What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] "System Has been infected" Backgound image Locked

25 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
Well I have the "Your system has been infected" background image in my desktop that is locked. I also cannot run my anti virus program(Kaspersky). It will not load. Scotty the watch dog keeps popping up telling me 3 different dll files want to load at start up. I cant run GMER Rootkit Scanne or Malwarebytes' Anti-Malware. I can however run HJT Help would greatly be appreciated. Logfile of Trend Micro HijackThis v2.0.2 (BETA) Scan saved at 7:24:23 AM, on 1/11/2010 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\WINDOWS\System32\CTsvcCDA.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe C:\WINDOWS\system32\drivers\svchost.exe C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\Program Files\AutoScale2000\Attended.exe C:\Program Files\AutoScale2000\Devices.exe C:\Program Files\AutoScale2000\ASIRptPr.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\AutoScale2000\ASIScaleSvr.exe C:\Program Files\Internet Explorer\Iexplore.exe C:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank F2 - REG:system.ini: Shell=Explorer.exe logon.exe O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: (no name) - {9db6c3a9-86e0-4fc1-914d-f92a5aec7203} - gukejibu.dll (file missing) O4 - HKLM\..\Run: [WinPatrol] C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [BlackBerryAutoUpdate] C:\Program Files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe /background O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [Dmizeteriwedokez] rundll32.exe "C:\WINDOWS\omazexowalifip.dll",Startup O4 - HKLM\..\Run: [homahukoj] Rundll32.exe "c:\windows\system32\suhahebu.dll",a O4 - HKLM\..\Run: [fozihaluna] Rundll32.exe "gepibura.dll",s O4 - HKCU\..\Run: [SVCHOST.EXE] C:\WINDOWS\system32\drivers\svchost.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\helper32.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\helper32.dll O21 - SSODL: SwUpdate - {009541A0-3B00-1F1C-00F3-040224001C01} - C:\Documents and Settings\All Users\Application Data\Macromedia\SwUpdate\swupdate.dll O21 - SSODL: guvetagek - {84a633b8-83df-4ac0-9688-e76736a3a412} - c:\windows\system32\suhahebu.dll O22 - SharedTaskScheduler: kupuhivus - {84a633b8-83df-4ac0-9688-e76736a3a412} - c:\windows\system32\suhahebu.dll O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AdobeVersionCue - Adobe Sytems - C:\Program Files\Adobe\Adobe Version Cue\service\VersionCue.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: InCD File System Service (InCDsrv) - Unknown owner - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Unknown owner - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe (file missing) – End of file - 5916 bytes
Post #2
Hi,

Please do the following:

It appears as though the infection has hooked into your LSP.

This may knock out your internet connection when we try and remove the malware, so you will need to download as much as you can, or have the programs ready on a USB stick.

First. Download and run this program (It will run from a USB stick - or if using IE and you have the option - run it without downloading)

This should stabilize your system so the other programs will run:


Please download exeHelper to your desktop.
  • Double-click on exeHelper.com to run the fix.
  • A black window should pop up, press any key to close once the fix is completed.
  • Post the contents of log.txt (Will be created in the directory where you ran exeHelper.com)
Note If the window shows a message that says "Error deleting file", please re-run the program before posting a log - and post the two logs together (they will both be in the one file).


NEXT:

download the following programs but don't run them yet:

LSPFix

Winsockxpfix



NEXT

Note: some of these entries may not still be there exeHelper may delete them:


  • Open HiJackThis
  • Click on Do a system scan only
  • Check the boxes next to ONLY the entries listed below (if still present):


F2 - REG:system.ini: Shell=Explorer.exe logon.exe
O2 - BHO: (no name) - {9db6c3a9-86e0-4fc1-914d-f92a5aec7203} - gukejibu.dll (file missing)
O4 - HKLM\..\Run: [Dmizeteriwedokez] rundll32.exe "C:\WINDOWS\omazexowalifip.dll",Startup
O4 - HKLM\..\Run: [homahukoj] Rundll32.exe "c:\windows\system32\suhahebu.dll",a
O4 - HKLM\..\Run: [fozihaluna] Rundll32.exe "gepibura.dll",s
O4 - HKCU\..\Run: [SVCHOST.EXE] C:\WINDOWS\system32\drivers\svchost.exe
O21 - SSODL: guvetagek - {84a633b8-83df-4ac0-9688-e76736a3a412} - c:\windows\system32\suhahebu.dll
O22 - SharedTaskScheduler: kupuhivus - {84a633b8-83df-4ac0-9688-e76736a3a412} - c:\windows\system32\suhahebu.dll

  • Close all windows except Hijackthis and click Fix Checked
  • Click Yes when prompted
  • Close HijackThis.


NEXT

If you lose your internet connection and only if you lose it….run the WinsockxpFix program.





NEXT


Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.
  • Disable any script blocking protection
  • Double click dds.pif to run the tool.
  • When done, two DDS.txt's will open.
  • Save both reports to your desktop.
—————————————————
Please include the contents of the following in your next reply:

DDS.txt
Attach.txt.


NEXT


[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.
  • Extract the contents of the zipped file to desktop.
  • Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • Sections
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and post it in your next reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
Post #4
Hi,

make sure you disable teatimer and winpatrol as well as your antivirus before running this scan




Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
  • Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

  • Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
Post #5
its telling me that i have a real time scanner active "Kasper Anti-Virus" but i have uninstalled it and it should not be running. I have no where to disable it. I don't know how or why it says its running
Post #7
I did the scan, then when it was supposed to restart the computer for me it went to the shutdown screen but never shut down(like 25 min i waited). I manual did the restart and when it started back up ComboFix said do not start any other programs till it finds the log file, well it never found it(another 25min). It also did something to my sql server because it was gone and it would not link, it gave an error message saying it could not find sqlserver.exe. I did a system restore to get my sql server back. I NEED that for work. Should i try to run ComboFix again or what are you thoughts
Post #8
Hi, yes, Please rerun ComboFix, delete the copy you have from your desktop download a fresh copy try running it in safe mode. reboot back into safe mode to have it create a log. It may take out the SQL software again, I can restore that from quarantine (hopefully it's not infected and was a false positive detection) so no need to system restore again, lets get rid of the bad stuff as much as we can.
Post #9 last edited
ok we are good to go, i got the scan to work and here are the results. I Did however loose the sql server again though,


ComboFix 10-01-11.01 - Pat 01/11/2010 16:23:36.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.511.304 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\123.exe
AV: Kaspersky Anti-Virus *On-access scanning enabled* (Outdated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Macromedia\SwUpdate\swUPdate.dll
c:\program files\InternetSecurity2010
c:\program files\InternetSecurity2010\IS2010.exe
c:\windows\1.dll
c:\windows\omazexo.dll
c:\windows\onvchin.dll
c:\windows\system32\11478.exe
c:\windows\system32\15724.exe
c:\windows\system32\16827.exe
c:\windows\system32\18467.exe
c:\windows\system32\19169.exe
c:\windows\system32\23281.exe
c:\windows\system32\24464.exe
c:\windows\system32\26500.exe
c:\windows\system32\26962.exe
c:\windows\system32\28145.exe
c:\windows\system32\29358.exe
c:\windows\system32\491.exe
c:\windows\system32\5705.exe
c:\windows\system32\6334.exe
c:\windows\system32\9961.exe
c:\windows\system32\Data
c:\windows\system32\dozilibe.dll
c:\windows\system32\drivers\H8SRTkypixdoykt.sys
c:\windows\system32\drivers\svchost.exe
c:\windows\system32\gehufidu.dll
c:\windows\system32\gepibura.dll
c:\windows\system32\H8SRTbpjxtufybw.dll
c:\windows\system32\H8SRTkipxmqfujf.dat
c:\windows\system32\H8SRTltbqxfijsw.dll
c:\windows\system32\H8SRTqrlybluvpj.dll
c:\windows\system32\helper32.dll
c:\windows\system32\holiwaga.dll
c:\windows\system32\lowsec
c:\windows\system32\lowsec\local.ds
c:\windows\system32\lowsec\user.ds
c:\windows\system32\smss32.exe
c:\windows\system32\suhahebu.dll
c:\windows\system32\tayanage.dll
c:\windows\system32\vafefudo.dll
c:\windows\system32\warning.html
c:\windows\system32\winlogon32.exe
c:\windows\system32\wohubevu.dll
c:\windows\Sysvxd.exe
.
—- Previous Run ——-
.
c:\documents and settings\All Users\Application Data\Macromedia\SwUpdate\swUPdate.dll
c:\program files\InternetSecurity2010\IS2010.exe
c:\windows\1.dll
c:\windows\omazexo.dll
c:\windows\onvchin.dll
c:\windows\system32\11478.exe
c:\windows\system32\15724.exe
c:\windows\system32\16827.exe
c:\windows\system32\18467.exe
c:\windows\system32\19169.exe
c:\windows\system32\23281.exe
c:\windows\system32\24464.exe
c:\windows\system32\26500.exe
c:\windows\system32\26962.exe
c:\windows\system32\28145.exe
c:\windows\system32\29358.exe
c:\windows\system32\491.exe
c:\windows\system32\5705.exe
c:\windows\system32\6334.exe
c:\windows\system32\9961.exe
c:\windows\system32\Data\CT0060W.DAT
c:\windows\system32\Data\CTP0060W.DAT
c:\windows\system32\Data\CTP0061W.DAT
c:\windows\system32\Data\CTP0100W.DAT
c:\windows\system32\Data\CTP0101W.DAT
c:\windows\system32\Data\CTP0102W.DAT
c:\windows\system32\Data\CTP0103W.DAT
c:\windows\system32\Data\CTP0105W.DAT
c:\windows\system32\Data\CTP0170W.DAT
c:\windows\system32\Data\CTP017AW.DAT
c:\windows\system32\Data\CTP017BW.DAT
c:\windows\system32\Data\CTP017CW.DAT
c:\windows\system32\Data\CTP017DW.DAT
c:\windows\system32\Data\CTP017EW.DAT
c:\windows\system32\Data\CTP017FW.DAT
c:\windows\system32\Data\CTP017GW.DAT
c:\windows\system32\Data\CTP017HW.DAT
c:\windows\system32\Data\CTP0221W.DAT
c:\windows\system32\Data\CTP0222W.DAT
c:\windows\system32\Data\CTP0226W.DAT
c:\windows\system32\Data\CTP0228W.DAT
c:\windows\system32\Data\CTP1140W.DAT
c:\windows\system32\Data\CTP4620W.DAT
c:\windows\system32\Data\CTP4670W.DAT
c:\windows\system32\Data\CTP4760W.DAT
c:\windows\system32\Data\CTP4780W.DAT
c:\windows\system32\Data\CTP4790W.DAT
c:\windows\system32\Data\CTP4830W.DAT
c:\windows\system32\Data\CTP4831W.DAT
c:\windows\system32\Data\CTP4832W.DAT
c:\windows\system32\Data\CTP4840W.DAT
c:\windows\system32\Data\CTP4850W.DAT
c:\windows\system32\Data\CTP4870W.DAT
c:\windows\system32\Data\CTP4871W.DAT
c:\windows\system32\Data\CTP4872W.DAT
c:\windows\system32\Data\CTP4875W.DAT
c:\windows\system32\Data\CTP4890W.DAT
c:\windows\system32\Data\CTP4891W.DAT
c:\windows\system32\Data\CTP4893W.DAT
c:\windows\system32\Data\CTPDXW.DAT
c:\windows\system32\Data\CTPM002W.DAT
c:\windows\system32\Data\CTSBASW.DAT
c:\windows\system32\dozilibe.dll
c:\windows\system32\drivers\svchost.exe
c:\windows\system32\gehufidu.dll
c:\windows\system32\gepibura.dll
c:\windows\system32\helper32.dll
c:\windows\system32\holiwaga.dll
c:\windows\system32\lowsec\local.ds
c:\windows\system32\lowsec\user.ds
c:\windows\system32\lowsec\user.ds.lll
c:\windows\system32\srcr.dat
c:\windows\system32\suhahebu.dll
c:\windows\system32\tayanage.dll
c:\windows\system32\vafefudo.dll
c:\windows\system32\wohubevu.dll
c:\windows\Sysvxd.exe

Infected copy of c:\windows\system32\DRIVERS\atapi.sys was found and disinfected
Restored copy from - Kitty ate it :P
Infected copy of c:\windows\system32\DRIVERS\atapi.sys was found and disinfected
Restored copy from - Kitty ate it :P
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_H8SRTd.sys
——-\Service_H8SRTd.sys


((((((((((((((((((((((((( Files Created from 2009-12-11 to 2010-01-11 )))))))))))))))))))))))))))))))
.

2010-01-11 21:52 . 2010-01-11 21:56 ——– d—–w- c:\documents and settings\All Users\Application Data\NOS
2010-01-11 21:52 . 2010-01-11 21:52 ——– d—–w- c:\program files\NOS
2010-01-11 21:52 . 2009-12-17 22:37 31936 —-a-w- c:\documents and settings\Pat\Application Data\Mozilla\Firefox\Profiles\jpqroyfl.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
2010-01-11 21:52 . 2009-12-17 22:37 29344 —-a-w- c:\documents and settings\Pat\Application Data\Mozilla\Firefox\Profiles\jpqroyfl.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\chrome\content\getPlusPlus_Adobe_reg.exe
2010-01-11 20:21 . 2010-01-11 20:21 ——– d—–w- c:\windows\system32\wbem\Repository
2010-01-11 12:56 . 2010-01-11 12:56 ——– d—–w- c:\program files\ERUNT
2010-01-11 11:20 . 2010-01-11 11:20 ——– d—–w- c:\documents and settings\Pat\Local Settings\Application Data\{5D10EBA4-320C-440D-804F-80604AA8611D}
2010-01-06 19:50 . 2010-01-11 11:20 0 —-a-w- c:\windows\Xsusopiwamik.bin
2010-01-06 19:49 . 2010-01-11 11:20 120 —-a-w- c:\windows\Cyupeheg.dat
2010-01-06 13:13 . 2010-01-11 21:12 ——– d—–w- c:\program files\1
2010-01-04 12:12 . 2010-01-04 12:12 388096 —-a-r- c:\documents and settings\Pat\Application Data\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe
2010-01-02 20:13 . 2010-01-02 20:13 ——– d—–w- c:\windows\system32\XPSViewer
2010-01-02 20:13 . 2010-01-02 20:13 ——– d—–w- c:\program files\MSBuild
2010-01-02 20:13 . 2010-01-02 20:13 ——– d—–w- c:\program files\Reference Assemblies
2010-01-02 20:13 . 2008-07-06 12:06 89088 —-a-w- c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
2010-01-02 20:12 . 2008-07-06 12:06 89088 -c—-w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2010-01-02 20:12 . 2008-07-06 12:06 117760 ——w- c:\windows\system32\prntvpt.dll
2010-01-02 20:12 . 2008-07-06 12:06 575488 -c—-w- c:\windows\system32\dllcache\xpsshhdr.dll
2010-01-02 20:12 . 2008-07-06 12:06 575488 ——w- c:\windows\system32\xpsshhdr.dll
2010-01-02 20:12 . 2008-07-06 10:50 597504 -c—-w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2010-01-02 20:12 . 2008-07-06 10:50 597504 ——w- c:\windows\system32\Spool\prtprocs\w32x86\printfilterpipelinesvc.exe
2010-01-02 20:12 . 2010-01-02 20:13 ——– d—–w- C:\e745aa45b9d8451e60ebc
2010-01-02 20:12 . 2008-07-06 12:06 1676288 -c—-w- c:\windows\system32\dllcache\xpssvcs.dll
2010-01-02 20:12 . 2008-07-06 12:06 1676288 ——w- c:\windows\system32\xpssvcs.dll
2009-12-30 14:51 . 2009-12-30 14:51 ——– d—–w- c:\program files\Common Files\Sonic Shared
2009-12-30 14:51 . 2009-12-30 14:52 ——– d—–w- c:\program files\Roxio
2009-12-30 14:26 . 2009-12-30 14:26 ——– d—–w- c:\documents and settings\All Users\Application Data\Research In Motion
2009-12-30 14:23 . 2009-12-30 14:23 ——– d—–w- c:\documents and settings\Pat\Application Data\InstallShield
2009-12-28 18:32 . 2009-12-28 18:32 ——– d—–w- c:\program files\WebEx
2009-12-28 17:58 . 2009-12-28 17:58 ——– d—–w- c:\windows\LastGood(2)
2009-12-24 18:03 . 2009-12-24 18:03 ——– d—–w- c:\documents and settings\All Users\Application Data\nView_Profiles
2009-12-24 15:57 . 2009-11-21 16:36 470528 -c—-w- c:\windows\system32\dllcache\aclayers.dll
2009-12-24 15:45 . 2009-12-24 15:45 664 —-a-w- c:\windows\system32\d3d9caps.dat
2009-12-24 14:06 . 2008-05-16 20:01 446464 —-a-w- c:\windows\system32\nvuninst.exe
2009-12-24 14:06 . 2008-05-16 20:01 446464 —-a-w- c:\windows\system32\nvudisp.exe
2009-12-23 22:14 . 2001-10-16 11:03 3387392 —-a-r- c:\windows\system32\nvrsja.dll
2009-12-23 18:28 . 2009-12-23 18:28 ——– d–h–w- c:\windows\PIF
2009-12-23 16:53 . 2009-10-15 03:18 36880 —-a-w- c:\windows\system32\drivers\klbg.sys
2009-12-23 16:47 . 2009-12-23 16:47 ——– d—–w- c:\program files\TrendMicro
2009-12-23 15:25 . 2009-12-23 15:25 ——– d—–w- C:\NVIDIA
2009-12-23 14:37 . 2009-12-23 14:37 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2009-12-22 22:58 . 2010-01-11 11:16 847 —-a-w- c:\windows\system32\krl32mainweq.dll
2009-12-16 13:13 . 2009-12-16 13:13 127325 —-a-w- c:\documents and settings\Pat\Application Data\Move Networks\uninstall.exe
2009-12-16 13:12 . 2009-12-16 13:12 1408800 —-a-w- c:\documents and settings\Pat\Application Data\Move Networks\MoveMediaPlayerWin_071505000011.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-11 22:06 . 2008-10-17 16:28 ——– d—–w- c:\program files\AutoScale2000
2010-01-11 20:21 . 2008-08-26 11:14 ——– d—–w- c:\documents and settings\Pat\Application Data\DNA
2010-01-11 20:17 . 2008-08-26 11:14 ——– d—–w- c:\program files\DNA
2010-01-11 18:10 . 2004-06-25 00:45 288 —-a-w- c:\windows\system32\DVCStateBkp-{00000000-00000000-0000000A-00001102-00000002-80661102}.dat
2010-01-11 18:10 . 2004-06-25 00:45 288 —-a-w- c:\windows\system32\DVCState-{00000000-00000000-0000000A-00001102-00000002-80661102}.dat
2010-01-11 17:49 . 2005-01-27 23:50 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-01-11 12:35 . 2008-10-23 11:55 ——– d—–w- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2010-01-08 22:32 . 2004-09-03 03:08 74584 —-a-w- c:\documents and settings\Pat\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-30 14:55 . 2009-05-21 10:50 ——– d—–w- c:\program files\Common Files\Roxio Shared
2009-12-30 14:51 . 2009-05-21 10:51 ——– d—–w- c:\documents and settings\All Users\Application Data\Roxio
2009-12-30 14:13 . 2009-05-21 10:55 256 —-a-w- c:\windows\system32\pool.bin
2009-12-24 19:06 . 2005-03-11 00:39 ——– d—–w- c:\documents and settings\Pat\Application Data\Lavasoft
2009-12-23 15:58 . 2004-06-21 06:20 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-12-18 22:41 . 2008-10-23 12:07 704544 –sha-w- c:\windows\system32\drivers\fidbox2.dat
2009-12-18 22:41 . 2008-10-23 12:07 3488 –sha-w- c:\windows\system32\drivers\fidbox2.idx
2009-12-18 22:41 . 2008-10-23 12:07 3128864 –sha-w- c:\windows\system32\drivers\fidbox.dat
2009-12-18 22:41 . 2008-10-23 12:07 25524 –sha-w- c:\windows\system32\drivers\fidbox.idx
2009-12-18 18:19 . 2004-10-04 01:14 ——– d—–w- c:\documents and settings\Pat\Application Data\AdobeUM
2009-12-16 14:02 . 2008-12-08 20:26 ——– d—–w- c:\documents and settings\Pat\Application Data\Move Networks
2009-12-16 13:13 . 2009-08-13 19:21 4187512 —-a-w- c:\documents and settings\Pat\Application Data\Move Networks\plugins\npqmp071505000011.dll
2009-12-16 12:40 . 2009-02-25 19:54 ——– d—–w- c:\documents and settings\All Users\Application Data\JUVNCQKJZG
2009-11-30 12:11 . 2009-11-30 12:11 ——– d—–w- c:\documents and settings\Pat\Application Data\GARMIN
2009-11-30 12:10 . 2009-11-30 12:10 ——– d—–w- c:\program files\Garmin GPS Plugin
2009-11-30 12:10 . 2009-11-30 12:10 ——– d—–w- c:\program files\DIFX
2009-11-30 12:10 . 2009-11-30 12:10 ——– d—–w- c:\program files\Garmin
2009-11-28 11:51 . 2010-01-07 12:12 5776 —-a-w- c:\windows\system32\drivers\OLD7.tmp
2009-11-21 16:36 . 2003-03-31 12:00 470528 —-a-w- c:\windows\AppPatch\aclayers.dll
2009-11-16 11:37 . 2009-11-16 11:37 ——– d—–w- c:\program files\MSECache
2009-10-29 05:48 . 2004-12-07 22:37 662016 —-a-w- c:\windows\system32\wininet.dll
2009-10-21 06:00 . 2004-08-04 07:56 75776 —-a-w- c:\windows\system32\strmfilt.dll
2009-10-21 06:00 . 2004-08-04 07:56 25088 —-a-w- c:\windows\system32\httpapi.dll
2009-10-21 02:34 . 2009-10-21 02:34 219664 —-a-w- c:\windows\system32\klogon.dll
2009-10-20 14:58 . 2004-08-04 06:00 263552 —-a-w- c:\windows\system32\drivers\http.sys
2009-10-14 13:46 . 2008-10-23 12:08 95259 —-a-w- c:\windows\system32\drivers\klick.dat
2009-10-14 13:46 . 2008-10-23 12:08 108059 —-a-w- c:\windows\system32\drivers\klin.dat
2009-08-12 15:23 . 2008-10-17 18:53 27976 —-a-w- c:\program files\mozilla firefox\plugins\atgpcdec.dll
2009-08-12 15:23 . 2008-10-17 18:53 126360 —-a-w- c:\program files\mozilla firefox\plugins\atgpcext.dll
2009-08-12 15:23 . 2008-10-17 18:53 98712 —-a-w- c:\program files\mozilla firefox\plugins\ieatgpc.dll
1601-01-01 00:03 . 1601-01-01 00:03 51712 –sha-w- c:\windows\system32\bonumohe.dll
1601-01-01 00:03 . 1601-01-01 00:03 51712 –sha-w- c:\windows\system32\gukejibu.dll
1601-01-01 00:03 . 1601-01-01 00:03 92160 –sha-w- c:\windows\system32\jayoriji.dll
1601-01-01 00:03 . 1601-01-01 00:03 61440 –sha-w- c:\windows\system32\jukazudu.dll
1601-01-01 00:03 . 1601-01-01 00:03 51712 –sha-w- c:\windows\system32\jurunute.dll.tmp
1601-01-01 00:03 . 1601-01-01 00:03 51712 –sha-w- c:\windows\system32\ketoyibo.dll.tmp
1601-01-01 00:03 . 1601-01-01 00:03 51712 –sha-w- c:\windows\system32\lanimaye.dll.tmp
1601-01-01 00:03 . 1601-01-01 00:03 61440 –sha-w- c:\windows\system32\tifakapu.dll
2008-10-20 11:05 . 2008-10-20 11:05 608 –sha-w- c:\windows\system32\winzvprt5.sys
1601-01-01 00:03 . 1601-01-01 00:03 91648 –sha-w- c:\windows\system32\zavituwe.dll
1601-01-01 00:03 . 1601-01-01 00:03 61440 –sha-w- c:\windows\system32\zukepive.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinPatrol"="c:\progra~1\BILLPS~1\WINPAT~1\winpatrol.exe" [2004-12-10 140480]
"nwiz"="nwiz.exe" [2008-05-16 1630208]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-16 86016]
"BlackBerryAutoUpdate"="c:\program files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe" [2009-11-20 623960]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-16 13529088]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [2000-1-21 65588]
Service Manager.lnk - c:\program files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2002-12-17 74308]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler]
"{84a633b8-83df-4ac0-9688-e76736a3a412}"= "c:\windows\system32\suhahebu.dll" [BU]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"guvetagek"= {84a633b8-83df-4ac0-9688-e76736a3a412} - c:\windows\system32\suhahebu.dll [BU]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WebrootSpySweeperService]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
1 [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
2008-11-07 20:16 111936 —-a-w- c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA]
2010-01-11 18:47 323392 —-a-w- c:\program files\DNA\btdna.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
2003-06-30 15:49 1130546 ——w- c:\program files\Ahead\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelliPoint]
2007-08-31 19:01 1037736 —-a-w- c:\program files\Microsoft IntelliPoint\ipoint.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2009-01-06 19:06 290088 —-a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2008-05-16 20:01 1630208 —-a-w- c:\windows\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-01-05 22:18 413696 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Bonjour Service"=2 (0x2)
"RoxLiveShare9"=2 (0x2)
"DigiRefresh"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [12/23/2009 10:53 AM 36880]
R2 FSHOOK;FSHOOK;c:\windows\system32\drivers\FSHOOK.SYS [6/21/2004 12:50 AM 7040]
R3 HPFXFAX;HPFXFAX;c:\windows\system32\drivers\hpfxfax.sys [10/20/2008 5:15 AM 20504]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [9/14/2009 2:42 PM 32272]
S0 viasraid;viasraid;c:\windows\system32\drivers\viasraid.sys [6/21/2004 12:29 AM 77312]
S2 nvtvSND;nVidia WDM TVAudio Crossbar;c:\windows\system32\DRIVERS\nvtvsnd.sys –> c:\windows\system32\DRIVERS\nvtvsnd.sys [?]
S3 dalwdmservice;dal service;c:\windows\system32\drivers\dalwdm.sys –> c:\windows\system32\drivers\dalwdm.sys [?]
S3 iteio;iteio;c:\windows\system32\drivers\Iteio.sys [6/21/2004 1:04 AM 3680]
S3 Vsp;Vsp;\??\c:\windows\System32\drivers\Vsp.sys –> c:\windows\System32\drivers\Vsp.sys [?]
S4 Inrfraaipruw;Inrfraaipruw; [x]

— Other Services/Drivers In Memory —

*Deregistered* - IPVNMon

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
getPlusHelper REG_MULTI_SZ getPlusHelper
.
Contents of the 'Scheduled Tasks' folder

2010-01-07 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 17:34]
.
.
——- Supplementary Scan ——-
.
uStart Page = about:blank
mStart Page = about:blank
Trusted Zone: aol.com\free
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Pat\Application Data\Mozilla\Firefox\Profiles\jpqroyfl.default\
FF - prefs.js: browser.search.selectedEngine - eBay
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe;=UTF-8&sourceid;=navclient&gfns;=1&q;=
FF - plugin: c:\documents and settings\Pat\Application Data\Move Networks\plugins\npqmp071505000011.dll
FF - plugin: c:\documents and settings\Pat\Application Data\Mozilla\Firefox\Profiles\jpqroyfl.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
FF - plugin: c:\program files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npatgpc.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npyaxmpb.dll
FF - HiddenExtension: XULRunner: {5D10EBA4-320C-440D-804F-80604AA8611D} - c:\documents and settings\Pat\Local Settings\Application Data\{5D10EBA4-320C-440D-804F-80604AA8611D}\
.
- - - - ORPHANS REMOVED - - - -

SafeBoot-WRConsumerService
AddRemove-{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1 - c:\program files\Spybot - Search & Destroy\unins000.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-11 16:38
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(2544)
c:\windows\System32\msls31.dll
c:\windows\System32\shdoclc.dll
c:\windows\System32\msimtf.dll
c:\windows\System32\MSCTF.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\RUNDLL32.EXE
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\windows\System32\CTsvcCDA.exe
c:\program files\Ahead\InCD\InCDsrv.exe
c:\windows\system32\nvsvc32.exe
c:\windows\System32\MsPMSPSv.exe
c:\windows\system32\taskmgr.exe
.
**************************************************************************
.
Completion time: 2010-01-11 16:49:28 - machine was rebooted
ComboFix-quarantined-files.txt 2010-01-11 22:49

Pre-Run: 88,966,459,392 bytes free
Post-Run: 88,779,345,920 bytes free

- - End Of File - - 16489E97F8A8771506B34133B72AB55C
Post #10 last edited
Hi,

I don't see any files related to your SQLServer that were actually deleted, do you recognize any?

It may just be a setting that can be reset.

Go into your services and make sure it is running and set to automatically start.

(open a run box - windows key + R and type services.msc to open the services window.)

Please do the following:
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
  • They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

http://forums.whatthetech.com/System_Has_been_infected_Backgound_image_Locked_t109444.html&view=findpost&p=623508#entry623508

Collect::
c:\windows\system32\krl32mainweq.dll
c:\windows\system32\bonumohe.dll
c:\windows\system32\gukejibu.dll
c:\windows\system32\jayoriji.dll
c:\windows\system32\jukazudu.dll
c:\windows\system32\jurunute.dll.tmp
c:\windows\system32\ketoyibo.dll.tmp
c:\windows\system32\lanimaye.dll.tmp
c:\windows\system32\tifakapu.dll
c:\windows\system32\winzvprt5.sys
c:\windows\system32\zavituwe.dll
c:\windows\system32\zukepive.dll
c:\windows\system32\suhahebu.dll

File::
c:\windows\Xsusopiwamik.bin
c:\windows\Cyupeheg.dat
c:\windows\system32\drivers\OLD7.tmp

Folder::
c:\program files\1
c:\documents and settings\All Users\Application Data\JUVNCQKJZG

Registry::
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler]
"{84a633b8-83df-4ac0-9688-e76736a3a412}"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"guvetagek"=-

Driver::
Inrfraaipruw

FireFox::
FF - ProfilePath - c:\documents and settings\Pat\Application Data\Mozilla\Firefox\Profiles\jpqroyfl.default\
FF - HiddenExtension: XULRunner: {5D10EBA4-320C-440D-804F-80604AA8611D} - c:\documents and settings\Pat\Local Settings\Application Data\{5D10EBA4-320C-440D-804F-80604AA8611D}\

DirLook::
c:\documents and settings\Pat\Local Settings\Application Data\{5D10EBA4-320C-440D-804F-80604AA8611D}

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you.
  • Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.



Also, please advise how your computer is running now.
Post #11
The computer seams to be back to normal. The wallpaper is back and I don't have any of the pop ups and no more redirects in Mozilla. The only thing not back to normal is the SQL server but i know you said you could bring that back. Here are the results from the second scan.

ComboFix 10-01-11.01 - Pat 01/11/2010 17:31:21.2.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.511.171 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\123.exe
Command switches used :: c:\documents and settings\Pat\Desktop\CFScript.txt
AV: Kaspersky Anti-Virus *On-access scanning enabled* (Outdated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}

FILE ::
"c:\windows\Cyupeheg.dat"
"c:\windows\system32\drivers\OLD7.tmp"
"c:\windows\Xsusopiwamik.bin"

file zipped: c:\windows\system32\bonumohe.dll
file zipped: c:\windows\system32\gukejibu.dll
file zipped: c:\windows\system32\jayoriji.dll
file zipped: c:\windows\system32\jukazudu.dll
file zipped: c:\windows\system32\jurunute.dll.tmp
file zipped: c:\windows\system32\ketoyibo.dll.tmp
file zipped: c:\windows\system32\krl32mainweq.dll
file zipped: c:\windows\system32\lanimaye.dll.tmp
file zipped: c:\windows\system32\tifakapu.dll
file zipped: c:\windows\system32\winzvprt5.sys
file zipped: c:\windows\system32\zavituwe.dll
file zipped: c:\windows\system32\zukepive.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\JUVNCQKJZG
c:\documents and settings\All Users\Application Data\JUVNCQKJZG\2017.Dat
c:\documents and settings\Pat\Local Settings\Application Data\{5D10EBA4-320C-440D-804F-80604AA8611D}\
c:\documents and settings\Pat\Local Settings\Application Data\{5D10EBA4-320C-440D-804F-80604AA8611D}\\chrome.manifest
c:\documents and settings\Pat\Local Settings\Application Data\{5D10EBA4-320C-440D-804F-80604AA8611D}\\chrome\content\_cfg.js
c:\documents and settings\Pat\Local Settings\Application Data\{5D10EBA4-320C-440D-804F-80604AA8611D}\\chrome\content\overlay.xul
c:\documents and settings\Pat\Local Settings\Application Data\{5D10EBA4-320C-440D-804F-80604AA8611D}\\install.rdf
c:\program files\1
c:\program files\1\sd123.exe
c:\program files\1\Slper.dll
c:\windows\Cyupeheg.dat
c:\windows\system32\bonumohe.dll
c:\windows\system32\drivers\OLD7.tmp
c:\windows\system32\gukejibu.dll
c:\windows\system32\jayoriji.dll
c:\windows\system32\jukazudu.dll
c:\windows\system32\jurunute.dll.tmp
c:\windows\system32\ketoyibo.dll.tmp
c:\windows\system32\krl32mainweq.dll
c:\windows\system32\lanimaye.dll.tmp
c:\windows\system32\tifakapu.dll
c:\windows\system32\winzvprt5.sys
c:\windows\system32\zavituwe.dll
c:\windows\system32\zukepive.dll
c:\windows\Xsusopiwamik.bin

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_Inrfraaipruw


((((((((((((((((((((((((( Files Created from 2009-12-11 to 2010-01-11 )))))))))))))))))))))))))))))))
.

2010-01-11 21:52 . 2010-01-11 21:56 ——– d—–w- c:\documents and settings\All Users\Application Data\NOS
2010-01-11 21:52 . 2010-01-11 21:52 ——– d—–w- c:\program files\NOS
2010-01-11 21:52 . 2009-12-17 22:37 31936 —-a-w- c:\documents and settings\Pat\Application Data\Mozilla\Firefox\Profiles\jpqroyfl.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
2010-01-11 21:52 . 2009-12-17 22:37 29344 —-a-w- c:\documents and settings\Pat\Application Data\Mozilla\Firefox\Profiles\jpqroyfl.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\chrome\content\getPlusPlus_Adobe_reg.exe
2010-01-11 20:21 . 2010-01-11 20:21 ——– d—–w- c:\windows\system32\wbem\Repository
2010-01-11 12:56 . 2010-01-11 12:56 ——– d—–w- c:\program files\ERUNT
2010-01-04 12:12 . 2010-01-04 12:12 388096 —-a-r- c:\documents and settings\Pat\Application Data\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe
2010-01-02 20:13 . 2010-01-02 20:13 ——– d—–w- c:\windows\system32\XPSViewer
2010-01-02 20:13 . 2010-01-02 20:13 ——– d—–w- c:\program files\MSBuild
2010-01-02 20:13 . 2010-01-02 20:13 ——– d—–w- c:\program files\Reference Assemblies
2010-01-02 20:13 . 2008-07-06 12:06 89088 —-a-w- c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
2010-01-02 20:12 . 2008-07-06 12:06 89088 -c—-w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2010-01-02 20:12 . 2008-07-06 12:06 117760 ——w- c:\windows\system32\prntvpt.dll
2010-01-02 20:12 . 2008-07-06 12:06 575488 -c—-w- c:\windows\system32\dllcache\xpsshhdr.dll
2010-01-02 20:12 . 2008-07-06 12:06 575488 ——w- c:\windows\system32\xpsshhdr.dll
2010-01-02 20:12 . 2008-07-06 10:50 597504 -c—-w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2010-01-02 20:12 . 2008-07-06 10:50 597504 ——w- c:\windows\system32\Spool\prtprocs\w32x86\printfilterpipelinesvc.exe
2010-01-02 20:12 . 2010-01-02 20:13 ——– d—–w- C:\e745aa45b9d8451e60ebc
2010-01-02 20:12 . 2008-07-06 12:06 1676288 -c—-w- c:\windows\system32\dllcache\xpssvcs.dll
2010-01-02 20:12 . 2008-07-06 12:06 1676288 ——w- c:\windows\system32\xpssvcs.dll
2009-12-30 14:51 . 2009-12-30 14:51 ——– d—–w- c:\program files\Common Files\Sonic Shared
2009-12-30 14:51 . 2009-12-30 14:52 ——– d—–w- c:\program files\Roxio
2009-12-30 14:26 . 2009-12-30 14:26 ——– d—–w- c:\documents and settings\All Users\Application Data\Research In Motion
2009-12-30 14:23 . 2009-12-30 14:23 ——– d—–w- c:\documents and settings\Pat\Application Data\InstallShield
2009-12-28 18:32 . 2009-12-28 18:32 ——– d—–w- c:\program files\WebEx
2009-12-28 17:58 . 2009-12-28 17:58 ——– d—–w- c:\windows\LastGood(2)
2009-12-24 18:03 . 2009-12-24 18:03 ——– d—–w- c:\documents and settings\All Users\Application Data\nView_Profiles
2009-12-24 15:57 . 2009-11-21 16:36 470528 -c—-w- c:\windows\system32\dllcache\aclayers.dll
2009-12-24 15:45 . 2009-12-24 15:45 664 —-a-w- c:\windows\system32\d3d9caps.dat
2009-12-24 14:06 . 2008-05-16 20:01 446464 —-a-w- c:\windows\system32\nvuninst.exe
2009-12-24 14:06 . 2008-05-16 20:01 446464 —-a-w- c:\windows\system32\nvudisp.exe
2009-12-23 22:14 . 2001-10-16 11:03 3387392 —-a-r- c:\windows\system32\nvrsja.dll
2009-12-23 18:28 . 2009-12-23 18:28 ——– d–h–w- c:\windows\PIF
2009-12-23 16:53 . 2009-10-15 03:18 36880 —-a-w- c:\windows\system32\drivers\klbg.sys
2009-12-23 16:47 . 2009-12-23 16:47 ——– d—–w- c:\program files\TrendMicro
2009-12-23 15:25 . 2009-12-23 15:25 ——– d—–w- C:\NVIDIA
2009-12-23 14:37 . 2009-12-23 14:37 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2009-12-16 13:13 . 2009-12-16 13:13 127325 —-a-w- c:\documents and settings\Pat\Application Data\Move Networks\uninstall.exe
2009-12-16 13:12 . 2009-12-16 13:12 1408800 —-a-w- c:\documents and settings\Pat\Application Data\Move Networks\MoveMediaPlayerWin_071505000011.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-11 22:06 . 2008-10-17 16:28 ——– d—–w- c:\program files\AutoScale2000
2010-01-11 20:21 . 2008-08-26 11:14 ——– d—–w- c:\documents and settings\Pat\Application Data\DNA
2010-01-11 20:17 . 2008-08-26 11:14 ——– d—–w- c:\program files\DNA
2010-01-11 18:10 . 2004-06-25 00:45 288 —-a-w- c:\windows\system32\DVCStateBkp-{00000000-00000000-0000000A-00001102-00000002-80661102}.dat
2010-01-11 18:10 . 2004-06-25 00:45 288 —-a-w- c:\windows\system32\DVCState-{00000000-00000000-0000000A-00001102-00000002-80661102}.dat
2010-01-11 17:49 . 2005-01-27 23:50 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-01-11 12:35 . 2008-10-23 11:55 ——– d—–w- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2010-01-08 22:32 . 2004-09-03 03:08 74584 —-a-w- c:\documents and settings\Pat\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-30 14:55 . 2009-05-21 10:50 ——– d—–w- c:\program files\Common Files\Roxio Shared
2009-12-30 14:51 . 2009-05-21 10:51 ——– d—–w- c:\documents and settings\All Users\Application Data\Roxio
2009-12-30 14:13 . 2009-05-21 10:55 256 —-a-w- c:\windows\system32\pool.bin
2009-12-24 19:06 . 2005-03-11 00:39 ——– d—–w- c:\documents and settings\Pat\Application Data\Lavasoft
2009-12-23 15:58 . 2004-06-21 06:20 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-12-18 22:41 . 2008-10-23 12:07 704544 –sha-w- c:\windows\system32\drivers\fidbox2.dat
2009-12-18 22:41 . 2008-10-23 12:07 3488 –sha-w- c:\windows\system32\drivers\fidbox2.idx
2009-12-18 22:41 . 2008-10-23 12:07 3128864 –sha-w- c:\windows\system32\drivers\fidbox.dat
2009-12-18 22:41 . 2008-10-23 12:07 25524 –sha-w- c:\windows\system32\drivers\fidbox.idx
2009-12-18 18:19 . 2004-10-04 01:14 ——– d—–w- c:\documents and settings\Pat\Application Data\AdobeUM
2009-12-16 14:02 . 2008-12-08 20:26 ——– d—–w- c:\documents and settings\Pat\Application Data\Move Networks
2009-12-16 13:13 . 2009-08-13 19:21 4187512 —-a-w- c:\documents and settings\Pat\Application Data\Move Networks\plugins\npqmp071505000011.dll
2009-11-30 12:11 . 2009-11-30 12:11 ——– d—–w- c:\documents and settings\Pat\Application Data\GARMIN
2009-11-30 12:10 . 2009-11-30 12:10 ——– d—–w- c:\program files\Garmin GPS Plugin
2009-11-30 12:10 . 2009-11-30 12:10 ——– d—–w- c:\program files\DIFX
2009-11-30 12:10 . 2009-11-30 12:10 ——– d—–w- c:\program files\Garmin
2009-11-21 16:36 . 2003-03-31 12:00 470528 —-a-w- c:\windows\AppPatch\aclayers.dll
2009-11-16 11:37 . 2009-11-16 11:37 ——– d—–w- c:\program files\MSECache
2009-10-29 05:48 . 2004-12-07 22:37 662016 ——w- c:\windows\system32\wininet.dll
2009-10-21 06:00 . 2004-08-04 07:56 75776 —-a-w- c:\windows\system32\strmfilt.dll
2009-10-21 06:00 . 2004-08-04 07:56 25088 —-a-w- c:\windows\system32\httpapi.dll
2009-10-21 02:34 . 2009-10-21 02:34 219664 —-a-w- c:\windows\system32\klogon.dll
2009-10-20 14:58 . 2004-08-04 06:00 263552 —-a-w- c:\windows\system32\drivers\http.sys
2009-10-14 13:46 . 2008-10-23 12:08 95259 —-a-w- c:\windows\system32\drivers\klick.dat
2009-10-14 13:46 . 2008-10-23 12:08 108059 —-a-w- c:\windows\system32\drivers\klin.dat
2009-08-12 15:23 . 2008-10-17 18:53 27976 —-a-w- c:\program files\mozilla firefox\plugins\atgpcdec.dll
2009-08-12 15:23 . 2008-10-17 18:53 126360 —-a-w- c:\program files\mozilla firefox\plugins\atgpcext.dll
2009-08-12 15:23 . 2008-10-17 18:53 98712 —-a-w- c:\program files\mozilla firefox\plugins\ieatgpc.dll
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
—- Directory of c:\documents and settings\Pat\Local Settings\Application Data\{5D10EBA4-320C-440D-804F-80604AA8611D} —-

2010-01-11 11:20 . 2010-01-11 11:20 6778 —-a-w- c:\documents and settings\Pat\Local Settings\Application Data\{5D10EBA4-320C-440D-804F-80604AA8611D}\chrome\content\overlay.xul
2010-01-11 11:20 . 2010-01-11 11:20 2024 —-a-w- c:\documents and settings\Pat\Local Settings\Application Data\{5D10EBA4-320C-440D-804F-80604AA8611D}\chrome\content\_cfg.js
2010-01-11 11:20 . 2010-01-11 11:20 764 —-a-w- c:\documents and settings\Pat\Local Settings\Application Data\{5D10EBA4-320C-440D-804F-80604AA8611D}\install.rdf
2010-01-11 11:20 . 2010-01-11 11:20 122 —-a-w- c:\documents and settings\Pat\Local Settings\Application Data\{5D10EBA4-320C-440D-804F-80604AA8611D}\chrome.manifest


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinPatrol"="c:\progra~1\BILLPS~1\WINPAT~1\winpatrol.exe" [2004-12-10 140480]
"nwiz"="nwiz.exe" [2008-05-16 1630208]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-16 86016]
"BlackBerryAutoUpdate"="c:\program files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe" [2009-11-20 623960]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-16 13529088]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [2000-1-21 65588]
Service Manager.lnk - c:\program files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2002-12-17 74308]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WebrootSpySweeperService]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
1 [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
2008-11-07 20:16 111936 —-a-w- c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA]
2010-01-11 18:47 323392 —-a-w- c:\program files\DNA\btdna.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
2003-06-30 15:49 1130546 ——w- c:\program files\Ahead\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelliPoint]
2007-08-31 19:01 1037736 —-a-w- c:\program files\Microsoft IntelliPoint\ipoint.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2009-01-06 19:06 290088 —-a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2008-05-16 20:01 1630208 —-a-w- c:\windows\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-01-05 22:18 413696 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Bonjour Service"=2 (0x2)
"RoxLiveShare9"=2 (0x2)
"DigiRefresh"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [12/23/2009 10:53 AM 36880]
R2 FSHOOK;FSHOOK;c:\windows\system32\drivers\FSHOOK.SYS [6/21/2004 12:50 AM 7040]
R3 HPFXFAX;HPFXFAX;c:\windows\system32\drivers\hpfxfax.sys [10/20/2008 5:15 AM 20504]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [9/14/2009 2:42 PM 32272]
S0 viasraid;viasraid;c:\windows\system32\drivers\viasraid.sys [6/21/2004 12:29 AM 77312]
S2 nvtvSND;nVidia WDM TVAudio Crossbar;c:\windows\system32\DRIVERS\nvtvsnd.sys –> c:\windows\system32\DRIVERS\nvtvsnd.sys [?]
S3 dalwdmservice;dal service;c:\windows\system32\drivers\dalwdm.sys –> c:\windows\system32\drivers\dalwdm.sys [?]
S3 iteio;iteio;c:\windows\system32\drivers\Iteio.sys [6/21/2004 1:04 AM 3680]
S3 Vsp;Vsp;\??\c:\windows\System32\drivers\Vsp.sys –> c:\windows\System32\drivers\Vsp.sys [?]

— Other Services/Drivers In Memory —

*Deregistered* - IPVNMon

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
getPlusHelper REG_MULTI_SZ getPlusHelper
.
Contents of the 'Scheduled Tasks' folder

2010-01-07 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 17:34]
.
.
——- Supplementary Scan ——-
.
uStart Page = about:blank
mStart Page = about:blank
Trusted Zone: aol.com\free
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Pat\Application Data\Mozilla\Firefox\Profiles\jpqroyfl.default\
FF - prefs.js: browser.search.selectedEngine - eBay
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
FF - plugin: c:\documents and settings\Pat\Application Data\Move Networks\plugins\npqmp071505000011.dll
FF - plugin: c:\documents and settings\Pat\Application Data\Mozilla\Firefox\Profiles\jpqroyfl.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
FF - plugin: c:\program files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npatgpc.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npyaxmpb.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-11 17:43
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(1540)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\windows\System32\CTsvcCDA.exe
c:\program files\Ahead\InCD\InCDsrv.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\RUNDLL32.EXE
c:\windows\System32\MsPMSPSv.exe
.
**************************************************************************
.
Completion time: 2010-01-11 17:45:44 - machine was rebooted
ComboFix-quarantined-files.txt 2010-01-11 23:45
ComboFix2.txt 2010-01-11 22:49

Pre-Run: 88,788,742,144 bytes free
Post-Run: 88,744,325,120 bytes free

- - End Of File - - 3B7E4314A4B4CF6B72CC180FA9BD8DC7
Post #12 last edited
Hi,

Nnothing has been deleted in relation to that SQL server.

It is still showing in the Global startup.

Manually reboot a couple of times to see if that restarts that SQL service.


If not - go into the services window and scroll down till you find it - make sure the SQL service is started and set to start automatically:

(press the windows key +R type services.msc in the run box to open the services window)

Let me know if it starts.
Post #13
no it didn't start. A box pops up and says Sql server could not find the default instance (MSSQLSERVER) - please specify the name of and existing instance on the invocation of sqlservr.exe

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI