What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Virus infection

15 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
This is a detailed description of what has happend to my computer, if it is unnecessary the hijackthis log is posted after it.

Today I was checking rycolaa.com for updates to see if there were any new comics released and waiting for warcraft 3 ladder to find a game. As I loaded the website at rycolaa.com it went into an ad screen, and before i could skip it warcraft found a game. I quickly unminimized and tried to close it. I noticed some error occured and thought nothing of it. After a few minutes warcraft3 minimized to a " google installer has had an error and must be closed " message and a " Generic Host Process for Win32 Services has had an error and must be closed " message. I quickly accept and go back to playing my game. But the screen minimizes one more time and the computer begins to shut down. It instantly reboots and displays the two google installer and generic host process error messages and begins to turn off again. After turning on and off 3 times I can finally use the computer but theres this antivirus program that was installed without my consent that offers to remove the critically infected processes if i register. Soon after I delete the program my computer goes into a blue screen where it says that it must shut off before there is any critical damage.

I may have turned off my avast protection to install a webcam 2 days ago and forgot to turn it back on. Btw since the "virus" avast is having error when i try to activate it and will not turn on.

The computer is a Hp pavilion laptop that is 4 years old. with Windows XP home edition version 2002.

Please help me fix my computer.

This is the Hijack this log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:21:54 PM, on 7/23/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Internet Explorer\Iexplore.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\WINDOWS\system32\braviax.exe
C:\windows\ld12.exe
C:\Program Files\HomeAntivirus2010\HomeAntivirus2010.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Documents and Settings\Eric Liu\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\DOCUME~1\ERICLI~1\LOCALS~1\Temp\b.exe
C:\WINDOWS\system32\dwwin.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\msa.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Raxco\PerfectDisk10\PDAgent.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\dwwin.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: EndNote Web - {945C8270-A848-11D5-A805-00B0D092F45B} - C:\Program Files\EndNote Web\ENWIEPlug.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [braviax] C:\WINDOWS\system32\braviax.exe
O4 - HKLM\..\Run: [sysldtray] C:\windows\ld12.exe
O4 - HKLM\..\Run: [Home Antivirus 2010] "C:\Program Files\HomeAntivirus2010\HomeAntivirus2010.exe" /hide
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Eric Liu\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Monopod] C:\DOCUME~1\ERICLI~1\LOCALS~1\Temp\b.exe
O4 - HKCU\..\Run: [braviax] C:\WINDOWS\system32\braviax.exe
O4 - S-1-5-18 Startup: Logitech . Product Registration.lnk = C:\Program Files\Logitech\QuickCam\eReg.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: Logitech . Product Registration.lnk = C:\Program Files\Logitech\QuickCam\eReg.exe (User 'Default user')
O4 - Startup: Logitech . Product Registration.lnk = C:\Program Files\Logitech\QuickCam\eReg.exe
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=pavilion&pf=laptop
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk10\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk10\PDEngine.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: WD Drive Manager Service (WDBtnMgrSvc.exe) - WDC - C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe

–
End of file - 6930 bytes

Thank you for your time and consideration.
Post #2
Hi,

Please do the following:

  • Open HiJackThis
  • Click on Do a system scan only
  • Check the boxes next to ONLY the entries listed below (if still present):


O4 - HKLM\..\Run: [braviax] C:\WINDOWS\system32\braviax.exe
O4 - HKLM\..\Run: [sysldtray] C:\windows\ld12.exe
O4 - HKLM\..\Run: [Home Antivirus 2010] "C:\Program Files\HomeAntivirus2010\HomeAntivirus2010.exe" /hide
O4 - HKCU\..\Run: [Monopod] C:\DOCUME~1\ERICLI~1\LOCALS~1\Temp\b.exe
O4 - HKCU\..\Run: [braviax] C:\WINDOWS\system32\braviax.exe

  • Close all windows except Hijackthis and click Fix Checked
  • Click Yes when prompted
  • Close HijackThis.

NEXT

Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.
  • Disable any script blocking protection
  • Double click dds.pif to run the tool.
  • When done, two DDS.txt's will open.
  • Save both reports to your desktop.
—————————————————
Please include the contents of the following in your next reply:

DDS.txt
Attach.txt.


NEXT


[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.
  • Extract the contents of the zipped file to desktop.
  • Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • Sections
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and post it in your next reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
Post #3
so it seems like my computer will not turn on anymore… i checked the batteries, it does have power.. i'm not sure what is wrong
Post #5
ok i had some issues with the gmer, but i ended up geting it from the links on this website http://www.techsupportforum.com/security-c…oesnt-work.html and got it to work.

Hijackthis log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:21:54 PM, on 7/23/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Internet Explorer\Iexplore.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\WINDOWS\system32\braviax.exe
C:\windows\ld12.exe
C:\Program Files\HomeAntivirus2010\HomeAntivirus2010.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Documents and Settings\Eric Liu\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\DOCUME~1\ERICLI~1\LOCALS~1\Temp\b.exe
C:\WINDOWS\system32\dwwin.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\msa.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Raxco\PerfectDisk10\PDAgent.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\dwwin.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: EndNote Web - {945C8270-A848-11D5-A805-00B0D092F45B} - C:\Program Files\EndNote Web\ENWIEPlug.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [braviax] C:\WINDOWS\system32\braviax.exe
O4 - HKLM\..\Run: [sysldtray] C:\windows\ld12.exe
O4 - HKLM\..\Run: [Home Antivirus 2010] "C:\Program Files\HomeAntivirus2010\HomeAntivirus2010.exe" /hide
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Eric Liu\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Monopod] C:\DOCUME~1\ERICLI~1\LOCALS~1\Temp\b.exe
O4 - HKCU\..\Run: [braviax] C:\WINDOWS\system32\braviax.exe
O4 - S-1-5-18 Startup: Logitech . Product Registration.lnk = C:\Program Files\Logitech\QuickCam\eReg.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: Logitech . Product Registration.lnk = C:\Program Files\Logitech\QuickCam\eReg.exe (User 'Default user')
O4 - Startup: Logitech . Product Registration.lnk = C:\Program Files\Logitech\QuickCam\eReg.exe
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=pavilion&pf=laptop
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk10\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk10\PDEngine.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: WD Drive Manager Service (WDBtnMgrSvc.exe) - WDC - C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe

–
End of file - 6930 bytes

DDS.txt:


DDS (Ver_09-06-26.01) - NTFSx86
Run by [removed] at 12:01:04.57 on Fri 07/24/2009
Internet Explorer: 7.0.5730.11
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1022.445 [GMT -4:00]

AV: avast! antivirus 4.8.1296 [VPS 090723-0] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\msa.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Bonjour\mDNSResponder.exe
svchost
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Raxco\PerfectDisk10\PDAgent.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\WINDOWS\system32\braviax.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Documents and Settings\Eric Liu\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32\dwwin.exe
C:\WINDOWS\system32\dwwin.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Eric Liu\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32\dwwin.exe
C:\Program Files\HomeAntivirus2010\HomeAntivirus2010.exe
C:\WINDOWS\system32\rundll32.exe
C:\Documents and Settings\Eric Liu\Desktop\gmer.exe
C:\Documents and Settings\Eric Liu\Desktop\dds.pif

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com
uSearch Page = hxxp://www.google.com
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
uSearch Bar = hxxp://www.google.com/ie
mDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = hxxp://www.google.com
mSearch Page = hxxp://www.google.com
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
mSearchAssistant = hxxp://www.google.com
TB: FlashGet Bar: {e0e899ab-f487-11d5-8d29-0050ba6940e3} - c:\progra~1\flashget\fgiebar.dll
TB: EndNote Web: {945c8270-a848-11d5-a805-00b0d092f45b} - c:\program files\endnote web\ENWIEPlug.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll
TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\daemon.exe" -autorun
uRun: [Google Update] "c:\documents and settings\eric liu\local settings\application data\google\update\GoogleUpdate.exe" /c
uRun: [braviax] c:\windows\system32\braviax.exe
mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe
mRun: [LogitechQuickCamRibbon] "c:\program files\logitech\quickcam\Quickcam.exe" /hide
mRun: [braviax] c:\windows\system32\braviax.exe
StartupFolder: c:\docume~1\ericli~1\startm~1\programs\startup\logite~1.lnk - c:\program files\logitech\quickcam\eReg.exe
uPolicies-explorer: ForceClassicControlPanel = 1 (0x1)
uPolicies-system: EnableProfileQuota = 1 (0x1)
IE: Download All by FlashGet - c:\program files\flashget\jc_all.htm
IE: Download using FlashGet - c:\program files\flashget\jc_link.htm
Trusted Zone: mirarsearch.com\click
Trusted Zone: mirarsearch.com\redirect
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_02-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: AtiExtEvent - Ati2evxx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\ericli~1\applic~1\mozilla\firefox\profiles\1dosvyzk.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.startup.homepage - google.com
FF - component: c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
FF - plugin: c:\documents and settings\eric liu\application data\mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\documents and settings\eric liu\local settings\application data\google\update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\java\jre1.5.0_09\bin\NPJava11.dll
FF - plugin: c:\program files\java\jre1.5.0_09\bin\NPJava12.dll
FF - plugin: c:\program files\java\jre1.5.0_09\bin\NPJava13.dll
FF - plugin: c:\program files\java\jre1.5.0_09\bin\NPJava14.dll
FF - plugin: c:\program files\java\jre1.5.0_09\bin\NPJava32.dll
FF - plugin: c:\program files\java\jre1.5.0_09\bin\NPJPI150_09.dll
FF - plugin: c:\program files\java\jre1.5.0_09\bin\NPOJI610.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npmozax.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npunagi2.dll

—- FIREFOX POLICIES —-
FF - user.js: general.useragent.extra.zencast -
============= SERVICES / DRIVERS ===============

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-10-22 111184]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-10-22 20560]
R2 WDBtnMgrSvc.exe;WD Drive Manager Service;c:\program files\western digital\wd drive manager\WDBtnMgrSvc.exe [2008-2-19 106496]
R3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast4\ashMaiSv.exe [2008-10-22 254040]
R3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast4\ashWebSv.exe [2008-10-22 352920]
R3 HSFHWATI;HSFHWATI;c:\windows\system32\drivers\HSFHWATI.sys [2005-3-22 200192]
S2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast4\ashServ.exe [2008-10-22 155160]
S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\google\google desktop search\GoogleDesktop.exe [2009-1-14 29744]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2005-8-2 32512]
S3 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2005-1-26 280344]

=============== Created Last 30 ================

2009-07-24 11:26 –d-h— c:\windows\PIF
2009-07-23 22:00 65,536 a——- c:\windows\system32\drivers\vsfocedjnsfteh.sys
2009-07-23 21:57 13,898 a——- c:\windows\igyr.vbs
2009-07-23 21:57 12,107 a——- c:\docume~1\alluse~1\applic~1\cykaxoma.reg
2009-07-23 21:57 10,103 a——- c:\windows\wyfovel.ban
2009-07-23 21:57 19,916 a——- c:\docume~1\alluse~1\applic~1\diqotu.dll
2009-07-23 21:57 16,282 a——- c:\docume~1\alluse~1\applic~1\uzapaq.dat
2009-07-23 21:57 15,673 a——- c:\windows\pifi.bat
2009-07-23 21:57 14,806 a——- c:\windows\xedom._dl
2009-07-23 21:57 13,441 a——- c:\windows\system32\ducafecuh.vbs
2009-07-23 21:57 11,156 a——- c:\program files\common files\iqamygame.vbs
2009-07-23 21:56 345,716 a——- c:\windows\system32\_scui.cpl
2009-07-23 21:56 –d—– c:\program files\HomeAntivirus2010
2009-07-23 21:44 162 a——- c:\windows\system32\delself.bat
2009-07-23 21:43 181,329 a——- c:\windows\system32\wisdstr.exe
2009-07-23 21:36 2 a——- c:\windows\0101120101464849.dat
2009-07-23 21:36 2 a——- c:\windows\010112010146118114.dat
2009-07-23 21:36 205 a——- c:\windows\prxid93ps.dat
2009-07-23 21:36 27,136 ——– c:\windows\ld12.exe
2009-07-23 21:36 32,768 a——- c:\windows\system32\dllcache\beep.sys
2009-07-23 21:36 11,264 a——- c:\windows\system32\braviax.exe
2009-07-23 21:31 141,312 a——- c:\windows\msa.exe
2009-07-23 21:31 140,804 a——- c:\windows\system32\msxml71.dll
2009-07-23 21:30 1,176,815 a——- c:\windows\system32\xa.tmp
2009-07-21 20:55 0 a——- c:\windows\system32\drivers\lvuvc.hs
2009-07-21 20:55 494,104 a—-r– c:\windows\system32\LVUI2.dll
2009-07-21 20:55 432,664 a—-r– c:\windows\system32\LVUI2RC.dll
2009-07-21 20:55 416,280 a—-r– c:\windows\system32\lvcodec2.dll
2009-07-21 20:55 6,364,440 a—-r– c:\windows\system32\drivers\lvuvc.sys
2009-07-21 20:54 29,562 a—-r– c:\windows\system32\Repository.reg
2009-07-21 20:54 195,096 a—-r– c:\windows\system32\lvci11901262.dll
2009-07-21 20:54 81,110 a—-r– c:\windows\system32\lvcoinst.ini
2009-07-21 20:54 768,024 a—-r– c:\windows\system32\drivers\lvrs.sys
2009-07-21 20:54 41,752 a—-r– c:\windows\system32\drivers\LVUSBSta.sys
2009-07-21 20:53 0 a——- c:\windows\system32\drivers\logiflt.iad
2009-07-21 20:53 23,832 a—-r– c:\windows\system32\drivers\lvuvcflt.sys
2009-07-21 20:50 20,992 a——- c:\windows\system32\dshowext.ax
2009-07-21 20:50 20,992 a——- c:\windows\system32\dllcache\dshowext.ax
2009-07-06 16:29 1,294,336 a——- c:\windows\system32\dllcache\dsound3d.dll
2009-07-05 16:37 –d—– c:\docume~1\ericli~1\applic~1\Red Alert 3 Demo
2009-07-05 15:56 1,491,992 a——- c:\windows\system32\D3DCompiler_38.dll
2009-07-05 15:56 467,984 a——- c:\windows\system32\d3dx10_38.dll
2009-07-05 15:55 3,850,760 a——- c:\windows\system32\D3DX9_38.dll
2009-07-05 15:55 1,358,192 a——- c:\windows\system32\D3DCompiler_35.dll
2009-07-05 15:55 444,776 a——- c:\windows\system32\d3dx10_35.dll
2009-07-05 15:55 3,727,720 a——- c:\windows\system32\d3dx9_35.dll
2009-07-05 15:55 –d—– c:\windows\Logs
2009-06-24 20:02 –d—– c:\program files\Microsoft CAPICOM 2.1.0.2

==================== Find3M ====================

2009-07-24 11:27 32,768 a——- c:\windows\system32\drivers\beep.sys
2009-07-23 21:57 17,353 a——- c:\program files\common files\ulipyluk.db
2009-07-23 21:57 14,912 a——- c:\program files\common files\lukatydadi._dl
2009-06-16 10:36 119,808 a——- c:\windows\system32\t2embed.dll
2009-06-16 10:36 81,920 a——- c:\windows\system32\fontsub.dll
2009-06-16 10:36 119,808 ——– c:\windows\system32\dllcache\t2embed.dll
2009-06-16 10:36 81,920 ——– c:\windows\system32\dllcache\fontsub.dll
2009-06-03 15:09 1,291,264 a——- c:\windows\system32\quartz.dll
2009-06-03 15:09 1,291,264 ——– c:\windows\system32\dllcache\quartz.dll
2009-05-07 11:32 345,600 a——- c:\windows\system32\localspl.dll
2009-05-07 11:32 345,600 ——– c:\windows\system32\dllcache\localspl.dll
2009-04-29 00:56 827,392 a——- c:\windows\system32\wininet.dll
2009-04-29 00:56 827,392 a——- c:\windows\system32\dllcache\wininet.dll
2009-04-29 00:56 233,472 ——– c:\windows\system32\dllcache\webcheck.dll
2009-04-29 00:56 1,159,680 a——- c:\windows\system32\dllcache\urlmon.dll
2009-04-29 00:56 671,232 a——- c:\windows\system32\dllcache\mstime.dll
2009-04-29 00:56 44,544 a——- c:\windows\system32\dllcache\pngfilt.dll
2009-04-29 00:56 105,984 ——– c:\windows\system32\dllcache\url.dll
2009-04-29 00:56 102,912 ——– c:\windows\system32\dllcache\occache.dll
2009-04-29 00:56 3,596,288 a——- c:\windows\system32\dllcache\mshtml.dll
2009-04-29 00:56 477,696 a——- c:\windows\system32\dllcache\mshtmled.dll
2009-04-29 00:56 193,024 a——- c:\windows\system32\dllcache\msrating.dll
2009-04-28 05:05 70,656 ——– c:\windows\system32\dllcache\ie4uinit.exe
2009-04-28 05:05 13,824 ——– c:\windows\system32\dllcache\ieudinit.exe
2007-12-29 03:25 32 ac—— c:\docume~1\alluse~1\applic~1\ezsid.dat
2008-10-10 07:10 32,768 ac-sh— c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008101020081011\index.dat

============= FINISH: 12:02:32.76 ===============

Attatch.txt:


UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-06-26.01)

Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume1
Install Date: 8/25/2005 4:59:11 AM
System Uptime: 7/24/2009 11:53:01 AM (1 hours ago)

Motherboard: Hewlett-Packard | | 3085
Processor: AMD Athlon™ 64 Processor 3500+ | U23 | 2192/mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 75 GiB total, 14.533 GiB free.
D: is CDROM ()
E: is CDROM ()

==== Disabled Device Manager Items =============

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: 1394 Net Adapter
Device ID: V1394\NIC1394\3254079583F0200
Manufacturer: Microsoft
Name: 1394 Net Adapter
PNP Device ID: V1394\NIC1394\3254079583F0200
Service: NIC1394

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: Cisco Systems VPN Adapter
Device ID: ROOT\NET\0000
Manufacturer: Cisco Systems
Name: Cisco Systems VPN Adapter
PNP Device ID: ROOT\NET\0000
Service: CVirtA

==== System Restore Points ===================

RP681: 7/23/2009 9:31:59 PM - System Checkpoint
RP682: 7/23/2009 9:32:03 PM - System Checkpoint
RP683: 7/23/2009 9:32:06 PM - System Checkpoint
RP684: 7/23/2009 9:32:09 PM - System Checkpoint
RP685: 7/23/2009 9:32:11 PM - System Checkpoint
RP686: 7/23/2009 9:32:11 PM - System Checkpoint
RP687: 7/23/2009 9:32:13 PM - System Checkpoint
RP688: 7/23/2009 9:32:14 PM - System Checkpoint
RP689: 7/23/2009 9:32:16 PM - System Checkpoint
RP690: 7/23/2009 9:32:18 PM - System Checkpoint
RP691: 7/23/2009 9:32:19 PM - System Checkpoint
RP692: 7/23/2009 9:32:22 PM - Software Distribution Service 3.0
RP693: 7/23/2009 9:32:26 PM - System Checkpoint
RP694: 7/23/2009 9:32:28 PM - System Checkpoint
RP695: 7/23/2009 9:32:31 PM - System Checkpoint
RP696: 7/23/2009 9:32:33 PM - System Checkpoint
RP697: 7/23/2009 9:32:36 PM - System Checkpoint
RP698: 7/23/2009 9:32:38 PM - System Checkpoint
RP699: 7/23/2009 9:32:40 PM - System Checkpoint
RP700: 7/23/2009 9:32:42 PM - System Checkpoint
RP701: 7/23/2009 9:32:44 PM - System Checkpoint
RP702: 7/23/2009 9:32:46 PM - System Checkpoint
RP703: 7/23/2009 9:32:48 PM - System Checkpoint
RP704: 7/23/2009 9:32:50 PM - System Checkpoint
RP705: 7/23/2009 9:32:50 PM - System Checkpoint
RP706: 7/23/2009 9:32:52 PM - System Checkpoint
RP707: 7/23/2009 9:32:55 PM - System Checkpoint
RP708: 7/23/2009 9:32:57 PM - System Checkpoint
RP709: 7/23/2009 9:33:00 PM - Software Distribution Service 3.0
RP710: 7/23/2009 9:33:03 PM - Installed Java™ SE Development Kit 6 Update 14
RP711: 7/23/2009 9:33:06 PM - System Checkpoint
RP712: 7/23/2009 9:33:08 PM - System Checkpoint
RP713: 7/23/2009 9:33:11 PM - System Checkpoint
RP714: 7/23/2009 9:33:12 PM - System Checkpoint
RP715: 7/23/2009 9:33:15 PM - System Checkpoint
RP716: 7/23/2009 9:33:16 PM - System Checkpoint
RP717: 7/23/2009 9:33:18 PM - System Checkpoint
RP718: 7/23/2009 9:33:20 PM - Software Distribution Service 3.0
RP719: 7/23/2009 9:33:22 PM - System Checkpoint
RP720: 7/23/2009 9:33:24 PM - System Checkpoint
RP721: 7/23/2009 9:33:25 PM - System Checkpoint
RP722: 7/23/2009 9:33:27 PM - System Checkpoint
RP723: 7/23/2009 9:33:29 PM - System Checkpoint
RP724: 7/23/2009 9:33:30 PM - Installed Command & Conquer™ Red Alert™ 3 Demo
RP725: 7/23/2009 9:33:32 PM - Installed Command & Conquer The First Decade
RP726: 7/23/2009 9:33:33 PM - Installed DirectX 9.0
RP727: 7/23/2009 9:33:35 PM - System Checkpoint
RP728: 7/23/2009 9:33:35 PM - System Checkpoint
RP729: 7/23/2009 9:33:37 PM - System Checkpoint
RP730: 7/23/2009 9:33:39 PM - System Checkpoint
RP731: 7/23/2009 9:33:41 PM - System Checkpoint
RP732: 7/23/2009 9:33:43 PM - System Checkpoint
RP733: 7/23/2009 9:33:45 PM - Software Distribution Service 3.0
RP734: 7/23/2009 9:33:47 PM - System Checkpoint
RP735: 7/23/2009 9:33:49 PM - System Checkpoint
RP736: 7/23/2009 9:33:50 PM - System Checkpoint
RP737: 7/23/2009 9:33:51 PM - Logitech QuickCam v11.90.1262
RP738: 7/23/2009 9:33:52 PM - System Checkpoint

==== Installed Programs ======================

µTorrent
Acme CADSee v4.9
Acrobat.com
Ad-Aware SE Personal
Adobe AIR
Adobe Flash Player 10 Plugin
Adobe Flash Player ActiveX
Adobe Reader 7.0.9
Adobe Shockwave Player
AOL Instant Messenger
Apple Mobile Device Support
Apple Software Update
Athlon 64 Processor Driver
ATI Control Panel
ATI Display Driver
avast! Antivirus
Bonjour
Broadcom 802.11 Driver
BufferChm
CCleaner (remove only)
CDisplay 1.8
Cisco Systems VPN Client 4.8.01.0300
Command & Conquer The First Decade
Command & Conquer™ Red Alert™ 3 Demo
Compatibility Pack for the 2007 Office system
Conexant AC-Link Audio
Creative Removable Disk Manager
Creative System Information
Critical Update for Windows Media Player 11 (KB959772)
CustomerResearchQFolder
DAEMON Tools Toolbar
Data Fax SoftModem with SmartCP
DeviceManagementQFolder
Diet Analysis Plus 7.0.1
EndNote Web 2.5
EssenceRO
eSupportQFolder
Far Cry (Patch 1.3)
Far Cry (Patch 1.31)
Far Cry (Patch 1.32)
Far Cry (Patch 1.33)
FlashGet(JetCar)
GameSpy Arcade
Google Desktop
Google Talk Plugin
Google Toolbar for Internet Explorer
Heroes of Might and Magic V Demo
HijackThis 2.0.2
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB952287)
HP Customer Participation Program 7.0
HP Help and Support
HP Imaging Device Functions 7.0
HP Pavillion zv6000 User Guides
HP Photosmart and Deskjet 7.0 Software
HP Photosmart Essential
HP Product Assistant
HP Solution Center 7.0
HP Update
HP Wireless Assistant 1.01 A3
hph_readme
hph_software
hph_software_req
HPPhotoSmartExpress
HPProductAssistant
HpSdpAppCoreApp
InstantShareDevicesMFC
InterActual Player
InterVideo WinDVD
iPod for Windows 2005-11-17
iPod for Windows 2006-01-10
IrfanView (remove only)
iTunes
J2SE Runtime Environment 5.0 Update 2
J2SE Runtime Environment 5.0 Update 6
J2SE Runtime Environment 5.0 Update 9
Java DB 10.4.2.1
Java™ SE Development Kit 6 Update 14
LiveUpdate 2.5 (Symantec Corporation)
Logitech QuickCam
Logitech QuickCam Driver Package
LS_HSI
Macromedia Flash Player 8
Malwarebytes' Anti-Malware
MarketResearch
MaxTRAQ
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office 2000 Professional
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Reader
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Works
MINITAB 14 Student
Mozilla Firefox (3.0.12)
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML4 Parser
muvee autoProducer 4.0 - SE
PanoStandAlone
PDF Password Cracker Pro v3.0
PerfectDisk 10 Professional
Picasa 2
QuickTime
ResearchSoft Direct Export Helper
Rumble Fighter
S4 League_EU
Security Update for CAPICOM (KB931906)
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 7 (KB969897)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB973346)
Skype™ 3.6
SolutionCenter
Sonic Audio Module
Sonic Copy Module
Sonic Data Module
Sonic Express Labeler
Sonic MyDVD Plus
Sonic Update Manager
Spybot - Search & Destroy 1.4
Starcraft
Status
Synaptics Pointing Device Driver
Texas Instruments PCIxx21/x515 drivers.
TIxx21
Toolbox
TrayApp
Unload
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
UserGuides
V CAST Music Manager
Ventrilo Client
VLC media player 0.9.4
Warcraft III: All Products
WC3Banlist
WD Backup
WD Diagnostics
WD Drive Manager (x86)
WD Firewire HID Driver
WebFldrs XP
WebReg
Winamp (remove only)
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage v1.3.0254.0
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 7
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Service Pack 3
WinPcap 3.1
WinRAR archiver

==== Event Viewer Messages From Past Week ========

7/24/2009 12:30:43 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
7/24/2009 12:25:56 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
7/24/2009 12:24:14 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
7/24/2009 12:23:47 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
7/23/2009 9:51:32 PM, error: Service Control Manager [7034] - The avast! Antivirus service terminated unexpectedly. It has done this 1 time(s).
7/23/2009 9:43:52 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Beep eabfiltr eeCtrl
7/23/2009 11:40:05 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Aavmker4 AFD AmdK8 aswSP aswTdi Beep eabfiltr eeCtrl Fips IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss Tcpip Tcpip6 WS2IFSL
7/23/2009 11:40:05 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.
7/23/2009 11:40:05 PM, error: Service Control Manager [7001] - The IPv6 Helper Service service depends on the Microsoft IPv6 Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
7/23/2009 11:40:05 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
7/23/2009 11:40:05 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
7/23/2009 11:40:05 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
7/23/2009 11:40:05 PM, error: Service Control Manager [7001] - The Bonjour Service service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
7/23/2009 11:40:05 PM, error: Service Control Manager [7001] - The Apple Mobile Device service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
7/21/2009 12:21:40 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: eabfiltr eeCtrl
7/18/2009 9:08:08 PM, error: Dhcp [1002] - The IP address lease 192.168.1.100 for the Network Card with network address 00904BF52B95 has been denied by the DHCP server 192.168.0.1 (The DHCP Server sent a DHCPNACK message).
7/18/2009 3:07:49 PM, error: MRxSmb [8003] - The master browser has received a server announcement from the computer ZHANG-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{91E578E9-8677-45EC-. The master browser is stopping or an election is being forced.

==== End Of File ===========================

Rootkit log:

GMER 1.0.15.14972 - http://www.gmer.net
Rootkit scan 2009-07-24 12:15:10
Windows 5.1.2600 Service Pack 3


—- System - GMER 1.0.15 —-

INT 0x62 ? 8716CBF8
INT 0x73 ? 871DABF8
INT 0x82 ? 8716CBF8
INT 0xB4 ? 86FF3BF8
INT 0xB4 ? 86FF3BF8
INT 0xB4 ? 86FF3BF8
INT 0xB4 ? 86FF3BF8

Code 86D32C20 ZwEnumerateKey
Code 86D26C58 ZwFlushInstructionCache
Code 86D32C56 IofCallDriver
Code 86CF5BAE IofCompleteRequest
Code 86D26C1D ZwSaveKey
Code 86C62E15 ZwSaveKeyEx

—- Devices - GMER 1.0.15 —-

Device \FileSystem\Ntfs \Ntfs 8716B1F8

AttachedDevice \FileSystem\Ntfs \Ntfs aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)

Device \Driver\sptd \Device\3558189062 spya.sys

AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

Device \Driver\NetBT \Device\NetBT_Tcpip_{91E578E9-8677-45EC-BFD3-E722C950F9FD} 8678C1F8

AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)

Device \Driver\usbohci \Device\USBPDO-0 86FD4500
Device \Driver\usbohci \Device\USBPDO-1 86FD4500
Device \Driver\usbehci \Device\USBPDO-2 86FD2500

AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

Device \Driver\Ftdisk \Device\HarddiskVolume1 871D81F8
Device \Driver\NetBT \Device\NetBt_Wins_Export 8678C1F8
Device \Driver\NetBT \Device\NetbiosSmb 8678C1F8
Device \Driver\PCI_PNP7812 \Device\0000005c spya.sys

AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

Device \Driver\usbohci \Device\USBFDO-0 86FD4500
Device \Driver\usbohci \Device\USBFDO-1 86FD4500
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 866F31F8
Device \Driver\usbehci \Device\USBFDO-2 86FD2500
Device \FileSystem\MRxSmb \Device\LanmanRedirector 866F31F8
Device \Driver\Ftdisk \Device\FtControl 871D81F8
Device \Driver\NetBT \Device\NetBT_Tcpip_{09EF98B2-EF70-4877-9F8D-730531A3FCB1} 8678C1F8
Device \Driver\a1219xri \Device\Scsi\a1219xri1Port2Path0Target0Lun0 86E801F8
Device \Driver\a1219xri \Device\Scsi\a1219xri1 86E801F8
Device \FileSystem\Cdfs \Cdfs 86F45500
—- Processes - GMER 1.0.15 —-

Library \\?\globalroot\systemroot\system32\UACpcbhkvfinb.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1484] 0x02EF0000

—- Disk sectors - GMER 1.0.15 —-

Disk \Device\Harddisk0\DR0 sector 01: copy of MBR
Disk \Device\Harddisk0\DR0 sector 02: copy of MBR
Disk \Device\Harddisk0\DR0 sector 03: copy of MBR
Disk \Device\Harddisk0\DR0 sector 04: copy of MBR
Disk \Device\Harddisk0\DR0 sector 05: copy of MBR
Disk \Device\Harddisk0\DR0 sector 06: copy of MBR
Disk \Device\Harddisk0\DR0 sector 07: copy of MBR
Disk \Device\Harddisk0\DR0 sector 08: copy of MBR
Disk \Device\Harddisk0\DR0 sector 09: copy of MBR
Disk \Device\Harddisk0\DR0 sector 10: copy of MBR
Disk \Device\Harddisk0\DR0 sector 11: copy of MBR
Disk \Device\Harddisk0\DR0 sector 12: copy of MBR
Disk \Device\Harddisk0\DR0 sector 13: copy of MBR
Disk \Device\Harddisk0\DR0 sector 14: copy of MBR
Disk \Device\Harddisk0\DR0 sector 15: copy of MBR
Disk \Device\Harddisk0\DR0 sector 16: copy of MBR
Disk \Device\Harddisk0\DR0 sector 17: copy of MBR
Disk \Device\Harddisk0\DR0 sector 18: copy of MBR
Disk \Device\Harddisk0\DR0 sector 19: copy of MBR
Disk \Device\Harddisk0\DR0 sector 20: copy of MBR
Disk \Device\Harddisk0\DR0 sector 21: copy of MBR
Disk \Device\Harddisk0\DR0 sector 22: copy of MBR
Disk \Device\Harddisk0\DR0 sector 23: copy of MBR
Disk \Device\Harddisk0\DR0 sector 24: copy of MBR
Disk \Device\Harddisk0\DR0 sector 25: copy of MBR
Disk \Device\Harddisk0\DR0 sector 26: copy of MBR
Disk \Device\Harddisk0\DR0 sector 27: copy of MBR
Disk \Device\Harddisk0\DR0 sector 28: copy of MBR
Disk \Device\Harddisk0\DR0 sector 29: copy of MBR
Disk \Device\Harddisk0\DR0 sector 30: copy of MBR
Disk \Device\Harddisk0\DR0 sector 31: copy of MBR
Disk \Device\Harddisk0\DR0 sector 32: copy of MBR
Disk \Device\Harddisk0\DR0 sector 33: copy of MBR
Disk \Device\Harddisk0\DR0 sector 34: copy of MBR
Disk \Device\Harddisk0\DR0 sector 35: copy of MBR
Disk \Device\Harddisk0\DR0 sector 36: copy of MBR
Disk \Device\Harddisk0\DR0 sector 37: copy of MBR
Disk \Device\Harddisk0\DR0 sector 38: copy of MBR
Disk \Device\Harddisk0\DR0 sector 39: copy of MBR
Disk \Device\Harddisk0\DR0 sector 40: copy of MBR
Disk \Device\Harddisk0\DR0 sector 41: copy of MBR
Disk \Device\Harddisk0\DR0 sector 42: copy of MBR
Disk \Device\Harddisk0\DR0 sector 43: copy of MBR
Disk \Device\Harddisk0\DR0 sector 44: copy of MBR
Disk \Device\Harddisk0\DR0 sector 45: copy of MBR
Disk \Device\Harddisk0\DR0 sector 46: copy of MBR
Disk \Device\Harddisk0\DR0 sector 47: copy of MBR
Disk \Device\Harddisk0\DR0 sector 48: copy of MBR
Disk \Device\Harddisk0\DR0 sector 49: copy of MBR
Disk \Device\Harddisk0\DR0 sector 50: copy of MBR
Disk \Device\Harddisk0\DR0 sector 51: copy of MBR
Disk \Device\Harddisk0\DR0 sector 52: copy of MBR
Disk \Device\Harddisk0\DR0 sector 53: copy of MBR
Disk \Device\Harddisk0\DR0 sector 54: copy of MBR
Disk \Device\Harddisk0\DR0 sector 55: copy of MBR
Disk \Device\Harddisk0\DR0 sector 56: copy of MBR
Disk \Device\Harddisk0\DR0 sector 57: copy of MBR
Disk \Device\Harddisk0\DR0 sector 58: copy of MBR
Disk \Device\Harddisk0\DR0 sector 59: copy of MBR
Disk \Device\Harddisk0\DR0 sector 60: copy of MBR
Disk \Device\Harddisk0\DR0 sector 61: copy of MBR
Disk \Device\Harddisk0\DR0 sector 62: rootkit-like behavior; copy of MBR
Disk \Device\Harddisk0\DR0 sector 63: rootkit-like behavior; copy of MBR

—- EOF - GMER 1.0.15 —-


Thank you for all of your help.
Post #6
Hi,

Please do the following:

Download Combofix from either of the links below. You must rename it before saving it.
Save it to your desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**

  • If you are using Firefox, make sure that your download settings are as follows:
  • Tools->Options->Main tab
  • Set to "Always ask me where to Save the files".


Link 1
Link 2



During the download, rename Combofix to Combo-Fix as follows:

[external image: Posted Image]


[external image: Posted Image]
——————————————————————–
  • It is important you rename Combofix during the download, but not after.
  • Please do not rename Combofix to other names, but only to the one indicated.


———————————————————–

  • Double click on Combo-Fix.exe & follow the prompts.
    • When finished, it will produce a report for you.
    • Please post the "C:\Combo-Fix.txt" for further review.
    **Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall**


    ———————————————————–

  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

    ———————————————————–

Post #7
i'm having trouble turning my computer on, it seems to stop at the blue windows loading screen. I try ctrl alt del and other buttons to no effect. the mouse is still active and keys such as caps lock still light up. it just wont proceed to the desktop
Post #8
should i go ahead and try to reformat the computer? i cant seem to be able to get past the blue windows xp loading screen
Post #9
can you boot up into safe mode?

If so try running ComboFix in safe mode


To Enter Safemode
  • Go to Start> Shut off your Computer> Restart
  • As the computer starts to boot-up, Tap the F8 KEY repeatedly,
  • this will bring up a menu.
  • Use the Up and Down Arrow Keys to scroll up to Safemode
  • Then press the Enter Key on your Keyboard
  • go into your usual account
Post #12
Ok it took a while, but i finally found my windows cd and used the repair install. The computer is now booting properly… here is the log from the combo fix:

ComboFix 09-07-23.04 - Eric Liu 07/24/2009 22:27.2.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1022.620 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\Combo-Fix.exe
AV: avast! antivirus 4.8.1296 [VPS 090724-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Eric Liu\Local Settings\Temporary Internet Files\jixe.db
c:\documents and settings\Eric Liu\Local Settings\Temporary Internet Files\loworepi.bin
c:\documents and settings\Eric Liu\Local Settings\Temporary Internet Files\qybonip._sy
c:\documents and settings\Eric Liu\Local Settings\Temporary Internet Files\yvyqegyro.bat
c:\windows\010112010146118114.dat
c:\windows\0101120101464849.dat
c:\windows\ld12.exe
c:\windows\msa.exe
c:\windows\system32\_scui.cpl
c:\windows\system32\braviax.exe
c:\windows\system32\DelSelf.bat
c:\windows\system32\drivers\UACfuvabvqfbw.sys
c:\windows\system32\drivers\vsfocedjnsfteh.sys
c:\windows\system32\msxml71.dll
c:\windows\system32\UACctnfukfnpu.dat
c:\windows\system32\UACermanwyqco.dll
c:\windows\system32\uacinit.dll
c:\windows\system32\UACipvlhinnpr.db
c:\windows\system32\UACkrdshhqlgu.dll
c:\windows\system32\UACokutkbbobq.dll
c:\windows\system32\UACoxucttnmko.dll
c:\windows\system32\UACpcbhkvfinb.dll
c:\windows\system32\wbem\proquota.exe
c:\windows\system32\wisdstr.exe
c:\windows\TEMP\logishrd\LVPrcInj01.dll

c:\windows\system32\drivers\beep.sys . . . is infected!!

c:\windows\system32\proquota.exe . . . is missing!!

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_UACd.sys


((((((((((((((((((((((((( Files Created from 2009-06-25 to 2009-07-25 )))))))))))))))))))))))))))))))
.

2009-07-25 02:39 . 2004-08-04 12:00 4224 —-a-w- c:\windows\system32\drivers\beep.sys
2009-07-24 22:06 . 2009-07-24 22:06 ——– d-sh–w- C:\found.000
2009-07-24 15:26 . 2009-07-24 15:26 ——– d–h–w- c:\windows\PIF
2009-07-24 01:57 . 2009-07-24 01:57 13898 —-a-w- c:\windows\igyr.vbs
2009-07-24 01:57 . 2009-07-24 01:57 11615 —-a-w- c:\documents and settings\Eric Liu\Local Settings\Application Data\ozysawa.dat
2009-07-24 01:57 . 2009-07-24 01:57 10457 —-a-w- c:\documents and settings\Eric Liu\Local Settings\Application Data\ylutanug.vbs
2009-07-24 01:57 . 2009-07-24 01:57 18447 —-a-w- c:\documents and settings\Eric Liu\Local Settings\Application Data\ucam.dll
2009-07-24 01:57 . 2009-07-24 01:57 15673 —-a-w- c:\windows\pifi.bat
2009-07-24 01:57 . 2009-07-24 01:57 13441 —-a-w- c:\windows\system32\ducafecuh.vbs
2009-07-24 01:57 . 2009-07-24 01:57 11608 —-a-w- c:\documents and settings\Eric Liu\Local Settings\Application Data\upubi.exe
2009-07-24 01:57 . 2009-07-24 01:57 11156 —-a-w- c:\program files\Common Files\iqamygame.vbs
2009-07-24 01:56 . 2009-07-24 01:59 ——– d—–w- c:\program files\HomeAntivirus2010
2009-07-24 01:36 . 2009-07-24 02:20 205 —-a-w- c:\windows\prxid93ps.dat
2009-07-24 01:36 . 2004-08-04 12:00 4224 —-a-w- c:\windows\system32\dllcache\beep.sys
2009-07-22 00:55 . 2009-07-22 00:55 ——– d—–w- c:\documents and settings\Eric Liu\Application Data\Leadertech
2009-07-22 00:55 . 2008-12-17 06:01 432664 —-a-r- c:\windows\system32\LVUI2RC.dll
2009-07-22 00:55 . 2008-12-17 06:00 494104 —-a-r- c:\windows\system32\LVUI2.dll
2009-07-22 00:55 . 2008-12-17 05:55 416280 —-a-r- c:\windows\system32\lvcodec2.dll
2009-07-22 00:55 . 2008-12-17 06:01 6364440 —-a-r- c:\windows\system32\drivers\lvuvc.sys
2009-07-22 00:54 . 2008-12-17 05:37 29562 —-a-r- c:\windows\system32\Repository.reg
2009-07-22 00:54 . 2008-12-17 05:55 195096 —-a-r- c:\windows\system32\lvci11901262.dll
2009-07-22 00:54 . 2008-12-17 06:01 41752 —-a-r- c:\windows\system32\drivers\LVUSBSta.sys
2009-07-22 00:54 . 2008-12-17 06:00 768024 —-a-r- c:\windows\system32\drivers\lvrs.sys
2009-07-22 00:53 . 2008-12-17 06:02 23832 —-a-r- c:\windows\system32\drivers\lvuvcflt.sys
2009-07-22 00:52 . 2009-07-22 00:55 ——– d—–w- c:\program files\Common Files\LogiShrd
2009-07-22 00:51 . 2009-07-22 00:51 ——– d—–w- c:\program files\Logitech
2009-07-22 00:50 . 2009-07-22 00:52 ——– d—–w- c:\docume~1\ALLUSE~1\APPLIC~1\LogiShrd
2009-07-13 01:53 . 2009-07-13 23:30 ——– d—–w- c:\documents and settings\Eric Liu\Local Settings\Application Data\Temp
2009-07-06 20:29 . 2003-05-30 13:00 1189888 —-a-w- c:\windows\system32\dllcache\dx8vb.dll
2009-07-05 20:37 . 2009-07-05 20:37 ——– d—–w- c:\documents and settings\Eric Liu\Application Data\Red Alert 3 Demo
2009-07-05 19:56 . 2008-05-30 18:11 467984 —-a-w- c:\windows\system32\d3dx10_38.dll
2009-07-05 19:56 . 2008-05-30 18:11 1491992 —-a-w- c:\windows\system32\D3DCompiler_38.dll
2009-07-05 19:55 . 2008-05-30 18:11 3850760 —-a-w- c:\windows\system32\D3DX9_38.dll
2009-07-05 19:55 . 2007-07-19 22:14 444776 —-a-w- c:\windows\system32\d3dx10_35.dll
2009-07-05 19:55 . 2007-07-19 22:14 1358192 —-a-w- c:\windows\system32\D3DCompiler_35.dll
2009-07-05 19:55 . 2007-07-19 22:14 3727720 —-a-w- c:\windows\system32\d3dx9_35.dll
2009-07-05 19:55 . 2009-07-05 19:55 ——– d—–w- c:\windows\Logs

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-24 01:57 . 2009-07-24 01:57 12107 —-a-w- c:\docume~1\ALLUSE~1\APPLIC~1\cykaxoma.reg
2009-07-24 01:57 . 2009-07-24 01:57 19916 —-a-w- c:\docume~1\ALLUSE~1\APPLIC~1\diqotu.dll
2009-07-24 01:57 . 2009-07-24 01:57 17353 —-a-w- c:\program files\Common Files\ulipyluk.db
2009-07-24 01:57 . 2009-07-24 01:57 16282 —-a-w- c:\docume~1\ALLUSE~1\APPLIC~1\uzapaq.dat
2009-07-24 01:57 . 2009-07-24 01:57 14912 —-a-w- c:\program files\Common Files\lukatydadi._dl
2009-07-24 01:42 . 2009-06-23 03:24 ——– d—–w- c:\program files\Microsoft Silverlight
2009-07-24 01:37 . 2005-11-30 18:09 ——– d—–w- c:\documents and settings\Eric Liu\Application Data\uTorrent
2009-07-24 01:30 . 2009-07-24 01:30 1176815 —-a-w- c:\windows\system32\xa.tmp
2009-07-24 01:30 . 2005-09-13 00:04 ——– d—–w- c:\program files\Warcraft III
2009-07-23 02:25 . 2009-02-13 16:56 ——– d—–w- c:\documents and settings\Eric Liu\Application Data\EndNote
2009-07-23 01:36 . 2009-07-22 00:55 0 —-a-w- c:\windows\system32\drivers\lvuvc.hs
2009-07-23 01:36 . 2009-07-22 00:53 0 —-a-w- c:\windows\system32\drivers\logiflt.iad
2009-07-22 00:46 . 2006-05-16 17:53 71736 -c–a-w- c:\documents and settings\Eric Liu\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-07-06 20:07 . 2005-11-28 01:40 ——– d—–w- c:\program files\EA Games
2009-07-06 20:07 . 2005-05-12 03:37 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-07-05 19:56 . 2008-09-10 18:17 ——– d—–w- c:\program files\Electronic Arts
2009-06-25 00:02 . 2009-06-25 00:02 ——– d—–w- c:\program files\Microsoft CAPICOM 2.1.0.2
2009-06-22 19:23 . 2009-06-22 19:23 239088 —-a-w- c:\documents and settings\Eric Liu\Application Data\Mozilla\plugins\npgoogletalk.dll
2009-06-16 14:36 . 2004-08-04 08:00 81920 —-a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:36 . 2004-08-04 08:00 119808 —-a-w- c:\windows\system32\t2embed.dll
2009-06-11 05:55 . 2009-06-11 05:55 ——– d—–w- c:\program files\Sun
2009-06-11 05:53 . 2005-05-12 03:39 ——– d—–w- c:\program files\Java
2009-06-10 16:51 . 2009-06-10 16:31 ——– d—–w- c:\documents and settings\Eric Liu\Application Data\vlc
2009-06-05 18:18 . 2006-09-10 23:02 ——– d—–w- c:\documents and settings\Eric Liu\Application Data\fltk.org
2009-06-03 19:09 . 2004-08-04 08:00 1291264 —-a-w- c:\windows\system32\quartz.dll
2009-05-30 06:09 . 2009-05-30 06:09 ——– d—–w- c:\program files\Gravity
2009-05-07 15:32 . 2004-08-04 08:00 345600 —-a-w- c:\windows\system32\localspl.dll
2009-04-29 04:56 . 2004-08-04 08:00 827392 —-a-w- c:\windows\system32\wininet.dll
2009-04-29 04:55 . 2004-08-04 08:00 78336 —-a-w- c:\windows\system32\ieencode.dll
2009-07-24 01:53 . 2008-06-19 03:16 134648 —-a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
2009-01-14 15:46 . 2009-01-14 15:45 122880 —-a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-03-09 68856]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-08-08 490952]
"Google Update"="c:\documents and settings\Eric Liu\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-07-13 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000]
"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" [2008-12-20 2656528]

c:\documents and settings\Eric Liu\Start Menu\Programs\Startup\
Logitech . Product Registration.lnk - c:\program files\Logitech\QuickCam\eReg.exe [2008-11-7 517384]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ PDBoot.exe\0autocheck autochk *

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^VPN Client.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\VPN Client.lnk
backup=c:\windows\pss\VPN Client.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WD Backup Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\WD Backup Monitor.lnk
backup=c:\windows\pss\WD Backup Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Eric Liu^Start Menu^Programs^Startup^MEMonitor.lnk]
path=c:\documents and settings\Eric Liu\Start Menu\Programs\Startup\MEMonitor.lnk
backup=c:\windows\pss\MEMonitor.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\AIM\\aim.exe"=
"c:\\Program Files\\Warcraft III\\Warcraft III.exe"=
"c:\\Program Files\\Warcraft III\\War3.exe"=
"c:\\Program Files\\Diet Analysis Plus 7.0.1\\jre1.5.0_01\\bin\\javaw.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Documents and Settings\\Eric Liu\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.dll"=
"c:\\Documents and Settings\\Eric Liu\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1700:TCP"= 1700:TCP:MioNet Remote Drive Access 0
"1701:TCP"= 1701:TCP:MioNet Remote Drive Access 1
"1702:TCP"= 1702:TCP:MioNet Remote Drive Access 2
"1703:TCP"= 1703:TCP:MioNet Remote Drive Access 3
"1704:TCP"= 1704:TCP:MioNet Remote Drive Access 4
"1705:TCP"= 1705:TCP:MioNet Remote Drive Access 5
"1706:TCP"= 1706:TCP:MioNet Remote Drive Access 6
"1707:TCP"= 1707:TCP:MioNet Remote Drive Access 7
"1708:TCP"= 1708:TCP:MioNet Remote Drive Access 8
"1709:TCP"= 1709:TCP:MioNet Remote Drive Access 9
"1641:TCP"= 1641:TCP:MioNet Remote Drive Verification
"1647:TCP"= 1647:TCP:MioNet Storage Device Configuration
"5432:UDP"= 5432:UDP:MioNet Storage Device Discovery

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [10/22/2008 6:25 PM 111184]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [10/22/2008 6:25 PM 20560]
R2 WDBtnMgrSvc.exe;WD Drive Manager Service;c:\program files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe [2/19/2008 3:15 AM 106496]
R3 HSFHWATI;HSFHWATI;c:\windows\system32\drivers\HSFHWATI.sys [3/22/2005 10:39 AM 200192]
S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [1/14/2009 11:45 AM 29744]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [8/2/2005 5:10 PM 32512]
.
- - - - ORPHANS REMOVED - - - -

SafeBoot-AVG Anti-Spyware Driver
SafeBoot-AVG Anti-Spyware Guard


.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mStart Page = hxxp://www.google.com
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: Download All by FlashGet - c:\program files\FlashGet\jc_all.htm
IE: Download using FlashGet - c:\program files\FlashGet\jc_link.htm
Trusted Zone: mirarsearch.com\click
Trusted Zone: mirarsearch.com\redirect
FF - ProfilePath - c:\docume~1\ERICLI~1\APPLIC~1\Mozilla\Firefox\Profiles\1dosvyzk.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.startup.homepage - google.com
FF - component: c:\program files\Mozilla Firefox\components\GoogleDesktopMozilla.dll
FF - plugin: c:\documents and settings\Eric Liu\Application Data\Mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\documents and settings\Eric Liu\Local Settings\Application Data\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\Java\jre1.5.0_09\bin\NPJava11.dll
FF - plugin: c:\program files\Java\jre1.5.0_09\bin\NPJava12.dll
FF - plugin: c:\program files\Java\jre1.5.0_09\bin\NPJava13.dll
FF - plugin: c:\program files\Java\jre1.5.0_09\bin\NPJava14.dll
FF - plugin: c:\program files\Java\jre1.5.0_09\bin\NPJava32.dll
FF - plugin: c:\program files\Java\jre1.5.0_09\bin\NPJPI150_09.dll
FF - plugin: c:\program files\Java\jre1.5.0_09\bin\NPOJI610.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll

—- FIREFOX POLICIES —-
FF - user.js: general.useragent.extra.zencast - .

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-24 22:51
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-3875666416-1808773945-10867406-1006\Software\SecuROM\License information*]
"datasecu"=hex:ac,53,c7,33,4f,d6,35,e8,d5,14,8b,66,0f,13,62,4d,c8,db,34,ab,5f,
04,e5,91,16,57,85,b6,59,86,52,f2,17,45,33,e8,f0,ee,41,9d,12,de,2b,e5,a2,b6,\
"rkeysecu"=hex:cb,5b,a1,98,4c,99,e5,1c,14,81,b2,68,58,7f,94,6a

[HKEY_LOCAL_MACHINE\software\DeterministicNetworks\DNE\Parameters]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,79,00,73,00,\
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(1244)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(7444)
c:\windows\TEMP\logishrd\LVPrcInj01.dll
c:\windows\system32\mshtml.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\ati2evxx.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Cisco Systems\VPN Client\cvpnd.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
c:\program files\Raxco\PerfectDisk10\PDAgent.exe
c:\windows\system32\HPZipm12.exe
c:\program files\Common Files\LogiShrd\LQCVFX\COCIManager.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-07-25 22:56 - machine was rebooted
ComboFix-quarantined-files.txt 2009-07-25 02:56
ComboFix2.txt 2009-02-02 16:06

Pre-Run: 16,900,923,392 bytes free
Post-Run: 17,098,948,608 bytes free

277 — E O F — 2009-07-23 15:56
Post #13 last edited
Hi,

Please do the following:

Go Start > Run and copy/paste the following single-line command into the Run box and click OK:

cmd /c PEV -l "%systemdrive%\proquota.*" >Log.txt&Log.txt&del Log.txt

A Notepad file will open.

Post the contents of Log.txt in your next reply.


NEXT

  • Make sure to use Internet Explorer for this
  • Please go to VirSCAN.org FREE on-line scan service
  • Copy and paste the following file path into the "Suspicious files to scan" box on the top of the page:


    c:\windows\system32\drivers\beep.sys

  • Click on the Upload button
  • If a pop-up appears saying the file has been scanned already, please select the ReScan button.
  • Once the Scan is completed, click on the "Copy to Clipboard" button. This will copy the link of the report into the Clipboard.
  • Paste the contents of the Clipboard in your next reply.

Do the same for the following file:

c:\windows\system32\dllcache\beep.sys
Post #14
Ok the first log is

-c–a-w- 26,379 2004-08-04 13:00:00 C:\I386\PROQUOTA.EX_
—-a-w- 36,352 2008-04-14 00:12:36 C:\Qoobox\Quarantine\C\WINDOWS\system32\wbem\proquota.exe.vir
-c—-w- 50,176 2004-08-04 08:00:00 C:\WINDOWS\$NtServicePackUninstall$\proquota.exe
-c—-w- 50,176 2008-04-14 00:12:32 C:\WINDOWS\ServicePackFiles\i386\proquota.exe

Entries: 4 (4)
Directories: 0 Files: 4
Bytes: 163,083 Blocks: 319

VirSCAN log for drivers\beep.sys:

VirSCAN.org Scanned Report :
Scanned time : 2009/07/25 10:04:50 (EDT)
Scanner results: All Scanners reported not find malware!
File Name : beep.sys
File Size : 4224 byte
File Type : PE32 executable for MS Windows (native) Intel 80386 32-bit
MD5 : da1f27d85e0d1525f6621372e7b685e9
SHA1 : e3d2dc5eb273fa701de8af13b60d6baac7629260
Online report : http://virscan.org/report/aac8695baea83857…2e59e06203.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 4.5.0.3 20090724195220 2009-07-24 0.47 -
AhnLab V3 2009.07.25.00 2009.07.25 2009-07-25 1.38 -
AntiVir 8.2.0.228 7.1.5.28 2009-07-24 0.22 -
Antiy 2.0.18 20090725.2642626 2009-07-25 0.24 -
Arcavir 2009 200907250844 2009-07-25 0.03 -
Authentium 5.1.1 200907241350 2009-07-24 1.12 -
AVAST! 4.7.4 090724-0 2009-07-24 0.01 -
AVG 8.5.288 270.13.29/2261 2009-07-25 0.32 -
BitDefender 7.81008.3849638 7.26798 2009-07-25 3.56 -
CA (VET) 9.0.0.143 31.6.6638 2009-07-25 5.83 -
ClamAV 0.95.2 9612 2009-07-25 0.01 -
Comodo 3.10 1761 2009-07-25 0.93 -
CP Secure 1.1.0.715 2009.07.25 2009-07-25 11.67 -
Dr.Web 4.44.0.9170 2009.07.25 2009-07-25 4.96 -
F-Prot 4.4.4.56 20090724 2009-07-24 1.14 -
F-Secure 5.51.6100 2009.07.24.08 2009-07-24 0.07 -
Fortinet 2.81-3.120 10.643 2009-07-24 0.40 -
GData 19.6681/19.410 20090725 2009-07-25 5.72 -
ViRobot 20090721 2009.07.21 2009-07-21 0.46 -
Ikarus T3.1.01.64 2009.07.25.73099 2009-07-25 4.26 -
JiangMin 11.0.800 2009.07.25 2009-07-25 12.62 -
Kaspersky 5.5.10 2009.07.25 2009-07-25 0.05 -
KingSoft 2009.2.5.15 2009.7.25.21 2009-07-25 0.61 -
McAfee 5.3.00 5687 2009-07-24 3.08 -
Microsoft 1.4903 2009.07.25 2009-07-25 7.07 -
Norman 6.01.09 6.01.00 2009-07-24 4.01 -
Panda 9.05.01 2009.07.24 2009-07-24 2.04 -
Trend Micro 8.700-1004 6.314.03 2009-07-24 0.02 -
Quick Heal 10.00 2009.07.25 2009-07-25 1.07 -
Rising 20.0 21.39.52.00 2009-07-25 1.15 -
Sophos 2.88.0 4.43 2009-07-25 3.52 -
Sunbelt 5277 5277 2009-07-22 1.11 -
Symantec 1.3.0.24 20090724.005 2009-07-24 0.19 -
nProtect 20090724.01 4931631 2009-07-24 6.60 -
The Hacker 6.3.4.3 v00373 2009-07-23 0.68 -
VBA32 3.12.10.9 20090724.1323 2009-07-24 1.84 -
VirusBuster 4.5.11.10 10.109.11/1833539 2009-07-25 2.24 -

VirSCAN Log for dllcache\beep.sys:

VirSCAN.org Scanned Report :
Scanned time : 2009/07/25 10:04:50 (EDT)
Scanner results: All Scanners reported not find malware!
File Name : beep.sys
File Size : 4224 byte
File Type : PE32 executable for MS Windows (native) Intel 80386 32-bit
MD5 : da1f27d85e0d1525f6621372e7b685e9
SHA1 : e3d2dc5eb273fa701de8af13b60d6baac7629260
Online report : http://virscan.org/report/aac8695baea83857…2e59e06203.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 4.5.0.3 20090724195220 2009-07-24 0.47 -
AhnLab V3 2009.07.25.00 2009.07.25 2009-07-25 1.38 -
AntiVir 8.2.0.228 7.1.5.28 2009-07-24 0.22 -
Antiy 2.0.18 20090725.2642626 2009-07-25 0.24 -
Arcavir 2009 200907250844 2009-07-25 0.03 -
Authentium 5.1.1 200907241350 2009-07-24 1.12 -
AVAST! 4.7.4 090724-0 2009-07-24 0.01 -
AVG 8.5.288 270.13.29/2261 2009-07-25 0.32 -
BitDefender 7.81008.3849638 7.26798 2009-07-25 3.56 -
CA (VET) 9.0.0.143 31.6.6638 2009-07-25 5.83 -
ClamAV 0.95.2 9612 2009-07-25 0.01 -
Comodo 3.10 1761 2009-07-25 0.93 -
CP Secure 1.1.0.715 2009.07.25 2009-07-25 11.67 -
Dr.Web 4.44.0.9170 2009.07.25 2009-07-25 4.96 -
F-Prot 4.4.4.56 20090724 2009-07-24 1.14 -
F-Secure 5.51.6100 2009.07.24.08 2009-07-24 0.07 -
Fortinet 2.81-3.120 10.643 2009-07-24 0.40 -
GData 19.6681/19.410 20090725 2009-07-25 5.72 -
ViRobot 20090721 2009.07.21 2009-07-21 0.46 -
Ikarus T3.1.01.64 2009.07.25.73099 2009-07-25 4.26 -
JiangMin 11.0.800 2009.07.25 2009-07-25 12.62 -
Kaspersky 5.5.10 2009.07.25 2009-07-25 0.05 -
KingSoft 2009.2.5.15 2009.7.25.21 2009-07-25 0.61 -
McAfee 5.3.00 5687 2009-07-24 3.08 -
Microsoft 1.4903 2009.07.25 2009-07-25 7.07 -
Norman 6.01.09 6.01.00 2009-07-24 4.01 -
Panda 9.05.01 2009.07.24 2009-07-24 2.04 -
Trend Micro 8.700-1004 6.314.03 2009-07-24 0.02 -
Quick Heal 10.00 2009.07.25 2009-07-25 1.07 -
Rising 20.0 21.39.52.00 2009-07-25 1.15 -
Sophos 2.88.0 4.43 2009-07-25 3.52 -
Sunbelt 5277 5277 2009-07-22 1.11 -
Symantec 1.3.0.24 20090724.005 2009-07-24 0.19 -
nProtect 20090724.01 4931631 2009-07-24 6.60 -
The Hacker 6.3.4.3 v00373 2009-07-23 0.68 -
VBA32 3.12.10.9 20090724.1323 2009-07-24 1.84 -
VirusBuster 4.5.11.10 10.109.11/1833539 2009-07-25 2.24 -
Post #15
Hi

Please do the following:

  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
  • They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

http://forums.whatthetech.com/Virus_infection_t105491.html&view=findpost&p=581637#entry581637

Collect::
c:\windows\igyr.vbs
c:\documents and settings\Eric Liu\Local Settings\Application Data\ozysawa.dat
c:\documents and settings\Eric Liu\Local Settings\Application Data\ylutanug.vbs
c:\documents and settings\Eric Liu\Local Settings\Application Data\ucam.dll
c:\windows\pifi.bat
c:\windows\system32\ducafecuh.vbs
c:\documents and settings\Eric Liu\Local Settings\Application Data\upubi.exe
c:\program files\Common Files\iqamygame.vbs
c:\windows\prxid93ps.dat
c:\docume~1\ALLUSE~1\APPLIC~1\cykaxoma.reg
c:\docume~1\ALLUSE~1\APPLIC~1\diqotu.dll
c:\program files\Common Files\ulipyluk.db
c:\docume~1\ALLUSE~1\APPLIC~1\uzapaq.dat
c:\program files\Common Files\lukatydadi._dl
c:\windows\system32\xa.tmp

Folder::
c:\program files\HomeAntivirus2010

FCopy::
C:\WINDOWS\ServicePackFiles\i386\proquota.exe | c:\windows\system32\proquota.exe

DDS::
Trusted Zone: mirarsearch.com\click
Trusted Zone: mirarsearch.com\redirect

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you.
  • Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.


**Note**
When CF finishes running, the ComboFix log will open along with a message box–do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.
  • Ensure you are connected to the internet and click OK on the message box.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI