-05-21 08:44 ——– dc—-w- c:\program files\PowerISO
2009-05-21 08:44 . 2009-05-21 08:44 ——– dc—-w- c:\program files\LimeWire
2009-05-21 08:37 . 2009-05-21 10:08 ——– dc—-w- c:\program files\Messenger Plus! Live
2009-05-21 08:33 . 2009-05-21 08:33 ——– dc—-w- c:\program files\uTorrent
2009-05-21 08:33 . 2009-06-13 22:42 ——– dc—-w- c:\documents and settings\12linnz\Application Data\uTorrent
2009-05-21 08:33 . 2009-05-28 07:37 ——– dc—-w- c:\documents and settings\12linnz\Application Data\Apple Computer
2009-05-21 08:33 . 2009-03-19 06:32 23400 -c–a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-05-21 08:33 . 2008-04-17 02:12 107368 -c–a-w- c:\windows\system32\GEARAspi.dll
2009-05-21 08:32 . 2009-05-21 08:32 ——– dc—-w- c:\program files\iPod
2009-05-21 08:32 . 2009-05-21 08:33 ——– dc—-w- c:\program files\iTunes
2009-05-21 08:32 . 2009-05-21 08:33 ——– dc—-w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-05-21 08:32 . 2009-05-21 08:32 ——– dc—-w- c:\program files\Bonjour
2009-05-21 08:31 . 2009-05-21 08:32 ——– dc—-w- c:\program files\QuickTime
2009-05-21 08:31 . 2009-05-21 08:32 ——– dc—-w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-05-21 08:31 . 2009-05-21 08:31 ——– dc—-w- c:\documents and settings\12linnz\Local Settings\Application Data\Apple
2009-05-21 08:31 . 2009-05-21 08:31 ——– dc—-w- c:\program files\Apple Software Update
2009-05-21 08:31 . 2009-03-26 05:23 36864 -c–a-w- c:\windows\system32\drivers\usbaapl.sys
2009-05-21 08:31 . 2009-03-26 05:23 1900544 -c–a-w- c:\windows\system32\usbaaplrc.dll
2009-05-21 08:31 . 2009-05-21 08:32 ——– dc—-w- c:\program files\Common Files\Apple
2009-05-21 08:31 . 2009-05-21 08:31 ——– dc—-w- c:\documents and settings\All Users\Application Data\Apple
2009-05-21 08:30 . 2009-05-21 08:33 ——– dc—-w- c:\documents and settings\12linnz\Local Settings\Application Data\Apple Computer
2009-05-21 08:12 . 2009-05-21 08:12 ——– dc—-w- c:\program files\DVD Decrypter
2009-05-21 08:12 . 2009-05-21 08:12 43602 -c–a-w- c:\windows\system32\xvid-uninstall.exe
2009-05-21 08:12 . 2009-05-21 08:12 ——– dc—-w- c:\program files\AviSynth 2.5
2009-05-21 08:12 . 2009-05-21 08:12 ——– dc—-w- c:\program files\Gabest
2009-05-21 08:12 . 2009-05-21 08:12 ——– dc—-w- c:\program files\AutoGK
2009-05-21 08:00 . 2009-06-14 01:06 ——– dc—-w- c:\documents and settings\12linnz\Tracing
2009-05-21 07:59 . 2009-05-21 07:59 ——– dc—-w- c:\program files\Microsoft Silverlight
2009-05-21 07:58 . 2009-05-21 07:59 ——– dc—-w- c:\program files\Microsoft
2009-05-21 07:58 . 2009-05-21 07:58 ——– dc—-w- c:\program files\Windows Live SkyDrive
2009-05-21 07:57 . 2009-05-21 07:58 ——– dc—-w- c:\program files\Windows Live
2009-05-21 07:55 . 2009-05-21 07:55 ——– dc—-w- c:\program files\Common Files\Windows Live
2009-05-21 07:55 . 2009-06-02 10:32 105544 -c–a-w- c:\documents and settings\12linnz\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-21 07:46 . 2008-04-13 14:15 10368 -c–a-w- c:\windows\system32\drivers\hidusb.sys
2009-05-21 07:46 . 2008-04-13 14:15 10368 -c–a-w- c:\windows\system32\dllcache\hidusb.sys
2009-05-21 05:19 . 2009-05-21 05:19 ——– dc—-w- c:\program files\Combined Community Codec Pack
2009-05-21 05:19 . 2009-05-21 05:19 ——– dc—-w- c:\program files\CCleaner
2009-05-21 05:14 . 2009-05-21 05:14 0 -c–a-w- c:\windows\nsreg.dat
2009-05-21 05:14 . 2009-05-21 05:14 ——– dc—-w- c:\documents and settings\12linnz\Local Settings\Application Data\Mozilla
2009-05-21 05:01 . 2009-05-21 05:01 152576 -c–a-w- c:\documents and settings\12linnz\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-05-21 04:59 . 2009-05-21 04:59 ——– dc—-w- c:\documents and settings\12linnz\Local Settings\Application Data\Microsoft Help
2009-05-21 04:59 . 2009-06-01 09:32 ——– dc—-w- c:\documents and settings\saaa
2009-05-21 04:57 . 2009-03-21 14:06 989696 -c—-w- c:\windows\system32\dllcache\kernel32.dll
2009-05-21 04:57 . 2009-02-03 19:59 56832 -c—-w- c:\windows\system32\dllcache\secur32.dll
2009-05-21 04:57 . 2008-12-05 06:54 144896 -c—-w- c:\windows\system32\dllcache\schannel.dll
2009-05-21 04:57 . 2009-03-06 14:22 284160 -c—-w- c:\windows\system32\dllcache\pdh.dll
2009-05-21 04:57 . 2009-02-09 12:10 401408 -c—-w- c:\windows\system32\dllcache\rpcss.dll
2009-05-21 04:57 . 2009-02-09 12:10 729088 -c—-w- c:\windows\system32\dllcache\lsasrv.dll
2009-05-21 04:57 . 2009-02-09 12:10 714752 -c—-w- c:\windows\system32\dllcache\ntdll.dll
2009-05-21 04:57 . 2009-02-09 12:10 617472 -c—-w- c:\windows\system32\dllcache\advapi32.dll
2009-05-21 04:57 . 2009-02-09 12:10 473600 -c—-w- c:\windows\system32\dllcache\fastprox.dll
2009-05-21 04:57 . 2009-02-09 12:10 453120 -c—-w- c:\windows\system32\dllcache\wmiprvsd.dll
2009-05-21 04:57 . 2009-02-06 11:11 110592 -c—-w- c:\windows\system32\dllcache\services.exe
2009-05-21 04:56 . 2008-06-12 14:23 66560 -c—-w- c:\windows\system32\dllcache\mtxclu.dll
2009-05-21 04:56 . 2008-06-17 19:02 8461312 -c—-w- c:\windows\system32\dllcache\shell32.dll
2009-05-21 04:55 . 2008-12-16 12:30 354304 -c—-w- c:\windows\system32\dllcache\winhttp.dll
2009-05-21 04:55 . 2008-10-23 12:36 286720 -c—-w- c:\windows\system32\dllcache\gdi32.dll
2009-05-21 04:14 . 2008-05-03 11:55 2560 -c—-w- c:\windows\system32\xpsp4res.dll
2009-05-21 04:13 . 2009-06-02 22:57 ——– dc—-w- c:\documents and settings\12linnz\Local Settings\Application Data\Adobe
2009-05-21 04:13 . 2009-05-21 04:13 ——– dc—-w- c:\documents and settings\12linnz\Application Data\Infineon

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-14 07:32 . 2009-06-14 07:32 0 -c–a-w- c:\documents and settings\12linnz\.user-client.12linnz.12linnz.lock.tmp
2009-06-13 12:19 . 2003-02-20 17:42 348160 -c–a-w- c:\windows\system32\msvcr71.dll
2009-06-13 12:19 . 2003-03-18 09:14 499712 -c–a-w- c:\windows\system32\msvcp71.dll
2009-06-02 06:33 . 2008-10-24 01:29 ——– dc—-w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-06-02 06:31 . 2008-10-24 01:32 ——– dc—-w- c:\program files\Microsoft Works
2009-05-21 05:02 . 2008-11-05 00:35 ——– dc—-w- c:\program files\Java
2009-04-02 06:29 . 2009-04-02 06:29 75048 -c–a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.1.1.10\SetupAdmin.exe
2009-03-19 06:32 . 2009-03-19 06:32 23400 -c–a-w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}\x86\x86\GEARAspiWDM.sys
2007-10-03 23:55 . 2007-10-03 23:55 69296 -csh–r- c:\windows\ctfmon.exe
2007-10-03 23:55 . 2007-10-03 23:55 69296 –sh–r- c:\windows\inetinfo.exe
2007-10-03 23:55 . 2007-10-03 23:55 69296 -csh–r- c:\windows\winlogon.exe
2007-10-03 23:55 . 2007-10-03 23:55 69296 -csh–r- c:\windows\system32\MaxBSLoad.exe
2007-10-03 23:55 . 2007-10-03 23:55 69296 -csh–r- c:\windows\system32\drivers\etc\networks.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MaxBSLoad"="c:\windows\system32\MaxBSLoad.exe" [2007-10-03 69296]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AzMixerSel"="c:\program files\Realtek\Audio\InstallShield\AzMixerSel.exe" [2006-07-17 53248]
"ZPdtWzdVitaKey MC3000"="c:\program files\Acer\Acer Bio Protection\PdtWzd.exe" [2008-10-22 3680768]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-01-18 1028096]
"IFXSPMGT"="c:\windows\system32\ifxspmgt.exe" [2007-07-23 677144]
"PLFSetI"="c:\windows\PLFSetI.exe" [2007-10-23 200704]
"PLFSetL"="c:\windows\PLFSetL.exe" [2007-07-05 94208]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-06-04 150040]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-06-04 170520]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-06-04 141848]
"LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2008-05-02 870920]
"PaperCut NG Client"="c:\program files\PaperCut NG Client\pc-client.exe" [2006-11-02 184320]
"networks"="c:\windows\winlogon.exe" [2007-10-03 69296]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-06-13 198160]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2008-05-07 16862208]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]
"inetinfo"="c:\windows\inetinfo.exe" [2007-10-03 69296]

[HKEY_CURRENT_USER\software\microsoft\windows\Currentversion\policies\explorer\Run]
"ctfmon"="c:\windows\ctfmon.exe" [2007-10-03 69296]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
AutoUpdate Monitor.lnk - c:\program files\Sophos\AutoUpdate\ALMon.exe [2009-1-28 245760]
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-9-11 576104]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\AWinNotifyVitaKey MC3000]
2008-10-22 03:39 3076096 —-a-w- c:\program files\Acer\Acer Bio Protection\WinNotify.dll

[HKEY_CURRENT_USER\software\microsoft\windows nt\currentversion\windows]
"load"=c:\windows\system32\drivers\etc\networks.exe

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0pgdfgsvc C 1\0lsdelete

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SAVService]
@="service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SophosAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\RM.exe"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\Studio.exe"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\umi.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\EA Sports\\FIFA Online 2\\FF2Client.exe"=
"c:\\Program Files\\EA Sports\\Madden NFL 08\\Updater.exe"=

R0 AlfaFF;AlfaFF File System mini-filter;c:\windows\system32\drivers\AlfaFF.sys [22/10/2008 1:39 PM 43184]
R1 PersonalSecureDrive;PersonalSecureDrive;c:\windows\system32\drivers\psd.sys [24/07/2007 7:59 AM 38816]
R1 SAVOnAccessControl;SAVOnAccessControl;c:\windows\system32\drivers\savonaccesscontrol.sys [10/06/2009 8:52 AM 110848]
R1 SAVOnAccessFilter;SAVOnAccessFilter;c:\windows\system32\drivers\savonaccessfilter.sys [10/06/2009 8:52 AM 38528]
R2 FPSensor;LTT-Corp Fingerprint Reader Driver (FPSensor.sys);c:\windows\system32\drivers\FPSensor.sys [22/10/2008 1:39 PM 20352]
R2 IGBASVC;iGroupTec Service;c:\program files\Acer\Acer Bio Protection\BASVC.exe [22/10/2008 1:39 PM 3481600]
R2 SAVAdminService;Sophos Anti-Virus status reporter;c:\program files\Sophos\Sophos Anti-Virus\SAVAdminService.exe [10/06/2009 8:52 AM 80936]
R2 SAVService;Sophos Anti-Virus;c:\program files\Sophos\Sophos Anti-Virus\SavService.exe [10/06/2009 8:52 AM 98304]
R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [24/07/2007 7:59 AM 41216]
R3 ITEIRDA;ITE Infrared Device Driver;c:\windows\system32\drivers\ITEirda.sys [22/10/2008 1:59 PM 24576]
R3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.12.1;c:\windows\system32\drivers\libusb0.sys [28/05/2009 4:34 PM 28672]
S3 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\program files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [15/08/2008 4:46 AM 284016]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service –> c:\windows\system32\GameMon.des -service [?]
S4 SophosBootDriver;SophosBootDriver;c:\windows\system32\drivers\SophosBootDriver.sys [10/06/2009 8:52 AM 14976]
.
Contents of the 'Scheduled Tasks' folder

2009-06-11 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 02:34]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://intranet.cgs.vic.edu.au
uInternet Settings,ProxyServer = proxy.cgs.vic.edu.au:8081
uInternet Settings,ProxyOverride = intranet.cgs.vic.edu.au;www.cgs.vic.edu.au;mail.cgs.vic.edu.au;homepages.cgs.vic
.edu.au;maintreq.cgs.vic.edu.au;icdl.cgs.vic.edu.au;10.1.0.10;
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Send to &Bluetooth Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send To Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
FF - ProfilePath -
.
.
——- File Associations ——-
.
txtfile=c:\windows\system32\drivers\etc\networks.exe %1
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-14 17:30
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Sophos Message Router]
"ImagePath"="\"c:\program files\Sophos\Remote Management System\RouterNT.exe\" -service -name Router -ORBListenEndpoints iiop://:8193/ssl_port=8194"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{95808DC4-FA4A-4c74-92FE-5B863F82066B}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD\000.fcl"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:c8,28,51,af,b0,29,a3,98,d5,b8,a1,a9,7e,
87,6a,94,e2,63,26,f1,3f,c8,ff,68,df,94,86,26,a5,12,0f,c0,e2,63,26,f1,3f,c8,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:6a,9c,d6,61,af,45,84,18,71,1a,61,44,db,
a8,82,97,6a,9c,d6,61,af,45,84,18,83,7b,73,fe,35,7f,b9,26,6a,9c,d6,61,af,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:7a,45,05,fd,91,e8,6f,31,47,40,97,61,c4,
c9,a5,79,ff,7c,85,e0,43,d4,0e,fe,21,4d,f0,17,f6,e7,28,88,ff,7c,85,e0,43,d4,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:86,8c,21,01,be,91,eb,e7,a3,17,83,07,a1,
83,8c,66,86,8c,21,01,be,91,eb,e7,0e,78,df,c8,9b,41,00,e2,86,8c,21,01,be,91,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:f5,1d,4d,73,a8,13,5c,05,97,2c,97,8b,a4,
1d,07,01,f5,1d,4d,73,a8,13,5c,05,20,5d,a8,2f,c8,f1,7c,ec,f5,1d,4d,73,a8,13,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:50,93,e5,ab,ec,6a,4e,ab,24,86,c7,1b,af,
30,21,d9,df,20,58,62,78,6b,cf,c8,5d,e6,b2,f6,ed,49,0d,ba,df,20,58,62,78,6b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:fb,a7,78,e6,12,2f,9a,ea,52,78,a1,7b,1a,
5c,ba,51,fb,a7,78,e6,12,2f,9a,ea,d5,67,83,e0,bf,40,66,d3,fb,a7,78,e6,12,2f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:01,3a,48,fc,e8,04,4a,f1,71,46,b7,8f,9c,
88,cf,5c,01,3a,48,fc,e8,04,4a,f1,90,cc,56,9e,a7,3b,4a,9a,01,3a,48,fc,e8,04,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:b2,46,9a,e2,1b,fe,1b,94,e0,3d,bd,d0,c7,
c8,8d,aa,f6,0f,4e,58,98,5b,89,c9,67,07,14,4c,8f,87,0d,9a,f6,0f,4e,58,98,5b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:3d,ce,ea,26,2d,45,aa,78,a6,b2,47,1f,90,
b6,4a,42,3d,ce,ea,26,2d,45,aa,78,73,ef,c4,29,16,3b,93,0d,3d,ce,ea,26,2d,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:e3,0e,66,d5,eb,bc,2f,6b,c5,95,af,cf,7c,
50,87,ac,2a,b7,cc,b5,b9,7f,41,e7,46,1e,1f,67,d1,64,b3,dd,2a,b7,cc,b5,b9,7f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:fa,ea,66,7f,d4,3b,6b,70,b0,19,c8,08,c2,
74,8d,60,6c,43,2d,1e,aa,22,2f,9c,2c,76,91,5e,93,cf,2a,25,6c,43,2d,1e,aa,22,\
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(1136)
c:\program files\Acer\Acer Bio Protection\CompPtc.dll
c:\program files\Acer\Acer Bio Protection\CustomRes.dll
c:\windows\system32\NBMatS1SDK.DLL
c:\program files\Acer\Acer Bio Protection\WinNotify.dll
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll

- - - - - - - > 'winlogon.exe'(3200)
c:\windows\system32\MSWINSCK.OCX
c:\program files\Bonjour\mdnsNSP.dll

- - - - - - - > 'lsass.exe'(1192)
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll

- - - - - - - > 'explorer.exe'(3852)
c:\windows\system32\btmmhook.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\btncopy.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\program files\Lavasoft\Ad-Aware 2007\aawservice.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\IFXTCS.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
c:\windows\system32\IfxPsdSv.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\program files\Sophos\Remote Management System\ManagementAgentNT.exe
c:\program files\Sophos\AutoUpdate\ALsvc.exe
c:\program files\Sophos\Remote Management System\RouterNT.exe
c:\windows\system32\CF467.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\Infineon\Security Platform Software\PSDrt.exe
c:\program files\Infineon\Security Platform Software\SpTNA.exe
c:\windows\system32\igfxext.exe
c:\windows\system32\dwwin.exe
c:\docume~1\12linnz\LOCALS~1\Temp\RtkBtMnt.exe
c:\windows\system32\wbem\wmiadap.exe
.
**************************************************************************
.
Completion time: 2009-06-14 17:34 - machine was rebooted
ComboFix-quarantined-files.txt 2009-06-14 07:34

Pre-Run: 86,548,688,896 bytes free
Post-Run: 88,548,339,712 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

389 — E O F — 2009-06-03 01:15

lin0056

Post #6June 14, 2009, 7:43 AM UTC

Oh, I forgot to add; When my computer was restarted by ComboFix, I still received the inetinfo.exe error.

CatByte

Post #7June 14, 2009, 11:49 AM UTC

Hi,

Using windows explorer (windows key +E) locate the inetinfo.exe file (if it's there) and provide the full path.

The version in System32 folder is used as a server connection for maintaining web pages. Are you networked into several other computers?

NEXT

Download Flash_Disinfector.exe from HERE and save it to your desktop.

Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear.
The utility may ask you to insert your flash drive and/or other removable drives including your mobile phone. Please do so and allow the utility to clean up those drives as well.
Wait until it has finished scanning and then exit the program.
Reboot your computer when done.

NEXT

Download Rooter.exe to your desktop

Doubleclick it to start the tool
A Notepad file containing the report will open, also found at %systemdrive%\Rooter.txt (Where %systemdrive% is usually C: or the drive that you have installed Windows).
Post that in your next reply.

NEXT

Please download Malwarebytes' Anti-Malware

Double Click mbam-setup.exe to install the application.
Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish, so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected. <– very important
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

NEXT

Run an on-line scan with Kaspersky

Please do a scan with Kaspersky Online Scanner. Please note: Kaspersky requires Java Runtime Environment (JRE) be installed before scanning for malware, as ActiveX is no longer being used.)

Open the Kaspersky WebScanner
page.
Click on the 🖼Click to load external image (Posted Image) button on the main page.
The program will launch and fill in the Information section on the left.
Read the "Requirements and Limitations" then press the 🖼Click to load external image (Posted Image) button.
The program will begin downloading the latest program and definition files. It may take a while so please be patient and let it finish.

under the Scan section on the left:
Select My Computer
The program will now start and scan your system. This will run for a while, be patient and let it finish.
Once the scan is complete, click on View scan report
Now, click on the Save Report as button.
Save the file to your desktop.
Copy and paste that information in your next post.

You can refer to this animation by sundavis.

In your next reply please include

Rooter Log
MBAM Log
Kaspersky report

lin0056

Post #8June 14, 2009, 1:45 PM UTC

I was unable to locate inetinfo.exe. I assume it is the one you are referring to because I'm part of a school network of many computers and laptops. I'm pretty sure that the server does manage webpages as well (the intranet) Rooter Log: Rooter.exe (v1.0) by Eric_71 ¨ Microsoft Windows XP Professional (5.1.2600) Service Pack 3 32_bits - x86 Family 6 Model 23 Stepping 6, GenuineIntel ¨ C:\ [Fixed-NTFS] .. ( Total:152625 Mo - Free:87359 Mo ) D:\ [CD_Rom] F:\ [Fixed-NTFS] .. ( Total:114463 Mo - Free:84543 Mo ) L:\ [Network] .. ( Total:0 Mo - Free:0 Mo ) P:\ [Network] .. ( Total:0 Mo - Free:0 Mo ) S:\ [Network] .. ( Total:0 Mo - Free:0 Mo ) T:\ [Network] .. ( Total:0 Mo - Free:0 Mo ) X:\ [Network] .. ( Total:0 Mo - Free:0 Mo ) ¨ Scan : 22:19.49 Path : C:\Documents and Settings\12linnz\Desktop\Rooter.exe User : 12LinNZ ( Administrator -> YES ) ¨ ———————-\\ Processes ¨ Locked [System Process] (0) ______ System (4) ______ \SystemRoot\System32\smss.exe (1020) ______ \??\C:\WINDOWS\system32\csrss.exe (1096) ______ \??\C:\WINDOWS\system32\winlogon.exe (1120) ______ C:\WINDOWS\system32\services.exe (1164) ______ C:\WINDOWS\system32\lsass.exe (1176) ______ C:\WINDOWS\system32\svchost.exe (1324) ______ C:\WINDOWS\system32\svchost.exe (1416) ______ C:\WINDOWS\System32\svchost.exe (1456) ______ C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe (1480) ______ C:\Program Files\Sophos\Sophos Anti-Virus\SavService.exe (1520) ______ C:\WINDOWS\system32\svchost.exe (1876) ______ C:\WINDOWS\system32\svchost.exe (1900) ______ C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe (280) ______ C:\WINDOWS\system32\spoolsv.exe (444) ______ C:\WINDOWS\system32\svchost.exe (732) ______ C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (820) ______ C:\Program Files\Bonjour\mDNSResponder.exe (844) ______ C:\WINDOWS\system32\ifxspmgt.exe (920) ______ C:\WINDOWS\system32\IFXTCS.exe (1064) ______ C:\Program Files\Acer\Acer Bio Protection\BASVC.exe (1352) ______ C:\Program Files\Java\jre6\bin\jqs.exe (1224) ______ C:\Program Files\Common Files\LightScribe\LSSrvc.exe (1600) ______ C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe (1748) ______ C:\WINDOWS\system32\IfxPsdSv.exe (1796) ______ C:\Program Files\CyberLink\Shared Files\RichVideo.exe (204) ______ C:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe (252) ______ C:\Program Files\Sophos\Remote Management System\ManagementAgentNT.exe (696) ______ C:\Program Files\Sophos\AutoUpdate\ALsvc.exe (772) ______ C:\Program Files\Sophos\Remote Management System\RouterNT.exe (792) ______ C:\WINDOWS\system32\svchost.exe (972) ______ C:\WINDOWS\System32\alg.exe (2220) ______ C:\WINDOWS\Explorer.EXE (3696) ______ C:\WINDOWS\RTHDCPL.EXE (3920) ______ C:\Program Files\Acer\Acer Bio Protection\PdtWzd.exe (3988) ______ C:\WINDOWS\winlogon.exe (3992) ______ C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (4072) ______ C:\WINDOWS\PLFSetI.exe (136) ______ C:\WINDOWS\system32\igfxtray.exe (224) ______ C:\WINDOWS\system32\hkcmd.exe (1784) ______ C:\WINDOWS\system32\igfxpers.exe (684) ______ C:\WINDOWS\system32\igfxsrvc.exe (1140) ______ C:\PROGRA~1\LAUNCH~1\LManager.exe (1772) ______ C:\Program Files\PaperCut NG Client\pc-client.exe (892) ______ C:\Program Files\Common Files\Real\Update_OB\realsched.exe (2276) ______ C:\WINDOWS\system32\ctfmon.exe (2492) ______ C:\Program Files\Infineon\Security Platform Software\PSDrt.exe (2432) ______ C:\Program Files\Infineon\Security Platform Software\SpTna.exe (2064) ______ C:\Program Files\Sophos\AutoUpdate\ALMon.exe (2524) ______ C:\WINDOWS\system32\igfxext.exe (2600) ______ C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (2808) ______ C:\WINDOWS\system32\wuauclt.exe (3248) ______ C:\WINDOWS\system32\wbem\wmiprvse.exe (3760) ______ C:\DOCUME~1\12linnz\LOCALS~1\Temp\RtkBtMnt.exe (3812) ______ C:\WINDOWS\inetinfo.exe (2488) ______ C:\Documents and Settings\12linnz\Desktop\Rooter.exe (3056) ______ C:\Program Files\Mozilla Firefox\firefox.exe (3192) ¨ ———————-\\ Device\Harddisk0\ ¨ \Device\Harddisk0 [Sectors : 63 x 512 Bytes] ¨ \Device\Harddisk0\Partition1 –[ MBR ]– (Start_Offset:32256 | Length:160039240704) ¨ ———————-\\ Scheduled Tasks ¨ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job C:\WINDOWS\Tasks\desktop.ini C:\WINDOWS\Tasks\SA.DAT ¨ ———————-\\ Registry ¨ ¨ ———————-\\ Files & Folders ¨ ———————-\\ Scan completed at 22:20.20 ¨ C:\Rooter$\Rooter_1.txt - (14/06/2009 | 22:20.20) MBAM Log: Malwarebytes' Anti-Malware 1.37 Database version: 2275 Windows 5.1.2600 Service Pack 3 14/06/2009 10:25:13 PM mbam-log-2009-06-14 (22-25-13).txt Scan type: Quick Scan Objects scanned: 93868 Time elapsed: 3 minute(s), 19 second(s) Memory Processes Infected: 1 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 4 Registry Data Items Infected: 1 Folders Infected: 0 Files Infected: 6 Memory Processes Infected: C:\WINDOWS\winlogon.exe (Backdoor.Bot) -> Unloaded process successfully. Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ctfmon (Trojan.Agent) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\networks (Backdoor.Bot) -> Delete on reboot. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\maxbsload (Worm.AutoRun) -> Delete on reboot. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\load (Worm.AutoRun) -> Delete on reboot. Registry Data Items Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Load (Worm.AutoRun) -> Data: c:\windows\system32\drivers\etc\networks.exe -> Delete on reboot. Folders Infected: (No malicious items detected) Files Infected: C:\WINDOWS\ctfmon.exe (Trojan.Agent) -> Delete on reboot. C:\WINDOWS\winlogon.exe (Backdoor.Bot) -> Delete on reboot. C:\AutoRun.inf (Worm.AutoRun) -> Quarantined and deleted successfully. C:\SysWin32.exe (Worm.AutoRun) -> Quarantined and deleted successfully. C:\WINDOWS\system32\drivers\etc\networks.exe (Worm.AutoRun) -> Delete on reboot. C:\WINDOWS\system32\MaxBSLoad.exe (Worm.AutoRun) -> Quarantined and deleted successfully. I do not have enough time for the Kaspersky scan tonight (it takes a while to update). I will do it when I return from school tomorrow. By the way, you need to change your instructions for Kaspersky.

lin0056

Post #9June 15, 2009, 9:13 AM UTC

Here is my Kaspersky Log: ——————————————————————————– KASPERSKY ONLINE SCANNER 7.0 REPORT Monday, June 15, 2009 Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Program database last update: Monday, June 15, 2009 07:01:46 Records in database: 2344759 ——————————————————————————– Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: C:\ D:\ L:\ P:\ S:\ T:\ X:\ Scan statistics: Files scanned: 152056 Threat name: 1 Infected objects: 17 Suspicious objects: 0 Duration of the scan: 02:42:13 File name / Threat name / Threats count C:\WINDOWS\inetinfo.exe//PE_Patch.UPX//UPX/C:\WINDOWS\inetinfo.exe//PE_Patch.UPX//UPX Infected: Worm.Win32.AutoRun.ctb 1 C:\WINDOWS\winlogon.exe//PE_Patch.UPX//UPX/C:\WINDOWS\winlogon.exe//PE_Patch.UPX//UPX Infected: Worm.Win32.AutoRun.ctb 1 C:\Qoobox\Quarantine\C\WINDOWS\ctfmon.exe.vir Infected: Worm.Win32.AutoRun.ctb 1 C:\Qoobox\Quarantine\C\WINDOWS\winlogon.exe.vir Infected: Worm.Win32.AutoRun.ctb 1 C:\Qoobox\Quarantine\C\WINDOWS\_ctfmon_.exe.zip Infected: Worm.Win32.AutoRun.ctb 3 C:\Qoobox\Quarantine\C\WINDOWS\_winlogon_.exe.zip Infected: Worm.Win32.AutoRun.ctb 4 C:\SysWin32.exe Infected: Worm.Win32.AutoRun.ctb 1 C:\WINDOWS\ctfmon.exe Infected: Worm.Win32.AutoRun.ctb 1 C:\WINDOWS\inetinfo.exe Infected: Worm.Win32.AutoRun.ctb 1 C:\WINDOWS\system32\drivers\etc\networks.exe Infected: Worm.Win32.AutoRun.ctb 1 C:\WINDOWS\system32\MaxBSLoad.exe Infected: Worm.Win32.AutoRun.ctb 1 C:\WINDOWS\winlogon.exe Infected: Worm.Win32.AutoRun.ctb 1 The selected area was scanned.

CatByte

Post #10June 15, 2009, 11:12 AM UTC last edited June 15, 2009, 11:14 AM UTC

One or more of the identified infections is a backdoor trojan.

This type of infection allows hackers to access and remotely control your computer, log keystrokes, steal critical system information, and download and execute files without your knowledge.
If you do any banking or other financial transactions on the PC or if it contains any other sensitive information, then from a clean computer, change all passwords where applicable.
It would also be wise to contact those same financial institutions to appraise them of your situation.
Please read this: How Do I Handle Possible Identify Theft, Internet Fraud, and CC Fraud?
The only way to be sure this computer can be 100% trustworthy again is a complete reformat / reinstall.

NEXT

Please download OTM by OldTimer.

Save it to your desktop.
Please click OTM and then click >> run.
Copy the lines inside the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

:Processes
explorer.exe

:Files
C:\WINDOWS\inetinfo.exe//PE_Patch.UPX//UPX/C:\WINDOWS\inetinfo.exe//PE_Patch.UPX//UPX 
C:\WINDOWS\winlogon.exe//PE_Patch.UPX//UPX/C:\WINDOWS\winlogon.exe//PE_Patch.UPX//UPX 
C:\SysWin32.exe 
C:\WINDOWS\ctfmon.exe 
C:\WINDOWS\inetinfo.exe
C:\WINDOWS\system32\drivers\etc\networks.exe 
C:\WINDOWS\system32\MaxBSLoad.exe 
C:\WINDOWS\winlogon.exe

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

Return to OTM, right click in the "Paste Instructions for items to be Moved" window (under the yellow bar) and choose Paste.
Click the red Moveit! button.
Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
Close OTM

Note: If an item cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

lin0056

Post #11June 15, 2009, 11:22 AM UTC

It had some errors while running… Here is the log: Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! ========== COMMANDS ========== File delete failed. C:\DOCUME~1\12linnz\LOCALS~1\Temp\etilqs_A7TazjVoGpwxAWRjcCmC scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\12linnz\LOCALS~1\Temp\np1AA.tmp scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\12linnz\LOCALS~1\Temp\np1AB.tmp scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\12linnz\LOCALS~1\Temp\np1AC.tmp scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\12linnz\LOCALS~1\Temp\np1AD.tmp scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\12linnz\LOCALS~1\Temp\np1AE.tmp scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\12linnz\LOCALS~1\Temp\np1AF.tmp scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\12linnz\LOCALS~1\Temp\np1B0.tmp scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\12linnz\LOCALS~1\Temp\np1B1.tmp scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\12linnz\LOCALS~1\Temp\RtkBtMnt.exe scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\12linnz\LOCALS~1\Temp\~DF4E79.tmp scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\12linnz\LOCALS~1\Temp\~DF95A8.tmp scheduled to be deleted on reboot. User's Temp folder emptied. User's Internet Explorer cache folder emptied. File delete failed. C:\Documents and Settings\12linnz\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. User's Temporary Internet Files folder emptied. Local Service Temp folder emptied. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. Local Service Temporary Internet Files folder emptied. Network Service Temp folder emptied. Network Service Temporary Internet Files folder emptied. File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_330.dat scheduled to be deleted on reboot. File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_8c4.dat scheduled to be deleted on reboot. Windows Temp folder emptied. Java cache emptied. File delete failed. C:\Documents and Settings\12linnz\Local Settings\Application Data\Mozilla\Firefox\Profiles\nc3mmks4.default\Cache\_CACHE_001_ scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\12linnz\Local Settings\Application Data\Mozilla\Firefox\Profiles\nc3mmks4.default\Cache\_CACHE_002_ scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\12linnz\Local Settings\Application Data\Mozilla\Firefox\Profiles\nc3mmks4.default\Cache\_CACHE_003_ scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\12linnz\Local Settings\Application Data\Mozilla\Firefox\Profiles\nc3mmks4.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\12linnz\Local Settings\Application Data\Mozilla\Firefox\Profiles\nc3mmks4.default\urlclassifier3.sqlite scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\12linnz\Local Settings\Application Data\Mozilla\Firefox\Profiles\nc3mmks4.default\XUL.mfl scheduled to be deleted on reboot. FireFox cache emptied. Temp folders emptied. Explorer started successfully OTM by OldTimer - Version 2.1.0.1 log created on 06152009_211536 Files moved on Reboot… File C:\DOCUME~1\12linnz\LOCALS~1\Temp\etilqs_A7TazjVoGpwxAWRjcCmC not found! C:\DOCUME~1\12linnz\LOCALS~1\Temp\np1AA.tmp moved successfully. C:\DOCUME~1\12linnz\LOCALS~1\Temp\np1AB.tmp moved successfully. C:\DOCUME~1\12linnz\LOCALS~1\Temp\np1AC.tmp moved successfully. C:\DOCUME~1\12linnz\LOCALS~1\Temp\np1AD.tmp moved successfully. C:\DOCUME~1\12linnz\LOCALS~1\Temp\np1AE.tmp moved successfully. C:\DOCUME~1\12linnz\LOCALS~1\Temp\np1AF.tmp moved successfully. C:\DOCUME~1\12linnz\LOCALS~1\Temp\np1B0.tmp moved successfully. C:\DOCUME~1\12linnz\LOCALS~1\Temp\np1B1.tmp moved successfully. C:\DOCUME~1\12linnz\LOCALS~1\Temp\RtkBtMnt.exe moved successfully. C:\DOCUME~1\12linnz\LOCALS~1\Temp\~DF4E79.tmp moved successfully. C:\DOCUME~1\12linnz\LOCALS~1\Temp\~DF95A8.tmp moved successfully. File C:\WINDOWS\temp\Perflib_Perfdata_330.dat not found! File C:\WINDOWS\temp\Perflib_Perfdata_8c4.dat not found! C:\Documents and Settings\12linnz\Local Settings\Application Data\Mozilla\Firefox\Profiles\nc3mmks4.default\Cache\_CACHE_001_ moved successfully. C:\Documents and Settings\12linnz\Local Settings\Application Data\Mozilla\Firefox\Profiles\nc3mmks4.default\Cache\_CACHE_002_ moved successfully. C:\Documents and Settings\12linnz\Local Settings\Application Data\Mozilla\Firefox\Profiles\nc3mmks4.default\Cache\_CACHE_003_ moved successfully. C:\Documents and Settings\12linnz\Local Settings\Application Data\Mozilla\Firefox\Profiles\nc3mmks4.default\Cache\_CACHE_MAP_ moved successfully. C:\Documents and Settings\12linnz\Local Settings\Application Data\Mozilla\Firefox\Profiles\nc3mmks4.default\urlclassifier3.sqlite moved successfully. C:\Documents and Settings\12linnz\Local Settings\Application Data\Mozilla\Firefox\Profiles\nc3mmks4.default\XUL.mfl moved successfully. Registry entries deleted on Reboot…

CatByte

Post #12June 15, 2009, 11:48 AM UTC

Hi can you please try that again, making sure you start the copying at the colon before the :Processes inside the codebox- do not copy the word "code"

lin0056

Post #13June 15, 2009, 12:03 PM UTC

I tried and it showed the same error; something about UPX must being numerical. I don't think it did anything, is there something wrong with the code? I copied it exactly right.

CatByte

Post #14June 15, 2009, 12:05 PM UTC

Ok

Lets do it this way then,

delete the copy of Combofix that you have on your desktop and download a fresh copy from one of these links….

post the resulting log

Download ComboFix from one of these locations:
Link 1
Link 2
Link 3

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

lin0056

Post #15June 15, 2009, 1:16 PM UTC

ComboFix Log:

ComboFix 09-06-14.02 - 12LinNZ 15/06/2009 23:02.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.61.1033.18.1977.1395 [GMT 10:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Sophos Anti-Virus *On-access scanning disabled* (Updated) {3F13C776-3CBE-4DE9-8BF6-09E5183CA2BD}
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf
c:\windows\ctfmon.exe
c:\windows\winlogon.exe

.
((((((((((((((((((((((((( Files Created from 2009-05-15 to 2009-06-15 )))))))))))))))))))))))))))))))
.

2009-06-15 11:14 . 2009-06-15 11:14 ——– dc—-w- C:\_OTM
2009-06-14 12:20 . 2009-06-14 12:20 ——– dc—-w- c:\documents and settings\12linnz\Application Data\Malwarebytes
2009-06-14 12:20 . 2009-05-26 03:20 40160 -c–a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-14 12:20 . 2009-06-14 12:20 ——– dc—-w- c:\program files\Malwarebytes' Anti-Malware
2009-06-14 12:20 . 2009-06-14 12:20 ——– dc—-w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-14 12:20 . 2009-05-26 03:19 19096 -c–a-w- c:\windows\system32\drivers\mbam.sys
2009-06-14 12:20 . 2009-06-14 12:20 ——– dc—-w- C:\Rooter$
2009-06-13 13:22 . 2009-06-14 07:44 ——– dc—-w- C:\finalburner
2009-06-13 13:08 . 2009-06-13 13:09 ——– dc—-w- c:\program files\FinalBurner
2009-06-13 12:20 . 2009-06-13 12:20 ——– dc—-w- c:\program files\Common Files\xing shared
2009-06-11 21:10 . 2009-06-11 21:10 ——– dc—-w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple
2009-06-10 13:09 . 2009-06-10 13:09 ——– dc—-w- c:\documents and settings\12linnz\Application Data\Red Kawa
2009-06-09 22:59 . 2009-06-10 04:54 ——– dc—-w- c:\documents and settings\12linnz\Local Settings\Application Data\Google
2009-06-09 22:59 . 2009-06-09 22:59 ——– dc—-w- c:\program files\Google
2009-06-09 22:55 . 2009-06-09 22:52 130104 -c–a-w- c:\windows\system32\sdccoinstaller.dll
2009-06-09 22:54 . 2009-06-09 22:54 ——– dc—-w- c:\program files\Common Files\Cisco Systems
2009-06-09 22:54 . 2009-06-09 22:52 23552 -c–a-w- c:\windows\system32\sophosboottasks.exe
2009-06-09 22:53 . 2009-06-09 22:54 ——– dc—-w- c:\documents and settings\All Users\Application Data\Sophos
2009-06-09 22:52 . 2009-06-09 22:52 14976 -c–a-w- c:\windows\system32\drivers\SophosBootDriver.sys
2009-06-09 22:52 . 2009-06-09 22:52 38528 -c–a-w- c:\windows\system32\drivers\savonaccessfilter.sys
2009-06-09 22:52 . 2009-06-09 22:52 110848 -c–a-w- c:\windows\system32\drivers\savonaccesscontrol.sys
2009-06-09 22:50 . 2009-06-09 22:54 ——– dc—-w- c:\program files\Sophos
2009-06-09 13:55 . 2009-06-09 13:55 664 -c–a-w- c:\windows\system32\d3d9caps.dat
2009-06-09 13:18 . 2009-06-09 13:18 ——– dc—-w- c:\program files\Regensoft
2009-06-09 13:18 . 2009-06-09 13:18 ——– dc—-w- c:\program files\Red Kawa
2009-06-09 07:39 . 2004-08-18 02:14 442368 -c–a-w- c:\windows\system32\vp6vfw.dll
2009-06-07 08:17 . 2009-06-07 10:39 ——– dc—-w- c:\program files\Universal Forum Poster
2009-06-07 08:17 . 2009-06-07 08:17 ——– dc—-w- c:\windows\Universal Forum Poster
2009-06-07 04:21 . 2009-06-07 04:21 ——– dc—-w- c:\documents and settings\12linnz\Application Data\WindowsApplication1
2009-06-07 04:02 . 2009-06-07 04:04 ——– dc—-w- c:\documents and settings\12linnz\Application Data\Media Player Classic
2009-06-07 03:43 . 2009-06-08 00:31 ——– dc—-w- c:\documents and settings\12linnz\Local Settings\Application Data\Deployment
2009-06-07 01:15 . 2009-06-07 01:15 ——– dc—-w- c:\documents and settings\12linnz\Application Data\CyberLink
2009-06-04 23:32 . 2009-06-13 12:20 ——– dc—-w- c:\program files\Common Files\Real
2009-06-04 23:31 . 2009-06-04 23:31 ——– dc—-w- c:\program files\Real
2009-06-03 01:12 . 2001-08-17 12:36 5632 -c–a-w- c:\windows\system32\ptpusb.dll
2009-06-03 01:12 . 2008-04-13 19:42 159232 -c–a-w- c:\windows\system32\ptpusd.dll
2009-06-03 01:12 . 2008-04-13 14:15 15104 -c–a-w- c:\windows\system32\drivers\usbscan.sys
2009-06-03 01:12 . 2008-04-13 14:15 15104 -c–a-w- c:\windows\system32\dllcache\usbscan.sys
2009-06-01 09:32 . 2009-06-01 09:32 ——– dc—-w- c:\windows\system32\wbem\Repository
2009-06-01 09:18 . 2009-06-01 09:18 ——– dc—-w- c:\windows\LastGood(2)
2009-05-31 10:44 . 2009-05-31 10:44 ——– dc—-w- c:\documents and settings\12linnz\Application Data\Uniblue
2009-05-29 02:21 . 2009-05-29 02:21 ——– dc—-w- c:\documents and settings\12linnz\Bluetooth Software
2009-05-28 06:34 . 2009-05-28 06:34 ——– dc—-w- c:\program files\LibUSB-Win32
2009-05-28 06:34 . 2007-03-20 01:33 28672 -c–a-w- c:\windows\system32\drivers\libusb0.sys
2009-05-28 06:34 . 2007-03-20 01:33 43520 -c–a-w- c:\windows\system32\libusb0.dll
2009-05-28 06:33 . 2009-06-03 02:04 ——– dc—-w- c:\program files\QuickFreedom
2009-05-26 05:10 . 2009-05-26 05:10 ——– dc—-w- c:\documents and settings\12linnz\Application Data\DivX
2009-05-25 04:32 . 2009-02-20 18:09 268288 -c—-w- c:\windows\system32\dllcache\iertutil.dll
2009-05-25 04:32 . 2009-02-20 18:09 63488 -c—-w- c:\windows\system32\dllcache\icardie.dll
2009-05-25 04:32 . 2009-02-20 18:09 52224 -c—-w- c:\windows\system32\dllcache\msfeedsbs.dll
2009-05-25 04:32 . 2009-02-20 10:20 13824 -c—-w- c:\windows\system32\dllcache\ieudinit.exe
2009-05-25 04:32 . 2009-02-20 18:09 459264 -c—-w- c:\windows\system32\dllcache\msfeeds.dll
2009-05-25 04:32 . 2008-07-09 14:25 2455488 -c—-w- c:\windows\system32\dllcache\ieapfltr.dat
2009-05-25 04:32 . 2009-02-20 18:09 383488 -c—-w- c:\windows\system32\dllcache\ieapfltr.dll
2009-05-25 04:31 . 2009-02-20 18:09 6066176 -c—-w- c:\windows\system32\dllcache\ieframe.dll
2009-05-24 11:34 . 2009-05-24 11:34 ——– dc—-w- c:\windows\system32\Adobe
2009-05-23 10:00 . 2009-05-23 10:00 ——– dc—-w- c:\documents and settings\12linnz\Application Data\Leadertech
2009-05-22 01:57 . 2005-01-03 06:43 4682 -c–a-w- c:\windows\system32\npptNT2.sys
2009-05-22 01:56 . 2009-05-22 01:56 ——– dc—-w- c:\program files\Common Files\INCA Shared
2009-05-21 12:23 . 2009-05-21 12:23 ——– dc—-w- c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-05-21 09:24 . 2009-06-13 22:59 ——– dc—-w- c:\program files\EA Sports
2009-05-21 09:07 . 2009-05-21 09:07 ——– dc—-w- c:\documents and settings\12linnz\Local Settings\Application Data\Sophos
2009-05-21 08:57 . 2009-05-21 08:57 721904 —-a-w- c:\windows\system32\drivers\sptd.sys
2009-05-21 08:57 . 2009-05-21 08:57 ——– dc—-w- c:\documents and settings\12linnz\Application Data\DAEMON Tools Lite
2009-05-21 08:53 . 2009-05-21 08:53 ——– dc-h–w- c:\windows\PIF
2009-05-21 08:47 . 2009-06-04 11:38 ——– dc—-w- c:\documents and settings\12linnz\Application Data\LimeWire
2009-05-21 08:44 . 2009-05-21 08:44 ——– dc—-w- c:\program files\PowerISO
2009-05-21 08:44 . 2009-05-21 08:44 ——– dc—-w- c:\program files\LimeWire
2009-05-21 08:37 . 2009-05-21 10:08 ——– dc—-w- c:\program files\Messenger Plus! Live
2009-05-21 08:33 . 2009-05-21 08:33 ——– dc—-w- c:\program files\uTorrent
2009-05-21 08:33 . 2009-06-15 05:07 ——– dc—-w- c:\documents and settings\12linnz\Application Data\uTorrent
2009-05-21 08:33 . 2009-05-28 07:37 ——– dc—-w- c:\documents and settings\12linnz\Application Data\Apple Computer
2009-05-21 08:33 . 2009-03-19 06:32 23400 -c–a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-05-21 08:33 . 2008-04-17 02:12 107368 -c–a-w- c:\windows\system32\GEARAspi.dll
2009-05-21 08:32 . 2009-05-21 08:32 ——– dc—-w- c:\program files\iPod
2009-05-21 08:32 . 2009-05-21 08:33 ——– dc—-w- c:\program files\iTunes
2009-05-21 08:32 . 2009-05-21 08:33 ——– dc—-w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-05-21 08:32 . 2009-05-21 08:32 ——– dc—-w- c:\program files\Bonjour
2009-05-21 08:31 . 2009-05-21 08:32 ——– dc—-w- c:\program files\QuickTime
2009-05-21 08:31 . 2009-05-21 08:32 ——– dc—-w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-05-21 08:31 . 2009-05-21 08:31 ——– dc—-w- c:\documents and settings\12linnz\Local Settings\Application Data\Apple
2009-05-21 08:31 . 2009-05-21 08:31 ——– dc—-w- c:\program files\Apple Software Update
2009-05-21 08:31 . 2009-03-26 05:23 36864 -c–a-w- c:\windows\system32\drivers\usbaapl.sys
2009-05-21 08:31 . 2009-03-26 05:23 1900544 -c–a-w- c:\windows\system32\usbaaplrc.dll
2009-05-21 08:31 . 2009-05-21 08:32 ——– dc—-w- c:\program files\Common Files\Apple
2009-05-21 08:31 . 2009-05-21 08:31 ——– dc—-w- c:\documents and settings\All Users\Application Data\Apple
2009-05-21 08:30 . 2009-05-21 08:33 ——– dc—-w- c:\documents and settings\12linnz\Local Settings\Application Data\Apple Computer
2009-05-21 08:12 . 2009-05-21 08:12 ——– dc—-w- c:\program files\DVD Decrypter
2009-05-21 08:12 . 2009-05-21 08:12 43602 -c–a-w- c:\windows\system32\xvid-uninstall.exe
2009-05-21 08:12 . 2009-05-21 08:12 ——– dc—-w- c:\program files\AviSynth 2.5
2009-05-21 08:12 . 2009-05-21 08:12 ——– dc—-w- c:\program files\Gabest
2009-05-21 08:12 . 2009-05-21 08:12 ——– dc—-w- c:\program files\AutoGK
2009-05-21 08:00 . 2009-06-15 06:08 ——– dc—-w- c:\documents and settings\12linnz\Tracing
2009-05-21 07:59 . 2009-05-21 07:59 ——– dc—-w- c:\program files\Microsoft Silverlight
2009-05-21 07:58 . 2009-05-21 07:59 ——– dc—-w- c:\program files\Microsoft
2009-05-21 07:58 . 2009-05-21 07:58 ——– dc—-w- c:\program files\Windows Live SkyDrive
2009-05-21 07:57 . 2009-05-21 07:58 ——– dc—-w- c:\program files\Windows Live
2009-05-21 07:55 . 2009-05-21 07:55 ——– dc—-w- c:\program files\Common Files\Windows Live
2009-05-21 07:55 . 2009-06-02 10:32 105544 -c–a-w- c:\documents and settings\12linnz\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-21 07:46 . 2008-04-13 14:15 10368 -c–a-w- c:\windows\system32\drivers\hidusb.sys
2009-05-21 07:46 . 2008-04-13 14:15 10368 -c–a-w- c:\windows\system32\dllcache\hidusb.sys
2009-05-21 05:19 . 2009-05-21 05:19 ——– dc—-w- c:\program files\Combined Community Codec Pack
2009-05-21 05:19 . 2009-05-21 05:19 ——– dc—-w- c:\program files\CCleaner
2009-05-21 05:14 . 2009-05-21 05:14 0 -c–a-w- c:\windows\nsreg.dat
2009-05-21 05:14 . 2009-05-21 05:14 ——– dc—-w- c:\documents and settings\12linnz\Local Settings\Application Data\Mozilla
2009-05-21 05:01 . 2009-05-21 05:01 152576 -c–a-w- c:\documents and settings\12linnz\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-05-21 04:59 . 2009-05-21 04:59 ——– dc—-w- c:\documents and settings\12linnz\Local Settings\Application Data\Microsoft Help
2009-05-21 04:59 . 2009-06-01 09:32 ——– dc—-w- c:\documents and settings\saaa
2009-05-21 04:57 . 2009-03-21 14:06 989696 -c—-w- c:\windows\system32\dllcache\kernel32.dll
2009-05-21 04:57 . 2009-02-03 19:59 56832 -c—-w- c:\windows\system32\dllcache\secur32.dll
2009-05-21 04:57 . 2008-12-05 06:54 144896 -c—-w- c:\windows\system32\dllcache\schannel.dll
2009-05-21 04:57 . 2009-03-06 14:22 284160 -c—-w- c:\windows\system32\dllcache\pdh.dll
2009-05-21 04:57 . 2009-02-09 12:10 401408 -c—-w- c:\windows\system32\dllcache\rpcss.dll
2009-05-21 04:57 . 2009-02-09 12:10 729088 -c—-w- c:\windows\system32\dllcache\lsasrv.dll
2009-05-21 04:57 . 2009-02-09 12:10 714752 -c—-w- c:\windows\system32\dllcache\ntdll.dll
2009-05-21 04:57 . 2009-02-09 12:10 617472 -c—-w- c:\windows\system32\dllcache\advapi32.dll
2009-05-21 04:57 . 2009-02-09 12:10 473600 -c—-w- c:\windows\system32\dllcache\fastprox.dll
2009-05-21 04:57 . 2009-02-09 12:10 453120 -c—-w- c:\windows\system32\dllcache\wmiprvsd.dll
2009-05-21 04:57 . 2009-02-06 11:11 110592 -c—-w- c:\windows\system32\dllcache\services.exe
2009-05-21 04:56 . 2008-06-12 14:23 66560 -c—-w- c:\windows\system32\dllcache\mtxclu.dll
2009-05-21 04:56 . 2008-06-17 19:02 8461312 -c—-w- c:\windows\system32\dllcache\shell32.dll
2009-05-21 04:55 . 2008-12-16 12:30 354304 -c—-w- c:\windows\system32\dllcache\winhttp.dll
2009-05-21 04:55 . 2008-10-23 12:36 286720 -c—-w- c:\windows\system32\dllcache\gdi32.dll
2009-05-21 04:14 . 2008-05-03 11:55 2560 -c—-w- c:\windows\system32\xpsp4res.dll
2009-05-21 04:13 . 2009-06-02 22:57 ——– dc—-w- c:\documents and settings\12linnz\Local Settings\Application Data\Adobe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-15 06:03 . 2009-06-15 06:03 0 -c–a-w- c:\documents and settings\12linnz\.user-client.12linnz.12linnz.lock.tmp
2009-06-13 12:19 . 2003-02-20 17:42 348160 -c–a-w- c:\windows\system32\msvcr71.dll
2009-06-13 12:19 . 2003-03-18 09:14 499712 -c–a-w- c:\windows\system32\msvcp71.dll
2009-06-02 06:33 . 2008-10-24 01:29 ——– dc—-w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-06-02 06:31 . 2008-10-24 01:32 ——– dc—-w- c:\program files\Microsoft Works
2009-05-21 05:02 . 2008-11-05 00:35 ——– dc—-w- c:\program files\Java
2009-04-02 06:29 . 2009-04-02 06:29 75048 -c–a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.1.1.10\SetupAdmin.exe
2009-03-19 06:32 . 2009-03-19 06:32 23400 -c–a-w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}\x86\x86\GEARAspiWDM.sys
2007-10-03 23:55 . 2007-10-03 23:55 69296 –sh–r- c:\windows\inetinfo.exe
2007-10-03 23:55 . 2007-10-03 23:55 69296 -csh–r- c:\windows\system32\MaxBSLoad.exe
2007-10-03 23:55 . 2007-10-03 23:55 69296 -csh–r- c:\windows\system32\drivers\etc\networks.exe
.

((((((((((((((((((((((((((((( SnapShot@2009-06-14_07.31.07 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-06-15 11:18 . 2009-06-15 11:18 16384 c:\windows\Temp\Perflib_Perfdata_2bc.dat
+ 2009-06-15 11:19 . 2009-06-15 11:19 16384 c:\windows\Temp\Perflib_Perfdata_1d8.dat
+ 2006-02-28 12:00 . 2009-06-15 11:22 85352 c:\windows\system32\perfc009.dat
- 2006-02-28 12:00 . 2009-06-14 07:09 85352 c:\windows\system32\perfc009.dat
+ 2006-02-28 12:00 . 2009-06-15 11:22 475516 c:\windows\system32\perfh009.dat
- 2006-02-28 12:00 . 2009-06-14 07:09 475516 c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"MaxBSLoad"="c:\windows\system32\MaxBSLoad.exe" [2007-10-03 69296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AzMixerSel"="c:\program files\Realtek\Audio\InstallShield\AzMixerSel.exe" [2006-07-17 53248]
"ZPdtWzdVitaKey MC3000"="c:\program files\Acer\Acer Bio Protection\PdtWzd.exe" [2008-10-22 3680768]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-01-18 1028096]
"IFXSPMGT"="c:\windows\system32\ifxspmgt.exe" [2007-07-23 677144]
"PLFSetI"="c:\windows\PLFSetI.exe" [2007-10-23 200704]
"PLFSetL"="c:\windows\PLFSetL.exe" [2007-07-05 94208]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-06-04 150040]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-06-04 170520]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-06-04 141848]
"LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2008-05-02 870920]
"PaperCut NG Client"="c:\program files\PaperCut NG Client\pc-client.exe" [2006-11-02 184320]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-06-13 198160]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2008-05-07 16862208]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]
"inetinfo"="c:\windows\inetinfo.exe" [2007-10-03 69296]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
AutoUpdate Monitor.lnk - c:\program files\Sophos\AutoUpdate\ALMon.exe [2009-1-28 245760]
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-9-11 576104]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\AWinNotifyVitaKey MC3000]
2008-10-22 03:39 3076096 —-a-w- c:\program files\Acer\Acer Bio Protection\WinNotify.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0pgdfgsvc C 1\0lsdelete

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SAVService]
@="service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SophosAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\RM.exe"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\Studio.exe"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\umi.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\EA Sports\\FIFA Online 2\\FF2Client.exe"=
"c:\\Program Files\\EA Sports\\Madden NFL 08\\Updater.exe"=
"c:\\Program Files\\EA Sports\\FIFA 09\\FIFA09.exe"=

R0 AlfaFF;AlfaFF File System mini-filter;c:\windows\system32\drivers\AlfaFF.sys [22/10/2008 1:39 PM 43184]
R1 PersonalSecureDrive;PersonalSecureDrive;c:\windows\system32\drivers\psd.sys [24/07/2007 7:59 AM 38816]
R1 SAVOnAccessControl;SAVOnAccessControl;c:\windows\system32\drivers\savonaccesscontrol.sys [10/06/2009 8:52 AM 110848]
R1 SAVOnAccessFilter;SAVOnAccessFilter;c:\windows\system32\drivers\savonaccessfilter.sys [10/06/2009 8:52 AM 38528]
R2 FPSensor;LTT-Corp Fingerprint Reader Driver (FPSensor.sys);c:\windows\system32\drivers\FPSensor.sys [22/10/2008 1:39 PM 20352]
R2 IGBASVC;iGroupTec Service;c:\program files\Acer\Acer Bio Protection\BASVC.exe [22/10/2008 1:39 PM 3481600]
R2 SAVAdminService;Sophos Anti-Virus status reporter;c:\program files\Sophos\Sophos Anti-Virus\SAVAdminService.exe [10/06/2009 8:52 AM 80936]
R2 SAVService;Sophos Anti-Virus;c:\program files\Sophos\Sophos Anti-Virus\SavService.exe [10/06/2009 8:52 AM 98304]
R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [24/07/2007 7:59 AM 41216]
R3 ITEIRDA;ITE Infrared Device Driver;c:\windows\system32\drivers\ITEirda.sys [22/10/2008 1:59 PM 24576]
R3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.12.1;c:\windows\system32\drivers\libusb0.sys [28/05/2009 4:34 PM 28672]
S3 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\program files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [15/08/2008 4:46 AM 284016]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service –> c:\windows\system32\GameMon.des -service [?]
S4 SophosBootDriver;SophosBootDriver;c:\windows\system32\drivers\SophosBootDriver.sys [10/06/2009 8:52 AM 14976]

— Other Services/Drivers In Memory —

*Deregistered* - dump_wmimmc
.
Contents of the 'Scheduled Tasks' folder

2009-06-11 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 02:34]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-networks - c:\windows\winlogon.exe
HKCU-Explorer_Run-ctfmon - c:\windows\ctfmon.exe

.
——- Supplementary Scan ——-
.
uStart Page = hxxp://intranet.cgs.vic.edu.au
uInternet Settings,ProxyOverride =
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Send to &Bluetooth Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send To Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
FF - ProfilePath -
.
.
——- File Associations ——-
.
txtfile=c:\windows\system32\drivers\etc\networks.exe %1
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-15 23:07
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Sophos Message Router]
"ImagePath"="\"c:\program files\Sophos\Remote Management System\RouterNT.exe\" -service -name Router -ORBListenEndpoints iiop://:8193/ssl_port=8194"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{95808DC4-FA4A-4c74-92FE-5B863F82066B}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD\000.fcl"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:c8,28,51,af,b0,29,a3,98,d5,b8,a1,a9,7e,
87,6a,94,e2,63,26,f1,3f,c8,ff,68,df,94,86,26,a5,12,0f,c0,e2,63,26,f1,3f,c8,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:6a,9c,d6,61,af,45,84,18,71,1a,61,44,db,
a8,82,97,6a,9c,d6,61,af,45,84,18,83,7b,73,fe,35,7f,b9,26,6a,9c,d6,61,af,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:7a,45,05,fd,91,e8,6f,31,47,40,97,61,c4,
c9,a5,79,ff,7c,85,e0,43,d4,0e,fe,21,4d,f0,17,f6,e7,28,88,ff,7c,85,e0,43,d4,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:86,8c,21,01,be,91,eb,e7,a3,17,83,07,a1,
83,8c,66,86,8c,21,01,be,91,eb,e7,0e,78,df,c8,9b,41,00,e2,86,8c,21,01,be,91,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:f5,1d,4d,73,a8,13,5c,05,97,2c,97,8b,a4,
1d,07,01,f5,1d,4d,73,a8,13,5c,05,20,5d,a8,2f,c8,f1,7c,ec,f5,1d,4d,73,a8,13,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:50,93,e5,ab,ec,6a,4e,ab,24,86,c7,1b,af,
30,21,d9,df,20,58,62,78,6b,cf,c8,5d,e6,b2,f6,ed,49,0d,ba,df,20,58,62,78,6b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:fb,a7,78,e6,12,2f,9a,ea,52,78,a1,7b,1a,
5c,ba,51,fb,a7,78,e6,12,2f,9a,ea,d5,67,83,e0,bf,40,66,d3,fb,a7,78,e6,12,2f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:01,3a,48,fc,e8,04,4a,f1,71,46,b7,8f,9c,
88,cf,5c,01,3a,48,fc,e8,04,4a,f1,90,cc,56,9e,a7,3b,4a,9a,01,3a,48,fc,e8,04,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:b2,46,9a,e2,1b,fe,1b,94,e0,3d,bd,d0,c7,
c8,8d,aa,f6,0f,4e,58,98,5b,89,c9,67,07,14,4c,8f,87,0d,9a,f6,0f,4e,58,98,5b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:3d,ce,ea,26,2d,45,aa,78,a6,b2,47,1f,90,
b6,4a,42,3d,ce,ea,26,2d,45,aa,78,73,ef,c4,29,16,3b,93,0d,3d,ce,ea,26,2d,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:e3,0e,66,d5,eb,bc,2f,6b,c5,95,af,cf,7c,
50,87,ac,2a,b7,cc,b5,b9,7f,41,e7,46,1e,1f,67,d1,64,b3,dd,2a,b7,cc,b5,b9,7f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:fa,ea,66,7f,d4,3b,6b,70,b0,19,c8,08,c2,
74,8d,60,6c,43,2d,1e,aa,22,2f,9c,2c,76,91,5e,93,cf,2a,25,6c,43,2d,1e,aa,22,\
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(1124)
c:\program files\Acer\Acer Bio Protection\CompPtc.dll
c:\program files\Acer\Acer Bio Protection\CustomRes.dll
c:\windows\system32\NBMatS1SDK.DLL
c:\program files\Acer\Acer Bio Protection\WinNotify.dll
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll

- - - - - - - > 'lsass.exe'(1180)
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll

- - - - - - - > 'explorer.exe'(3272)
c:\windows\system32\btmmhook.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2009-06-15 23:09
ComboFix-quarantined-files.txt 2009-06-15 13:09
ComboFix2.txt 2009-06-14 07:34

Pre-Run: 91,010,146,304 bytes free
Post-Run: 91,360,550,912 bytes free

358 — E O F — 2009-06-03 01:15

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] inetinfo.exe crashes

✨ Ask AI

Ask AI