Jump to content

Build Theme!
  •  
  • Infected?

WE'RE SURE THAT YOU'LL LOVE US!

Hey there! :wub: Looks like you're enjoying the discussion, but you're not signed up for an account. When you create an account, we remember exactly what you've read, so you always come right back where you left off. You also get notifications, here and via email, whenever new posts are made. You can like posts to share the love. :D Join 91804 other members! Anybody can ask, anybody can answer. Consistently helpful members may be invited to become staff. Here's how it works. Virus cleanup? Start here -> Malware Removal Forum.

Try What the Tech -- It's free!


Photo

[Resolved] A couple Trojan horse's on my computer according to AVG


  • This topic is locked This topic is locked
27 replies to this topic

#16 smt

smt

    New Member

  • Authentic Member
  • Pip
  • 14 posts

Posted 23 October 2009 - 10:28 PM

LDTate,
I finally got Combofix to work with the windows reboot the report follows:

ComboFix 09-10-22.01 - Owner 10/23/2009 21:16.1.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.510.264 [GMT -7:00]
Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\Downloaded Program Files\popcaploader.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_MICROSOFT_LOCATOR_SERVICE
-------\Legacy_RDRIV
-------\Service_Microsoft Locator Service


((((((((((((((((((((((((( Files Created from 2009-09-24 to 2009-10-24 )))))))))))))))))))))))))))))))
.

2009-10-24 02:17 . 2009-10-24 02:17 -------- d-----w- c:\documents and settings\Owner\Application Data\Malwarebytes
2009-10-24 02:17 . 2009-09-10 21:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-24 02:17 . 2009-10-24 02:17 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-10-24 02:17 . 2009-10-24 02:17 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-10-24 02:17 . 2009-09-10 21:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-10-24 02:03 . 2009-10-24 02:03 -------- d-----w- c:\windows\system32\VirtualExpander
2009-10-24 01:51 . 2009-10-24 01:51 -------- d-----w- c:\documents and settings\Owner\Application Data\Verizon Wireless
2009-10-24 01:49 . 2009-10-24 01:53 -------- d-----w- c:\documents and settings\All Users\Application Data\Verizon Wireless
2009-10-24 01:49 . 2009-10-24 01:49 -------- d-----w- c:\program files\Verizon Wireless
2009-10-24 01:47 . 2009-10-24 01:47 -------- d-----w- c:\program files\Novatel Wireless
2009-10-24 01:46 . 2009-10-24 01:46 -------- d-----w- c:\documents and settings\Owner\Application Data\InstallShield
2009-10-19 21:02 . 2009-10-21 05:35 -------- d-----w- c:\documents and settings\All Users\Dl_cats
2009-10-19 20:55 . 2009-10-19 20:55 -------- d-----w- C:\logs
2009-10-19 20:55 . 2007-04-28 14:41 40960 ----a-w- c:\windows\system32\dldtvs.dll
2009-10-19 20:55 . 2007-12-12 21:32 360448 ----a-w- c:\windows\system32\dldtcoin.dll
2009-10-19 20:54 . 2004-08-04 06:58 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys
2009-10-19 20:54 . 2004-08-04 06:58 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
2009-10-19 20:54 . 2001-08-18 05:36 87040 -c--a-w- c:\windows\system32\dllcache\wiafbdrv.dll
2009-10-19 20:54 . 2001-08-18 05:36 87040 ----a-w- c:\windows\system32\wiafbdrv.dll
2009-10-19 20:53 . 2008-02-19 22:25 81920 ----a-w- c:\windows\system32\dldtcaps.dll
2009-10-19 20:53 . 2008-02-21 20:41 782336 ----a-w- c:\windows\system32\dldtdrs.dll
2009-10-19 20:53 . 2007-11-13 19:13 69632 ----a-w- c:\windows\system32\dldtcnv4.dll
2009-10-19 20:52 . 2009-10-19 20:52 -------- d-----w- c:\program files\Abbyy FineReader 6.0 Sprint
2009-10-19 20:51 . 2009-10-19 20:51 -------- d-----w- c:\program files\Dell
2009-10-19 20:45 . 2008-02-25 16:38 17648 ----a-w- c:\windows\system32\dldtwupd.exe
2009-10-19 20:45 . 2008-01-29 13:29 102400 ----a-w- c:\windows\system32\dldtwupd.dll
2009-10-19 20:45 . 2009-10-19 21:02 -------- d-----w- c:\program files\Dell V305
2009-10-19 05:11 . 2009-10-19 05:11 -------- d-----w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com
2009-10-19 04:55 . 2009-10-19 04:55 -------- d-----w- c:\program files\Trend Micro
2009-10-18 19:12 . 2009-10-18 19:12 -------- d-----w- c:\documents and settings\Owner\Local Settings\Application Data\Opera
2009-10-18 19:11 . 2009-10-18 19:11 -------- d-----w- c:\program files\Opera
2009-10-18 18:42 . 2009-10-18 18:42 -------- d-----w- c:\program files\Common Files\Adobe AIR
2009-10-18 17:58 . 2009-10-24 02:14 -------- d-----w- c:\documents and settings\Owner\Local Settings\Application Data\Google
2009-10-18 17:57 . 2009-10-18 17:57 -------- d-----w- c:\program files\Google
2009-10-18 17:54 . 2009-10-18 19:16 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2009-10-18 15:46 . 2009-10-18 15:46 -------- d-----w- c:\program files\AVG
2009-10-18 15:42 . 2009-10-18 17:13 -------- d-----w- c:\windows\system32\CatRoot_bak
2009-10-18 06:30 . 2009-06-21 22:04 153088 -c----w- c:\windows\system32\dllcache\triedit.dll
2009-10-18 06:27 . 2008-05-01 14:30 331776 -c----w- c:\windows\system32\dllcache\msadce.dll
2009-10-18 06:26 . 2009-03-06 14:44 283648 -c----w- c:\windows\system32\dllcache\pdh.dll
2009-10-18 06:26 . 2009-02-09 10:20 399360 -c----w- c:\windows\system32\dllcache\rpcss.dll
2009-10-18 06:26 . 2009-02-09 10:20 473088 -c----w- c:\windows\system32\dllcache\fastprox.dll
2009-10-18 06:26 . 2009-02-09 10:20 453120 -c----w- c:\windows\system32\dllcache\wmiprvsd.dll
2009-10-18 06:26 . 2009-02-06 17:14 110592 -c----w- c:\windows\system32\dllcache\services.exe
2009-10-18 06:26 . 2009-02-06 16:39 227840 -c----w- c:\windows\system32\dllcache\wmiprvse.exe
2009-10-18 06:26 . 2005-07-26 04:39 60416 -c----w- c:\windows\system32\dllcache\colbact.dll
2009-10-18 06:26 . 2009-02-09 10:20 714752 -c----w- c:\windows\system32\dllcache\ntdll.dll
2009-10-18 06:26 . 2009-02-09 10:20 616960 -c----w- c:\windows\system32\dllcache\advapi32.dll
2009-10-18 06:01 . 2009-06-05 07:42 655872 -c----w- c:\windows\system32\dllcache\mstscax.dll
2009-10-18 05:58 . 2008-04-21 10:02 215552 -c----w- c:\windows\system32\dllcache\wordpad.exe
2009-10-18 05:09 . 2009-10-18 05:09 -------- d-----w- c:\documents and settings\Owner\Application Data\Smith Micro
2009-10-18 05:04 . 2008-05-17 04:46 77824 ----a-w- c:\windows\system32\PTDUwmcp.dll
2009-10-18 05:04 . 2008-03-11 22:58 59776 ----a-w- c:\windows\system32\drivers\PTDUWWAN.sys
2009-10-18 05:04 . 2006-11-01 22:21 319456 ----a-w- c:\windows\system32\DIFxAPI.dll
2009-10-18 05:04 . 2009-10-18 05:04 -------- d-----w- c:\program files\PANTECH
2009-10-18 05:04 . 2008-03-11 22:58 39936 ----a-w- c:\windows\system32\drivers\PTDUVsp.sys
2009-10-18 05:04 . 2008-03-11 22:58 41344 ----a-w- c:\windows\system32\drivers\PTDUMdm.sys
2009-10-18 05:04 . 2008-03-11 22:58 29824 ----a-w- c:\windows\system32\drivers\PTDUBus.sys
2009-10-18 04:56 . 2009-10-18 04:56 -------- d-----w- c:\windows\system32\wbem\Repository
2009-10-18 04:51 . 2004-08-04 07:56 21504 -c--a-w- c:\windows\system32\dllcache\hidserv.dll
2009-10-18 04:51 . 2004-08-04 07:56 21504 ----a-w- c:\windows\system32\hidserv.dll
2009-10-18 04:36 . 2009-10-18 04:36 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-10-18 04:36 . 2009-10-18 04:36 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-10-18 04:36 . 2009-10-18 04:36 -------- d-----w- c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-18 19:16 . 2008-04-28 01:43 -------- d-----w- c:\program files\Brother
2009-10-18 17:28 . 2005-01-22 22:11 -------- d-----w- c:\program files\SocratesMedia
2009-10-18 17:25 . 2005-03-15 05:27 -------- d-----w- c:\program files\Common Files\Real
2009-10-18 17:16 . 2004-06-28 16:58 -------- d-----w- c:\program files\Common Files\Adobe
2009-10-18 17:13 . 2005-03-15 05:26 -------- d-----w- c:\program files\Logitech
2009-10-18 17:06 . 2008-05-08 20:10 -------- d-----w- c:\program files\Coupons
2009-10-18 17:05 . 2004-06-10 17:05 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-10-18 17:04 . 2004-06-10 17:04 -------- d-----w- c:\program files\Common Files\InstallShield
2009-10-18 17:01 . 2004-06-10 16:06 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-10-18 06:08 . 2008-04-15 20:19 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee
2009-10-18 06:04 . 2008-06-10 18:41 -------- d-----w- c:\documents and settings\All Users\Application Data\SiteAdvisor
2009-09-11 14:33 . 2002-09-03 16:46 133632 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-04 20:45 . 2002-09-03 16:44 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-08-29 07:36 . 2006-06-23 17:33 832512 ----a-w- c:\windows\system32\wininet.dll
2009-08-29 07:36 . 2004-08-04 07:56 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-08-29 07:36 . 2002-09-03 16:29 17408 ------w- c:\windows\system32\corpol.dll
2009-08-26 08:16 . 2002-09-03 17:05 247326 ----a-w- c:\windows\system32\strmdll.dll
2009-08-05 09:11 . 2002-09-03 16:46 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-04 14:00 . 2002-09-03 16:50 2180352 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-08-04 13:13 . 2002-08-29 01:04 2057728 ----a-w- c:\windows\system32\ntkrnlpa.exe
2009-07-29 04:53 . 2002-09-03 17:06 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-07-29 04:53 . 2002-09-03 16:33 82432 ----a-w- c:\windows\system32\fontsub.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\VirtualExpanderFile.1]
@="{E4000AC4-5E5F-4956-807A-C5854405D64F}"
[HKEY_CLASSES_ROOT\CLSID\{E4000AC4-5E5F-4956-807A-C5854405D64F}]
2009-10-24 02:03 73728 ----a-w- c:\windows\system32\VirtualExpander\VEShellExt.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"msurr"="c:\documents and settings\Owner\msurr.exe" [2005-02-24 167424]
"LDM"="c:\program files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [2005-03-15 16384]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-10-13 2000112]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-10-18 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\System32\igfxtray.exe" [2003-04-07 155648]
"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2003-04-07 114688]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2004-10-20 77824]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2004-06-04 286720]
"LVCOMS"="c:\program files\Common Files\Logitech\QCDriver\LVCOMS.EXE" [2002-06-10 102400]
"LogitechGalleryRepair"="c:\program files\Logitech\ImageStudio\ISStart.exe" [2002-06-20 155648]
"LogitechImageStudioTray"="c:\program files\Logitech\ImageStudio\LogiTray.exe" [2002-06-20 45056]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"dldtmon.exe"="c:\program files\Dell V305\dldtmon.exe" [2008-06-24 668912]
"dldtamon"="c:\program files\Dell V305\dldtamon.exe" [2008-06-24 16624]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]

c:\documents and settings\Owner\Start Menu\Programs\Startup\
VirtualExpander.lnk - c:\windows\system32\VirtualExpander\VirtualExpander.exe [2009-10-23 474808]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2005-3-14 169472]
Personal Coach.lnk - c:\program files\Broderbund\Mavis Beacon Teaches Typing 15\minimavis.exe [2007-8-17 2392064]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 21:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Dell V305\\dldtamon.exe"=
"c:\\Program Files\\Dell V305\\frun.exe"=
"c:\\Program Files\\Abbyy FineReader 6.0 Sprint\\Scan\\ScanMan6.exe"=
"c:\\Program Files\\Dell V305\\dldtmon.exe"=
"c:\\WINDOWS\\system32\\dldtcoms.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\dldtpswx.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\dldttime.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\dldtjswx.exe"=

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [10/12/2009 8:24 PM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [10/12/2009 8:24 PM 74480]
R2 dldt_device;dldt_device;c:\windows\system32\dldtcoms.exe -service --> c:\windows\system32\dldtcoms.exe -service [?]
R2 dldtCATSCustConnectService;dldtCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\dldtserv.exe [10/19/2009 1:55 PM 99568]
R3 NWUSBPort2;Novatel Wireless USB Status2 Port Driver;c:\windows\system32\drivers\nwusbser2.sys [5/9/2008 11:08 AM 174336]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [10/12/2009 8:24 PM 7408]
S3 NWUSBCDFIL;Novatel Wireless Installation CD;c:\windows\system32\drivers\NwUsbCdFil.sys [7/7/2008 12:23 PM 20480]
S3 PTDUBus;PANTECH UM175 Composite Device Driver ;c:\windows\system32\drivers\PTDUBus.sys [10/17/2009 10:04 PM 29824]
S3 PTDUMdm;PANTECH UM175 Drivers;c:\windows\system32\drivers\PTDUMdm.sys [10/17/2009 10:04 PM 41344]
S3 PTDUVsp;PANTECH UM175 Diagnostic Port;c:\windows\system32\drivers\PTDUVsp.sys [10/17/2009 10:04 PM 39936]
S3 PTDUWWAN;PANTECH UM175 WWAN Driver;c:\windows\system32\drivers\PTDUWWAN.sys [10/17/2009 10:04 PM 59776]
S3 SMSIVZAM5;SMSIVZAM5 NDIS Protocol Driver;c:\progra~1\VERIZO~1\VZACCE~1\SMSIVZAM5.SYS [3/20/2009 7:03 PM 32408]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ee81b5b0-be73-11de-992d-000bdb81620b}]
\Shell\AutoRun\command - F:\VZAccess_Manager.exe /z detect
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mSearch Bar = hxxp://red.clientapps.yahoo.com/customize/ie/defaults/sb/ymsgr6/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = localhost
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
IE: &Yahoo! Search - file:///c:\program files\Yahoo!\Common/ycsrch.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Yahoo! &Dictionary - file:///c:\program files\Yahoo!\Common/ycdict.htm
IE: Yahoo! &Maps - file:///c:\program files\Yahoo!\Common/ycdict.htm
TCP: {955BEDDA-3AC1-47A6-BD15-35B646179B51} = 66.174.92.14 69.78.96.14
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: NDWCab - hxxp://www.neededware.com/ndw.cab
.
- - - - ORPHANS REMOVED - - - -

Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
HKLM-Explorer_Run-wcmzgsb - c:\windows\System32\wcmzgsb.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-23 21:22
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(604)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll

- - - - - - - > 'explorer.exe'(2460)
c:\windows\system32\WININET.dll
c:\windows\system32\VirtualExpander\VEShellExt.dll
c:\windows\system32\IEFRAME.dll
c:\progra~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
c:\windows\system32\mshtml.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\dldtcoms.exe
c:\combofix\CF15221.exe
c:\program files\Dell V305\dldtMsdMon.exe
c:\program files\iPod\bin\iPodService.exe
c:\progra~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
c:\combofix\PEV.cfxxe
.
**************************************************************************
.
Completion time: 2009-10-24 21:25 - machine was rebooted
ComboFix-quarantined-files.txt 2009-10-24 04:25

Pre-Run: 31,068,237,824 bytes free
Post-Run: 31,048,335,360 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

- - End Of File - - 7F4480941980CC6EBD9E998A0E6BA762

Thank you,
Shyann

    Advertisements

Register to Remove


#17 LDTate

LDTate

    Forum God

  • Root Admin
  • 57,171 posts

Posted 24 October 2009 - 06:21 AM

Copy/paste the text in the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text.

File::
c:\documents and settings\Owner\msurr.exe

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msurr"=-

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:
1.Click File;
2.Click Save As... Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save ...


Posted Image

Drag CFScript.txt into ComboFix.exe

Then post the results log and a new HijackThis log.


Also please describe how your computer behaves at the moment.

The forum is run by volunteers who donate their time and expertise.

Want to help others? Join the ClassRoom and learn how.

Logs will be closed if you haven't replied within 3 days

 

If you would like to paypal.gif for the help you received.
 

Proud graduate of TC/WTT Classroom

 


#18 smt

smt

    New Member

  • Authentic Member
  • Pip
  • 14 posts

Posted 24 October 2009 - 01:56 PM

Ok I have ran both programs and here are the reports:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:51:59 PM, on 10/24/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16915)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\dldtserv.exe
C:\WINDOWS\system32\dldtcoms.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Logitech\QCDriver\LVCOMS.EXE
C:\Program Files\Logitech\ImageStudio\LogiTray.exe
C:\Program Files\Dell V305\dldtmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Broderbund\Mavis Beacon Teaches Typing 15\minimavis.exe
C:\WINDOWS\system32\VirtualExpander\VirtualExpander.exe
C:\Program Files\Dell V305\dldtMsdMon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapp...rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.c...//www.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (file missing)
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver\LVCOMS.EXE
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe
O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Program Files\Logitech\ImageStudio\LogiTray.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [dldtmon.exe] "C:\Program Files\Dell V305\dldtmon.exe"
O4 - HKLM\..\Run: [dldtamon] "C:\Program Files\Dell V305\dldtamon.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - Startup: VirtualExpander.lnk = C:\WINDOWS\system32\VirtualExpander\VirtualExpander.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Personal Coach.lnk = ?
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: JT's Blocks - http://download.game...ts/y/blt1_x.cab
O16 - DPF: NDWCab - http://www.neededware.com/ndw.cab
O16 - DPF: Yahoo! Dice - http://download.game...ts/y/dct4_x.cab
O16 - DPF: Yahoo! Klondike Solitaire - http://yog55.games.s...og/y/ks12_x.cab
O16 - DPF: Yahoo! MahJong Solitaire - http://download.game...s/y/mjst4_x.cab
O16 - DPF: Yahoo! Towers 2.0 - http://download.game...ts/y/ywt0_x.cab
O16 - DPF: {1DF36010-E276-11D4-A7C0-00C04F0453DD} (Stamps.com Secure Postal Account Registration) - https://secure.stamp...34/sdcregie.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/...ro.cab27513.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.c...utocomplete.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.ad...Plus/1.6/gp.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: dldtCATSCustConnectService - Unknown owner - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\dldtserv.exe
O23 - Service: dldt_device - - C:\WINDOWS\system32\dldtcoms.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

--
End of file - 8367 bytes

And here is the second report.

ComboFix 09-10-22.01 - Owner 10/24/2009 12:45.2.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.510.283 [GMT -7:00]
Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt

FILE ::
"c:\documents and settings\Owner\msurr.exe"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Owner\msurr.exe

.
((((((((((((((((((((((((( Files Created from 2009-09-24 to 2009-10-24 )))))))))))))))))))))))))))))))
.

2009-10-24 02:17 . 2009-10-24 02:17 -------- d-----w- c:\documents and settings\Owner\Application Data\Malwarebytes
2009-10-24 02:17 . 2009-09-10 21:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-24 02:17 . 2009-10-24 02:17 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-10-24 02:17 . 2009-10-24 02:17 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-10-24 02:17 . 2009-09-10 21:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-10-24 02:03 . 2009-10-24 02:03 -------- d-----w- c:\windows\system32\VirtualExpander
2009-10-24 01:51 . 2009-10-24 01:51 -------- d-----w- c:\documents and settings\Owner\Application Data\Verizon Wireless
2009-10-24 01:49 . 2009-10-24 01:53 -------- d-----w- c:\documents and settings\All Users\Application Data\Verizon Wireless
2009-10-24 01:49 . 2009-10-24 01:49 -------- d-----w- c:\program files\Verizon Wireless
2009-10-24 01:47 . 2009-10-24 01:47 -------- d-----w- c:\program files\Novatel Wireless
2009-10-24 01:46 . 2009-10-24 01:46 -------- d-----w- c:\documents and settings\Owner\Application Data\InstallShield
2009-10-19 21:02 . 2009-10-21 05:35 -------- d-----w- c:\documents and settings\All Users\Dl_cats
2009-10-19 20:55 . 2009-10-19 20:55 -------- d-----w- C:\logs
2009-10-19 20:55 . 2007-04-28 14:41 40960 ----a-w- c:\windows\system32\dldtvs.dll
2009-10-19 20:55 . 2007-12-12 21:32 360448 ----a-w- c:\windows\system32\dldtcoin.dll
2009-10-19 20:54 . 2004-08-04 06:58 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys
2009-10-19 20:54 . 2004-08-04 06:58 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
2009-10-19 20:54 . 2001-08-18 05:36 87040 -c--a-w- c:\windows\system32\dllcache\wiafbdrv.dll
2009-10-19 20:54 . 2001-08-18 05:36 87040 ----a-w- c:\windows\system32\wiafbdrv.dll
2009-10-19 20:53 . 2008-02-19 22:25 81920 ----a-w- c:\windows\system32\dldtcaps.dll
2009-10-19 20:53 . 2008-02-21 20:41 782336 ----a-w- c:\windows\system32\dldtdrs.dll
2009-10-19 20:53 . 2007-11-13 19:13 69632 ----a-w- c:\windows\system32\dldtcnv4.dll
2009-10-19 20:52 . 2009-10-19 20:52 -------- d-----w- c:\program files\Abbyy FineReader 6.0 Sprint
2009-10-19 20:51 . 2009-10-19 20:51 -------- d-----w- c:\program files\Dell
2009-10-19 20:45 . 2008-02-25 16:38 17648 ----a-w- c:\windows\system32\dldtwupd.exe
2009-10-19 20:45 . 2008-01-29 13:29 102400 ----a-w- c:\windows\system32\dldtwupd.dll
2009-10-19 20:45 . 2009-10-19 21:02 -------- d-----w- c:\program files\Dell V305
2009-10-19 05:11 . 2009-10-19 05:11 -------- d-----w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com
2009-10-19 04:55 . 2009-10-19 04:55 -------- d-----w- c:\program files\Trend Micro
2009-10-18 19:12 . 2009-10-18 19:12 -------- d-----w- c:\documents and settings\Owner\Local Settings\Application Data\Opera
2009-10-18 19:11 . 2009-10-18 19:11 -------- d-----w- c:\program files\Opera
2009-10-18 18:42 . 2009-10-18 18:42 -------- d-----w- c:\program files\Common Files\Adobe AIR
2009-10-18 17:58 . 2009-10-24 02:14 -------- d-----w- c:\documents and settings\Owner\Local Settings\Application Data\Google
2009-10-18 17:57 . 2009-10-18 17:57 -------- d-----w- c:\program files\Google
2009-10-18 17:54 . 2009-10-18 19:16 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2009-10-18 15:46 . 2009-10-18 15:46 -------- d-----w- c:\program files\AVG
2009-10-18 15:42 . 2009-10-18 17:13 -------- d-----w- c:\windows\system32\CatRoot_bak
2009-10-18 06:30 . 2009-06-21 22:04 153088 -c----w- c:\windows\system32\dllcache\triedit.dll
2009-10-18 06:27 . 2008-05-01 14:30 331776 -c----w- c:\windows\system32\dllcache\msadce.dll
2009-10-18 06:26 . 2009-03-06 14:44 283648 -c----w- c:\windows\system32\dllcache\pdh.dll
2009-10-18 06:26 . 2009-02-09 10:20 399360 -c----w- c:\windows\system32\dllcache\rpcss.dll
2009-10-18 06:26 . 2009-02-09 10:20 473088 -c----w- c:\windows\system32\dllcache\fastprox.dll
2009-10-18 06:26 . 2009-02-09 10:20 453120 -c----w- c:\windows\system32\dllcache\wmiprvsd.dll
2009-10-18 06:26 . 2009-02-06 17:14 110592 -c----w- c:\windows\system32\dllcache\services.exe
2009-10-18 06:26 . 2009-02-06 16:39 227840 -c----w- c:\windows\system32\dllcache\wmiprvse.exe
2009-10-18 06:26 . 2005-07-26 04:39 60416 -c----w- c:\windows\system32\dllcache\colbact.dll
2009-10-18 06:26 . 2009-02-09 10:20 714752 -c----w- c:\windows\system32\dllcache\ntdll.dll
2009-10-18 06:26 . 2009-02-09 10:20 616960 -c----w- c:\windows\system32\dllcache\advapi32.dll
2009-10-18 06:01 . 2009-06-05 07:42 655872 -c----w- c:\windows\system32\dllcache\mstscax.dll
2009-10-18 05:58 . 2008-04-21 10:02 215552 -c----w- c:\windows\system32\dllcache\wordpad.exe
2009-10-18 05:09 . 2009-10-18 05:09 -------- d-----w- c:\documents and settings\Owner\Application Data\Smith Micro
2009-10-18 05:04 . 2008-05-17 04:46 77824 ----a-w- c:\windows\system32\PTDUwmcp.dll
2009-10-18 05:04 . 2008-03-11 22:58 59776 ----a-w- c:\windows\system32\drivers\PTDUWWAN.sys
2009-10-18 05:04 . 2006-11-01 22:21 319456 ----a-w- c:\windows\system32\DIFxAPI.dll
2009-10-18 05:04 . 2009-10-18 05:04 -------- d-----w- c:\program files\PANTECH
2009-10-18 05:04 . 2008-03-11 22:58 39936 ----a-w- c:\windows\system32\drivers\PTDUVsp.sys
2009-10-18 05:04 . 2008-03-11 22:58 41344 ----a-w- c:\windows\system32\drivers\PTDUMdm.sys
2009-10-18 05:04 . 2008-03-11 22:58 29824 ----a-w- c:\windows\system32\drivers\PTDUBus.sys
2009-10-18 04:56 . 2009-10-18 04:56 -------- d-----w- c:\windows\system32\wbem\Repository
2009-10-18 04:51 . 2004-08-04 07:56 21504 -c--a-w- c:\windows\system32\dllcache\hidserv.dll
2009-10-18 04:51 . 2004-08-04 07:56 21504 ----a-w- c:\windows\system32\hidserv.dll
2009-10-18 04:36 . 2009-10-18 04:36 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-10-18 04:36 . 2009-10-18 04:36 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-10-18 04:36 . 2009-10-18 04:36 -------- d-----w- c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-18 19:16 . 2008-04-28 01:43 -------- d-----w- c:\program files\Brother
2009-10-18 17:28 . 2005-01-22 22:11 -------- d-----w- c:\program files\SocratesMedia
2009-10-18 17:25 . 2005-03-15 05:27 -------- d-----w- c:\program files\Common Files\Real
2009-10-18 17:16 . 2004-06-28 16:58 -------- d-----w- c:\program files\Common Files\Adobe
2009-10-18 17:13 . 2005-03-15 05:26 -------- d-----w- c:\program files\Logitech
2009-10-18 17:06 . 2008-05-08 20:10 -------- d-----w- c:\program files\Coupons
2009-10-18 17:05 . 2004-06-10 17:05 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-10-18 17:04 . 2004-06-10 17:04 -------- d-----w- c:\program files\Common Files\InstallShield
2009-10-18 17:01 . 2004-06-10 16:06 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-10-18 06:08 . 2008-04-15 20:19 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee
2009-10-18 06:04 . 2008-06-10 18:41 -------- d-----w- c:\documents and settings\All Users\Application Data\SiteAdvisor
2009-09-11 14:33 . 2002-09-03 16:46 133632 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-04 20:45 . 2002-09-03 16:44 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-08-29 07:36 . 2006-06-23 17:33 832512 ------w- c:\windows\system32\wininet.dll
2009-08-29 07:36 . 2004-08-04 07:56 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-08-29 07:36 . 2002-09-03 16:29 17408 ------w- c:\windows\system32\corpol.dll
2009-08-26 08:16 . 2002-09-03 17:05 247326 ----a-w- c:\windows\system32\strmdll.dll
2009-08-05 09:11 . 2002-09-03 16:46 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-04 14:00 . 2002-09-03 16:50 2180352 ------w- c:\windows\system32\ntoskrnl.exe
2009-08-04 13:13 . 2002-08-29 01:04 2057728 ------w- c:\windows\system32\ntkrnlpa.exe
2009-07-29 04:53 . 2002-09-03 17:06 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-07-29 04:53 . 2002-09-03 16:33 82432 ----a-w- c:\windows\system32\fontsub.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\VirtualExpanderFile.1]
@="{E4000AC4-5E5F-4956-807A-C5854405D64F}"
[HKEY_CLASSES_ROOT\CLSID\{E4000AC4-5E5F-4956-807A-C5854405D64F}]
2009-10-24 02:03 73728 ----a-w- c:\windows\system32\VirtualExpander\VEShellExt.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"LDM"="c:\program files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [2005-03-15 16384]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-10-13 2000112]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-10-18 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\System32\igfxtray.exe" [2003-04-07 155648]
"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2003-04-07 114688]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2004-10-20 77824]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2004-06-04 286720]
"LVCOMS"="c:\program files\Common Files\Logitech\QCDriver\LVCOMS.EXE" [2002-06-10 102400]
"LogitechGalleryRepair"="c:\program files\Logitech\ImageStudio\ISStart.exe" [2002-06-20 155648]
"LogitechImageStudioTray"="c:\program files\Logitech\ImageStudio\LogiTray.exe" [2002-06-20 45056]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"dldtmon.exe"="c:\program files\Dell V305\dldtmon.exe" [2008-06-24 668912]
"dldtamon"="c:\program files\Dell V305\dldtamon.exe" [2008-06-24 16624]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]

c:\documents and settings\Owner\Start Menu\Programs\Startup\
VirtualExpander.lnk - c:\windows\system32\VirtualExpander\VirtualExpander.exe [2009-10-23 474808]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2005-3-14 169472]
Personal Coach.lnk - c:\program files\Broderbund\Mavis Beacon Teaches Typing 15\minimavis.exe [2007-8-17 2392064]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 21:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Dell V305\\dldtamon.exe"=
"c:\\Program Files\\Dell V305\\frun.exe"=
"c:\\Program Files\\Abbyy FineReader 6.0 Sprint\\Scan\\ScanMan6.exe"=
"c:\\Program Files\\Dell V305\\dldtmon.exe"=
"c:\\WINDOWS\\system32\\dldtcoms.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\dldtpswx.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\dldttime.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\dldtjswx.exe"=

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [10/12/2009 8:24 PM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [10/12/2009 8:24 PM 74480]
R2 dldt_device;dldt_device;c:\windows\system32\dldtcoms.exe -service --> c:\windows\system32\dldtcoms.exe -service [?]
R2 dldtCATSCustConnectService;dldtCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\dldtserv.exe [10/19/2009 1:55 PM 99568]
R3 NWUSBPort2;Novatel Wireless USB Status2 Port Driver;c:\windows\system32\drivers\nwusbser2.sys [5/9/2008 11:08 AM 174336]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [10/12/2009 8:24 PM 7408]
R3 SMSIVZAM5;SMSIVZAM5 NDIS Protocol Driver;c:\progra~1\VERIZO~1\VZACCE~1\SMSIVZAM5.SYS [3/20/2009 7:03 PM 32408]
S3 NWUSBCDFIL;Novatel Wireless Installation CD;c:\windows\system32\drivers\NwUsbCdFil.sys [7/7/2008 12:23 PM 20480]
S3 PTDUBus;PANTECH UM175 Composite Device Driver ;c:\windows\system32\drivers\PTDUBus.sys [10/17/2009 10:04 PM 29824]
S3 PTDUMdm;PANTECH UM175 Drivers;c:\windows\system32\drivers\PTDUMdm.sys [10/17/2009 10:04 PM 41344]
S3 PTDUVsp;PANTECH UM175 Diagnostic Port;c:\windows\system32\drivers\PTDUVsp.sys [10/17/2009 10:04 PM 39936]
S3 PTDUWWAN;PANTECH UM175 WWAN Driver;c:\windows\system32\drivers\PTDUWWAN.sys [10/17/2009 10:04 PM 59776]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mSearch Bar = hxxp://red.clientapps.yahoo.com/customize/ie/defaults/sb/ymsgr6/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
IE: &Yahoo! Search - file:///c:\program files\Yahoo!\Common/ycsrch.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Yahoo! &Dictionary - file:///c:\program files\Yahoo!\Common/ycdict.htm
IE: Yahoo! &Maps - file:///c:\program files\Yahoo!\Common/ycdict.htm
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: NDWCab - hxxp://www.neededware.com/ndw.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-24 12:48
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(600)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll
.
Completion time: 2009-10-24 12:51
ComboFix-quarantined-files.txt 2009-10-24 19:51
ComboFix2.txt 2009-10-24 04:25

Pre-Run: 30,991,552,512 bytes free
Post-Run: 30,961,332,224 bytes free

- - End Of File - - C1D5EA478A62F0E1FF0D1840349516A1

#19 LDTate

LDTate

    Forum God

  • Root Admin
  • 57,171 posts

Posted 24 October 2009 - 05:45 PM

How's it running now?

The forum is run by volunteers who donate their time and expertise.

Want to help others? Join the ClassRoom and learn how.

Logs will be closed if you haven't replied within 3 days

 

If you would like to paypal.gif for the help you received.
 

Proud graduate of TC/WTT Classroom

 


#20 smt

smt

    New Member

  • Authentic Member
  • Pip
  • 14 posts

Posted 24 October 2009 - 07:34 PM

I have never had a problem with the way it runs. It just concerned me with seeing all the trojans showing up on AVG and the other scan. It seems to be starting up a little faster but still kind of slow to start.

#21 LDTate

LDTate

    Forum God

  • Root Admin
  • 57,171 posts

Posted 24 October 2009 - 07:35 PM

trojans showing up on AVG and the other scan

Are they still showing?
If so, where are they located?

The forum is run by volunteers who donate their time and expertise.

Want to help others? Join the ClassRoom and learn how.

Logs will be closed if you haven't replied within 3 days

 

If you would like to paypal.gif for the help you received.
 

Proud graduate of TC/WTT Classroom

 


#22 smt

smt

    New Member

  • Authentic Member
  • Pip
  • 14 posts

Posted 24 October 2009 - 11:12 PM

I have ran both scans and neither scan shows a trojan. They just showed cookies which i had them remove.

#23 LDTate

LDTate

    Forum God

  • Root Admin
  • 57,171 posts

Posted 25 October 2009 - 04:46 AM

Good job :thumbup:

The following will implement some cleanup procedures as well as reset System Restore points:

  • Click START then RUN
  • Now type ComboFix /Uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.

    • Posted Image


    To be on the safe side, I would also change all my passwords.


    Here's my usual all clean post

    Log looks good :D


    • Make your Internet Explorer more secure - This can be done by following these simple instructions:
      • From within Internet Explorer click on the Tools menu and then click on Options.
      • Click once on the Security tab
      • Click once on the Internet icon so it becomes highlighted.
      • Click once on the Custom Level button.
      • Change the Download signed ActiveX controls to Prompt
      • Change the Download unsigned ActiveX controls to Disable
      • Change the Initialize and script ActiveX controls not marked as safe to Disable
      • Change the Installation of desktop items to Prompt
      • Change the Launching programs and files in an IFRAME to Prompt
      • Change the Navigate sub-frames across different domains to Prompt
      • When all these settings have been made, click on the OK button.
      • If it prompts you as to whether or not you want to save the settings, press the Yes button.
    • Next press the Apply button and then the OK to exit the Internet Properties page.
  • Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week
    (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

  • Use a Firewall - I can not stress how important it is that you use a Firewall on your computer.
    Without a firewall your computer is succeptible to being hacked and taken over.
    I am very serious about this and see it happen almost every day with my clients.
    Simply using a Firewall in its default configuration can lower your risk greatly.

  • Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly.
    This will ensure your computer has always the latest security updates available installed on your computer.
    If there are new updates to install, install them immediately, reboot your computer, and revisit the site
    until there are no more critical updates.

  • Update all these programs regularly - Make sure you update all the programs I have listed regularly.
    Without regular updates you WILL NOT be protected when new malicious programs are released.

Only run one Anti-Virus and Firewall program.


I would suggest you read How to Prevent Malware:

The forum is run by volunteers who donate their time and expertise.

Want to help others? Join the ClassRoom and learn how.

Logs will be closed if you haven't replied within 3 days

 

If you would like to paypal.gif for the help you received.
 

Proud graduate of TC/WTT Classroom

 


#24 smt

smt

    New Member

  • Authentic Member
  • Pip
  • 14 posts

Posted 25 October 2009 - 07:54 AM

So I have one last question for this computer. A windows Security Alert came up asking me if I want to keep blocking or unblock the following BackWeb-8876480 what should I say to that question?

#25 LDTate

LDTate

    Forum God

  • Root Admin
  • 57,171 posts

Posted 25 October 2009 - 01:23 PM

backweb-8876480.exe is a process that comes with the Logitech Products software. It manages the automatic update check as well as providing you with new for the latest offers and products from Logitech.

The forum is run by volunteers who donate their time and expertise.

Want to help others? Join the ClassRoom and learn how.

Logs will be closed if you haven't replied within 3 days

 

If you would like to paypal.gif for the help you received.
 

Proud graduate of TC/WTT Classroom

 

    Advertisements

Register to Remove


#26 smt

smt

    New Member

  • Authentic Member
  • Pip
  • 14 posts

Posted 25 October 2009 - 02:30 PM

Thank you so very much for your help on cleaning up this computer. While we were fixing this computer my labtop's AVG said there is a trojan horse SHeur2.BLKR. Can you help me with this or do I need to post a new post? My second question is should I keep the malwarebytes, and ATF-Cleaner on this computer? You also stated I should only run one anti-virus and firewall program which one would you suggest I use? Thank you so much, Shyann

Edited by smt, 25 October 2009 - 02:33 PM.


#27 LDTate

LDTate

    Forum God

  • Root Admin
  • 57,171 posts

Posted 25 October 2009 - 02:44 PM

Yes I would keep both MBAM and ATF Cleaner. I only see one abti-virus program running. Yes, start a new topic for your laptop. I'd suggest you use 'Second PC" as part of your topic.

The forum is run by volunteers who donate their time and expertise.

Want to help others? Join the ClassRoom and learn how.

Logs will be closed if you haven't replied within 3 days

 

If you would like to paypal.gif for the help you received.
 

Proud graduate of TC/WTT Classroom

 


#28 LDTate

LDTate

    Forum God

  • Root Admin
  • 57,171 posts

Posted 25 October 2009 - 03:29 PM

Since this issue appears to be resolved ... this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

The forum is run by volunteers who donate their time and expertise.

Want to help others? Join the ClassRoom and learn how.

Logs will be closed if you haven't replied within 3 days

 

If you would like to paypal.gif for the help you received.
 

Proud graduate of TC/WTT Classroom

 

Related Topics



0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users