[Closed] Zoreloyum and Virtumond

mclass Topic Starter

Post #1February 26, 2010, 12:53 AM UTC

Hi, it seems that my computer is infected with a couple of different things right now. I thought I succesfully removed Virtumond a couple of months ago but it seems to have re appeared on my computer. Also, when I start up my computer I get an error message saying unable to load wesapodi.dll, which I also removed a couple of months ago after figuring out it was harmful. Now, when I run spysweeper Virtumond is always back, and I have two new thing's I haven't seen before which wont go away. One is called zoreloyum which spysweeper says "Rundll32.exe" "C\windows\system32\basadofo.dll". When I look in the system 32 folder that dll is no where to be found. Secondly, there is something called Yjebiz which is located in c\windows\okikelikufev.dll. Whatever is going on, every time I restart my computer it disables all the shields that spysweeper has running until I manually start them up again. It also does not let me use windows update, as it keeps disabling the service. Another thing is I am not able to load spybot search and destroy as it stops before it fully opens. Any help on this problem would be greatly appreciated.

LDTate

Post #2February 26, 2010, 11:27 AM UTC last edited February 26, 2010, 11:27 AM UTC

[external image: Posted Image]

Can you follow the instructions here and post the results from the suggested scans back here in your topic?
http://forums.whatthetech.com/you_Infected_t106388.html

mclass

Post #3February 26, 2010, 8:42 PM UTC

k, sorry about that, didnt follow those steps in the beginning

I ran everything except mbam, when I tried to run that it couldn't locate the .exe file, I tried unistalling a couple of times and reinstalling it, with the link in the thread, from their site and from a mirror site, but none of them worked

Here is the gmer log though
GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-02-26 14:28:33
Windows 5.1.2600 Service Pack 2
Running: lncj18hf.exe; Driver: C:\DOCUME~1\manan\LOCALS~1\Temp\awrcipow.sys

—- System - GMER 1.0.15 —-

SSDT 8A51BD50 ZwAllocateVirtualMemory
SSDT 8A5971C0 ZwCreateKey
SSDT 8A599738 ZwCreateProcess
SSDT 8A599238 ZwCreateProcessEx
SSDT 8A51C188 ZwCreateThread
SSDT 8A596AB0 ZwDeleteKey
SSDT 8A5C5180 ZwDeleteValueKey
SSDT spuc.sys ZwEnumerateKey [0xF74F5CA2]
SSDT spuc.sys ZwEnumerateValueKey [0xF74F6030]
SSDT spuc.sys ZwOpenKey [0xF74D70C0]
SSDT spuc.sys ZwQueryKey [0xF74F6108]
SSDT spuc.sys ZwQueryValueKey [0xF74F5F88]
SSDT 8A51BDC8 ZwQueueApcThread
SSDT 8A51BC60 ZwReadVirtualMemory
SSDT 8A5C6D28 ZwRenameKey
SSDT 8A51BEB8 ZwSetContextThread
SSDT 8A598270 ZwSetInformationKey
SSDT 8A51C278 ZwSetInformationProcess
SSDT 8A51BF30 ZwSetInformationThread
SSDT 8A5CF270 ZwSetValueKey
SSDT 8A51C200 ZwSuspendProcess
SSDT 8A51BE40 ZwSuspendThread
SSDT 8A5C41A8 ZwTerminateProcess
SSDT 8A51BFA8 ZwTerminateThread
SSDT 8A51BCD8 ZwWriteVirtualMemory

INT 0x62 ? 8A5C7BF8
INT 0x63 ? 8A47FF00
INT 0x73 ? 8A47FF00
INT 0x73 ? 8A47FF00
INT 0x82 ? 8A5C7BF8
INT 0xA4 ? 8A47FF00
INT 0xB4 ? 8A47FF00

—- Kernel code sections - GMER 1.0.15 —-

.text ntoskrnl.exe!_abnormal_termination + 148 804E27A4 2 Bytes [B0, 6A] {MOV AL, 0x6a}
.text ntoskrnl.exe!_abnormal_termination + 14B 804E27A7 1 Byte [8A]
? spuc.sys The system cannot find the file specified. !
.text USBPORT.SYS!DllUnload BAD0F62C 5 Bytes JMP 8A47F4E0
.text win32k.sys!EngUnmapFontFileFD + D78E BF83FC00 10 Bytes [8D, 8D, 18, FF, FF, FF, E8, …]
.text win32k.sys!EngUnmapFontFileFD + D799 BF83FC0B 27 Bytes [85, C0, 74, 1D, 8D, 8D, F0, …]
.text win32k.sys!EngUnmapFontFileFD + D7B5 BF83FC27 11 Bytes CALL BF80AB54 \SystemRoot\System32\win32k.sys (Multi-User Win32 Driver/Microsoft Corporation)
.text win32k.sys!EngUnmapFontFileFD + D7C1 BF83FC33 3 Bytes CALL BF805AC0 \SystemRoot\System32\win32k.sys (Multi-User Win32 Driver/Microsoft Corporation)
.text win32k.sys!EngUnmapFontFileFD + D7C5 BF83FC37 8 Bytes [8B, 85, 44, FF, FF, FF, 85, …] {MOV EAX, [EBP-0xbc]; TEST EAX, EAX}
.text …
.text win32k.sys!EngAllocMem + 1 BF843576 23 Bytes [FF, 55, 8B, EC, 57, 8B, 7D, …]
.text win32k.sys!EngAllocMem + 19 BF84358E 65 Bytes [71, 02, 73, C0, F6, 45, 08, …]
.text win32k.sys!EngFreeMem + 4 BF8435D0 15 Bytes [EC, 8B, 45, 08, 85, C0, 74, …]
.text win32k.sys!EngFreeMem + 15 BF8435E1 40 Bytes CALL BF802AAF \SystemRoot\System32\win32k.sys (Multi-User Win32 Driver/Microsoft Corporation)
.text win32k.sys!EngFreeMem + 3E BF84360A 27 Bytes [01, 8B, 49, 04, 89, 01, 89, …]
.text win32k.sys!EngFreeMem + 5A BF843626 5 Bytes [90, 90, 90, 90, 90] {NOP ; NOP ; NOP ; NOP ; NOP }
.text win32k.sys!EngFreeMem + 60 BF84362C 5 Bytes [FF, 55, 8B, EC, 51] {CALL [EBP-0x75]; IN AL, DX ; PUSH ECX}
.text …
.text win32k.sys!XFORMOBJ_iGetXform + 39 BF84E34F 10 Bytes [03, 58, EB, F6, 90, 90, 90, …]
.text win32k.sys!FONTOBJ_pxoGetXform + 2 BF84E35A 21 Bytes [55, 8B, EC, 8B, 45, 08, 05, …]
.text win32k.sys!FONTOBJ_pxoGetXform + 18 BF84E370 1 Byte [55]
.text win32k.sys!FONTOBJ_pxoGetXform + 18 BF84E370 25 Bytes [55, 8B, EC, 51, 51, 8D, 45, …]
.text win32k.sys!FONTOBJ_pxoGetXform + 32 BF84E38A 22 Bytes [8B, 4D, 08, 89, 01, C9, C2, …]
.text win32k.sys!FONTOBJ_pxoGetXform + 49 BF84E3A1 108 Bytes [AF, D2, EB, 4A, F7, DA, EB, …]
.text …
.text win32k.sys!EngMulDiv + 29 BF85C307 57 Bytes [C1, 99, 2B, C2, D1, F8, 99, …]
.text win32k.sys!EngMulDiv + 63 BF85C341 50 Bytes [55, 8B, EC, 8B, 45, 08, 8B, …]
.text win32k.sys!EngMulDiv + 96 BF85C374 81 Bytes JMP BF85C46B \SystemRoot\System32\win32k.sys (Multi-User Win32 Driver/Microsoft Corporation)
.text win32k.sys!EngMulDiv + E8 BF85C3C6 136 Bytes [47, 0C, 89, 46, 0C, 8B, 47, …]
.text win32k.sys!EngMulDiv + 171 BF85C44F 24 Bytes [FF, FF, 8B, 5D, 08, 2B, DA, …]
.text …

—- Kernel IAT/EAT - GMER 1.0.15 —-

IAT \WINDOWS\System32\Drivers\SCSIPORT.SYS[ntoskrnl.exe!DbgBreakPoint] 8A5C92D8
IAT pci.sys[ntoskrnl.exe!IoDetachDevice] [F7508C4C] spuc.sys
IAT pci.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack] [F7508CA0] spuc.sys
IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] [F74D8040] spuc.sys
IAT atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] [F74D813C] spuc.sys
IAT atapi.sys[HAL.dll!READ_PORT_USHORT] [F74D80BE] spuc.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] [F74D87FC] spuc.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_UCHAR] [F74D86D2] spuc.sys
IAT \SystemRoot\system32\DRIVERS\USBPORT.SYS[ntoskrnl.exe!DbgBreakPoint] 8A47F5E0
IAT \SystemRoot\System32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [F74E8048] spuc.sys
IAT \SystemRoot\System32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisDeregisterProtocol] 8A51BA88
IAT \SystemRoot\System32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisRegisterProtocol] 8A51BB80
IAT \SystemRoot\System32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisRegisterProtocol] 8A51BB80
IAT \SystemRoot\System32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisDeregisterProtocol] 8A51BA88
IAT \SystemRoot\System32\DRIVERS\psched.sys[NDIS.SYS!NdisDeregisterProtocol] 8A51BA88
IAT \SystemRoot\System32\DRIVERS\psched.sys[NDIS.SYS!NdisRegisterProtocol] 8A51BB80
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisRegisterProtocol] 8A51BB80
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisDeregisterProtocol] 8A51BA88
IAT \SystemRoot\System32\DRIVERS\tcpip.sys[NDIS.SYS!NdisRegisterProtocol] 8A51BB80
IAT \SystemRoot\System32\DRIVERS\wanarp.sys[NDIS.SYS!NdisDeregisterProtocol] 8A51BA88
IAT \SystemRoot\System32\DRIVERS\wanarp.sys[NDIS.SYS!NdisRegisterProtocol] 8A51BB80
IAT \SystemRoot\System32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisRegisterProtocol] 8A51BB80
IAT \SystemRoot\System32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisDeregisterProtocol] 8A51BA88

—- Devices - GMER 1.0.15 —-

Device \FileSystem\Ntfs \Ntfs 8A5C61F8

AttachedDevice \FileSystem\Ntfs \Ntfs ssfs0bbc.sys (Spy Sweeper FileSystem Filter Driver/Webroot Software, Inc. (www.webroot.com))

Device \FileSystem\Fastfat \FatCdrom 89AE01F8
Device \Driver\Tcpip \Device\Ip 8A040190
Device \Driver\usbuhci \Device\USBPDO-0 8A4D3500
Device \Driver\usbuhci \Device\USBPDO-1 8A4D3500
Device \Driver\usbuhci \Device\USBPDO-2 8A4D3500
Device \Driver\usbuhci \Device\USBPDO-3 8A4D3500
Device \Driver\usbehci \Device\USBPDO-4 8A4411F8
Device \Driver\Tcpip \Device\Tcp 8A040190
Device \Driver\Ftdisk \Device\HarddiskVolume1 8A55B1F8
Device \Driver\Cdrom \Device\CdRom0 8A440500
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 8A5C71F8
Device \Driver\atapi \Device\Ide\IdePort0 8A5C71F8
Device \Driver\atapi \Device\Ide\IdePort1 8A5C71F8
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-e 8A5C71F8
Device \Driver\NetBT \Device\NetBt_Wins_Export 8A0301F8
Device \Driver\NetBT \Device\NetbiosSmb 8A0301F8
Device \Driver\NetBT \Device\NetBT_Tcpip_{73335873-1535-4E5C-A487-1DF72C0EAEC1} 8A0301F8
Device \Driver\Tcpip \Device\Udp 8A040190
Device \Driver\Tcpip \Device\RawIp 8A040190
Device \Driver\usbuhci \Device\USBFDO-0 8A4D3500
Device \Driver\usbuhci \Device\USBFDO-1 8A4D3500
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 89B3D1F8
Device \Driver\Tcpip \Device\IPMULTICAST 8A040190
Device \Driver\usbuhci \Device\USBFDO-2 8A4D3500
Device \FileSystem\MRxSmb \Device\LanmanRedirector 89B3D1F8
Device \Driver\usbuhci \Device\USBFDO-3 8A4D3500
Device \Driver\usbehci \Device\USBFDO-4 8A4411F8
Device \Driver\Ftdisk \Device\FtControl 8A55B1F8
Device \FileSystem\Fastfat \Fat 89AE01F8

AttachedDevice \FileSystem\Fastfat \Fat ssfs0bbc.sys (Spy Sweeper FileSystem Filter Driver/Webroot Software, Inc. (www.webroot.com))

Device \FileSystem\Cdfs \Cdfs 89B02500

—- Registry - GMER 1.0.15 —-

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xF5 0x1C 0x98 0x50 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x84 0xCE 0x7E 0xD4 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x38 0xAD 0x0B 0x89 …
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xF5 0x1C 0x98 0x50 …
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x84 0xCE 0x7E 0xD4 …
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x38 0xAD 0x0B 0x89 …
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run@zoreloyum Rundll32.exe "c:\windows\system32\wapufumi.dll",a
Reg HKLM\SOFTWARE\Classes\CLSID\{23234ea1-eefa-479d-b101-1ca659757bcf}\InprocServer32@ c:\windows\system32\basadofo.dll

—- EOF - GMER 1.0.15 —-

LDTate

Post #4February 27, 2010, 1:35 AM UTC

Download ComboFix from one of these locations:

Link 1
Link 2 If using this link, Right Click and select Save As.

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs
Double click on ComboFix.exe & follow the prompts.

Notes: Combofix will run without the Recovery Console installed. Skip the Recovery Console part if you're running Vista or Windows 7.

Note: If you have SP3, use the SP2 package.If Vista or Windows 7, skip the Recovery Console part
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt using Copy / Paste in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Give it atleast 20-30 minutes to finish if needed.

Also please describe how your computer behaves at the moment.

mclass

Post #5February 27, 2010, 4:31 AM UTC

At the moment my computer has been running fine, it is noticeably slower then before, but I guess thats expected. Every time I exit my browser I get some ad's popping up and at times in the processes there is rundll32.exe which I've never seen there either and it seems to be part of the problem.

Anyways heres the combofix log
ComboFix 10-02-26.01 - manan 02/26/2010 21:45:19.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.2039.1677 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\documents and settings\manan\Local Settings\Application Data\{31A567BD-41C3-434E-BA09-6F6241605C42}
c:\documents and settings\manan\Local Settings\Application Data\{31A567BD-41C3-434E-BA09-6F6241605C42}\chrome.manifest
c:\documents and settings\manan\Local Settings\Application Data\{31A567BD-41C3-434E-BA09-6F6241605C42}\chrome\content\_cfg.js
c:\documents and settings\manan\Local Settings\Application Data\{31A567BD-41C3-434E-BA09-6F6241605C42}\chrome\content\overlay.xul
c:\documents and settings\manan\Local Settings\Application Data\{31A567BD-41C3-434E-BA09-6F6241605C42}\install.rdf
C:\install.exe
c:\program files\Cheat Engine\dbk32.sys
c:\program files\hackhound.txt
c:\program files\Mozilla Firefox\components\npclntax.xpt
c:\program files\wp3.dat
c:\program files\wp4.dat
c:\recycler\S-1-5-21-1177238915-746137067-725345543-1003
c:\recycler\S-1-5-21-1812479652-463594114-1775889662-1003
c:\recycler\S-1-5-21-2224147106-3917340456-3939387562-1003
c:\recycler\S-1-5-21-3966768002-3979761680-4275377042-1003
c:\windows\inf\dm.PNF
c:\windows\setup.exe
c:\windows\smdat32m.sys
c:\windows\system32\fiwokibi.dll
c:\windows\system32\limepuye.dll
c:\windows\system32\sasajuye.dll
c:\windows\system32\wesapodi(2).dll
c:\windows\system32\yunadidi.dll
c:\windows\Tasks\aqmejvsy.job
c:\windows\Tasks\vrtunyry.job

—– BITS: Possible infected sites —–

hxxp://77.74.48.111
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_RPCPATCH

((((((((((((((((((((((((( Files Created from 2010-01-27 to 2010-02-27 )))))))))))))))))))))))))))))))
.

2010-02-26 17:36 . 2010-02-26 17:36 ——– d—–w- c:\documents and settings\manan\Application Data\Malwarebytes
2010-02-26 17:36 . 2010-02-26 17:36 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-02-25 22:12 . 2010-02-25 22:27 ——– d—–w- c:\documents and settings\manan\Application Data\Systweak
2010-02-25 22:11 . 2010-02-25 22:11 ——– d—–w- c:\documents and settings\All Users\Application Data\MyDefrag
2010-02-14 20:26 . 2010-02-14 20:26 ——– d—–w- c:\documents and settings\All Users\Application Data\RoboForm
2010-02-07 17:47 . 2010-02-07 17:47 ——– d—–w- c:\documents and settings\All Users\Application Data\Azureus
2010-02-07 17:47 . 2010-02-25 22:29 ——– d—–w- c:\documents and settings\manan\Application Data\Azureus
2010-02-04 22:42 . 2010-02-04 22:42 ——– d—–w- c:\documents and settings\All Users\Application Data\JCreator
2010-02-04 22:42 . 2010-02-04 22:42 ——– d—–w- c:\documents and settings\manan\Application Data\JCreator

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-27 03:51 . 2009-11-17 03:55 ——– d—–w- c:\program files\Cheat Engine
2010-02-26 17:50 . 2010-02-26 17:48 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-02-26 17:44 . 2004-07-11 22:54 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-02-26 17:34 . 2010-02-26 17:34 ——– d—–w- c:\program files\ERUNT
2010-02-26 11:17 . 2008-11-04 20:10 ——– d—–w- c:\documents and settings\All Users\Application Data\Google Updater
2010-02-25 22:31 . 2009-06-04 21:21 164 —-a-w- c:\windows\install.dat
2010-02-25 22:27 . 2010-02-25 22:10 ——– d—–w- c:\program files\Advanced System Optimizer 3
2010-02-25 22:11 . 2010-02-07 17:46 ——– d—–w- c:\program files\Vuze
2010-02-25 21:13 . 2010-02-24 22:54 120 —-a-w- c:\windows\Btucacudezenoc.dat
2010-02-25 21:13 . 2010-02-24 22:54 0 —-a-w- c:\windows\Ksegagoxutuxun.bin
2010-02-21 06:23 . 2009-11-27 06:23 ——– d—–w- c:\program files\JDownloader
2010-02-16 04:38 . 2010-02-16 04:38 ——– d—–w- c:\program files\MP3Gain
2010-02-14 20:26 . 2010-02-14 20:26 ——– d—–w- c:\program files\Siber Systems
2010-02-07 17:45 . 2006-10-13 01:01 ——– d—–w- c:\documents and settings\manan\Application Data\BitTorrent
2010-02-07 17:45 . 2006-10-13 00:56 ——– d—–w- c:\program files\BitTorrent
2010-02-07 16:54 . 2010-02-07 13:31 ——– d—–w- c:\program files\schtml
2010-02-07 16:39 . 2010-02-07 13:26 36 —-a-w- c:\program files\skynet.dat
2010-02-04 22:42 . 2009-08-24 20:15 ——– d—–w- c:\program files\Xinox Software
2010-01-24 00:47 . 2008-08-01 21:54 ——– d—–w- c:\program files\Safari
2010-01-17 21:08 . 2006-07-31 22:39 ——– d—–w- c:\documents and settings\manan\Application Data\U3
2010-01-07 22:07 . 2010-02-26 17:48 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 22:07 . 2010-02-26 17:48 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
1601-01-01 00:03 . 1601-01-01 00:03 95232 –sha-w- c:\windows\system32\basadofo.dll
2009-08-13 20:59 . 2009-08-13 20:59 53248 –sha-w- c:\windows\system32\gumeyesu.dll.tmp
1601-01-01 00:03 . 1601-01-01 00:03 60928 –sha-w- c:\windows\system32\sikasiso.dll
2009-08-13 20:59 . 2009-08-13 20:59 53248 –sha-w- c:\windows\system32\sivepena.dll.tmp
1601-01-01 00:03 . 1601-01-01 00:03 94720 –sha-w- c:\windows\system32\wapufumi.dll
2009-08-13 20:59 . 2009-08-13 20:59 53248 –sha-w- c:\windows\system32\zirinuva.dll.tmp
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\manan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-08-31 133104]
"RoboForm"="c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2010-02-14 160592]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nmctxth"="c:\program files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2008-12-12 642856]
"Linksys Wireless Manager"="c:\program files\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe" [2009-05-11 1348144]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-09-09 305440]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"zoreloyum"="c:\windows\system32\basadofo.dll" [1601-01-01 95232]
"SpySweeper"="c:\program files\Webroot\Spy Sweeper\SpySweeperUI.exe" [2009-11-06 6515784]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"RoboForm"="c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2010-02-14 160592]

c:\documents and settings\manan\Start Menu\Programs\Startup\
PowerReg Scheduler.exe [2008-7-5 189952]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"GreyMSIAds"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler]
"{23234ea1-eefa-479d-b101-1ca659757bcf}"= "c:\windows\system32\basadofo.dll" [1601-01-01 95232]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"minebimuf"= {23234ea1-eefa-479d-b101-1ca659757bcf} - c:\windows\system32\basadofo.dll [1601-01-01 95232]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli HTHATD.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WebrootSpySweeperService]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WRConsumerService]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^manan^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
path=c:\documents and settings\manan\Start Menu\Programs\Startup\LimeWire On Startup.lnk
backup=c:\windows\pss\LimeWire On Startup.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^manan^Start Menu^Programs^Startup^PowerReg Scheduler V3.exe]
path=c:\documents and settings\manan\Start Menu\Programs\Startup\PowerReg Scheduler V3.exe
backup=c:\windows\pss\PowerReg Scheduler V3.exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^manan^Start Menu^Programs^Startup^Stardock ObjectDock.lnk]
path=c:\documents and settings\manan\Start Menu\Programs\Startup\Stardock ObjectDock.lnk
backup=c:\windows\pss\Stardock ObjectDock.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^manan^Start Menu^Programs^Startup^Trillian.lnk]
path=c:\documents and settings\manan\Start Menu\Programs\Startup\Trillian.lnk
backup=c:\windows\pss\Trillian.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^manan^Start Menu^Programs^Startup^Xfire.lnk]
path=c:\documents and settings\manan\Start Menu\Programs\Startup\Xfire.lnk
backup=c:\windows\pss\Xfire.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CHotkey]
2003-06-03 19:01 496640 —-a-w- c:\windows\zHotkey.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2004-08-04 12:00 15360 ——w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2004-11-02 00:59 126976 —-a-r- c:\windows\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2004-11-02 01:03 155648 —-a-r- c:\windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMEKRMIG6.1]
2002-08-29 12:00 44032 —-a-w- c:\windows\ime\imkr6_1\imekrmig.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
2004-08-04 05:31 208952 —-a-w- c:\windows\ime\imjp8_1\imjpmig.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2009-09-09 02:09 305440 —-a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2004-10-13 16:24 1694208 –sh–w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-09-05 06:54 417792 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
2006-03-01 08:22 577536 —-a-r- c:\windows\SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpySweeper]
2009-11-06 21:19 6515784 —-a-w- c:\program files\Webroot\Spy Sweeper\SpySweeperUI.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2005-04-13 08:48 36975 —-a-w- c:\program files\Java\jre1.5.0_03\bin\jusched.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Nexon\\MapleStory\\MapleStory.exe"=
"c:\\Nexon\\MapleStory\\Patcher.exe"=
"c:\\Program Files\\Safari\\Safari.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Vuze\\Azureus.exe"=

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [6/28/2008 8:22 PM 717296]
R0 ssfs0bbc;ssfs0bbc;c:\windows\system32\drivers\ssfs0bbc.sys [4/21/2009 5:27 PM 29808]
R2 NIOC;NIOC Service;c:\windows\system32\NIOC.sys [9/27/2002 6:21 PM 22912]
R2 WRConsumerService;Webroot Client Service;c:\program files\Webroot\Spy Sweeper\WRConsumerService.exe [6/4/2009 3:28 PM 1201640]
R2 WZCBDLService;WZCBDL Service;c:\program files\WZCBDL Service\WZCBDLS.exe [3/19/2002 12:15 PM 36864]
R3 rt2870;Linksys 802.11n USB Wireless LAN Card Driver;c:\windows\system32\drivers\rt2870.sys [8/2/2009 10:54 AM 709248]
R3 vkeyfdo;Virtual Keybord Function Driver;c:\windows\system32\drivers\vkeyfdo.sys [10/2/2008 2:00 AM 11336]
S2 clr_optimization_v4.0.21006_32;Microsoft .NET Framework NGEN v4.0.21006_X86;c:\windows\Microsoft.NET\Framework\v4.0.21006\mscorsvw.exe [10/7/2009 1:44 AM 129856]
S3 FeMouWDM;Fellowes Mouse Driver;c:\windows\system32\DRIVERS\FeMouWDM.sys –> c:\windows\system32\DRIVERS\FeMouWDM.sys [?]
S3 geebers12;geebers12;\??\c:\documents and settings\manan\Desktop\Buffy Engine\nvid888.sys –> c:\documents and settings\manan\Desktop\Buffy Engine\nvid888.sys [?]
S3 kaspersky1;kaspersky1;\??\c:\documents and settings\manan\Desktop\S3NSA_4__S4NSA_\S3NSA 4 [S4NSA]\AM I\FEMALE\Working UCE's\Kaspersky2 [cracked by me]\kaspersky.sys –> c:\documents and settings\manan\Desktop\S3NSA_4__S4NSA_\S3NSA 4 [S4NSA]\AM I\FEMALE\Working UCE's\Kaspersky2 [cracked by me]\kaspersky.sys [?]
S3 maxD20081102;maxD20081102;c:\documents and settings\manan\Desktop\Manan's stuff\wannabot\iMax Macro 4.8\max20081102.sys [2/2/2010 5:26 PM 11776]
S3 NETR33X;D-Link Air Wireless Adapter(RTL) NT Driver;c:\windows\system32\drivers\NETR33X.sys [12/3/2003 11:02 PM 158976]
S3 sejt1;sejt1;\??\c:\documents and settings\manan\Desktop\S3NSA_4__S4NSA_\S3NSA 4 [S4NSA]\AM I\FEMALE\Working UCE's\Akuma Engine\sejt.sys –> c:\documents and settings\manan\Desktop\S3NSA_4__S4NSA_\S3NSA 4 [S4NSA]\AM I\FEMALE\Working UCE's\Akuma Engine\sejt.sys [?]
S3 serum1;serum1;\??\c:\documents and settings\manan\Desktop\serum\serum.sys –> c:\documents and settings\manan\Desktop\serum\serum.sys [?]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\d:\ntglm7x.sys –> d:\NTGLM7X.sys [?]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.21006\WPF\WPFFontCache_v0400.exe [10/7/2009 1:44 AM 752984]
S3 xp1;xp1;\??\c:\documents and settings\manan\Desktop\xpengine\xp.sys –> c:\documents and settings\manan\Desktop\xpengine\xp.sys [?]
.
Contents of the 'Scheduled Tasks' folder

2010-02-27 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-11-04 21:08]

2010-02-27 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2555438207-227717993-4258109870-1005Core.job
- c:\documents and settings\manan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-08-31 23:06]

2010-02-27 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2555438207-227717993-4258109870-1005UA.job
- c:\documents and settings\manan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-08-31 23:06]

2010-02-26 c:\windows\Tasks\wrSpySweeper_L1CEC862FBE2F4C4AA82D2FDF21777497.job
- c:\program files\Webroot\Spy Sweeper\SpySweeperUI.exe [2006-07-24 21:19]

2010-02-26 c:\windows\Tasks\wrSpySweeper_L1CEC862FBE2F4C4AA82D2FDF21777497.job
- c:\program files\Webroot\Spy Sweeper\SpySweeperUI.exe [2006-07-24 21:19]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.cubs.com/
mSearch Bar = about:blank
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uCustomizeSearch =
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &AIM Search - c:\program files\AIM Toolbar\AIMBar.dll/aimsearch.htm
IE: Customize Menu - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Fill Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
IE: RoboForm Toolbar - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
IE: Save Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {2931566C-B8A6-46C5-BF4D-E6AB9251E953} - hxxp://file.nx.com/activex/public_new/nxpm.cab
FF - ProfilePath - c:\documents and settings\manan\Application Data\Mozilla\Firefox\Profiles\fvxk1fuy.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=megaup&p=
FF - component: c:\program files\Siber Systems\AI RoboForm\Firefox\components\rfproxy_31.dll
FF - plugin: c:\documents and settings\All Users\Application Data\NexonUS\NGM\npNxGameUS.dll
FF - plugin: c:\documents and settings\manan\Local Settings\Application Data\Google\Update\1.2.183.17\npGoogleOneClick8.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -

BHO-{A057A204-BACC-4D26-C39E-35F1D2A32EC8} - (no file)
BHO-{e2c7a533-c498-405c-848a-943f9afbc46f} - sasajuye.dll
Toolbar-{A057A204-BACC-4D26-C39E-35F1D2A32EC8} - (no file)
WebBrowser-{A057A204-BACC-4D26-C39E-35F1D2A32EC8} - (no file)
HKLM-Run-widapefefe - fiwokibi.dll
SharedTaskScheduler-{f4a4f542-9730-4851-b947-34cc7aad47d6} - c:\windows\system32\limepuye.dll
SSODL-luyehizej-{f4a4f542-9730-4851-b947-34cc7aad47d6} - c:\windows\system32\limepuye.dll
SafeBoot-svcWRSSSDK
MSConfigStartUp-AIM - c:\program files\AIM\aim.exe
MSConfigStartUp-ares - c:\program files\Ares Lite Edition\Ares.exe
MSConfigStartUp-D-Link Air Utility - c:\program files\D-Link\Air Utility\AirCFG.exe
MSConfigStartUp-KWTray - c:\program files\Webroot\Webroot Parental Controls\WPCTray.exe
MSConfigStartUp-Microsoft Works Update Detection - c:\program files\Microsoft Works\WkDetect.exe
MSConfigStartUp-NNLL - c:\program files\Net Nanny\nnll.exe
AddRemove-{C8C8387B-A98B-44E8-807A-1A9B7F51FFDA} - c:\documents and settings\manan\Local Settings\Application Data\{436FF568-C03A-41B5-B97A-23CADCB7E6C9}\setup_blazemp.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-26 21:55
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x89C071F8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf765bfc3
\Driver\ACPI -> ACPI.sys @ 0xf7496cb8
\Driver\atapi -> 0x89c071f8
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805a0084
ParseProcedure -> ntoskrnl.exe @ 0x8056f07e
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805a0084
ParseProcedure -> ntoskrnl.exe @ 0x8056f07e
Warning: possible MBR rootkit infection !
user & kernel MBR OK

**************************************************************************
"ImagePath"="\??\c:\documents and settings\manan\Desktop\S3NSA_4__S4NSA_\S3NSA 4
[S4NSA]\AM I\FEMALE\Working UCE's\Kaspersky2 [cracked by me]\kaspersky.sys"

–
"ImagePath"="\??\c:\documents and settings\manan\Desktop\S3NSA_4__S4NSA_\S3NSA 4
[S4NSA]\AM I\FEMALE\Working UCE's\Akuma Engine\sejt.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\kaspersky1]
"ImagePath"="\??\c:\documents and settings\manan\Desktop\S3NSA_4__S4NSA_\S3NSA 4

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\sejt1]
"ImagePath"="\??\c:\documents and settings\manan\Desktop\S3NSA_4__S4NSA_\S3NSA 4
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'lsass.exe'(868)
c:\windows\HTHATD.dll

- - - - - - - > 'explorer.exe'(3252)
c:\windows\system32\basadofo.dll
c:\windows\HTHATD.dll
c:\program files\Bonjour\mdnsNSP.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\program files\Webroot\Spy Sweeper\SpySweeper.exe
c:\program files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
c:\windows\system32\wscntfy.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Webroot\Spy Sweeper\SSU.EXE
.
**************************************************************************
.
Completion time: 2010-02-26 22:26:16 - machine was rebooted
ComboFix-quarantined-files.txt 2010-02-27 04:26

Pre-Run: 8,333,086,720 bytes free
Post-Run: 8,134,057,984 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS=" Microsoft Windows XP Home Edition" /noexecute=AlwaysOff /fastdetect

- - End Of File - - 13A5AD154EB8344D317A4AB5BA573DDB

LDTate

Post #6February 27, 2010, 12:22 PM UTC

Copy/paste the text in the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text.

http://forums.whatthetech.com/Zoreloyum_Virtumond_t110542.html

File::
c:\windows\Ksegagoxutuxun.bin
c:\windows\system32\basadofo.dll
c:\windows\system32\gumeyesu.dll.tmp
c:\windows\system32\sivepena.dll.tmp
c:\windows\system32\zirinuva.dll.tmp


Collect::
c:\windows\Btucacudezenoc.dat
c:\windows\system32\sikasiso.dll
c:\windows\system32\wapufumi.dll


Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"zoreloyum"=-
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler]
"{23234ea1-eefa-479d-b101-1ca659757bcf}"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"minebimuf"=-

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:
1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe

Then post the results log using Copy / Paste

Also please describe how your computer behaves at the moment.

mclass

Post #7February 28, 2010, 3:33 AM UTC

Heres the new log, and the computer is still sluggish

ComboFix 10-02-27.04 - manan 02/27/2010 20:11:18.2.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.2039.1568 [GMT -6:00]
Running from: c:\combofix\ComboFix.exe
Command switches used :: c:\documents and settings\manan\Desktop\CFScript.txt

FILE ::
"c:\windows\Ksegagoxutuxun.bin"
"c:\windows\system32\basadofo.dll"
"c:\windows\system32\gumeyesu.dll.tmp"
"c:\windows\system32\sivepena.dll.tmp"
"c:\windows\system32\zirinuva.dll.tmp"

file zipped: c:\windows\Btucacudezenoc.dat
file zipped: c:\windows\system32\sikasiso.dll
file zipped: c:\windows\system32\wapufumi.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\Btucacudezenoc.dat
c:\windows\Ksegagoxutuxun.bin
c:\windows\system32\a.exe
c:\windows\system32\basadofo.dll
c:\windows\system32\gumeyesu.dll.tmp
c:\windows\system32\sikasiso.dll
c:\windows\system32\sivepena.dll.tmp
c:\windows\system32\wapufumi.dll
c:\windows\system32\zirinuva.dll.tmp

.
((((((((((((((((((((((((( Files Created from 2010-01-28 to 2010-02-28 )))))))))))))))))))))))))))))))
.

2010-02-26 17:48 . 2010-01-07 22:07 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-26 17:48 . 2010-02-26 17:50 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-02-26 17:48 . 2010-01-07 22:07 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-02-26 17:36 . 2010-02-26 17:36 ——– d—–w- c:\documents and settings\manan\Application Data\Malwarebytes
2010-02-26 17:36 . 2010-02-26 17:36 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-02-26 17:34 . 2010-02-26 17:34 ——– d—–w- c:\program files\ERUNT
2010-02-26 01:17 . 2004-08-04 12:00 82944 —h-tw- c:\windows\system32\156bd3dc.dll
2010-02-26 01:17 . 2004-08-04 12:00 82944 —h-tw- c:\windows\system32\14f45a35.dll
2010-02-26 00:13 . 2009-08-07 01:23 274288 —-a-w- c:\windows\system32\mucltui.dll
2010-02-25 22:12 . 2010-02-25 22:27 ——– d—–w- c:\documents and settings\manan\Application Data\Systweak
2010-02-25 22:11 . 2010-02-25 22:11 ——– d—–w- c:\documents and settings\All Users\Application Data\MyDefrag
2010-02-25 22:10 . 2010-02-25 22:27 ——– d—–w- c:\program files\Advanced System Optimizer 3
2010-02-24 23:38 . 2004-08-04 12:00 82944 —h-tw- c:\windows\system32\940df31.dll
2010-02-24 23:38 . 2004-08-04 12:00 82944 —h-tw- c:\windows\system32\380953c.dll
2010-02-24 21:05 . 2004-08-04 12:00 82944 —h-tw- c:\windows\system32\206fde5e.dll
2010-02-24 21:05 . 2004-08-04 12:00 82944 —h-tw- c:\windows\system32\15a00080.dll
2010-02-21 18:38 . 2004-08-04 12:00 82944 —h-tw- c:\windows\system32\8459f09.dll
2010-02-21 18:38 . 2004-08-04 12:00 82944 —h-tw- c:\windows\system32\19a5fe1c.dll
2010-02-16 04:51 . 2004-08-04 12:00 82944 —h-tw- c:\windows\system32\28db441e.dll
2010-02-16 04:51 . 2004-08-04 12:00 82944 —h-tw- c:\windows\system32\133a631.dll
2010-02-16 04:38 . 2010-02-16 04:38 ——– d—–w- c:\program files\MP3Gain
2010-02-15 20:06 . 2004-08-04 12:00 82944 —h-tw- c:\windows\system32\359c1f0.dll
2010-02-15 20:06 . 2004-08-04 12:00 82944 —h-tw- c:\windows\system32\2670d996.dll
2010-02-15 02:22 . 2004-08-04 12:00 82944 —h-tw- c:\windows\system32\f93c605.dll
2010-02-15 02:22 . 2004-08-04 12:00 82944 —h-tw- c:\windows\system32\32af7e0.dll
2010-02-14 20:26 . 2010-02-14 20:26 ——– d—–w- c:\documents and settings\All Users\Application Data\RoboForm
2010-02-14 20:26 . 2010-02-14 20:26 ——– d—–w- c:\program files\Siber Systems
2010-02-14 18:08 . 2004-08-04 12:00 82944 —h-tw- c:\windows\system32\37dfb64.dll
2010-02-14 18:08 . 2004-08-04 12:00 82944 —h-tw- c:\windows\system32\10dc7944.dll
2010-02-13 07:55 . 2004-08-04 12:00 82944 —h-tw- c:\windows\system32\f8dca01.dll
2010-02-13 07:55 . 2004-08-04 12:00 82944 —h-tw- c:\windows\system32\1a69d938.dll
2010-02-13 07:51 . 2004-08-04 12:00 82944 —h-tw- c:\windows\system32\b5d5300.dll
2010-02-13 07:51 . 2004-08-04 12:00 82944 —h-tw- c:\windows\system32\1bc3b18.dll
2010-02-12 22:38 . 2004-08-04 12:00 82944 —h-tw- c:\windows\system32\1f662798.dll
2010-02-12 22:38 . 2004-08-04 12:00 82944 —h-tw- c:\windows\system32\2f4a3e0a.dll
2010-02-12 21:19 . 2004-08-04 12:00 82944 —h-tw- c:\windows\system32\dc69610.dll
2010-02-12 21:19 . 2004-08-04 12:00 82944 —h-tw- c:\windows\system32\2720d4c.dll
2010-02-07 20:48 . 2004-08-04 12:00 82944 —h-tw- c:\windows\system32\7d7144.dll
2010-02-07 20:48 . 2004-08-04 12:00 82944 —h-tw- c:\windows\system32\149fc9.dll
2010-02-07 17:47 . 2010-02-07 17:47 ——– d—–w- c:\documents and settings\All Users\Application Data\Azureus
2010-02-07 17:47 . 2010-02-25 22:29 ——– d—–w- c:\documents and settings\manan\Application Data\Azureus
2010-02-07 17:46 . 2010-02-25 22:11 ——– d—–w- c:\program files\Vuze
2010-02-07 16:55 . 2010-02-07 16:55 ——– d—–w- c:\windows\system32\wbem\Repository
2010-02-07 13:26 . 2010-02-07 16:39 36 —-a-w- c:\program files\skynet.dat
2010-02-04 22:42 . 2010-02-04 22:42 ——– d—–w- c:\documents and settings\All Users\Application Data\JCreator
2010-02-04 22:42 . 2010-02-04 22:42 ——– d—–w- c:\documents and settings\manan\Application Data\JCreator
2010-02-04 03:53 . 2004-08-04 12:00 82944 —h-tw- c:\windows\system32\be0377e.dll
2010-02-04 03:53 . 2004-08-04 12:00 82944 —h-tw- c:\windows\system32\2e6c86ae.dll
2010-02-04 00:09 . 2004-08-04 12:00 82944 —h-tw- c:\windows\system32\fa5524e.dll
2010-02-04 00:09 . 2004-08-04 12:00 82944 —h-tw- c:\windows\system32\10d9e5fb.dll
2010-02-02 22:43 . 2004-08-04 12:00 82944 —h-tw- c:\windows\system32\2d07c222.dll
2010-02-02 22:43 . 2004-08-04 12:00 82944 —h-tw- c:\windows\system32\1e374708.dll
2010-02-02 22:42 . 2004-08-04 12:00 82944 —h-tw- c:\windows\system32\b6634dc.dll
2010-02-02 22:42 . 2004-08-04 12:00 82944 —h-tw- c:\windows\system32\7bdb0c6.dll
2010-02-02 03:53 . 2004-08-04 12:00 82944 —h-tw- c:\windows\system32\22b31d88.dll
2010-02-02 03:53 . 2004-08-04 12:00 82944 —h-tw- c:\windows\system32\1b419491.dll
2010-01-31 22:55 . 2004-08-04 12:00 82944 —h-tw- c:\windows\system32\c8a522d.dll
2010-01-31 22:55 . 2004-08-04 12:00 82944 —h-tw- c:\windows\system32\4c0793a.dll
2010-01-31 22:23 . 2004-08-04 12:00 82944 —h-tw- c:\windows\system32\d7925f4.dll
2010-01-31 22:23 . 2004-08-04 12:00 82944 —h-tw- c:\windows\system32\2bfe1cc8.dll
2010-01-29 04:45 . 2004-08-04 12:00 82944 —h-tw- c:\windows\system32\50dc000.dll
2010-01-29 04:45 . 2004-08-04 12:00 82944 —h-tw- c:\windows\system32\342cdb.dll
2010-01-29 04:45 . 2004-08-04 12:00 82944 —h-tw- c:\windows\system32\b4a0c10.dll
2010-01-29 04:45 . 2004-08-04 12:00 82944 —h-tw- c:\windows\system32\19aa7b30.dll
2010-01-29 04:41 . 2004-08-04 12:00 82944 —h-tw- c:\windows\system32\5810c4.dll
2010-01-29 04:41 . 2004-08-04 12:00 82944 —h-tw- c:\windows\system32\1fcc8b4.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-28 01:21 . 2005-09-11 21:23 ——– d—–w- c:\program files\Microsoft Works
2010-02-27 12:18 . 2008-11-04 20:10 ——– d—–w- c:\documents and settings\All Users\Application Data\Google Updater
2010-02-27 03:51 . 2009-11-17 03:55 ——– d—–w- c:\program files\Cheat Engine
2010-02-26 17:44 . 2004-07-11 22:54 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-02-25 22:31 . 2009-06-04 21:21 164 —-a-w- c:\windows\install.dat
2010-02-21 06:23 . 2009-11-27 06:23 ——– d—–w- c:\program files\JDownloader
2010-02-07 17:45 . 2006-10-13 01:01 ——– d—–w- c:\documents and settings\manan\Application Data\BitTorrent
2010-02-07 17:45 . 2006-10-13 00:56 ——– d—–w- c:\program files\BitTorrent
2010-02-04 22:42 . 2009-08-24 20:15 ——– d—–w- c:\program files\Xinox Software
2010-01-24 00:47 . 2008-08-01 21:54 ——– d—–w- c:\program files\Safari
2010-01-17 21:08 . 2006-07-31 22:39 ——– d—–w- c:\documents and settings\manan\Application Data\U3
2009-12-31 16:14 . 2004-08-04 12:00 352640 —-a-w- c:\windows\system32\drivers\srv.sys
2009-12-22 05:42 . 2004-08-04 12:00 662016 —-a-w- c:\windows\system32\wininet.dll
2009-12-22 05:42 . 2004-08-04 12:00 81920 —-a-w- c:\windows\system32\ieencode.dll
2009-12-16 12:58 . 2002-01-01 11:28 343040 —-a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:35 . 2004-08-04 12:00 33280 —-a-w- c:\windows\system32\csrsrv.dll
2009-12-04 14:41 . 2004-08-04 12:00 453760 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\manan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-08-31 133104]
"RoboForm"="c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2010-02-14 160592]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nmctxth"="c:\program files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2008-12-12 642856]
"Linksys Wireless Manager"="c:\program files\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe" [2009-05-11 1348144]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-09-09 305440]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"SpySweeper"="c:\program files\Webroot\Spy Sweeper\SpySweeperUI.exe" [2009-11-06 6515784]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"RoboForm"="c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2010-02-14 160592]

c:\documents and settings\manan\Start Menu\Programs\Startup\
PowerReg Scheduler.exe [2008-7-5 189952]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"GreyMSIAds"= 0 (0x0)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli HTHATD.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WebrootSpySweeperService]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WRConsumerService]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^manan^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
path=c:\documents and settings\manan\Start Menu\Programs\Startup\LimeWire On Startup.lnk
backup=c:\windows\pss\LimeWire On Startup.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^manan^Start Menu^Programs^Startup^PowerReg Scheduler V3.exe]
path=c:\documents and settings\manan\Start Menu\Programs\Startup\PowerReg Scheduler V3.exe
backup=c:\windows\pss\PowerReg Scheduler V3.exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^manan^Start Menu^Programs^Startup^Stardock ObjectDock.lnk]
path=c:\documents and settings\manan\Start Menu\Programs\Startup\Stardock ObjectDock.lnk
backup=c:\windows\pss\Stardock ObjectDock.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^manan^Start Menu^Programs^Startup^Trillian.lnk]
path=c:\documents and settings\manan\Start Menu\Programs\Startup\Trillian.lnk
backup=c:\windows\pss\Trillian.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^manan^Start Menu^Programs^Startup^Xfire.lnk]
path=c:\documents and settings\manan\Start Menu\Programs\Startup\Xfire.lnk
backup=c:\windows\pss\Xfire.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CHotkey]
2003-06-03 19:01 496640 —-a-w- c:\windows\zHotkey.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2004-08-04 12:00 15360 ——w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2004-11-02 00:59 126976 —-a-r- c:\windows\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2004-11-02 01:03 155648 —-a-r- c:\windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMEKRMIG6.1]
2002-08-29 12:00 44032 —-a-w- c:\windows\ime\imkr6_1\imekrmig.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
2004-08-04 05:31 208952 —-a-w- c:\windows\ime\imjp8_1\imjpmig.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2009-09-09 02:09 305440 —-a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2004-10-13 16:24 1694208 –sh–w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-09-05 06:54 417792 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
2006-03-01 08:22 577536 —-a-r- c:\windows\SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpySweeper]
2009-11-06 21:19 6515784 —-a-w- c:\program files\Webroot\Spy Sweeper\SpySweeperUI.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2005-04-13 08:48 36975 —-a-w- c:\program files\Java\jre1.5.0_03\bin\jusched.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Nexon\\MapleStory\\MapleStory.exe"=
"c:\\Nexon\\MapleStory\\Patcher.exe"=
"c:\\Program Files\\Safari\\Safari.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Vuze\\Azureus.exe"=

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [6/28/2008 8:22 PM 717296]
R0 ssfs0bbc;ssfs0bbc;c:\windows\system32\drivers\ssfs0bbc.sys [4/21/2009 5:27 PM 29808]
R2 NIOC;NIOC Service;c:\windows\system32\NIOC.sys [9/27/2002 6:21 PM 22912]
R2 WRConsumerService;Webroot Client Service;c:\program files\Webroot\Spy Sweeper\WRConsumerService.exe [6/4/2009 3:28 PM 1201640]
R2 WZCBDLService;WZCBDL Service;c:\program files\WZCBDL Service\WZCBDLS.exe [3/19/2002 12:15 PM 36864]
R3 rt2870;Linksys 802.11n USB Wireless LAN Card Driver;c:\windows\system32\drivers\rt2870.sys [8/2/2009 10:54 AM 709248]
R3 vkeyfdo;Virtual Keybord Function Driver;c:\windows\system32\drivers\vkeyfdo.sys [10/2/2008 2:00 AM 11336]
S2 clr_optimization_v4.0.21006_32;Microsoft .NET Framework NGEN v4.0.21006_X86;c:\windows\Microsoft.NET\Framework\v4.0.21006\mscorsvw.exe [10/7/2009 1:44 AM 129856]
S3 FeMouWDM;Fellowes Mouse Driver;c:\windows\system32\DRIVERS\FeMouWDM.sys –> c:\windows\system32\DRIVERS\FeMouWDM.sys [?]
S3 geebers12;geebers12;\??\c:\documents and settings\manan\Desktop\Buffy Engine\nvid888.sys –> c:\documents and settings\manan\Desktop\Buffy Engine\nvid888.sys [?]
S3 kaspersky1;kaspersky1;\??\c:\documents and settings\manan\Desktop\S3NSA_4__S4NSA_\S3NSA 4 [S4NSA]\AM I\FEMALE\Working UCE's\Kaspersky2 [cracked by me]\kaspersky.sys –> c:\documents and settings\manan\Desktop\S3NSA_4__S4NSA_\S3NSA 4 [S4NSA]\AM I\FEMALE\Working UCE's\Kaspersky2 [cracked by me]\kaspersky.sys [?]
S3 maxD20081102;maxD20081102;c:\documents and settings\manan\Desktop\Manan's stuff\wannabot\iMax Macro 4.8\max20081102.sys [2/2/2010 5:26 PM 11776]
S3 NETR33X;D-Link Air Wireless Adapter(RTL) NT Driver;c:\windows\system32\drivers\NETR33X.sys [12/3/2003 11:02 PM 158976]
S3 sejt1;sejt1;\??\c:\documents and settings\manan\Desktop\S3NSA_4__S4NSA_\S3NSA 4 [S4NSA]\AM I\FEMALE\Working UCE's\Akuma Engine\sejt.sys –> c:\documents and settings\manan\Desktop\S3NSA_4__S4NSA_\S3NSA 4 [S4NSA]\AM I\FEMALE\Working UCE's\Akuma Engine\sejt.sys [?]
S3 serum1;serum1;\??\c:\documents and settings\manan\Desktop\serum\serum.sys –> c:\documents and settings\manan\Desktop\serum\serum.sys [?]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\d:\ntglm7x.sys –> d:\NTGLM7X.sys [?]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.21006\WPF\WPFFontCache_v0400.exe [10/7/2009 1:44 AM 752984]
S3 xp1;xp1;\??\c:\documents and settings\manan\Desktop\xpengine\xp.sys –> c:\documents and settings\manan\Desktop\xpengine\xp.sys [?]
.
Contents of the 'Scheduled Tasks' folder

2010-02-28 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-11-04 21:08]

2010-02-27 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2555438207-227717993-4258109870-1005Core.job
- c:\documents and settings\manan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-08-31 23:06]

2010-02-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2555438207-227717993-4258109870-1005UA.job
- c:\documents and settings\manan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-08-31 23:06]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.cubs.com/
mSearch Bar = about:blank
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uCustomizeSearch =
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &AIM Search - c:\program files\AIM Toolbar\AIMBar.dll/aimsearch.htm
IE: Customize Menu - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Fill Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
IE: RoboForm Toolbar - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
IE: Save Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {2931566C-B8A6-46C5-BF4D-E6AB9251E953} - hxxp://file.nx.com/activex/public_new/nxpm.cab
FF - ProfilePath - c:\documents and settings\manan\Application Data\Mozilla\Firefox\Profiles\fvxk1fuy.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=megaup&p=
FF - component: c:\program files\Siber Systems\AI RoboForm\Firefox\components\rfproxy_31.dll
FF - plugin: c:\documents and settings\All Users\Application Data\NexonUS\NGM\npNxGameUS.dll
FF - plugin: c:\documents and settings\manan\Local Settings\Application Data\Google\Update\1.2.183.17\npGoogleOneClick8.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-27 20:22
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8A5C71F8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf765bfc3
\Driver\ACPI -> ACPI.sys @ 0xf7496cb8
\Driver\atapi -> 0x8a5c71f8
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805a0084
ParseProcedure -> ntoskrnl.exe @ 0x8056f07e
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805a0084
ParseProcedure -> ntoskrnl.exe @ 0x8056f07e
Warning: possible MBR rootkit infection !
user & kernel MBR OK

**************************************************************************
"ImagePath"="\??\c:\documents and settings\manan\Desktop\S3NSA_4__S4NSA_\S3NSA 4
[S4NSA]\AM I\FEMALE\Working UCE's\Kaspersky2 [cracked by me]\kaspersky.sys"

–
"ImagePath"="\??\c:\documents and settings\manan\Desktop\S3NSA_4__S4NSA_\S3NSA 4
[S4NSA]\AM I\FEMALE\Working UCE's\Akuma Engine\sejt.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\kaspersky1]
"ImagePath"="\??\c:\documents and settings\manan\Desktop\S3NSA_4__S4NSA_\S3NSA 4

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\sejt1]
"ImagePath"="\??\c:\documents and settings\manan\Desktop\S3NSA_4__S4NSA_\S3NSA 4
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'lsass.exe'(916)
c:\windows\HTHATD.dll

- - - - - - - > 'explorer.exe'(3556)
c:\windows\HTHATD.dll
c:\program files\Bonjour\mdnsNSP.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\program files\Webroot\Spy Sweeper\SpySweeper.exe
c:\program files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
c:\windows\system32\wscntfy.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Webroot\Spy Sweeper\SSU.EXE
.
**************************************************************************
.
Completion time: 2010-02-27 20:41:01 - machine was rebooted
ComboFix-quarantined-files.txt 2010-02-28 02:40
ComboFix2.txt 2010-02-27 04:26

Pre-Run: 7,159,914,496 bytes free
Post-Run: 7,136,579,584 bytes free

- - End Of File - - 957B64C596DBFD6E5D620A22BE970222

LDTate

Post #8February 28, 2010, 12:43 PM UTC

Kaspersky2 [cracked by me]\kaspersky.sys

Did you install a cracked version of kaspersky?

Copy/paste the text in the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text.

File::
c:\windows\system32\156bd3dc.dll
c:\windows\system32\14f45a35.dll
c:\windows\system32\940df31.dll
c:\windows\system32\380953c.dll
c:\windows\system32\206fde5e.dll
c:\windows\system32\15a00080.dll
c:\windows\system32\8459f09.dll
c:\windows\system32\19a5fe1c.dll
c:\windows\system32\28db441e.dll
c:\windows\system32\133a631.dll
c:\windows\system32\359c1f0.dll
c:\windows\system32\2670d996.dll
c:\windows\system32\f93c605.dll
c:\windows\system32\32af7e0.dll
c:\windows\system32\37dfb64.dll
c:\windows\system32\10dc7944.dll
c:\windows\system32\f8dca01.dll
c:\windows\system32\1a69d938.dll
c:\windows\system32\b5d5300.dll
c:\windows\system32\1bc3b18.dll
c:\windows\system32\1f662798.dll
c:\windows\system32\2f4a3e0a.dll
c:\windows\system32\dc69610.dll
c:\windows\system32\2720d4c.dll
c:\windows\system32\7d7144.dll
c:\windows\system32\149fc9.dll
c:\windows\system32\be0377e.dll
c:\windows\system32\2e6c86ae.dll
c:\windows\system32\fa5524e.dll
c:\windows\system32\10d9e5fb.dll
c:\windows\system32\2d07c222.dll
c:\windows\system32\1e374708.dll
c:\windows\system32\b6634dc.dll
c:\windows\system32\7bdb0c6.dll
c:\windows\system32\22b31d88.dll
c:\windows\system32\1b419491.dll
c:\windows\system32\c8a522d.dll
c:\windows\system32\4c0793a.dll
c:\windows\system32\d7925f4.dll
c:\windows\system32\2bfe1cc8.dll
c:\windows\system32\50dc000.dll
c:\windows\system32\342cdb.dll
c:\windows\system32\b4a0c10.dll
c:\windows\system32\19aa7b30.dll
c:\windows\system32\5810c4.dll
c:\windows\system32\1fcc8b4.dll

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:
1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe

Then post the results log using Copy / Paste

Also please describe how your computer behaves at the moment.

mclass

Post #9March 1, 2010, 5:21 AM UTC

Hmm, not knowingly. I haven't downloaded kaspersky, The only 2 antiviruses I have used on this computer are Norton and AVG, but I deleted AVG around two years ago and since then haven't used an anti virus program. This is the first time I've been infected like this.

Anyways heres the new log
ComboFix 10-02-26.01 - manan 02/28/2010 23:05:43.3.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.2039.1607 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\manan\Desktop\CFScript.txt

FILE ::
"c:\windows\system32\10d9e5fb.dll"
"c:\windows\system32\10dc7944.dll"
"c:\windows\system32\133a631.dll"
"c:\windows\system32\149fc9.dll"
"c:\windows\system32\14f45a35.dll"
"c:\windows\system32\156bd3dc.dll"
"c:\windows\system32\15a00080.dll"
"c:\windows\system32\19a5fe1c.dll"
"c:\windows\system32\19aa7b30.dll"
"c:\windows\system32\1a69d938.dll"
"c:\windows\system32\1b419491.dll"
"c:\windows\system32\1bc3b18.dll"
"c:\windows\system32\1e374708.dll"
"c:\windows\system32\1f662798.dll"
"c:\windows\system32\1fcc8b4.dll"
"c:\windows\system32\206fde5e.dll"
"c:\windows\system32\22b31d88.dll"
"c:\windows\system32\2670d996.dll"
"c:\windows\system32\2720d4c.dll"
"c:\windows\system32\28db441e.dll"
"c:\windows\system32\2bfe1cc8.dll"
"c:\windows\system32\2d07c222.dll"
"c:\windows\system32\2e6c86ae.dll"
"c:\windows\system32\2f4a3e0a.dll"
"c:\windows\system32\32af7e0.dll"
"c:\windows\system32\342cdb.dll"
"c:\windows\system32\359c1f0.dll"
"c:\windows\system32\37dfb64.dll"
"c:\windows\system32\380953c.dll"
"c:\windows\system32\4c0793a.dll"
"c:\windows\system32\50dc000.dll"
"c:\windows\system32\5810c4.dll"
"c:\windows\system32\7bdb0c6.dll"
"c:\windows\system32\7d7144.dll"
"c:\windows\system32\8459f09.dll"
"c:\windows\system32\940df31.dll"
"c:\windows\system32\b4a0c10.dll"
"c:\windows\system32\b5d5300.dll"
"c:\windows\system32\b6634dc.dll"
"c:\windows\system32\be0377e.dll"
"c:\windows\system32\c8a522d.dll"
"c:\windows\system32\d7925f4.dll"
"c:\windows\system32\dc69610.dll"
"c:\windows\system32\f8dca01.dll"
"c:\windows\system32\f93c605.dll"
"c:\windows\system32\fa5524e.dll"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\manan\Local Settings\Application Data\{A68BA7CF-C515-4CE0-A9C7-E22CDB3F46F7}
c:\documents and settings\manan\Local Settings\Application Data\{A68BA7CF-C515-4CE0-A9C7-E22CDB3F46F7}\chrome.manifest
c:\documents and settings\manan\Local Settings\Application Data\{A68BA7CF-C515-4CE0-A9C7-E22CDB3F46F7}\chrome\content\_cfg.js
c:\documents and settings\manan\Local Settings\Application Data\{A68BA7CF-C515-4CE0-A9C7-E22CDB3F46F7}\chrome\content\overlay.xul
c:\documents and settings\manan\Local Settings\Application Data\{A68BA7CF-C515-4CE0-A9C7-E22CDB3F46F7}\install.rdf
c:\windows\system32\10d9e5fb.dll
c:\windows\system32\10dc7944.dll
c:\windows\system32\133a631.dll
c:\windows\system32\149fc9.dll
c:\windows\system32\14f45a35.dll
c:\windows\system32\156bd3dc.dll
c:\windows\system32\15a00080.dll
c:\windows\system32\19a5fe1c.dll
c:\windows\system32\19aa7b30.dll
c:\windows\system32\1a69d938.dll
c:\windows\system32\1b419491.dll
c:\windows\system32\1bc3b18.dll
c:\windows\system32\1e374708.dll
c:\windows\system32\1f662798.dll
c:\windows\system32\1fcc8b4.dll
c:\windows\system32\206fde5e.dll
c:\windows\system32\22b31d88.dll
c:\windows\system32\2670d996.dll
c:\windows\system32\2720d4c.dll
c:\windows\system32\28db441e.dll
c:\windows\system32\2bfe1cc8.dll
c:\windows\system32\2d07c222.dll
c:\windows\system32\2e6c86ae.dll
c:\windows\system32\2f4a3e0a.dll
c:\windows\system32\32af7e0.dll
c:\windows\system32\342cdb.dll
c:\windows\system32\359c1f0.dll
c:\windows\system32\37dfb64.dll
c:\windows\system32\380953c.dll
c:\windows\system32\4c0793a.dll
c:\windows\system32\50dc000.dll
c:\windows\system32\5810c4.dll
c:\windows\system32\7bdb0c6.dll
c:\windows\system32\7d7144.dll
c:\windows\system32\8459f09.dll
c:\windows\system32\940df31.dll
c:\windows\system32\b4a0c10.dll
c:\windows\system32\b5d5300.dll
c:\windows\system32\b6634dc.dll
c:\windows\system32\be0377e.dll
c:\windows\system32\c8a522d.dll
c:\windows\system32\d7925f4.dll
c:\windows\system32\dc69610.dll
c:\windows\system32\f8dca01.dll
c:\windows\system32\f93c605.dll
c:\windows\system32\fa5524e.dll

.
((((((((((((((((((((((((( Files Created from 2010-02-01 to 2010-03-01 )))))))))))))))))))))))))))))))
.

2010-02-28 04:02 . 2010-02-28 04:02 ——– d—–w- c:\windows\system32\wbem\Repository
2010-02-28 03:59 . 2010-02-28 03:59 ——– d—–w- c:\program files\schtml
2010-02-28 03:59 . 2010-02-28 03:59 ——– d—–w- c:\program files\ERUNT
2010-02-28 03:59 . 2010-02-28 03:59 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-02-28 03:55 . 2010-02-28 03:59 ——– d—–w- C:\RECYCLER(2)
2010-02-26 17:48 . 2010-01-07 22:07 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-26 17:48 . 2010-01-07 22:07 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-02-26 17:36 . 2010-02-26 17:36 ——– d—–w- c:\documents and settings\manan\Application Data\Malwarebytes
2010-02-26 17:36 . 2010-02-26 17:36 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-02-26 00:13 . 2009-08-07 01:23 274288 —-a-w- c:\windows\system32\mucltui.dll
2010-02-25 22:12 . 2010-02-25 22:27 ——– d—–w- c:\documents and settings\manan\Application Data\Systweak
2010-02-25 22:11 . 2010-02-25 22:11 ——– d—–w- c:\documents and settings\All Users\Application Data\MyDefrag
2010-02-25 22:10 . 2010-02-25 22:27 ——– d—–w- c:\program files\Advanced System Optimizer 3
2010-02-16 04:38 . 2010-02-16 04:38 ——– d—–w- c:\program files\MP3Gain
2010-02-14 20:26 . 2010-02-14 20:26 ——– d—–w- c:\documents and settings\All Users\Application Data\RoboForm
2010-02-14 20:26 . 2010-02-14 20:26 ——– d—–w- c:\program files\Siber Systems
2010-02-07 17:47 . 2010-02-07 17:47 ——– d—–w- c:\documents and settings\All Users\Application Data\Azureus
2010-02-07 17:47 . 2010-02-25 22:29 ——– d—–w- c:\documents and settings\manan\Application Data\Azureus
2010-02-07 17:46 . 2010-02-25 22:11 ——– d—–w- c:\program files\Vuze
2010-02-07 13:26 . 2010-02-07 16:39 36 —-a-w- c:\program files\skynet.dat
2010-02-04 22:42 . 2010-02-04 22:42 ——– d—–w- c:\documents and settings\All Users\Application Data\JCreator
2010-02-04 22:42 . 2010-02-04 22:42 ——– d—–w- c:\documents and settings\manan\Application Data\JCreator

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-01 02:47 . 2003-12-20 23:07 86840 —-a-w- c:\documents and settings\manan\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-03-01 01:10 . 2005-09-11 21:23 ——– d—–w- c:\program files\Microsoft Works
2010-02-28 13:19 . 2008-11-04 20:10 ——– d—–w- c:\documents and settings\All Users\Application Data\Google Updater
2010-02-27 03:51 . 2009-11-17 03:55 ——– d—–w- c:\program files\Cheat Engine
2010-02-26 17:44 . 2004-07-11 22:54 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-02-25 22:31 . 2009-06-04 21:21 164 —-a-w- c:\windows\install.dat
2010-02-24 23:24 . 2009-08-01 02:16 401408 —-a-w- c:\documents and settings\All Users\Application Data\NexonUS\NGM\NGMResource.dll
2010-02-21 06:23 . 2009-11-27 06:23 ——– d—–w- c:\program files\JDownloader
2010-02-07 17:45 . 2006-10-13 01:01 ——– d—–w- c:\documents and settings\manan\Application Data\BitTorrent
2010-02-07 17:45 . 2006-10-13 00:56 ——– d—–w- c:\program files\BitTorrent
2010-02-04 22:42 . 2009-08-24 20:15 ——– d—–w- c:\program files\Xinox Software
2010-01-24 00:47 . 2008-08-01 21:54 ——– d—–w- c:\program files\Safari
2010-01-17 21:08 . 2006-07-31 22:39 ——– d—–w- c:\documents and settings\manan\Application Data\U3
2009-12-31 16:14 . 2004-08-04 12:00 352640 —-a-w- c:\windows\system32\drivers\srv.sys
2009-12-22 05:42 . 2004-08-04 12:00 662016 ——w- c:\windows\system32\wininet.dll
2009-12-22 05:42 . 2004-08-04 12:00 1506304 —-a-w- c:\windows\system32\shdocvw(2).dll
2009-12-22 05:42 . 2004-08-04 12:00 81920 —-a-w- c:\windows\system32\ieencode.dll
2009-12-16 12:58 . 2002-01-01 11:28 343040 —-a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:35 . 2004-08-04 12:00 33280 —-a-w- c:\windows\system32\csrsrv.dll
2009-12-04 14:41 . 2004-08-04 12:00 453760 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\manan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-08-31 133104]
"RoboForm"="c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2010-02-14 160592]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nmctxth"="c:\program files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2008-12-12 642856]
"Linksys Wireless Manager"="c:\program files\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe" [2009-05-11 1348144]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-09-09 305440]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"SpySweeper"="c:\program files\Webroot\Spy Sweeper\SpySweeperUI.exe" [2009-11-06 6515784]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"RoboForm"="c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2010-02-14 160592]

c:\documents and settings\manan\Start Menu\Programs\Startup\
PowerReg Scheduler.exe [2008-7-5 189952]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"GreyMSIAds"= 0 (0x0)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli HTHATD.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WebrootSpySweeperService]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WRConsumerService]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^manan^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
path=c:\documents and settings\manan\Start Menu\Programs\Startup\LimeWire On Startup.lnk
backup=c:\windows\pss\LimeWire On Startup.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^manan^Start Menu^Programs^Startup^PowerReg Scheduler V3.exe]
path=c:\documents and settings\manan\Start Menu\Programs\Startup\PowerReg Scheduler V3.exe
backup=c:\windows\pss\PowerReg Scheduler V3.exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^manan^Start Menu^Programs^Startup^Stardock ObjectDock.lnk]
path=c:\documents and settings\manan\Start Menu\Programs\Startup\Stardock ObjectDock.lnk
backup=c:\windows\pss\Stardock ObjectDock.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^manan^Start Menu^Programs^Startup^Trillian.lnk]
path=c:\documents and settings\manan\Start Menu\Programs\Startup\Trillian.lnk
backup=c:\windows\pss\Trillian.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^manan^Start Menu^Programs^Startup^Xfire.lnk]
path=c:\documents and settings\manan\Start Menu\Programs\Startup\Xfire.lnk
backup=c:\windows\pss\Xfire.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CHotkey]
2003-06-03 19:01 496640 —-a-w- c:\windows\zHotkey.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2004-08-04 12:00 15360 ——w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2004-11-02 00:59 126976 —-a-r- c:\windows\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2004-11-02 01:03 155648 —-a-r- c:\windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMEKRMIG6.1]
2002-08-29 12:00 44032 —-a-w- c:\windows\ime\imkr6_1\imekrmig.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
2004-08-04 05:31 208952 —-a-w- c:\windows\ime\imjp8_1\imjpmig.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2009-09-09 02:09 305440 —-a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2004-10-13 16:24 1694208 –sh–w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-09-05 06:54 417792 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
2006-03-01 08:22 577536 —-a-r- c:\windows\SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpySweeper]
2009-11-06 21:19 6515784 —-a-w- c:\program files\Webroot\Spy Sweeper\SpySweeperUI.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2005-04-13 08:48 36975 —-a-w- c:\program files\Java\jre1.5.0_03\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Nexon\\MapleStory\\MapleStory.exe"=
"c:\\Nexon\\MapleStory\\Patcher.exe"=
"c:\\Program Files\\Safari\\Safari.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Vuze\\Azureus.exe"=

R?2 WZCBDLService;WZCBDL Service;c:\program files\WZCBDL Service\WZCBDLS.exe [3/19/2002 12:15 PM 36864]
R0 ssfs0bbc;ssfs0bbc;c:\windows\system32\drivers\ssfs0bbc.sys [4/21/2009 5:27 PM 29808]
R2 NIOC;NIOC Service;c:\windows\system32\NIOC.sys [9/27/2002 6:21 PM 22912]
R2 WRConsumerService;Webroot Client Service;c:\program files\Webroot\Spy Sweeper\WRConsumerService.exe [6/4/2009 3:28 PM 1201640]
R3 rt2870;Linksys 802.11n USB Wireless LAN Card Driver;c:\windows\system32\drivers\rt2870.sys [8/2/2009 10:54 AM 709248]
R3 vkeyfdo;Virtual Keybord Function Driver;c:\windows\system32\drivers\vkeyfdo.sys [10/2/2008 2:00 AM 11336]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [6/28/2008 8:22 PM 717296]
S2 clr_optimization_v4.0.21006_32;Microsoft .NET Framework NGEN v4.0.21006_X86;c:\windows\Microsoft.NET\Framework\v4.0.21006\mscorsvw.exe [10/7/2009 1:44 AM 129856]
S3 FeMouWDM;Fellowes Mouse Driver;c:\windows\system32\DRIVERS\FeMouWDM.sys –> c:\windows\system32\DRIVERS\FeMouWDM.sys [?]
S3 geebers12;geebers12;\??\c:\documents and settings\manan\Desktop\Buffy Engine\nvid888.sys –> c:\documents and settings\manan\Desktop\Buffy Engine\nvid888.sys [?]
S3 kaspersky1;kaspersky1;\??\c:\documents and settings\manan\Desktop\S3NSA_4__S4NSA_\S3NSA 4 [S4NSA]\AM I\FEMALE\Working UCE's\Kaspersky2 [cracked by me]\kaspersky.sys –> c:\documents and settings\manan\Desktop\S3NSA_4__S4NSA_\S3NSA 4 [S4NSA]\AM I\FEMALE\Working UCE's\Kaspersky2 [cracked by me]\kaspersky.sys [?]
S3 maxD20081102;maxD20081102;c:\documents and settings\manan\Desktop\Manan's stuff\wannabot\iMax Macro 4.8\max20081102.sys [2/2/2010 5:26 PM 11776]
S3 NETR33X;D-Link Air Wireless Adapter(RTL) NT Driver;c:\windows\system32\drivers\NETR33X.sys [12/3/2003 11:02 PM 158976]
S3 sejt1;sejt1;\??\c:\documents and settings\manan\Desktop\S3NSA_4__S4NSA_\S3NSA 4 [S4NSA]\AM I\FEMALE\Working UCE's\Akuma Engine\sejt.sys –> c:\documents and settings\manan\Desktop\S3NSA_4__S4NSA_\S3NSA 4 [S4NSA]\AM I\FEMALE\Working UCE's\Akuma Engine\sejt.sys [?]
S3 serum1;serum1;\??\c:\documents and settings\manan\Desktop\serum\serum.sys –> c:\documents and settings\manan\Desktop\serum\serum.sys [?]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\d:\ntglm7x.sys –> d:\NTGLM7X.sys [?]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.21006\WPF\WPFFontCache_v0400.exe [10/7/2009 1:44 AM 752984]
S3 xp1;xp1;\??\c:\documents and settings\manan\Desktop\xpengine\xp.sys –> c:\documents and settings\manan\Desktop\xpengine\xp.sys [?]
.
Contents of the 'Scheduled Tasks' folder

2010-03-01 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-11-04 21:08]

2010-03-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2555438207-227717993-4258109870-1005Core.job
- c:\documents and settings\manan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-08-31 23:06]

2010-03-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2555438207-227717993-4258109870-1005UA.job
- c:\documents and settings\manan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-08-31 23:06]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.cubs.com/
mSearch Bar = about:blank
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uCustomizeSearch =
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &AIM Search - c:\program files\AIM Toolbar\AIMBar.dll/aimsearch.htm
IE: Customize Menu - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Fill Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
IE: RoboForm Toolbar - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
IE: Save Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {2931566C-B8A6-46C5-BF4D-E6AB9251E953} - hxxp://file.nx.com/activex/public_new/nxpm.cab
FF - ProfilePath - c:\documents and settings\manan\Application Data\Mozilla\Firefox\Profiles\fvxk1fuy.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=megaup&p=
FF - component: c:\program files\Siber Systems\AI RoboForm\Firefox\components\rfproxy_31.dll
FF - plugin: c:\documents and settings\All Users\Application Data\NexonUS\NGM\npNxGameUS.dll
FF - plugin: c:\documents and settings\manan\Local Settings\Application Data\Google\Update\1.2.183.17\npGoogleOneClick8.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-28 23:11
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
"ImagePath"="\??\c:\documents and settings\manan\Desktop\S3NSA_4__S4NSA_\S3NSA 4
[S4NSA]\AM I\FEMALE\Working UCE's\Kaspersky2 [cracked by me]\kaspersky.sys"

–
"ImagePath"="\??\c:\documents and settings\manan\Desktop\S3NSA_4__S4NSA_\S3NSA 4
[S4NSA]\AM I\FEMALE\Working UCE's\Akuma Engine\sejt.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\kaspersky1]
"ImagePath"="\??\c:\documents and settings\manan\Desktop\S3NSA_4__S4NSA_\S3NSA 4

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\sejt1]
"ImagePath"="\??\c:\documents and settings\manan\Desktop\S3NSA_4__S4NSA_\S3NSA 4
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'lsass.exe'(1192)
c:\windows\HTHATD.dll
.
Completion time: 2010-02-28 23:15:16
ComboFix-quarantined-files.txt 2010-03-01 05:15
ComboFix2.txt 2010-03-01 05:00
ComboFix3.txt 2010-02-28 02:41
ComboFix4.txt 2010-02-27 04:26

Pre-Run: 7,204,282,368 bytes free
Post-Run: 7,184,187,392 bytes free

- - End Of File - - AB686599BDA638A37D02A9DDE5897C40

LDTate

Post #10March 1, 2010, 10:37 PM UTC

I will give you a list of free Anti-Virus programs at the bottom.

Do you know what these programs are?

c:\documents and settings\manan\Desktop\S3NSA_4__S4NSA_\S3NSA 4
[S4NSA]\AM I\FEMALE\Working UCE's\Kaspersky2 [cracked by me]\kaspersky.sys"

c:\documents and settings\manan\Desktop\S3NSA_4__S4NSA_\S3NSA 4
[S4NSA]\AM I\FEMALE\Working UCE's\Akuma Engine\sejt.sys"

Copy/paste the text in the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text.

File::
c:\documents and settings\manan\Start Menu\Programs\Startup\PowerReg Scheduler V3.exe
c:\windows\pss\PowerReg Scheduler V3.exeStartup

Registry::
[-HKLM\~\startupfolder\C:^Documents and Settings^manan^Start Menu^Programs^Startup^PowerReg Scheduler V3.exe]

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:
1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe

Then post the results log using Copy / Paste

Also please describe how your computer behaves at the moment.

Only run one AVG at a time.

Use an AntiVirus Software - Choose only one - More than one will conflict. It is very important that your computer has anti-virus software running to protect against viruses. Update Antivirus prior to manual scans as necessary or as used. Please only choose one, having more than one can cause problems, such as crashes and your computer to slow down.

Run a full scan and let us know what it finds

mclass

Post #11March 2, 2010, 4:50 AM UTC

The first file, must have come with the second file which I used for some source code on one of my java projects, though I thought i deleted both last year. Heres the new log

ComboFix 10-02-26.01 - manan 03/01/2010 22:25:16.4.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.2039.1585 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\manan\Desktop\CFScript.txt

FILE ::
"c:\documents and settings\manan\Start Menu\Programs\Startup\PowerReg Scheduler V3.exe"
"c:\windows\pss\PowerReg Scheduler V3.exeStartup"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\pss\PowerReg Scheduler V3.exeStartup

.
((((((((((((((((((((((((( Files Created from 2010-02-02 to 2010-03-02 )))))))))))))))))))))))))))))))
.

2010-02-28 04:02 . 2010-02-28 04:02 ——– d—–w- c:\windows\system32\wbem\Repository
2010-02-28 03:59 . 2010-02-28 03:59 ——– d—–w- c:\program files\schtml
2010-02-28 03:59 . 2010-02-28 03:59 ——– d—–w- c:\program files\ERUNT
2010-02-28 03:59 . 2010-02-28 03:59 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-02-28 03:55 . 2010-02-28 03:59 ——– d—–w- C:\RECYCLER(2)
2010-02-26 17:48 . 2010-01-07 22:07 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-26 17:48 . 2010-01-07 22:07 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-02-26 17:36 . 2010-02-26 17:36 ——– d—–w- c:\documents and settings\manan\Application Data\Malwarebytes
2010-02-26 17:36 . 2010-02-26 17:36 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-02-26 00:13 . 2009-08-07 01:23 274288 —-a-w- c:\windows\system32\mucltui.dll
2010-02-25 22:12 . 2010-02-25 22:27 ——– d—–w- c:\documents and settings\manan\Application Data\Systweak
2010-02-25 22:11 . 2010-02-25 22:11 ——– d—–w- c:\documents and settings\All Users\Application Data\MyDefrag
2010-02-25 22:10 . 2010-02-25 22:27 ——– d—–w- c:\program files\Advanced System Optimizer 3
2010-02-16 04:38 . 2010-02-16 04:38 ——– d—–w- c:\program files\MP3Gain
2010-02-14 20:26 . 2010-02-14 20:26 ——– d—–w- c:\documents and settings\All Users\Application Data\RoboForm
2010-02-14 20:26 . 2010-02-14 20:26 ——– d—–w- c:\program files\Siber Systems
2010-02-07 17:47 . 2010-02-07 17:47 ——– d—–w- c:\documents and settings\All Users\Application Data\Azureus
2010-02-07 17:47 . 2010-02-25 22:29 ——– d—–w- c:\documents and settings\manan\Application Data\Azureus
2010-02-07 17:46 . 2010-02-25 22:11 ——– d—–w- c:\program files\Vuze
2010-02-07 13:26 . 2010-02-07 16:39 36 —-a-w- c:\program files\skynet.dat
2010-02-04 22:42 . 2010-02-04 22:42 ——– d—–w- c:\documents and settings\All Users\Application Data\JCreator
2010-02-04 22:42 . 2010-02-04 22:42 ——– d—–w- c:\documents and settings\manan\Application Data\JCreator

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-01 21:32 . 2009-11-27 06:23 ——– d—–w- c:\program files\JDownloader
2010-03-01 20:50 . 2008-11-04 20:10 ——– d—–w- c:\documents and settings\All Users\Application Data\Google Updater
2010-03-01 02:47 . 2003-12-20 23:07 86840 —-a-w- c:\documents and settings\manan\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-03-01 01:10 . 2005-09-11 21:23 ——– d—–w- c:\program files\Microsoft Works
2010-02-27 03:51 . 2009-11-17 03:55 ——– d—–w- c:\program files\Cheat Engine
2010-02-26 17:44 . 2004-07-11 22:54 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-02-25 22:31 . 2009-06-04 21:21 164 —-a-w- c:\windows\install.dat
2010-02-24 23:24 . 2009-08-01 02:16 401408 —-a-w- c:\documents and settings\All Users\Application Data\NexonUS\NGM\NGMResource.dll
2010-02-07 17:45 . 2006-10-13 01:01 ——– d—–w- c:\documents and settings\manan\Application Data\BitTorrent
2010-02-07 17:45 . 2006-10-13 00:56 ——– d—–w- c:\program files\BitTorrent
2010-02-04 22:42 . 2009-08-24 20:15 ——– d—–w- c:\program files\Xinox Software
2010-01-24 00:47 . 2008-08-01 21:54 ——– d—–w- c:\program files\Safari
2010-01-17 21:08 . 2006-07-31 22:39 ——– d—–w- c:\documents and settings\manan\Application Data\U3
2009-12-31 16:14 . 2004-08-04 12:00 352640 —-a-w- c:\windows\system32\drivers\srv.sys
2009-12-22 05:42 . 2004-08-04 12:00 662016 ——w- c:\windows\system32\wininet.dll
2009-12-22 05:42 . 2004-08-04 12:00 1506304 —-a-w- c:\windows\system32\shdocvw(2).dll
2009-12-22 05:42 . 2004-08-04 12:00 81920 —-a-w- c:\windows\system32\ieencode.dll
2009-12-16 12:58 . 2002-01-01 11:28 343040 —-a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:35 . 2004-08-04 12:00 33280 —-a-w- c:\windows\system32\csrsrv.dll
2009-12-04 14:41 . 2004-08-04 12:00 453760 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
.

((((((((((((((((((((((((((((( SnapShot@2010-03-01_04.55.42 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-03-02 04:21 . 2010-03-02 04:21 16384 c:\windows\temp\Perflib_Perfdata_28c.dat
- 2002-01-01 11:37 . 2010-03-01 01:48 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2002-01-01 11:37 . 2010-03-01 05:35 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2002-01-01 11:37 . 2010-03-01 01:48 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2002-01-01 11:37 . 2010-03-01 05:35 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2002-01-01 11:37 . 2010-03-01 01:48 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2010-03-01 05:35 . 2010-03-01 05:35 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2005-09-11 21:31 . 2010-03-02 02:18 23040 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
- 2005-09-11 21:31 . 2010-03-01 01:30 23040 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
- 2005-09-11 21:31 . 2010-03-01 01:30 61440 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pubs.exe
+ 2005-09-11 21:31 . 2010-03-02 02:18 61440 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pubs.exe
+ 2005-09-11 21:31 . 2010-03-02 02:18 27136 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
- 2005-09-11 21:31 . 2010-03-01 01:30 27136 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
+ 2005-09-11 21:31 . 2010-03-02 02:18 11264 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
- 2005-09-11 21:31 . 2010-03-01 01:30 11264 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
- 2005-09-11 21:31 . 2010-03-01 01:30 86016 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\inficon.exe
+ 2005-09-11 21:31 . 2010-03-02 02:18 86016 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\inficon.exe
+ 2005-09-11 21:31 . 2010-03-02 02:18 12288 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
- 2005-09-11 21:31 . 2010-03-01 01:30 12288 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
+ 2007-03-23 01:07 . 2007-03-23 01:07 78168 c:\windows\Installer\$PatchCache$\Managed\9040110900063D11C8EF10054038389C\11.0.8173\RM.DLL
+ 2007-03-23 01:07 . 2007-03-23 01:07 41824 c:\windows\Installer\$PatchCache$\Managed\9040110900063D11C8EF10054038389C\11.0.8173\RECALL.DLL
+ 2007-03-23 01:05 . 2007-03-23 01:05 97632 c:\windows\Installer\$PatchCache$\Managed\9040110900063D11C8EF10054038389C\11.0.8173\PP7X32.DLL
+ 2007-04-19 19:53 . 2007-04-19 19:53 69984 c:\windows\Installer\$PatchCache$\Managed\9040110900063D11C8EF10054038389C\11.0.8173\OUTLRPC.DLL
+ 2007-03-23 01:07 . 2007-03-23 01:07 80224 c:\windows\Installer\$PatchCache$\Managed\9040110900063D11C8EF10054038389C\11.0.8173\DLGSETP.DLL
+ 2007-03-23 01:07 . 2007-03-23 01:07 91488 c:\windows\Installer\$PatchCache$\Managed\9040110900063D11C8EF10054038389C\11.0.8173\ADDRPARS.DLL
- 2005-09-11 21:31 . 2010-03-01 01:30 4096 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
+ 2005-09-11 21:31 . 2010-03-02 02:18 4096 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
+ 2009-09-09 21:40 . 2009-09-09 21:40 632320 c:\windows\Installer\42e93b9.msp
+ 2008-06-11 20:02 . 2008-06-11 20:02 830464 c:\windows\Installer\42e92c9.msp
+ 2008-07-28 20:59 . 2008-07-28 20:59 180736 c:\windows\Installer\42e929f.msp
+ 2005-09-11 21:31 . 2010-03-02 02:18 409600 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
- 2005-09-11 21:31 . 2010-03-01 01:30 409600 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
+ 2005-09-11 21:31 . 2010-03-02 02:18 286720 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
- 2005-09-11 21:31 . 2010-03-01 01:30 286720 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
+ 2005-09-11 21:31 . 2010-03-02 02:18 249856 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pptico.exe
- 2005-09-11 21:31 . 2010-03-01 01:30 249856 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pptico.exe
- 2005-09-11 21:31 . 2010-03-01 01:30 794624 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\outicon.exe
+ 2005-09-11 21:31 . 2010-03-02 02:18 794624 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\outicon.exe
+ 2005-09-11 21:31 . 2010-03-02 02:18 135168 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\misc.exe
- 2005-09-11 21:31 . 2010-03-01 01:30 135168 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\misc.exe
- 2005-09-11 21:31 . 2010-03-01 01:30 593920 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\accicons.exe
+ 2005-09-11 21:31 . 2010-03-02 02:18 593920 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\accicons.exe
+ 2007-03-23 01:22 . 2007-03-23 01:22 103264 c:\windows\Installer\$PatchCache$\Managed\9040110900063D11C8EF10054038389C\11.0.8173\TRANSMGR.DLL
+ 2007-05-10 19:34 . 2007-05-10 19:34 562528 c:\windows\Installer\$PatchCache$\Managed\9040110900063D11C8EF10054038389C\11.0.8173\PUBCONV.DLL
+ 2007-05-31 19:36 . 2007-05-31 19:36 612184 c:\windows\Installer\$PatchCache$\Managed\9040110900063D11C8EF10054038389C\11.0.8173\PTXT9.DLL
+ 2007-05-31 19:35 . 2007-05-31 19:35 133976 c:\windows\Installer\$PatchCache$\Managed\9040110900063D11C8EF10054038389C\11.0.8173\PRTF9.DLL
+ 2010-03-01 01:09 . 2010-03-01 01:09 464272 c:\windows\Installer\$PatchCache$\Managed\9040110900063D11C8EF10054038389C\11.0.8173\OWC11PIA.DLL
+ 2007-04-19 19:53 . 2007-04-19 19:53 149856 c:\windows\Installer\$PatchCache$\Managed\9040110900063D11C8EF10054038389C\11.0.8173\OUTLPH.DLL
+ 2007-05-31 19:42 . 2007-05-31 19:42 200032 c:\windows\Installer\$PatchCache$\Managed\9040110900063D11C8EF10054038389C\11.0.8173\OUTLOOK.EXE
+ 2007-04-19 19:53 . 2007-04-19 19:53 106336 c:\windows\Installer\$PatchCache$\Managed\9040110900063D11C8EF10054038389C\11.0.8173\OUTLMIME.DLL
+ 2007-04-19 19:53 . 2007-04-19 19:53 109408 c:\windows\Installer\$PatchCache$\Managed\9040110900063D11C8EF10054038389C\11.0.8173\OUTLCTL.DLL
+ 2007-05-10 20:35 . 2007-05-10 20:35 120160 c:\windows\Installer\$PatchCache$\Managed\9040110900063D11C8EF10054038389C\11.0.8173\MSCONV97.DLL
+ 2007-04-19 19:54 . 2007-04-19 19:54 183136 c:\windows\Installer\$PatchCache$\Managed\9040110900063D11C8EF10054038389C\11.0.8173\MIMEDIR.DLL
+ 2007-04-19 19:53 . 2007-04-19 19:53 127328 c:\windows\Installer\$PatchCache$\Managed\9040110900063D11C8EF10054038389C\11.0.8173\IMPMAIL.DLL
+ 2007-04-19 20:09 . 2007-04-19 20:09 167256 c:\windows\Installer\$PatchCache$\Managed\9040110900063D11C8EF10054038389C\11.0.8173\IETAG.DLL
+ 2007-04-19 19:53 . 2007-04-19 19:53 137568 c:\windows\Installer\$PatchCache$\Managed\9040110900063D11C8EF10054038389C\11.0.8173\ENVELOPE.DLL
+ 2003-07-15 08:18 . 2003-07-15 08:18 141360 c:\windows\Installer\$PatchCache$\Managed\9040110900063D11C8EF10054038389C\11.0.5614\ATP.DLL
+ 2010-03-02 01:46 . 2010-03-02 01:46 477056 c:\windows\assembly\GAC\Microsoft.Office.Interop.Owc11\11.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.Owc11.dll
+ 2009-08-05 01:52 . 2009-08-05 01:52 1193832 c:\windows\system32\FM20.DLL
+ 2009-08-21 16:14 . 2009-08-21 16:14 8363008 c:\windows\Installer\42e93d8.msp
+ 2009-08-20 11:02 . 2009-08-20 11:02 5204992 c:\windows\Installer\42e93a4.msp
+ 2009-10-22 18:46 . 2009-10-22 18:46 6821888 c:\windows\Installer\42e938f.msp
+ 2009-07-01 19:21 . 2009-07-01 19:21 8891904 c:\windows\Installer\42e9379.msp
+ 2008-04-01 20:33 . 2008-04-01 20:33 5479936 c:\windows\Installer\42e9361.msp
+ 2009-10-07 00:40 . 2009-10-07 00:40 7681024 c:\windows\Installer\42e9334.msp
+ 2008-01-14 22:53 . 2008-01-14 22:53 5213696 c:\windows\Installer\42e931f.msp
+ 2009-12-17 04:58 . 2009-12-17 04:58 5382144 c:\windows\Installer\42e930a.msp
+ 2008-10-25 15:15 . 2008-10-25 15:15 6227456 c:\windows\Installer\42e92f2.msp
+ 2009-09-29 15:08 . 2009-09-29 15:08 6747648 c:\windows\Installer\42e92b4.msp
+ 2010-01-20 00:29 . 2010-01-20 00:29 5050368 c:\windows\Installer\42e928a.msp
+ 2007-11-08 17:42 . 2007-11-08 17:42 4158464 c:\windows\Installer\42e9273.msp
+ 2007-05-09 23:19 . 2007-05-09 23:19 2585936 c:\windows\Installer\$PatchCache$\Managed\9040110900063D11C8EF10054038389C\11.0.8173\VBE6.DLL
+ 2007-04-19 19:49 . 2007-04-19 19:49 1661280 c:\windows\Installer\$PatchCache$\Managed\9040110900063D11C8EF10054038389C\11.0.8173\PPTVIEW.EXE
+ 2007-05-31 19:35 . 2007-05-31 19:35 6420320 c:\windows\Installer\$PatchCache$\Managed\9040110900063D11C8EF10054038389C\11.0.8173\POWERPNT.EXE
+ 2007-05-10 19:45 . 2007-05-10 19:45 8069464 c:\windows\Installer\$PatchCache$\Managed\9040110900063D11C8EF10054038389C\11.0.8173\OWC11.DLL
+ 2007-03-14 19:10 . 2007-03-14 19:10 7255384 c:\windows\Installer\$PatchCache$\Managed\9040110900063D11C8EF10054038389C\11.0.8173\OWC10.DLL
+ 2007-05-31 19:43 . 2007-05-31 19:43 7613280 c:\windows\Installer\$PatchCache$\Managed\9040110900063D11C8EF10054038389C\11.0.8173\OUTLLIB.DLL
+ 2007-05-10 19:35 . 2007-05-10 19:35 6747480 c:\windows\Installer\$PatchCache$\Managed\9040110900063D11C8EF10054038389C\11.0.8173\MSPUB.EXE
+ 2007-06-06 16:53 . 2007-06-06 16:53 1195888 c:\windows\Installer\$PatchCache$\Managed\9040110900063D11C8EF10054038389C\11.0.8173\FM20.DLL
+ 2009-07-01 19:19 . 2009-07-01 19:19 10607104 c:\windows\Installer\42e937a.msp
+ 2008-06-04 19:29 . 2008-06-04 19:29 16905728 c:\windows\Installer\42e9349.msp
+ 2008-01-14 21:24 . 2008-01-14 21:24 10721280 c:\windows\Installer\42e92dd.msp
+ 2007-05-31 19:37 . 2007-05-31 19:37 12310368 c:\windows\Installer\$PatchCache$\Managed\9040110900063D11C8EF10054038389C\11.0.8173\WINWORD.EXE
+ 2007-06-18 23:16 . 2007-06-18 23:16 12259160 c:\windows\Installer\$PatchCache$\Managed\9040110900063D11C8EF10054038389C\11.0.8173\MSO.DLL
+ 2007-05-31 19:41 . 2007-05-31 19:41 10352472 c:\windows\Installer\$PatchCache$\Managed\9040110900063D11C8EF10054038389C\11.0.8173\EXCEL.EXE
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\manan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-08-31 133104]
"RoboForm"="c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2010-02-14 160592]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nmctxth"="c:\program files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2008-12-12 642856]
"Linksys Wireless Manager"="c:\program files\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe" [2009-05-11 1348144]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-09-09 305440]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"SpySweeper"="c:\program files\Webroot\Spy Sweeper\SpySweeperUI.exe" [2009-11-06 6515784]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"RoboForm"="c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2010-02-14 160592]

c:\documents and settings\manan\Start Menu\Programs\Startup\
PowerReg Scheduler.exe [2008-7-5 189952]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"GreyMSIAds"= 0 (0x0)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli HTHATD.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WebrootSpySweeperService]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WRConsumerService]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^manan^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
path=c:\documents and settings\manan\Start Menu\Programs\Startup\LimeWire On Startup.lnk
backup=c:\windows\pss\LimeWire On Startup.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^manan^Start Menu^Programs^Startup^Stardock ObjectDock.lnk]
path=c:\documents and settings\manan\Start Menu\Programs\Startup\Stardock ObjectDock.lnk
backup=c:\windows\pss\Stardock ObjectDock.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^manan^Start Menu^Programs^Startup^Trillian.lnk]
path=c:\documents and settings\manan\Start Menu\Programs\Startup\Trillian.lnk
backup=c:\windows\pss\Trillian.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^manan^Start Menu^Programs^Startup^Xfire.lnk]
path=c:\documents and settings\manan\Start Menu\Programs\Startup\Xfire.lnk
backup=c:\windows\pss\Xfire.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CHotkey]
2003-06-03 19:01 496640 —-a-w- c:\windows\zHotkey.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2004-08-04 12:00 15360 ——w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2004-11-02 00:59 126976 —-a-r- c:\windows\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2004-11-02 01:03 155648 —-a-r- c:\windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMEKRMIG6.1]
2002-08-29 12:00 44032 —-a-w- c:\windows\ime\imkr6_1\imekrmig.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
2004-08-04 05:31 208952 —-a-w- c:\windows\ime\imjp8_1\imjpmig.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2009-09-09 02:09 305440 —-a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2004-10-13 16:24 1694208 –sh–w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-09-05 06:54 417792 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
2006-03-01 08:22 577536 —-a-r- c:\windows\SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpySweeper]
2009-11-06 21:19 6515784 —-a-w- c:\program files\Webroot\Spy Sweeper\SpySweeperUI.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2005-04-13 08:48 36975 —-a-w- c:\program files\Java\jre1.5.0_03\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Nexon\\MapleStory\\MapleStory.exe"=
"c:\\Nexon\\MapleStory\\Patcher.exe"=
"c:\\Program Files\\Safari\\Safari.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Vuze\\Azureus.exe"=

R?2 WZCBDLService;WZCBDL Service;c:\program files\WZCBDL Service\WZCBDLS.exe [3/19/2002 12:15 PM 36864]
R0 ssfs0bbc;ssfs0bbc;c:\windows\system32\drivers\ssfs0bbc.sys [4/21/2009 5:27 PM 29808]
R2 NIOC;NIOC Service;c:\windows\system32\NIOC.sys [9/27/2002 6:21 PM 22912]
R2 WRConsumerService;Webroot Client Service;c:\program files\Webroot\Spy Sweeper\WRConsumerService.exe [6/4/2009 3:28 PM 1201640]
R3 rt2870;Linksys 802.11n USB Wireless LAN Card Driver;c:\windows\system32\drivers\rt2870.sys [8/2/2009 10:54 AM 709248]
R3 vkeyfdo;Virtual Keybord Function Driver;c:\windows\system32\drivers\vkeyfdo.sys [10/2/2008 2:00 AM 11336]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [6/28/2008 8:22 PM 717296]
S2 clr_optimization_v4.0.21006_32;Microsoft .NET Framework NGEN v4.0.21006_X86;c:\windows\Microsoft.NET\Framework\v4.0.21006\mscorsvw.exe [10/7/2009 1:44 AM 129856]
S3 FeMouWDM;Fellowes Mouse Driver;c:\windows\system32\DRIVERS\FeMouWDM.sys –> c:\windows\system32\DRIVERS\FeMouWDM.sys [?]
S3 geebers12;geebers12;\??\c:\documents and settings\manan\Desktop\Buffy Engine\nvid888.sys –> c:\documents and settings\manan\Desktop\Buffy Engine\nvid888.sys [?]
S3 kaspersky1;kaspersky1;\??\c:\documents and settings\manan\Desktop\S3NSA_4__S4NSA_\S3NSA 4 [S4NSA]\AM I\FEMALE\Working UCE's\Kaspersky2 [cracked by me]\kaspersky.sys –> c:\documents and settings\manan\Desktop\S3NSA_4__S4NSA_\S3NSA 4 [S4NSA]\AM I\FEMALE\Working UCE's\Kaspersky2 [cracked by me]\kaspersky.sys [?]
S3 maxD20081102;maxD20081102;c:\documents and settings\manan\Desktop\Manan's stuff\wannabot\iMax Macro 4.8\max20081102.sys [2/2/2010 5:26 PM 11776]
S3 NETR33X;D-Link Air Wireless Adapter(RTL) NT Driver;c:\windows\system32\drivers\NETR33X.sys [12/3/2003 11:02 PM 158976]
S3 sejt1;sejt1;\??\c:\documents and settings\manan\Desktop\S3NSA_4__S4NSA_\S3NSA 4 [S4NSA]\AM I\FEMALE\Working UCE's\Akuma Engine\sejt.sys –> c:\documents and settings\manan\Desktop\S3NSA_4__S4NSA_\S3NSA 4 [S4NSA]\AM I\FEMALE\Working UCE's\Akuma Engine\sejt.sys [?]
S3 serum1;serum1;\??\c:\documents and settings\manan\Desktop\serum\serum.sys –> c:\documents and settings\manan\Desktop\serum\serum.sys [?]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\d:\ntglm7x.sys –> d:\NTGLM7X.sys [?]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.21006\WPF\WPFFontCache_v0400.exe [10/7/2009 1:44 AM 752984]
S3 xp1;xp1;\??\c:\documents and settings\manan\Desktop\xpengine\xp.sys –> c:\documents and settings\manan\Desktop\xpengine\xp.sys [?]
.
Contents of the 'Scheduled Tasks' folder

2010-03-02 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-11-04 21:08]

2010-03-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2555438207-227717993-4258109870-1005Core.job
- c:\documents and settings\manan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-08-31 23:06]

2010-03-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2555438207-227717993-4258109870-1005UA.job
- c:\documents and settings\manan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-08-31 23:06]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.cubs.com/
mSearch Bar = about:blank
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uCustomizeSearch =
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &AIM Search - c:\program files\AIM Toolbar\AIMBar.dll/aimsearch.htm
IE: Customize Menu - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Fill Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
IE: RoboForm Toolbar - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
IE: Save Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {2931566C-B8A6-46C5-BF4D-E6AB9251E953} - hxxp://file.nx.com/activex/public_new/nxpm.cab
FF - ProfilePath - c:\documents and settings\manan\Application Data\Mozilla\Firefox\Profiles\fvxk1fuy.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=megaup&p=
FF - component: c:\program files\Siber Systems\AI RoboForm\Firefox\components\rfproxy_31.dll
FF - plugin: c:\documents and settings\All Users\Application Data\NexonUS\NGM\npNxGameUS.dll
FF - plugin: c:\documents and settings\manan\Local Settings\Application Data\Google\Update\1.2.183.17\npGoogleOneClick8.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-01 22:34
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
"ImagePath"="\??\c:\documents and settings\manan\Desktop\S3NSA_4__S4NSA_\S3NSA 4
[S4NSA]\AM I\FEMALE\Working UCE's\Kaspersky2 [cracked by me]\kaspersky.sys"

–
"ImagePath"="\??\c:\documents and settings\manan\Desktop\S3NSA_4__S4NSA_\S3NSA 4
[S4NSA]\AM I\FEMALE\Working UCE's\Akuma Engine\sejt.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\kaspersky1]
"ImagePath"="\??\c:\documents and settings\manan\Desktop\S3NSA_4__S4NSA_\S3NSA 4

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\sejt1]
"ImagePath"="\??\c:\documents and settings\manan\Desktop\S3NSA_4__S4NSA_\S3NSA 4
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'lsass.exe'(1136)
c:\windows\HTHATD.dll
.
Completion time: 2010-03-01 22:39:48
ComboFix-quarantined-files.txt 2010-03-02 04:39
ComboFix2.txt 2010-03-01 05:15
ComboFix3.txt 2010-03-01 05:00
ComboFix4.txt 2010-02-28 02:41
ComboFix5.txt 2010-03-02 04:22

Pre-Run: 5,397,868,544 bytes free
Post-Run: 5,363,212,288 bytes free

- - End Of File - - AFF950C942D231E49A766EA64F10AA7D

LDTate

Post #12March 3, 2010, 12:23 AM UTC

If you don't use it, lets remove it.

Copy/paste the text in the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text.

File::
c:\documents and settings\manan\Desktop\S3NSA_4__S4NSA_\S3NSA 4 
[S4NSA]\AM I\FEMALE\Working UCE's\Kaspersky2 [cracked by me]\kaspersky.sys
c:\documents and settings\manan\Desktop\S3NSA_4__S4NSA_\S3NSA 4 
[S4NSA]\AM I\FEMALE\Working UCE's\Akuma Engine\sejt.sys


Folder::
c:\documents and settings\manan\Desktop\S3NSA_4__S4NSA_

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:
1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe

Then post the results log using Copy / Paste

Also please describe how your computer behaves at the moment.

LDTate

Post #13March 7, 2010, 3:06 AM UTC

Do you still need help with this?

LDTate

Post #14March 11, 2010, 10:20 PM UTC

Due to inactivity this topic will be closed.
If you need help please start a new thread.

New members follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html and start a new topic

✨ Ask AI

Ask AI