What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Trojen attacs and forced shutdowns

11 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #31
This is the latest. Objects scanned: 128251 Threats found: 1 Infected objects found: 1 Suspicious objects found: 0 Scan duration: 09:42:17 Please wait, scanning can take some time depending upon the size of the area to scan. You can continue work with other browser windows. Scanning: ngdjctfu.sys Path: C:\WINDOWS\system32\drivers
Post #32
Try opening taskmanager (Alt/CTRL/DEL) and end the process for ngdjctfu if listed
Delete this file
Path: C:\WINDOWS\system32\drivers\ngdjctfu.sys

Reboot and try Combofix
Post #33 last edited
Hi, had to step out for a bit.

"Delete this file
Path: C:\WINDOWS\system32\drivers\ngdjctfu.sys"

acces denied.

needed to shut down…had problems shutting down. had to force it to shut down….when starting back up a small black window came up was the path.
I shut that window down.

then an erroe came up

Uninstalled the AVG thinking that it mite be the cause of the other program not able to continue…should I reinstall AVG or maybe another?
Post #34 last edited
Am uploading COMODO being it has a firewall+ antivir, is that ok? Should I install it now or should I wait untill we resolve the issues? AND have downloaded Combo fix. What should I do first/next?
Post #35
restart in Safe Mode and try deleting this file
Path: C:\WINDOWS\system32\drivers\ngdjctfu.sys

Then run combofix while in Safe mode
Post #37
ComboFix 10-05-16.02 - User 05/17/2010 15:52:45.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.578 [GMT 2:00]
Running from: c:\documents and settings\[removed]\Desktop\DOWNLOADS\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\User\Application Data\BITS
c:\documents and settings\User\Application Data\BITS\BITS.ini
c:\documents and settings\User\Application Data\BITS\DHTTable.dat
c:\documents and settings\User\Application Data\BITS\UPnP.ini
c:\documents and settings\User\Application Data\FlashGetBHO
c:\documents and settings\User\Application Data\FlashGetBHO\FlashGetHook.dll
c:\documents and settings\User\Application Data\FlashGetBHO\GetAllUrl.htm
c:\documents and settings\User\Application Data\FlashGetBHO\GetUrl.htm
c:\program files\FlashGet Network
c:\program files\FlashGet Network\FlashGet 3\adns.dll
c:\program files\FlashGet Network\FlashGet 3\btcoreu.dll
c:\program files\FlashGet Network\FlashGet 3\BugReport.dll
c:\program files\FlashGet Network\FlashGet 3\BugReport.exe
c:\program files\FlashGet Network\FlashGet 3\cd1.ico
c:\program files\FlashGet Network\FlashGet 3\ckcore.dll
c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\14_43260.dll
c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\28_83260.dll
c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\atrc.dll
c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\Codecs.zip
c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\cook.dll
c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\ddnt3260.dll
c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\dnet3260.dll
c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\drv1.dll
c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\drv2.dll
c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\drvc.dll
c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\hxltcolor.dll
c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\raac.dll
c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\ralf.dll
c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\rv10.dll
c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\rv20.dll
c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\rv30.dll
c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\rv40.dll
c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\sipr.dll
c:\program files\FlashGet Network\FlashGet 3\commonlib.dll
c:\program files\FlashGet Network\FlashGet 3\componentskrnl.dll
c:\program files\FlashGet Network\FlashGet 3\config\clients.met
c:\program files\FlashGet Network\FlashGet 3\config\clients.met.bak
c:\program files\FlashGet Network\FlashGet 3\config\cryptkey.dat
c:\program files\FlashGet Network\FlashGet 3\config\emfriends.met
c:\program files\FlashGet Network\FlashGet 3\config\known.met
c:\program files\FlashGet Network\FlashGet 3\config\known2_64.met
c:\program files\FlashGet Network\FlashGet 3\config\preferences.ini
c:\program files\FlashGet Network\FlashGet 3\config\server.met
c:\program files\FlashGet Network\FlashGet 3\config\server_met.old
c:\program files\FlashGet Network\FlashGet 3\corestat.dll
c:\program files\FlashGet Network\FlashGet 3\dat\Appsetting.cfg
c:\program files\FlashGet Network\FlashGet 3\dat\directui\client_33665566.jpg
c:\program files\FlashGet Network\FlashGet 3\dat\directui\client_5-04400194A.jpg
c:\program files\FlashGet Network\FlashGet 3\dat\directui\client_5_4504_1.jpg
c:\program files\FlashGet Network\FlashGet 3\dat\directui\client_icon01.jpg
c:\program files\FlashGet Network\FlashGet 3\dat\directui\client_icon03.jpg
c:\program files\FlashGet Network\FlashGet 3\dat\directui\client_icon04.jpg
c:\program files\FlashGet Network\FlashGet 3\dat\directui\client_KeHuDuanZiYuanZhongXinTuiJianTuMoBanFuBen.jpg
c:\program files\FlashGet Network\FlashGet 3\dat\directui\client_logo.jpg
c:\program files\FlashGet Network\FlashGet 3\dat\directui\client_Nona4me.jpg
c:\program files\FlashGet Network\FlashGet 3\dat\directui\client_Noname111.jpg
c:\program files\FlashGet Network\FlashGet 3\dat\directui\client_Noname4433.jpg
c:\program files\FlashGet Network\FlashGet 3\dat\directui\client_shennv.jpg
c:\program files\FlashGet Network\FlashGet 3\dat\directui\dian.jpg
c:\program files\FlashGet Network\FlashGet 3\dat\directui\directui_new_1273835616.zip
c:\program files\FlashGet Network\FlashGet 3\dat\directui\gameall.gif
c:\program files\FlashGet Network\FlashGet 3\dat\directui\gametop.gif
c:\program files\FlashGet Network\FlashGet 3\dat\directui\newgame.gif
c:\program files\FlashGet Network\FlashGet 3\dat\directui\newmovie.gif
c:\program files\FlashGet Network\FlashGet 3\dat\directui\p1.gif
c:\program files\FlashGet Network\FlashGet 3\dat\directui\p2.gif
c:\program files\FlashGet Network\FlashGet 3\dat\directui\p3.gif
c:\program files\FlashGet Network\FlashGet 3\dat\directui\p4.gif
c:\program files\FlashGet Network\FlashGet 3\dat\directui\p5.gif
c:\program files\FlashGet Network\FlashGet 3\dat\directui\p6.gif
c:\program files\FlashGet Network\FlashGet 3\dat\directui\p7.gif
c:\program files\FlashGet Network\FlashGet 3\dat\directui\p8.gif
c:\program files\FlashGet Network\FlashGet 3\dat\directui\reom.jpg
c:\program files\FlashGet Network\FlashGet 3\dat\directui\rescenter.txt
c:\program files\FlashGet Network\FlashGet 3\dat\directui\soft.jpg
c:\program files\FlashGet Network\FlashGet 3\dat\directui\tab.gif
c:\program files\FlashGet Network\FlashGet 3\dat\FlashGet3db.bak
c:\program files\FlashGet Network\FlashGet 3\dat\FlashGet3db.db
c:\program files\FlashGet Network\FlashGet 3\dat\stat\advertisement\domain_url_list_en.zip
c:\program files\FlashGet Network\FlashGet 3\dat\stat\skinpreview\preview_blue.png
c:\program files\FlashGet Network\FlashGet 3\dat\stat\skinpreview\preview_classic.png
c:\program files\FlashGet Network\FlashGet 3\dat\stat\skinpreview\preview_white.png
c:\program files\FlashGet Network\FlashGet 3\dbghelp.dll
c:\program files\FlashGet Network\FlashGet 3\fg.ico
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\default.htm
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\FGResDetector.conf
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\banner.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\bullet.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\close.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\closelabel.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\download-icon.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\explorer.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\ftp.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\image.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\introTextBg.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\loading.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\nextlabel.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\prevlabel.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\software.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\vod.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\FGResDetector.exe
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\about.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\ftplist_tree_icon.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\option_icon.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\quickop_hide.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\quickop_show.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\statusbar_bk.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\tasktab_close.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\toolbar_back.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\toolbar_bk.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\toolbar_close.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\toolbar_forward.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\toolbar_refresh.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\lang\l.eng.xml
c:\program files\FlashGet Network\FlashGet 3\FGSoftware.exe
c:\program files\FlashGet Network\FlashGet 3\Flashget3.exe
c:\program files\FlashGet Network\FlashGet 3\FlashGet3.xpi
c:\program files\FlashGet Network\FlashGet 3\FlashGetHook.dll
c:\program files\FlashGet Network\FlashGet 3\fnsArchive.dll
c:\program files\FlashGet Network\FlashGet 3\fnsDirectuix.dll
c:\program files\FlashGet Network\FlashGet 3\fnsLanguage.dll
c:\program files\FlashGet Network\FlashGet 3\fnslanguage_en.dll
c:\program files\FlashGet Network\FlashGet 3\fnsScheduler.dll
c:\program files\FlashGet Network\FlashGet 3\fnsSecurity.dll
c:\program files\FlashGet Network\FlashGet 3\fnsSkinX.dll
c:\program files\FlashGet Network\FlashGet 3\fnsStatistics.dll
c:\program files\FlashGet Network\FlashGet 3\game.ico
c:\program files\FlashGet Network\FlashGet 3\gb2312-unicode.dic
c:\program files\FlashGet Network\FlashGet 3\gdiplus.dll
c:\program files\FlashGet Network\FlashGet 3\GetAllUrl.htm
c:\program files\FlashGet Network\FlashGet 3\GetUrl.htm
c:\program files\FlashGet Network\FlashGet 3\GoogleToolbarInstaller_download_signed.exe
c:\program files\FlashGet Network\FlashGet 3\libem.dll
c:\program files\FlashGet Network\FlashGet 3\license.txt
c:\program files\FlashGet Network\FlashGet 3\lst_tz.bin
c:\program files\FlashGet Network\FlashGet 3\P2PCfg.ini
c:\program files\FlashGet Network\FlashGet 3\p2pcore.dll
c:\program files\FlashGet Network\FlashGet 3\p2score.dll
c:\program files\FlashGet Network\FlashGet 3\pncrt.dll
c:\program files\FlashGet Network\FlashGet 3\pup.dat
c:\program files\FlashGet Network\FlashGet 3\RdOldDb.dll
c:\program files\FlashGet Network\FlashGet 3\RealMediaSplitter.ax
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\BarSet.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\btn_check.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\btn_normal.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\btn_radio.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\desktoplink.ico
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\login_line.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\menu_icon.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\option_line.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\option_page_line.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\skin.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\SuspendLogo.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\SuspendNoLogo.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_backgrand.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_cancle.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_catgroy.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_group.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_new.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_open.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_option.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_pause.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_recly.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_start.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbarbutton_left.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbarbutton_middle.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbarbutton_right.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\top_logotitle.gif
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\torrent.ico
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\userinfo_head.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\VistaStyleListItems.bmp
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\preview.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\skin.xml
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\sound\loginfailed.wav
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\sound\loginsucc.wav
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\sound\msgnotify.wav
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\sound\notify.wav
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\topmain.png
c:\program files\FlashGet Network\FlashGet 3\SnapShot.dll
c:\program files\FlashGet Network\FlashGet 3\storage.dll
c:\program files\FlashGet Network\FlashGet 3\SysOptimize.exe
c:\program files\FlashGet Network\FlashGet 3\uninst.exe
c:\program files\FlashGet Network\FlashGet 3\VodCore.dll
c:\program files\FlashGet Network\FlashGet 3\zlib.dll
c:\windows\system32\regsvr.exe
c:\windows\system32\VB40016.DLL

.
((((((((((((((((((((((((( Files Created from 2010-04-17 to 2010-05-17 )))))))))))))))))))))))))))))))
.

2010-05-16 23:04 . 2010-05-16 23:04 503808 —-a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-7f8875aa-n\msvcp71.dll
2010-05-16 23:04 . 2010-05-16 23:04 499712 —-a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-7f8875aa-n\jmc.dll
2010-05-16 23:04 . 2010-05-16 23:04 348160 —-a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-7f8875aa-n\msvcr71.dll
2010-05-16 23:04 . 2010-05-16 23:04 61440 —-a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-328c1160-n\decora-sse.dll
2010-05-16 23:04 . 2010-05-16 23:04 12800 —-a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-328c1160-n\decora-d3d.dll
2010-05-16 23:04 . 2010-05-16 23:04 411368 —-a-w- c:\windows\system32\deployJava1.dll
2010-05-16 21:59 . 2010-05-16 21:59 ——– d—–w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2010-05-16 20:25 . 2010-05-16 20:25 ——– d—–w- c:\documents and settings\User\Application Data\Malwarebytes
2010-05-16 20:24 . 2010-04-29 13:39 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-05-16 20:24 . 2010-05-16 20:24 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-05-16 20:24 . 2010-05-16 20:24 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-05-16 20:24 . 2010-04-29 13:39 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-05-15 23:13 . 2010-05-15 23:13 151040 —-a-w- c:\windows\system32\drivers\ngdjctfu.sys
2010-05-13 00:19 . 2010-05-13 00:19 ——– d—–w- c:\program files\Common Files\EzTools
2010-05-13 00:00 . 2010-05-16 11:07 ——– d—–w- c:\program files\e-Sword
2010-05-08 19:27 . 2010-05-08 19:27 ——– d—–w- c:\documents and settings\User\Application Data\Helper
2010-05-06 20:15 . 2010-05-06 20:15 439816 —-a-w- c:\documents and settings\User\Application Data\Real\Update\temp\~Upg0\setup.exe
2010-04-27 07:05 . 2010-04-27 07:05 ——– d—–w- c:\program files\iPod
2010-04-27 07:04 . 2010-04-27 07:06 ——– d—–w- c:\program files\iTunes
2010-04-27 07:04 . 2010-04-27 07:06 ——– d—–w- c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-04-27 06:42 . 2010-04-27 06:42 73000 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.1.0.79\SetupAdmin.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-17 09:40 . 2009-04-30 13:07 ——– d—–w- c:\program files\Mozilla Thunderbird
2010-05-17 07:21 . 2010-02-27 16:28 0 —-a-w- c:\documents and settings\User\Local Settings\Application Data\prvlcl.dat
2010-05-16 23:05 . 2009-04-29 05:33 ——– d—–w- c:\program files\Common Files\Java
2010-05-16 23:04 . 2009-04-29 05:33 ——– d—–w- c:\program files\Java
2010-05-16 21:19 . 2009-05-31 06:53 ——– d—–w- c:\documents and settings\User\Application Data\TeamViewer
2010-05-16 21:19 . 2009-05-31 17:51 ——– d—–w- c:\program files\TeamViewer
2010-05-15 14:38 . 2010-03-04 21:25 598 —-a-w- c:\windows\system32\secushr.dat
2010-05-13 22:13 . 2009-04-29 19:37 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-05-13 11:05 . 2009-04-29 17:00 76936 —-a-w- c:\documents and settings\User\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-05-11 22:31 . 2009-10-17 17:54 ——– d—–w- c:\documents and settings\User\Application Data\vlc
2010-05-08 17:34 . 2009-06-20 18:29 ——– d—–w- c:\documents and settings\User\Application Data\dvdcss
2010-05-06 20:15 . 2010-03-28 08:43 439816 —-a-w- c:\documents and settings\User\Application Data\Real\Update\setup3.10\setup.exe
2010-05-05 07:07 . 2009-05-31 07:27 ——– d—–w- c:\program files\FileZilla FTP Client
2010-04-27 20:43 . 2009-07-09 19:42 ——– d—–w- c:\documents and settings\User\Application Data\Apple Computer
2010-04-27 07:04 . 2009-08-04 06:27 ——– d—–w- c:\program files\Common Files\Apple
2010-04-27 07:01 . 2009-08-04 06:09 ——– d—–w- c:\program files\QuickTime
2010-04-27 06:57 . 2009-08-04 06:28 ——– d—–w- c:\program files\Bonjour
2010-04-05 21:47 . 2009-12-06 17:03 ——– d—–w- c:\program files\Morton Benson
2010-03-28 23:31 . 2010-03-28 23:31 ——– d—–w- c:\documents and settings\User\Application Data\Talkback
2010-03-25 18:37 . 2010-03-25 18:37 ——– d—–w- c:\program files\Photomatix
2010-03-10 06:15 . 2002-02-26 21:58 420352 —-a-w- c:\windows\system32\vbscript.dll
2010-02-25 06:24 . 2003-03-31 12:00 916480 —-a-w- c:\windows\system32\wininet.dll
2010-02-24 13:11 . 2002-11-18 16:27 455680 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-02-17 07:10 . 2003-04-24 13:57 2189952 —-a-w- c:\windows\system32\ntoskrnl.exe
.

——- Sigcheck ——-

[7] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
[7] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\system32\dllcache\tcpip.sys
[-] 2008-06-20 . 4AFB3B0919649F95C1964AA1FAD27D73 . 361600 . . [5.1.2600.5625] . . c:\windows\system32\drivers\tcpip.sys
[7] 2008-04-13 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB951748$\tcpip.sys
[7] 2008-04-13 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\tcpip.sys
[-] 2006-04-20 . B2220C618B42A2212A59D91EBD6FC4B4 . 360576 . . [5.1.2600.2892] . . c:\windows\SoftwareDistribution\Download\556eb98436b65a8c1ffae674c83d197f\sp2qfe\tcpip.sys
[-] 2006-04-20 . 1DBF125862891817F374F407626967F4 . 359808 . . [5.1.2600.2892] . . c:\windows\SoftwareDistribution\Download\556eb98436b65a8c1ffae674c83d197f\sp2gdr\tcpip.sys
[7] 2004-08-04 . 9F4B36614A0FC234525BA224957DE55C . 359040 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\tcpip.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2003-04-07 114688]
"IgfxTray"="c:\windows\System32\igfxtray.exe" [2003-04-07 155648]
"PRONoMgr.exe"="c:\program files\Intel\NCS\PROSet\PRONoMgr.exe" [2003-03-11 86016]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-09-28 198160]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-17 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-03-25 142120]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - c:\windows\Installer\{AC76BA86-1033-0000-7760-000000000003}\_SC_Acrobat.exe [2009-9-18 295606]
Adobe Acrobat Synchronizer.lnk - c:\program files\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe [2006-10-23 734872]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Sebring]
2003-02-28 23:01 110592 —-a-w- c:\windows\system32\LgNotify.dll

[HKLM\~\startupfolder\C:^Documents and Settings^User^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=c:\documents and settings\User\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=c:\windows\pss\Adobe Gamma.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
2006-10-22 21:24 620152 —-a-w- c:\program files\Adobe\Acrobat 8.0\Acrobat\acrotray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe_ID0EYTHM]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2008-10-25 18:44 31072 —-a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 ——w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
2009-04-29 05:48 577536 —-a-w- c:\program files\Synaptics\SynTP\SynTPEnh.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPLpr]
2009-04-29 05:48 126976 —-a-w- c:\program files\Synaptics\SynTP\SynTPLpr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2009-09-28 07:28 198160 —-a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Documents and Settings\\User\\temp\\TeamViewer\\Version4\\TeamViewer.exe"=
"c:\\WINDOWS\\system32\\ftp.exe"=
"c:\\Program Files\\Macromedia\\Dreamweaver 8\\Dreamweaver.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Program Files\\Common Files\\Adobe\\Adobe Version Cue CS3\\Server\\bin\\VersionCueCS3.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\TeamViewer\\Version5\\TeamViewer.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"3703:TCP"= 3703:TCP:Adobe Version Cue CS3 Server
"3704:TCP"= 3704:TCP:Adobe Version Cue CS3 Server
"50900:TCP"= 50900:TCP:Adobe Version Cue CS3 Server
"50901:TCP"= 50901:TCP:Adobe Version Cue CS3 Server

S2 mrhohxqj;mrhohxqj; [x]
S2 ngdjctfu;ngdjctfu;c:\windows\system32\drivers\ngdjctfu.sys [5/16/2010 1:13 AM 151040]
S2 usbf37;usbf37; [x]
S3 aekjmcpv;aekjmcpv;\??\c:\windows\System32\Drivers\aekjmcpv.sys –> c:\windows\System32\Drivers\aekjmcpv.sys [?]
S3 bjkkkbsv;bjkkkbsv;\??\c:\windows\System32\Drivers\bjkkkbsv.sys –> c:\windows\System32\Drivers\bjkkkbsv.sys [?]
S3 bmclaisf;bmclaisf;\??\c:\windows\System32\Drivers\bmclaisf.sys –> c:\windows\System32\Drivers\bmclaisf.sys [?]
S3 buswvifk;buswvifk;\??\c:\windows\System32\Drivers\buswvifk.sys –> c:\windows\System32\Drivers\buswvifk.sys [?]
S3 evwperrv;evwperrv;\??\c:\windows\System32\Drivers\evwperrv.sys –> c:\windows\System32\Drivers\evwperrv.sys [?]
S3 gdiqnrgu;gdiqnrgu;\??\c:\windows\System32\Drivers\gdiqnrgu.sys –> c:\windows\System32\Drivers\gdiqnrgu.sys [?]
S3 kngpsajf;kngpsajf;\??\c:\windows\System32\Drivers\kngpsajf.sys –> c:\windows\System32\Drivers\kngpsajf.sys [?]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [5/16/2010 10:24 PM 38224]
S3 ovicfdij;ovicfdij;\??\c:\windows\System32\Drivers\ovicfdij.sys –> c:\windows\System32\Drivers\ovicfdij.sys [?]
S3 rcpvqrtd;rcpvqrtd;\??\c:\windows\System32\Drivers\rcpvqrtd.sys –> c:\windows\System32\Drivers\rcpvqrtd.sys [?]
S3 rtsvwtwb;rtsvwtwb;\??\c:\windows\System32\Drivers\rtsvwtwb.sys –> c:\windows\System32\Drivers\rtsvwtwb.sys [?]
S3 tmjziczm;tmjziczm;\??\c:\windows\System32\Drivers\tmjziczm.sys –> c:\windows\System32\Drivers\tmjziczm.sys [?]
S3 ufsrewra;ufsrewra;\??\c:\windows\System32\Drivers\ufsrewra.sys –> c:\windows\System32\Drivers\ufsrewra.sys [?]
S3 urwtbstp;urwtbstp;\??\c:\windows\System32\Drivers\urwtbstp.sys –> c:\windows\System32\Drivers\urwtbstp.sys [?]
S3 yresnayx;yresnayx;\??\c:\windows\System32\Drivers\yresnayx.sys –> c:\windows\System32\Drivers\yresnayx.sys [?]
.
Contents of the 'Scheduled Tasks' folder

2010-04-27 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 19:34]

2010-05-17 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAEXEC.exe [2009-08-03 13:07]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.de/
uInternet Connection Wizard,ShellNext = hxxp://www.gatewaybiz.com/
IE: Append to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Download All By FlashGet3 - c:\documents and settings\User\Application Data\FlashGetBHO\GetAllUrl.htm
IE: Download By FlashGet3 - c:\documents and settings\User\Application Data\FlashGetBHO\GetUrl.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
Trusted Zone: kuaiche.com\software
TCP: {FAC838AC-F065-4764-BAB7-7CC8F65DEFD1} = 217.0.43.97 217.0.43.113
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\w2kukr31.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo! Search
FF - component: c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\w2kukr31.default\extensions\{DB9127A2-3381-41ec-82B3-1B6ED4C6F29A}\components\FlashgetXpi.dll
FF - component: c:\program files\real\realplayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdjvu.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npOGAPlugin.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
.
- - - - ORPHANS REMOVED - - - -

Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll
HKCU-Run-Getdo - c:\documents and settings\User\Application Data\Adobe\Update\flacor.dat
SafeBoot-coqnmgso
SafeBoot-krn38
SafeBoot-mrhohxqj
SafeBoot-ngdjctfu
SafeBoot-usbf37
AddRemove-FlashGet 3.3 - c:\program files\FlashGet Network\FlashGet 3\uninst.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-17 15:58
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(1212)
c:\windows\System32\LgNotify.dll
.
Completion time: 2010-05-17 16:00:39
ComboFix-quarantined-files.txt 2010-05-17 14:00

Pre-Run: 31,748,165,632 bytes free
Post-Run: 31,833,198,592 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

- - End Of File - - 9CB876C32C09F7CD76F9978C6FD6AE7A
Post #40

I will need to rune out in about 5 min,

No problem.

Copy/paste the text in the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text. 

http://forums.whatthetech.com/Trojen_attacs_forced_shutdowns_t112094.html&st=30#entry653705

Collect::
c:\windows\system32\drivers\ngdjctfu.sys
C:\windows\system32\drivers\ngdjctfu.sys 
c:\windows\System32\Drivers\aekjmcpv.sys 
c:\windows\System32\Drivers\bjkkkbsv.sys 
c:\windows\System32\Drivers\bmclaisf.sys 
c:\windows\System32\Drivers\buswvifk.sys
c:\windows\System32\Drivers\evwperrv.sys 
c:\windows\System32\Drivers\gdiqnrgu.sys 
c:\windows\System32\Drivers\kngpsajf.sys
c:\windows\System32\Drivers\ovicfdij.sys 
c:\windows\System32\Drivers\rcpvqrtd.sys 
c:\windows\System32\Drivers\rtsvwtwb.sys 
c:\windows\System32\Drivers\tmjziczm.sys 
c:\windows\System32\Drivers\ufsrewra.sys
c:\windows\System32\Drivers\urwtbstp.sys 
c:\windows\System32\Drivers\yresnayx.sys 

Driver::
ngdjctfu
mrhohxqj
usbf37
aekjmcpv
bjkkkbsv
bmclaisf
buswvifk
evwperrv
gdiqnrgu
kngpsajf
ovicfdij
rcpvqrtd
rtsvwtwb
tmjziczm
ufsrewra
urwtbstp
yresnayx

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:
1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …


[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe


Then post the results log using Copy / Paste
Post #41 last edited
After I draged and droped the file into combofix and started the program Combofix a window came up with : 'NIRCMDC' is not recognized as an internal or external command, operable program or batch file. I await your instruction.
Post #44

Did I misunderstand? I did copy all that was in the box.

You did it right if you included eveything. Can you try it again please?
Post #45
And the results:


ComboFix 10-05-16.02 - User 05/17/2010 18:31:29.2.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.488 [GMT 2:00]
Running from: c:\documents and settings\[removed]\Desktop\DOWNLOADS\ComboFix.exe
Command switches used :: c:\documents and settings\User\Desktop\CFScript.txt
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_MRHOHXQJ
——-\Legacy_NGDJCTFU
——-\Legacy_USBF37
——-\Service_aekjmcpv
——-\Service_bjkkkbsv
——-\Service_bmclaisf
——-\Service_buswvifk
——-\Service_evwperrv
——-\Service_gdiqnrgu
——-\Service_kngpsajf
——-\Service_mrhohxqj
——-\Service_ngdjctfu
——-\Service_ovicfdij
——-\Service_rcpvqrtd
——-\Service_rtsvwtwb
——-\Service_tmjziczm
——-\Service_ufsrewra
——-\Service_urwtbstp
——-\Service_usbf37
——-\Service_yresnayx


((((((((((((((((((((((((( Files Created from 2010-04-17 to 2010-05-17 )))))))))))))))))))))))))))))))
.

2010-05-17 14:25 . 2010-05-17 14:25 ——– d—–w- c:\documents and settings\All Users\Application Data\Comodo Downloader
2010-05-16 23:04 . 2010-05-16 23:04 411368 —-a-w- c:\windows\system32\deployJava1.dll
2010-05-16 21:59 . 2010-05-16 21:59 ——– d—–w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2010-05-16 20:25 . 2010-05-16 20:25 ——– d—–w- c:\documents and settings\User\Application Data\Malwarebytes
2010-05-16 20:24 . 2010-04-29 13:39 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-05-16 20:24 . 2010-05-16 20:24 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-05-16 20:24 . 2010-05-16 20:24 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-05-16 20:24 . 2010-04-29 13:39 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-05-13 00:19 . 2010-05-13 00:19 ——– d—–w- c:\program files\Common Files\EzTools
2010-05-13 00:00 . 2010-05-16 11:07 ——– d—–w- c:\program files\e-Sword
2010-05-08 19:27 . 2010-05-08 19:27 ——– d—–w- c:\documents and settings\User\Application Data\Helper
2010-04-27 07:05 . 2010-04-27 07:05 ——– d—–w- c:\program files\iPod
2010-04-27 07:04 . 2010-04-27 07:06 ——– d—–w- c:\program files\iTunes
2010-04-27 07:04 . 2010-04-27 07:06 ——– d—–w- c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-17 14:23 . 2009-04-30 13:07 ——– d—–w- c:\program files\Mozilla Thunderbird
2010-05-17 07:21 . 2010-02-27 16:28 0 —-a-w- c:\documents and settings\User\Local Settings\Application Data\prvlcl.dat
2010-05-16 23:05 . 2009-04-29 05:33 ——– d—–w- c:\program files\Common Files\Java
2010-05-16 23:04 . 2010-05-16 23:04 503808 —-a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-7f8875aa-n\msvcp71.dll
2010-05-16 23:04 . 2010-05-16 23:04 499712 —-a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-7f8875aa-n\jmc.dll
2010-05-16 23:04 . 2010-05-16 23:04 348160 —-a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-7f8875aa-n\msvcr71.dll
2010-05-16 23:04 . 2010-05-16 23:04 61440 —-a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-328c1160-n\decora-sse.dll
2010-05-16 23:04 . 2010-05-16 23:04 12800 —-a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-328c1160-n\decora-d3d.dll
2010-05-16 23:04 . 2009-04-29 05:33 ——– d—–w- c:\program files\Java
2010-05-16 21:19 . 2009-05-31 06:53 ——– d—–w- c:\documents and settings\User\Application Data\TeamViewer
2010-05-16 21:19 . 2009-05-31 17:51 ——– d—–w- c:\program files\TeamViewer
2010-05-15 14:38 . 2010-03-04 21:25 598 —-a-w- c:\windows\system32\secushr.dat
2010-05-13 22:13 . 2009-04-29 19:37 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-05-13 11:05 . 2009-04-29 17:00 76936 —-a-w- c:\documents and settings\User\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-05-11 22:31 . 2009-10-17 17:54 ——– d—–w- c:\documents and settings\User\Application Data\vlc
2010-05-08 17:34 . 2009-06-20 18:29 ——– d—–w- c:\documents and settings\User\Application Data\dvdcss
2010-05-06 20:15 . 2010-03-28 08:43 439816 —-a-w- c:\documents and settings\User\Application Data\Real\Update\setup3.10\setup.exe
2010-05-06 20:15 . 2010-05-06 20:15 439816 —-a-w- c:\documents and settings\User\Application Data\Real\Update\temp\~Upg0\setup.exe
2010-05-05 07:07 . 2009-05-31 07:27 ——– d—–w- c:\program files\FileZilla FTP Client
2010-04-27 20:43 . 2009-07-09 19:42 ——– d—–w- c:\documents and settings\User\Application Data\Apple Computer
2010-04-27 07:04 . 2009-08-04 06:27 ——– d—–w- c:\program files\Common Files\Apple
2010-04-27 07:01 . 2009-08-04 06:09 ——– d—–w- c:\program files\QuickTime
2010-04-27 06:57 . 2009-08-04 06:28 ——– d—–w- c:\program files\Bonjour
2010-04-27 06:42 . 2010-04-27 06:42 73000 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.1.0.79\SetupAdmin.exe
2010-04-05 21:47 . 2009-12-06 17:03 ——– d—–w- c:\program files\Morton Benson
2010-03-28 23:31 . 2010-03-28 23:31 ——– d—–w- c:\documents and settings\User\Application Data\Talkback
2010-03-25 18:37 . 2010-03-25 18:37 ——– d—–w- c:\program files\Photomatix
2010-03-10 06:15 . 2002-02-26 21:58 420352 —-a-w- c:\windows\system32\vbscript.dll
2010-02-25 06:24 . 2003-03-31 12:00 916480 —-a-w- c:\windows\system32\wininet.dll
2010-02-24 13:11 . 2002-11-18 16:27 455680 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-02-17 07:10 . 2003-04-24 13:57 2189952 —-a-w- c:\windows\system32\ntoskrnl.exe
.

——- Sigcheck ——-

[7] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
[7] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\system32\dllcache\tcpip.sys
[-] 2008-06-20 . 4AFB3B0919649F95C1964AA1FAD27D73 . 361600 . . [5.1.2600.5625] . . c:\windows\system32\drivers\tcpip.sys
[7] 2008-04-13 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB951748$\tcpip.sys
[7] 2008-04-13 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\tcpip.sys
[-] 2006-04-20 . B2220C618B42A2212A59D91EBD6FC4B4 . 360576 . . [5.1.2600.2892] . . c:\windows\SoftwareDistribution\Download\556eb98436b65a8c1ffae674c83d197f\sp2qfe\tcpip.sys
[-] 2006-04-20 . 1DBF125862891817F374F407626967F4 . 359808 . . [5.1.2600.2892] . . c:\windows\SoftwareDistribution\Download\556eb98436b65a8c1ffae674c83d197f\sp2gdr\tcpip.sys
[7] 2004-08-04 . 9F4B36614A0FC234525BA224957DE55C . 359040 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\tcpip.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2003-04-07 114688]
"IgfxTray"="c:\windows\System32\igfxtray.exe" [2003-04-07 155648]
"PRONoMgr.exe"="c:\program files\Intel\NCS\PROSet\PRONoMgr.exe" [2003-03-11 86016]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-09-28 198160]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-17 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-03-25 142120]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - c:\windows\Installer\{AC76BA86-1033-0000-7760-000000000003}\_SC_Acrobat.exe [2009-9-18 295606]
Adobe Acrobat Synchronizer.lnk - c:\program files\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe [2006-10-23 734872]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Sebring]
2003-02-28 23:01 110592 —-a-w- c:\windows\system32\LgNotify.dll

[HKLM\~\startupfolder\C:^Documents and Settings^User^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=c:\documents and settings\User\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=c:\windows\pss\Adobe Gamma.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
2006-10-22 21:24 620152 —-a-w- c:\program files\Adobe\Acrobat 8.0\Acrobat\acrotray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe_ID0EYTHM]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2008-10-25 18:44 31072 —-a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 ——w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
2009-04-29 05:48 577536 —-a-w- c:\program files\Synaptics\SynTP\SynTPEnh.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPLpr]
2009-04-29 05:48 126976 —-a-w- c:\program files\Synaptics\SynTP\SynTPLpr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2009-09-28 07:28 198160 —-a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Documents and Settings\\User\\temp\\TeamViewer\\Version4\\TeamViewer.exe"=
"c:\\WINDOWS\\system32\\ftp.exe"=
"c:\\Program Files\\Macromedia\\Dreamweaver 8\\Dreamweaver.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Program Files\\Common Files\\Adobe\\Adobe Version Cue CS3\\Server\\bin\\VersionCueCS3.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\TeamViewer\\Version5\\TeamViewer.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"3703:TCP"= 3703:TCP:Adobe Version Cue CS3 Server
"3704:TCP"= 3704:TCP:Adobe Version Cue CS3 Server
"50900:TCP"= 50900:TCP:Adobe Version Cue CS3 Server
"50901:TCP"= 50901:TCP:Adobe Version Cue CS3 Server

S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [5/16/2010 10:24 PM 38224]
.
Contents of the 'Scheduled Tasks' folder

2010-04-27 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 19:34]

2010-05-17 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAEXEC.exe [2009-08-03 13:07]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.de/
uInternet Connection Wizard,ShellNext = hxxp://www.gatewaybiz.com/
IE: Append to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Download All By FlashGet3 - c:\documents and settings\User\Application Data\FlashGetBHO\GetAllUrl.htm
IE: Download By FlashGet3 - c:\documents and settings\User\Application Data\FlashGetBHO\GetUrl.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
Trusted Zone: kuaiche.com\software
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\w2kukr31.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo! Search
FF - component: c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\w2kukr31.default\extensions\{DB9127A2-3381-41ec-82B3-1B6ED4C6F29A}\components\FlashgetXpi.dll
FF - component: c:\program files\real\realplayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdjvu.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npOGAPlugin.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-17 18:41
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(1216)
c:\windows\System32\LgNotify.dll

- - - - - - - > 'explorer.exe'(880)
c:\windows\system32\WININET.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
c:\program files\Windows Desktop Search\deskbar.dll
c:\program files\Windows Desktop Search\en-us\dbres.dll.mui
c:\program files\Windows Desktop Search\dbres.dll
c:\program files\Windows Desktop Search\wordwheel.dll
c:\program files\Windows Desktop Search\en-us\msnlExtRes.dll.mui
c:\program files\Windows Desktop Search\msnlExtRes.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\windows\System32\S24EvMon.exe
c:\windows\system32\ZCfgSvc.exe
c:\program files\Microsoft ActiveSync\wcescomm.exe
c:\progra~1\MI3AA1~1\rapimgr.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
c:\windows\System32\RegSrvc.exe
c:\windows\System32\RoamMgr.exe
c:\windows\system32\SearchIndexer.exe
c:\program files\Intel\Switching\User\RoamSvc.exe
c:\windows\system32\wscntfy.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2010-05-17 18:47:09 - machine was rebooted
ComboFix-quarantined-files.txt 2010-05-17 16:47
ComboFix2.txt 2010-05-17 14:00

Pre-Run: 31,844,388,864 bytes free
Post-Run: 31,708,909,568 bytes free

- - End Of File - - C590FD5B056135DC4D5C5214681747F1

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI