What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Rootkit?

13 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Computer was acting weird so I scanned with malware/super and now ran combofix. Here are results.

ComboFix 11-04-07.01 - CAPWN 04/07/2011 22:02:29.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1013.732 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
.
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Administrator\Desktop\499wggr7.exe
c:\documents and settings\Administrator\Desktop\ComboFix.exe
c:\documents and settings\jhamilton\Desktop\ComboFix(1).exe
c:\documents and settings\kgreen.PCS\Desktop\clj4600pcl6winvista2kxp2003.exe
c:\documents and settings\kgreen\WINDOWS
c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe
c:\program files\Analog Devices\Core\smax4pnp.exe
c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
c:\program files\Common Files\Microsoft Shared\Web Folders\MSONSEXT.DLL
c:\program files\Common Files\System\SNAPVIEW.OCX
c:\program files\Dell AIO Printer A920\dlbkbmgr.exe
c:\program files\HP\HP Software Update\HPWuSchd2.exe
c:\program files\Internet Explorer\custsat.dll
c:\program files\Internet Explorer\ieproxy.dll
c:\program files\Internet Explorer\Plugins\nppdf32.dll
c:\program files\Messenger\custsat.dll
c:\program files\Windows Media Player\dlimport.exe
c:\program files\Windows Media Player\LegitLibM.dll
c:\program files\Windows Media Player\wmdbexport.exe
c:\program files\Windows Media Player\wmlaunch.exe
c:\program files\Windows Media Player\wmpenc.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\Windows Media Player\wmpnscfg.exe
c:\program files\Windows Media Player\wmpnssci.dll
c:\program files\Windows Media Player\wmpshare.exe
c:\program files\Windows Media Player\wmpvis.dll
c:\program files\Windows Media Player\wmsetsdk.exe
c:\program files\Windows NT\Accessories\mswrd6.wpc
c:\program files\Windows NT\Accessories\mswrd8.wpc
c:\program files\Windows NT\Accessories\write.wpc
c:\program files\Windows NT\hypertrm.exe
c:\windows\apppatch\acadproc.dll
c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
c:\windows\ODEUNST.EXE
c:\windows\Setup1.exe
c:\windows\System\crlds3d.dll
c:\windows\system32\acelpdec.ax
c:\windows\system32\advpack.dll.mui
c:\windows\system32\audiodev.dll
c:\windows\system32\chcp.com
c:\windows\system32\comsdupd.exe
c:\windows\system32\dfshim.dll
c:\windows\system32\DIMM.DLL
c:\windows\system32\diskcomp.com
c:\windows\system32\diskcopy.com
c:\windows\system32\dlbkcinf.dll
c:\windows\system32\dlbkcoin.dll
c:\windows\system32\dlbkcomm.dll
c:\windows\system32\dlbkpwr.dll
c:\windows\system32\drivers\ADIHdAud.sys
c:\windows\system32\Drivers\hdaudbus.sys
c:\windows\system32\Drivers\Hdaudio.sys
c:\windows\system32\DRIVERS\igxpmp32.sys
c:\windows\system32\Drivers\mbamswissarmy.sys
c:\windows\system32\DRIVERS\secdrv.sys
c:\windows\system32\drivers\Senfilt.sys
c:\windows\system32\Drivers\sffp_mmc.sys
c:\windows\system32\Drivers\wpdusb.sys
c:\windows\system32\DRIVERS\WudfPf.sys
c:\windows\system32\DRIVERS\wudfrd.sys
c:\windows\system32\drmupgds.exe
c:\windows\system32\dxva2.dll
c:\windows\system32\evr.dll
c:\windows\system32\faxpatch.exe
c:\windows\system32\format.com
c:\windows\system32\graftabl.com
c:\windows\system32\Hdaudprop.dll
c:\windows\system32\Hdaudpropres.dll
c:\windows\system32\Hdaudpropshortcut.exe
c:\windows\system32\hptcpmib.dll
c:\windows\system32\HpTcpMon.dll
c:\windows\system32\HPTcpMUI.dll
c:\windows\system32\hpzipm12.dll
c:\windows\system32\html.iec
c:\windows\system32\icardagt.exe
c:\windows\system32\icardres.dll
c:\windows\system32\icardres.dll.mui
c:\windows\system32\ieframe.dll.mui
c:\windows\system32\igldev32.dll
c:\windows\system32\iglicd32.dll
c:\windows\system32\igxpdv32.dll
c:\windows\system32\igxpdx32.dll
c:\windows\system32\igxpgd32.dll
c:\windows\system32\igxprd32.dll
c:\windows\system32\igxpun.exe
c:\windows\system32\imaadp32.acm
c:\windows\system32\infocardapi.dll
c:\windows\system32\infocardcpl.cpl
c:\windows\system32\INKED.DLL
c:\windows\system32\ivfsrc.ax
c:\windows\system32\LEX2KUSB.DLL
c:\windows\system32\LEXBCE.DLL
c:\windows\system32\LEXBCES.EXE
c:\windows\system32\lexlmpm.dll
c:\windows\system32\LEXP2P32.DLL
c:\windows\system32\LEXPPS.EXE
c:\windows\system32\MFPLAT.dll
c:\windows\system32\migpwd.exe
c:\windows\system32\milcore.dll
c:\windows\system32\mindex.dll
c:\windows\system32\mode.com
c:\windows\system32\more.com
c:\windows\system32\MP43DECD.dll
c:\windows\system32\mp4sdecd.dll
c:\windows\system32\MPG4DECD.dll
c:\windows\system32\msacm32.drv
c:\windows\system32\msadp32.acm
c:\windows\system32\msaud32.acm
c:\windows\system32\mscoree.dll
c:\windows\system32\msdelta.dll
c:\windows\system32\msg711.acm
c:\windows\system32\msg723.acm
c:\windows\system32\msgsm32.acm
c:\windows\system32\msh261.drv
c:\windows\system32\msh263.drv
c:\windows\system32\MSRDO20.DLL
c:\windows\system32\MSRTEDIT.DLL
c:\windows\system32\MSSTDFMT.DLL
c:\windows\system32\mucltui.dll
c:\windows\system32\mucltui.dll.mui
c:\windows\system32\muweb.dll
c:\windows\system32\netfxperf.dll
c:\windows\system32\ODESTKIT.DLL
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\PortableDeviceClassExtension.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceWiaCompat.dll
c:\windows\system32\PortableDeviceWMDRM.dll
c:\windows\system32\prntvpt.dll
c:\windows\system32\RDOCURS.DLL
c:\windows\system32\rgb9rast_2.dll
c:\windows\system32\SCP32.DLL
c:\windows\system32\spdwnwxp.exe
c:\windows\system32\spmsg2.dll
c:\windows\System32\spool\PRTPROCS\W32X86\DLBKPP5C.dll
c:\windows\System32\spool\PRTPROCS\W32X86\filterpipelineprintproc.dll
c:\windows\System32\spool\PRTPROCS\W32X86\hpzpp053.dll
c:\windows\System32\spool\PRTPROCS\W32X86\hpzpp5in.DLL
c:\windows\System32\spool\PRTPROCS\W32X86\mdippr.dll
c:\windows\system32\spupdsvc.exe
c:\windows\system32\spupdwxp.exe
c:\windows\system32\system
c:\windows\system32\taskman.exe
c:\windows\system32\temp.000
c:\windows\system32\tree.com
c:\windows\system32\tscupgrd.exe
c:\windows\system32\tssoft32.acm
c:\windows\system32\TsWpfWrp.exe
c:\windows\system32\UIAutomationCore.dll
c:\windows\system32\uwdf.exe
c:\windows\system32\VBAEN32.OLB
c:\windows\system32\VBAEND32.OLB
c:\windows\system32\VBAME.DLL
c:\windows\system32\VEN2232.OLB
c:\windows\system32\verclsid.exe
c:\windows\system32\wdfapi.dll
c:\windows\system32\wdfmgr.exe
c:\windows\system32\win.com
c:\windows\system32\WINSSPI.DLL
c:\windows\system32\WISPTIS.EXE
c:\windows\system32\wmdrmdev.dll
c:\windows\system32\wmdrmnet.dll
c:\windows\system32\wmidx.ocx
c:\windows\system32\wmpeffects.dll
c:\windows\system32\wmpencen.dll
c:\windows\system32\wmpmde.dll
c:\windows\system32\wmpps.dll
c:\windows\system32\wmpsrcwp.dll
c:\windows\system32\wmpstub.exe
c:\windows\system32\WMVADVD.dll
c:\windows\system32\WMVADVE.DLL
c:\windows\system32\wmvcore2.dll
c:\windows\system32\WMVDECOD.dll
c:\windows\system32\wmvdmoe.dll
c:\windows\system32\WMVENCOD.dll
c:\windows\system32\WMVSDECD.dll
c:\windows\system32\WMVSENCD.dll
c:\windows\system32\WMVXENCD.dll
c:\windows\system32\wpd_ci.dll
c:\windows\system32\wpdconns.dll
c:\windows\system32\wpdmtp.dll
c:\windows\system32\wpdmtpus.dll
c:\windows\system32\WpdShext.dll
c:\windows\system32\wpdshextautoplay.exe
c:\windows\system32\wpdshextres.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\wpdsp.dll
c:\windows\system32\wuapi.dll.mui
c:\windows\system32\wuaucpl.cpl.mui
c:\windows\system32\wuaueng.dll.mui
c:\windows\system32\wucltui.dll.mui
c:\windows\system32\WUDFCoinstaller.dll
c:\windows\system32\WudfHost.exe
c:\windows\system32\WudfPlatform.dll
c:\windows\System32\WUDFSvc.dll
c:\windows\system32\WUDFx.dll
c:\windows\system32\xpsp4res.dll
c:\windows\system32\xpsshhdr.dll
c:\windows\system32\xpssvcs.dll
.
.
\\.\PhysicalDrive0 - Bootkit TDL4 was found and disinfected
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
——-\Service_ADIHdAudAddService
——-\Service_SenFiltService
.
.
((((((((((((((((((((((((( Files Created from 2011-03-08 to 2011-04-08 )))))))))))))))))))))))))))))))
.
.
2011-04-07 21:18 . 2011-04-07 21:18 ——– d—–w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2011-04-07 21:18 . 2011-04-07 21:18 ——– d—–w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com
2011-04-07 21:18 . 2011-04-07 21:18 ——– d—–w- c:\program files\SUPERAntiSpyware
2011-03-28 14:30 . 2008-04-14 11:42 26624 —-a-w- c:\documents and settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
2011-03-15 12:56 . 2011-03-15 12:56 ——– d–h–w- c:\documents and settings\All Users\Application Data\Common Files
2011-03-14 18:38 . 2011-03-14 18:38 ——– d—–w- c:\documents and settings\All Users\Application Data\hOnDaNm06321
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-01-21 14:44 . 2003-03-31 12:00 439296 —-a-w- c:\windows\system32\shimgvw.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-06-06 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-06-06 162328]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-06-06 137752]
"ToolBoxFX"="c:\program files\HP\ToolBoxFX\bin\HPTLBXFX.exe" [2005-11-21 45056]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"TSClientMSIUninstaller"="c:\windows\Installer\TSClientMsiTrans\tscuinst.vbs" [2007-10-30 13801]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\sambar50\\bin\\server.exe"=
"c:\\Inetpub\\wwwroot\\RedeSetGrow\\RSGLauncher.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
.
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 12:25 PM 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 12:41 PM 67656]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [3/25/2010 11:25 AM 30969208]
S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [1/9/2010 10:37 PM 4640000]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} -
.
- - - - ORPHANS REMOVED - - - -
.
HKLM-Run-SoundMAXPnP - c:\program files\Analog Devices\Core\smax4pnp.exe
HKLM-Run-Dell AIO Printer A920 - c:\program files\Dell AIO Printer A920\dlbkbmgr.exe
HKLM-Run-HP Software Update - c:\program files\HP\HP Software Update\HPWuSchd2.exe
HKLM-Run-Adobe Reader Speed Launcher - c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe
Notify-avgrsstarter - avgrsstx.dll
Notify-NavLogon - (no file)
AddRemove-HDMI - c:\windows\system32\igxpun.exe
AddRemove-Windows Media Format Runtime - c:\program files\Windows Media Player\wmsetsdk.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-04-07 22:23
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(656)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
.
- - - - - - - > 'explorer.exe'(1844)
c:\windows\system32\WININET.dll
c:\progra~1\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf
c:\progra~1\MICROS~2\Office14\1033\GrooveIntlResource.dll
c:\windows\system32\ieframe.dll
.
———————— Other Running Processes ————————
.
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
.
**************************************************************************
.
Completion time: 2011-04-07 22:26:12 - machine was rebooted
ComboFix-quarantined-files.txt 2011-04-08 04:26
.
Pre-Run: 64,619,741,184 bytes free
Post-Run: 67,509,272,576 bytes free
.
- - End Of File - - 0CC51A4289CD04B5331BCBF4D903917B
Post #2
Hi, welcome to the WTT Forums. My username is Raktor, and I would be glad to help you with your malware issues. I'd be grateful if you would note the following:

  • Absence of symptoms does not always mean the computer is clean
  • Please do not run any scans or fixes without my direction.
  • Finally, stay with this topic until I give you the final 'All clear' post.

Please post the contents of C:\Qoobox\ComboFix-quarantined-files.txt
Post #3
Thanks for the reply 2011-04-08 04:25:50 . 2011-04-08 04:25:50 1,032 —-a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-Windows Media Format Runtime.reg.dat 2011-04-08 04:25:50 . 2011-04-08 04:25:50 496 —-a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-HDMI.reg.dat 2011-04-08 04:25:43 . 2011-04-08 04:25:43 306 —-a-w- C:\Qoobox\Quarantine\Registry_backups\Notify-NavLogon.reg.dat 2011-04-08 04:25:43 . 2011-04-08 04:25:43 378 —-a-w- C:\Qoobox\Quarantine\Registry_backups\Notify-avgrsstarter.reg.dat 2011-04-08 04:25:37 . 2011-04-08 04:25:37 177 —-a-w- C:\Qoobox\Quarantine\Registry_backups\HKLM-Run-Adobe Reader Speed Launcher.reg.dat 2011-04-08 04:25:37 . 2011-04-08 04:25:37 161 —-a-w- C:\Qoobox\Quarantine\Registry_backups\HKLM-Run-HP Software Update.reg.dat 2011-04-08 04:25:37 . 2011-04-08 04:25:37 166 —-a-w- C:\Qoobox\Quarantine\Registry_backups\HKLM-Run-Dell AIO Printer A920.reg.dat 2011-04-08 04:25:37 . 2011-04-08 04:25:37 151 —-a-w- C:\Qoobox\Quarantine\Registry_backups\HKLM-Run-SoundMAXPnP.reg.dat 2011-04-08 04:09:21 . 2011-04-08 04:09:21 2,550 —-a-w- C:\Qoobox\Quarantine\Registry_backups\Service_SenFiltService.reg.dat 2011-04-08 04:09:21 . 2011-04-08 04:09:21 2,670 —-a-w- C:\Qoobox\Quarantine\Registry_backups\Service_ADIHdAudAddService.reg.dat 2011-04-08 04:08:39 . 2011-04-08 04:08:39 7,234 —-a-w- C:\Qoobox\Quarantine\Registry_backups\tcpip.reg 2011-04-08 03:47:28 . 2011-04-08 03:47:28 512 —-a-w- C:\Qoobox\Quarantine\MBR_HardDisk0.mbr 2011-04-08 03:35:23 . 2011-04-08 03:59:34 102 —-a-w- C:\Qoobox\Quarantine\catchme.log 2011-04-07 21:29:05 . 2011-04-07 21:26:00 301,568 —-a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Administrator\Desktop\499wggr7.exe.vir 2011-04-07 20:57:19 . 2011-04-07 20:57:33 4,345,411 —-a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Administrator\Desktop\ComboFix.exe.vir 2011-04-07 20:20:07 . 2011-04-07 20:16:52 4,345,411 —-a-w- C:\Qoobox\Quarantine\C\Documents and Settings\jhamilton\Desktop\ComboFix(1).exe.vir 2011-02-04 13:47:57 . 2010-08-26 12:52:45 5,120 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\xpsp4res.dll.vir 2011-02-04 13:44:26 . 2009-08-07 02:23:46 16,736 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\mucltui.dll.mui.vir 2011-02-04 13:44:26 . 2009-08-07 02:23:46 274,288 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\mucltui.dll.vir 2011-02-03 20:34:00 . 2010-12-21 01:09:00 38,224 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\Drivers\mbamswissarmy.sys.vir 2010-09-23 13:35:18 . 2010-09-23 13:35:18 20 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\SYSTEM.vir 2010-08-19 17:43:14 . 2007-03-03 00:23:38 235,520 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\spool\prtprocs\w32x86\hpzpp5in.DLL.vir 2010-08-19 17:43:13 . 2006-05-12 00:15:50 52,736 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\HPZIPM12.DLL.vir 2010-08-19 17:40:10 . 2010-08-19 17:40:10 14,110,192 —-a-w- C:\Qoobox\Quarantine\C\Documents and Settings\kgreen.PCS\Desktop\clj4600pcl6winvista2kxp2003.exe.vir 2010-02-28 09:15:40 . 2010-02-28 09:15:40 991,072 —-a-w- C:\Qoobox\Quarantine\C\Program Files\Common Files\Microsoft Shared\Web Folders\MSONSEXT.DLL.vir 2010-02-18 04:42:38 . 2010-02-18 04:42:38 51,584 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\VBAME.DLL.vir 2010-01-10 04:18:00 . 2010-01-10 04:18:00 149,352 —-a-w- C:\Qoobox\Quarantine\C\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE.vir 2009-11-07 08:07:08 . 2009-11-07 08:07:08 49,488 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\netfxperf.dll.vir 2009-11-07 08:06:46 . 2009-11-07 08:06:46 1,130,824 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\dfshim.dll.vir 2009-11-06 05:17:22 . 2009-11-06 05:17:22 297,808 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\mscoree.dll.vir 2008-08-14 17:22:08 . 2008-04-14 06:10:50 10,240 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\Drivers\sffp_mmc.sys.vir 2008-07-30 04:10:04 . 2008-07-30 04:10:04 73,720 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\dxva2.dll.vir 2008-07-30 04:10:04 . 2008-07-30 04:10:04 493,048 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\evr.dll.vir 2008-07-30 04:10:04 . 2008-07-30 04:10:04 26,112 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\TsWpfWrp.exe.vir 2008-07-30 02:59:58 . 2008-07-30 02:59:58 161,296 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\UIAutomationCore.dll.vir 2008-07-30 02:24:50 . 2008-07-30 02:24:50 881,664 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe.vir 2008-07-30 02:24:50 . 2008-07-30 02:24:50 622,080 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\icardagt.exe.vir 2008-07-30 02:24:50 . 2008-07-30 02:24:50 11,264 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\icardres.dll.vir 2008-07-30 02:24:50 . 2008-07-30 02:24:50 97,800 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\infocardapi.dll.vir 2008-07-30 02:24:50 . 2008-07-30 02:24:50 37,384 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\infocardcpl.cpl.vir 2008-07-30 02:16:38 . 2008-07-30 02:16:38 132,096 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe.vir 2008-07-29 12:49:58 . 2008-07-29 12:49:58 586,240 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\icardres.dll.mui.vir 2008-07-25 18:16:40 . 2008-07-25 18:16:40 34,312 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe.vir 2008-02-22 10:11:52 . 2008-04-14 11:41:50 39,424 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\AppPatch\acadproc.dll.vir 2008-02-22 10:04:56 . 2008-07-06 12:06:10 89,088 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll.vir 2008-02-22 10:04:43 . 2006-06-29 20:07:36 14,048 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\spmsg2.dll.vir 2008-01-12 04:16:38 . 2008-01-12 04:16:38 39,792 —-a-w- C:\Qoobox\Quarantine\C\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe.vir 2007-11-19 16:20:51 . 2003-05-12 22:02:32 174,592 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\LEXPPS.EXE.vir 2007-11-19 16:20:51 . 2003-05-12 22:02:32 201,216 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\LEXP2P32.DLL.vir 2007-11-19 16:20:51 . 2003-05-12 22:02:32 147,456 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\LEXBCE.DLL.vir 2007-11-19 16:20:51 . 2003-05-12 22:02:32 303,104 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\LEXBCES.EXE.vir 2007-11-19 16:20:51 . 2003-05-12 22:02:32 196,096 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\LEX2KUSB.DLL.vir 2007-11-19 16:20:51 . 2003-05-12 22:02:32 73,728 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\dlbkpwr.dll.vir 2007-11-19 16:20:51 . 2003-05-12 22:02:32 78,336 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\spool\prtprocs\w32x86\DLBKPP5C.DLL.vir 2007-11-19 16:20:51 . 2003-05-12 22:02:30 286,720 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\dlbkcomm.dll.vir 2007-11-19 16:20:51 . 2003-05-12 22:02:32 192,512 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\lexlmpm.dll.vir 2007-11-19 16:20:35 . 2003-05-12 22:02:30 57,344 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\dlbkcinf.dll.vir 2007-11-19 16:20:35 . 2003-05-12 22:02:30 49,152 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\dlbkcoin.dll.vir 2007-11-19 16:20:35 . 2003-05-12 22:02:26 270,336 —-a-w- C:\Qoobox\Quarantine\C\Program Files\Dell AIO Printer A920\dlbkbmgr.exe.vir 2007-11-13 17:11:01 . 2007-11-13 17:11:01 266,240 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\Setup1.exe.vir 2007-11-13 17:10:58 . 2007-11-13 17:10:59 73,216 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\ODEUNST.EXE.vir 2007-11-12 18:46:32 . 2007-04-09 20:23:54 28,552 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll.vir 2007-11-12 17:15:14 . 2009-08-07 02:24:18 21,728 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\wucltui.dll.mui.vir 2007-11-12 17:15:14 . 2009-08-07 02:24:00 17,632 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\wuaueng.dll.mui.vir 2007-11-12 17:15:14 . 2009-08-07 02:24:12 15,072 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\wuaucpl.cpl.mui.vir 2007-11-12 17:15:14 . 2009-08-07 02:24:06 15,064 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\wuapi.dll.mui.vir 2007-11-12 16:40:50 . 2007-08-01 21:52:42 1,036,288 —-a-w- C:\Qoobox\Quarantine\C\Program Files\Analog Devices\Core\smax4pnp.exe.vir 2007-11-12 16:40:50 . 2006-03-18 01:18:58 392,960 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\Drivers\senfilt.sys.vir 2007-11-12 16:40:50 . 2001-09-19 20:47:14 765,952 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system\crlds3d.dll.vir 2007-11-12 16:40:50 . 2007-08-03 22:29:12 307,712 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\Drivers\ADIHdAud.sys.vir 2007-11-12 16:34:11 . 2007-06-06 05:48:58 5,761,728 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\Drivers\igxpmp32.sys.vir 2007-11-12 16:34:11 . 2007-06-06 04:48:40 450,560 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\igldev32.dll.vir 2007-11-12 16:34:11 . 2007-06-06 05:48:34 150,528 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\igxpgd32.dll.vir 2007-11-12 16:34:11 . 2007-06-06 05:48:40 57,344 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\igxprd32.dll.vir 2007-11-12 16:34:11 . 2007-06-06 05:49:28 2,681,344 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\igxpdx32.dll.vir 2007-11-12 16:34:11 . 2007-06-06 05:48:20 1,717,504 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\igxpdv32.dll.vir 2007-11-12 16:34:11 . 2007-06-06 04:47:02 2,334,720 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\iglicd32.dll.vir 2007-11-12 16:34:10 . 2007-06-28 23:40:32 399,896 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\igxpun.exe.vir 2007-11-10 01:28:33 . 2008-04-14 11:41:52 33,792 —-a-w- C:\Qoobox\Quarantine\C\Program Files\Messenger\custsat.dll.vir 2007-11-10 01:28:29 . 2008-04-14 06:13:34 9,728 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\comsdupd.exe.vir 2007-11-10 01:28:25 . 2010-12-20 12:55:25 389,120 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\html.iec.vir 2007-11-10 01:28:24 . 2008-04-14 11:42:44 154,624 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\ivfsrc.ax.vir 2007-11-10 01:28:22 . 2009-11-20 11:14:51 187,392 —-a-w- C:\Qoobox\Quarantine\C\Program Files\Windows NT\Accessories\mswrd6.wpc.vir 2007-11-10 01:28:22 . 2010-06-25 13:30:29 279,552 —-a-w- C:\Qoobox\Quarantine\C\Program Files\Windows NT\Accessories\mswrd8.wpc.vir 2007-11-10 01:28:22 . 2009-11-20 11:14:50 89,600 —-a-w- C:\Qoobox\Quarantine\C\Program Files\Windows NT\Accessories\write.wpc.vir 2007-11-10 01:24:48 . 2007-11-30 11:18:51 26,488 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\spupdsvc.exe.vir 2007-11-09 17:34:20 . 2003-03-31 12:00:00 118,784 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\msg723.acm.vir 2007-11-09 17:34:07 . 2008-04-14 11:42:18 294,912 —-a-w- C:\Qoobox\Quarantine\C\Program Files\Windows Media Player\dlimport.exe.vir 2007-11-09 17:34:07 . 2003-03-31 12:00:00 520,192 —-a-w- C:\Qoobox\Quarantine\C\Program Files\Windows Media Player\wmpvis.dll.vir 2007-11-09 17:34:01 . 2008-04-14 11:42:46 188,416 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\msh261.drv.vir 2007-11-09 17:32:57 . 2003-03-31 12:00:00 28,160 —-a-w- C:\Qoobox\Quarantine\C\Program Files\Windows NT\hypertrm.exe.vir 2007-11-09 17:32:31 . 2004-08-04 05:59:28 44,544 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\tscupgrd.exe.vir 2007-08-14 01:54:10 . 2007-08-14 01:54:10 33,792 —-a-w- C:\Qoobox\Quarantine\C\Program Files\Internet Explorer\custsat.dll.vir 2007-08-14 01:54:10 . 2007-08-14 01:54:10 287,744 —-a-w- C:\Qoobox\Quarantine\C\Program Files\Internet Explorer\ieproxy.dll.vir 2007-08-14 01:40:52 . 2010-07-05 20:37:00 991,232 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\ieframe.dll.mui.vir 2007-08-14 01:38:48 . 2007-08-14 01:38:48 10,240 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\advpack.dll.mui.vir 2007-07-31 02:18:34 . 2009-08-07 02:23:46 215,920 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\muweb.dll.vir 2007-05-11 04:52:34 . 2007-05-11 04:52:34 95,864 —-a-w- C:\Qoobox\Quarantine\C\Program Files\Internet Explorer\PLUGINS\nppdf32.dll.vir 2007-05-08 22:24:20 . 2007-05-08 22:24:20 54,840 —-a-w- C:\Qoobox\Quarantine\C\Program Files\HP\HP Software Update\hpwuSchd2.exe.vir 2006-11-02 01:31:38 . 2006-11-02 01:31:38 1,669,120 —-a-w- C:\Qoobox\Quarantine\C\Program Files\Windows Media Player\wmsetsdk.exe.vir 2006-10-21 04:30:06 . 2006-10-21 04:30:06 1,980,704 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\milcore.dll.vir 2006-10-19 04:58:00 . 2006-10-19 04:58:00 8,704 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\uwdf.exe.vir 2006-10-19 04:58:00 . 2006-10-19 04:58:00 8,704 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\wdfmgr.exe.vir 2006-10-19 04:47:22 . 2006-10-19 04:47:22 4,096 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\WMVADVD.dll.vir 2006-10-19 04:47:22 . 2006-10-19 04:47:22 4,096 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\WMVADVE.DLL.vir 2006-10-19 04:47:22 . 2006-10-19 04:47:22 1,543,680 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\WMVDECOD.dll.vir 2006-10-19 04:47:22 . 2006-10-19 04:47:22 1,574,912 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\WMVENCOD.dll.vir 2006-10-19 04:47:22 . 2006-10-19 04:47:22 1,382,912 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\WMVSDECD.dll.vir 2006-10-19 04:47:22 . 2006-10-19 04:47:22 767,488 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\WMVSENCD.dll.vir 2006-10-19 04:47:22 . 2006-10-19 04:47:22 656,896 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\WMVXENCD.dll.vir 2006-10-19 04:47:22 . 2006-10-19 04:47:22 35,840 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\wpdconns.dll.vir 2006-10-19 04:47:22 . 2006-10-19 04:47:22 154,624 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\wpdmtp.dll.vir 2006-10-19 04:47:22 . 2006-10-19 04:47:22 63,488 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\wpdmtpus.dll.vir 2006-10-19 04:47:22 . 2006-10-19 04:47:22 2,603,008 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\WpdShext.dll.vir 2006-10-19 04:47:22 . 2006-10-19 04:47:22 38,400 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\wpdshextres.dll.vir 2006-10-19 04:47:22 . 2006-10-19 04:47:22 133,632 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\WPDShServiceObj.dll.vir 2006-10-19 04:47:22 . 2006-10-19 04:47:22 356,352 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\wpdsp.dll.vir 2006-10-19 04:47:22 . 2006-10-19 04:47:22 629,760 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\wpd_ci.dll.vir 2006-10-19 04:47:20 . 2006-10-19 04:47:20 198,144 —-a-w- C:\Qoobox\Quarantine\C\Program Files\Windows Media Player\wmpnssci.dll.vir 2006-10-19 04:47:20 . 2006-10-19 04:47:20 348,672 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\wmdrmnet.dll.vir 2006-10-19 04:47:20 . 2008-06-25 01:12:58 295,936 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\wmpeffects.dll.vir 2006-10-19 04:47:20 . 2006-10-19 04:47:20 1,661,440 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\wmpencen.dll.vir 2006-10-19 04:47:20 . 2006-10-19 04:47:20 613,376 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\wmpmde.dll.vir 2006-10-19 04:47:20 . 2006-10-19 04:47:20 130,048 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\wmpps.dll.vir 2006-10-19 04:47:20 . 2006-10-19 04:47:20 204,288 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\wmpsrcwp.dll.vir 2006-10-19 04:47:18 . 2006-10-19 04:47:18 284,160 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\PortableDeviceApi.dll.vir 2006-10-19 04:47:18 . 2006-10-19 04:47:18 101,888 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\PortableDeviceClassExtension.dll.vir 2006-10-19 04:47:18 . 2006-10-19 04:47:18 166,912 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\PortableDeviceTypes.dll.vir 2006-10-19 04:47:18 . 2006-10-19 04:47:18 132,096 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\PortableDeviceWiaCompat.dll.vir 2006-10-19 04:47:18 . 2006-10-19 04:47:18 199,168 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\PortableDeviceWMDRM.dll.vir 2006-10-19 04:47:18 . 2006-10-19 04:47:18 4,096 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\wdfapi.dll.vir 2006-10-19 04:47:18 . 2006-10-19 04:47:18 429,056 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\wmdrmdev.dll.vir 2006-10-19 04:47:14 . 2006-10-19 04:47:14 212,992 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\MFPLAT.dll.vir 2006-10-19 04:47:14 . 2006-10-19 04:47:14 259,072 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\MP43DECD.dll.vir 2006-10-19 04:47:14 . 2010-03-30 19:24:40 317,440 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\mp4sdecd.dll.vir 2006-10-19 04:47:14 . 2006-10-19 04:47:14 259,072 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\MPG4DECD.dll.vir 2006-10-19 04:47:08 . 2006-10-19 04:47:08 276,992 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\audiodev.dll.vir 2006-10-19 03:05:26 . 2006-10-19 03:05:26 204,288 —-a-w- C:\Qoobox\Quarantine\C\Program Files\Windows Media Player\wmpnscfg.exe.vir 2006-10-19 03:05:24 . 2006-10-19 03:05:24 913,408 —-a-w- C:\Qoobox\Quarantine\C\Program Files\Windows Media Player\wmpnetwk.exe.vir 2006-10-19 03:05:02 . 2006-10-19 03:05:02 25,600 —-a-w- C:\Qoobox\Quarantine\C\Program Files\Windows Media Player\wmpenc.exe.vir 2006-10-19 03:05:00 . 2006-10-19 03:05:00 241,664 —-a-w- C:\Qoobox\Quarantine\C\Program Files\Windows Media Player\wmlaunch.exe.vir 2006-10-19 03:04:40 . 2006-10-19 03:04:40 493,568 —-a-w- C:\Qoobox\Quarantine\C\Program Files\Windows Media Player\wmdbexport.exe.vir 2006-10-19 03:04:30 . 2006-10-19 03:04:30 36,864 —-a-w- C:\Qoobox\Quarantine\C\Program Files\Windows Media Player\wmpshare.exe.vir 2006-10-19 03:00:46 . 2006-10-19 03:00:46 249,856 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\drmupgds.exe.vir 2006-10-19 03:00:14 . 2006-10-19 03:00:14 17,408 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\wpdshextautoplay.exe.vir 2006-10-19 03:00:00 . 2006-10-19 03:00:00 38,528 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\Drivers\wpdusb.sys.vir 2006-10-15 03:22:00 . 2008-07-06 12:06:10 1,676,288 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\xpssvcs.dll.vir 2006-10-15 03:21:58 . 2008-07-06 12:06:10 575,488 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\xpsshhdr.dll.vir 2006-10-14 23:43:38 . 2008-07-06 12:06:10 117,760 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\prntvpt.dll.vir 2006-10-02 22:28:42 . 2006-10-02 22:28:42 312,128 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\msdelta.dll.vir 2006-09-29 03:13:26 . 2006-09-29 03:13:26 95,344 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\WUDFCoinstaller.dll.vir 2006-09-29 02:00:34 . 2006-09-29 02:00:34 82,944 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\Drivers\WudfRd.sys.vir 2006-09-29 01:56:38 . 2006-09-29 01:56:38 146,432 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\WudfHost.exe.vir 2006-09-29 01:56:38 . 2006-09-29 01:56:38 316,416 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\WUDFx.dll.vir 2006-09-29 01:56:16 . 2006-09-29 01:56:16 165,376 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\WudfPlatform.dll.vir 2006-09-29 01:56:14 . 2006-09-29 01:56:14 55,808 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\WudfSvc.dll.vir 2006-09-29 01:55:50 . 2006-09-29 01:55:50 77,568 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\Drivers\WudfPf.sys.vir 2006-08-24 23:15:06 . 2006-08-24 23:15:06 150,808 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\rgb9rast_2.dll.vir 2006-06-28 02:00:26 . 2006-06-28 02:00:26 410,928 —-a-w- C:\Qoobox\Quarantine\C\Program Files\Windows Media Player\LegitLibM.dll.vir 2006-03-17 00:38:01 . 2008-04-14 11:42:40 28,672 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\verclsid.exe.vir 2005-09-23 09:25:16 . 2005-09-23 09:25:16 69,120 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\spool\prtprocs\w32x86\hpzpp053.dll.vir 2005-06-21 16:28:22 . 2005-06-21 16:28:22 204,800 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\HPTcpMUI.dll.vir 2005-06-21 16:26:24 . 2005-06-21 16:26:24 155,648 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\HPTcpMon.dll.vir 2005-06-21 16:25:18 . 2005-06-21 16:25:18 65,536 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\HPTcpMib.dll.vir 2004-08-13 00:45:54 . 2008-04-14 04:06:06 144,384 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\Drivers\hdaudbus.sys.vir 2004-08-13 00:45:52 . 2004-08-13 00:45:52 24,064 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\Hdaudprop.dll.vir 2004-08-13 00:45:52 . 2004-08-13 00:45:52 61,952 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\Hdaudpropshortcut.exe.vir 2004-08-13 00:45:52 . 2004-08-13 00:45:52 113,664 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\Drivers\Hdaudio.sys.vir 2004-08-13 00:45:42 . 2004-08-13 00:45:42 5,120 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\Hdaudpropres.dll.vir 2004-08-04 14:56:58 . 2004-08-04 14:56:58 293,376 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\WISPTIS.EXE.vir 2004-08-04 14:56:44 . 2004-08-04 14:56:44 207,360 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\INKED.DLL.vir 2004-08-04 07:56:58 . 2008-04-14 11:42:38 7,680 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\spdwnwxp.exe.vir 2004-08-04 07:56:58 . 2008-04-14 11:42:38 20,992 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\spupdwxp.exe.vir 2004-08-04 07:56:50 . 2008-04-14 11:42:22 20,992 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\faxpatch.exe.vir 2003-03-31 12:00:00 . 2003-03-31 12:00:00 61,952 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\acelpdec.ax.vir 2003-03-31 12:00:00 . 2003-03-31 12:00:00 7,680 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\chcp.com.vir 2003-03-31 12:00:00 . 2003-03-31 12:00:00 9,216 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\diskcomp.com.vir 2003-03-31 12:00:00 . 2003-03-31 12:00:00 7,168 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\diskcopy.com.vir 2003-03-31 12:00:00 . 2008-04-14 11:42:44 29,696 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\format.com.vir 2003-03-31 12:00:00 . 2003-03-31 12:00:00 26,112 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\graftabl.com.vir 2003-03-31 12:00:00 . 2008-04-14 11:39:44 16,384 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\imaadp32.acm.vir 2003-03-31 12:00:00 . 2003-03-31 12:00:00 51,712 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\migpwd.exe.vir 2003-03-31 12:00:00 . 2003-03-31 12:00:00 163,840 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\mindex.dll.vir 2003-03-31 12:00:00 . 2003-03-31 12:00:00 19,456 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\mode.com.vir 2003-03-31 12:00:00 . 2008-04-14 11:42:44 16,896 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\more.com.vir 2003-03-31 12:00:00 . 2003-03-31 12:00:00 20,480 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\msacm32.drv.vir 2003-03-31 12:00:00 . 2008-04-14 11:40:08 14,848 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\msadp32.acm.vir 2003-03-31 12:00:00 . 2009-09-01 14:46:07 282,654 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\msaud32.acm.vir 2003-03-31 12:00:00 . 2003-03-31 12:00:00 9,216 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\msg711.acm.vir 2003-03-31 12:00:00 . 2003-03-31 12:00:00 19,968 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\msgsm32.acm.vir 2003-03-31 12:00:00 . 2003-03-31 12:00:00 15,360 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\taskman.exe.vir 2003-03-31 12:00:00 . 2008-04-14 11:42:44 12,800 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\tree.com.vir 2003-03-31 12:00:00 . 2003-03-31 12:00:00 8,192 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\tssoft32.acm.vir 2003-03-31 12:00:00 . 2003-03-31 12:00:00 18,432 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\win.com.vir 2003-03-31 12:00:00 . 2003-03-31 12:00:00 89,600 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\wmidx.ocx.vir 2003-03-31 12:00:00 . 2003-03-31 12:00:00 77,824 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\wmpstub.exe.vir 2003-03-31 12:00:00 . 2003-03-31 12:00:00 1,677,312 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\wmvcore2.dll.vir 2003-03-31 12:00:00 . 2003-03-31 12:00:00 446,464 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\wmvdmoe.dll.vir 2003-03-31 12:00:00 . 2008-04-14 04:09:16 20,480 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\Drivers\secdrv.sys.vir 2002-08-29 03:41:32 . 2008-04-14 11:42:46 294,912 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\msh263.drv.vir 2000-05-24 05:45:58 . 2000-05-24 05:45:58 118,784 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\MSSTDFMT.DLL.vir 2000-05-11 20:06:20 . 2000-05-11 20:06:20 397,312 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\MSRDO20.DLL.vir 2000-04-04 00:52:54 . 2000-04-04 00:52:54 151,552 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\RDOCURS.DLL.vir 1999-05-11 02:01:14 . 1999-05-11 02:01:14 1,384,448 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\temp.000.vir 1999-01-22 15:46:58 . 1999-01-22 15:46:58 65,536 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\MSRTEDIT.DLL.vir 1998-12-02 15:59:14 . 1998-12-02 15:59:14 114,688 —-a-w- C:\Qoobox\Quarantine\C\Program Files\Common Files\System\SNAPVIEW.OCX.vir 1998-11-03 07:00:00 . 1998-11-03 07:00:00 101,888 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\ODESTKIT.DLL.vir 1998-04-03 23:12:24 . 1998-04-03 23:12:24 68,080 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\DIMM.DLL.vir 1998-03-25 04:54:08 . 1998-03-25 04:54:08 15,872 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\SCP32.DLL.vir 1998-03-24 20:44:06 . 1998-03-24 20:44:06 24,848 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\VBAEN32.OLB.vir 1998-03-24 20:44:06 . 1998-03-24 20:44:06 24,848 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\VBAEND32.OLB.vir 1998-03-13 22:22:26 . 1998-03-13 22:22:26 20,080 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\WINSSPI.DLL.vir 1996-12-03 21:50:14 . 1996-12-03 21:50:14 37,376 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\VEN2232.OLB.vir
Post #4
Please download the attached zip file. Extract the contents (morik.bat) to your C:\. Double click on it to execute, then your PC should reboot. Please let me know if this is successful, and do not rerun Combofix yet.

Attachments:

Post #5
Ran the bat file, the appropriate cmd window opened and files copied. The computer did not restart though. File execution seems like it was successful.
Post #6
Good to hear. :)

Please double click on C:\WINDOWS\ERDNT\Hiv-backup\erdnt.exe - if you cannot find this exact file then stop here and let me know.

After that, reboot your machine.

Then, please download DDS and save it to your desktop from here or here or here.
Double click dds.scr to run the tool.
  • When done, DDS will open two (2) logs:
    • DDS.txt
    • Attach.txt
  • Save both reports to your desktop and post them here.
Post #7
Here is the DDS log and the requested Attach file. Thanks! . DDS (Ver_11-03-05.01) - NTFSx86 Run by [removed] at 20:41:08.91 on Tue 04/12/2011 Internet Explorer: 7.0.5730.13 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1013.704 [GMT -6:00] . . ============== Running Processes =============== . C:\WINDOWS\system32\svchost.exe -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\System32\svchost.exe -k HPZ12 C:\WINDOWS\System32\svchost.exe -k imgsvc C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\userinit.exe C:\WINDOWS\system32\userinit.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\igfxpers.exe C:\WINDOWS\system32\igfxsrvc.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Dell AIO Printer A920\dlbkbmon.exe C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Documents and Settings\Administrator\Desktop\dds.scr . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.google.com/ mURLSearchHooks: H - No File BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll BHO: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No File BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~2\office14\GROOVEEX.DLL BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - c:\progra~1\micros~2\office14\URLREDIR.DLL BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe mRun: [IgfxTray] c:\windows\system32\igfxtray.exe mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [Persistence] c:\windows\system32\igfxpers.exe mRun: [SoundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe mRun: [Dell AIO Printer A920] "c:\program files\dell aio printer a920\dlbkbmgr.exe" mRun: [ToolBoxFX] "c:\program files\hp\toolboxfx\bin\HPTLBXFX.exe" /enum:on /alerts:on /systrayIcon:on mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe" mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" dRunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" IE: E&xport; to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000 IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office14\ONBttnIE.dll IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office\office14\ONBttnIELinkedNotes.dll DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1194887578421 DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1251232689836 DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL Notify: avgrsstarter - avgrsstx.dll Notify: igfxcui - igfxdev.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~2\office14\GROOVEEX.DLL SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL . ============= SERVICES / DRIVERS =============== . R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2010-2-17 12872] R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-5-10 67656] S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\microsoft office\office14\GROOVE.EXE [2010-3-25 30969208] S3 osppsvc;Office Software Protection Platform;c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\OSPPSVC.EXE [2010-1-9 4640000] . =============== Created Last 30 ================ . 2011-04-13 15:47:24 8084 —-a-w- C:\morik.bat 2011-04-12 03:45:32 ——– d—–w- c:\docume~1\admini~1\applic~1\Malwarebytes 2011-04-09 00:39:02 274288 —-a-w- c:\windows\system32\mucltui.dll 2011-04-09 00:39:02 21728 —-a-w- c:\windows\system32\wucltui.dll.mui 2011-04-09 00:39:02 215920 —-a-w- c:\windows\system32\muweb.dll 2011-04-09 00:39:02 17632 —-a-w- c:\windows\system32\wuaueng.dll.mui 2011-04-09 00:39:02 16736 —-a-w- c:\windows\system32\mucltui.dll.mui 2011-04-09 00:39:02 15072 —-a-w- c:\windows\system32\wuaucpl.cpl.mui 2011-04-09 00:39:02 15064 —-a-w- c:\windows\system32\wuapi.dll.mui 2011-04-08 03:36:19 98816 —-a-w- c:\windows\sed.exe 2011-04-08 03:36:19 89088 —-a-w- c:\windows\MBR.exe 2011-04-08 03:36:19 256512 —-a-w- c:\windows\PEV.exe 2011-04-08 03:36:19 161792 —-a-w- c:\windows\SWREG.exe 2011-04-07 21:18:55 ——– d—–w- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com 2011-04-07 21:18:55 ——– d—–w- c:\docume~1\admini~1\applic~1\SUPERAntiSpyware.com 2011-04-07 21:18:48 ——– d—–w- c:\program files\SUPERAntiSpyware 2011-03-15 12:56:37 ——– d–h–w- c:\docume~1\alluse~1\applic~1\Common Files 2011-03-14 18:38:32 ——– d—–w- c:\docume~1\alluse~1\applic~1\hOnDaNm06321 . ==================== Find3M ==================== . 2011-01-21 14:44:37 439296 —-a-w- c:\windows\system32\shimgvw.dll . ============= FINISH: 20:42:28.74 ===============

Attachments:

Post #8
Good, we're making progress. :)

Please delete any copies of Combofix from your desktop.

Download a new copy from one of the links below, and save it to your desktop.
Link 1
Link 2

Disable any anti-virus protection, and double click on Combofix.exe.

Post the log saved at C:\Combofix.txt once the scan has completed.
Post #9
ComboFix 11-04-12.01 - CAPWN 04/12/2011 20:56:00.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1013.682 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\system
.
.
((((((((((((((((((((((((( Files Created from 2011-03-13 to 2011-04-13 )))))))))))))))))))))))))))))))
.
.
2011-04-13 15:47 . 2011-04-13 15:47 8084 —-a-w- C:\morik.bat
2011-04-12 03:45 . 2011-04-12 03:45 ——– d—–w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2011-04-09 00:39 . 2009-08-07 01:24 21728 —-a-w- c:\windows\system32\wucltui.dll.mui
2011-04-09 00:39 . 2009-08-07 01:24 15072 —-a-w- c:\windows\system32\wuaucpl.cpl.mui
2011-04-09 00:39 . 2009-08-07 01:24 15064 —-a-w- c:\windows\system32\wuapi.dll.mui
2011-04-09 00:39 . 2009-08-07 01:24 17632 —-a-w- c:\windows\system32\wuaueng.dll.mui
2011-04-09 00:39 . 2009-08-07 01:23 274288 —-a-w- c:\windows\system32\mucltui.dll
2011-04-09 00:39 . 2009-08-07 01:23 215920 —-a-w- c:\windows\system32\muweb.dll
2011-04-07 21:18 . 2011-04-07 21:18 ——– d—–w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2011-04-07 21:18 . 2011-04-07 21:18 ——– d—–w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com
2011-04-07 21:18 . 2011-04-07 21:18 ——– d—–w- c:\program files\SUPERAntiSpyware
2011-03-28 14:30 . 2008-04-14 11:42 26624 —-a-w- c:\documents and settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
2011-03-15 12:56 . 2011-03-15 12:56 ——– d–h–w- c:\documents and settings\All Users\Application Data\Common Files
2011-03-14 18:38 . 2011-03-14 18:38 ——– d—–w- c:\documents and settings\All Users\Application Data\hOnDaNm06321
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-01-21 14:44 . 2003-03-31 12:00 439296 —-a-w- c:\windows\system32\shimgvw.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-06-06 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-06-06 162328]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-06-06 137752]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2007-08-01 1036288]
"Dell AIO Printer A920"="c:\program files\Dell AIO Printer A920\dlbkbmgr.exe" [2003-05-12 270336]
"ToolBoxFX"="c:\program files\HP\ToolBoxFX\bin\HPTLBXFX.exe" [2005-11-21 45056]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"TSClientMSIUninstaller"="c:\windows\Installer\TSClientMsiTrans\tscuinst.vbs" [2007-10-30 13801]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
avgrsstx.dll [BU]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\NavLogon]
[BU]
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\sambar50\\bin\\server.exe"=
"c:\\Inetpub\\wwwroot\\RedeSetGrow\\RSGLauncher.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
.
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 12:25 PM 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 12:41 PM 67656]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [3/25/2010 11:25 AM 30969208]
S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [1/9/2010 10:37 PM 4640000]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} -
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-04-12 20:58
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(656)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
.
Completion time: 2011-04-12 21:00:09
ComboFix-quarantined-files.txt 2011-04-13 03:00
ComboFix2.txt 2011-04-08 04:26
.
Pre-Run: 67,442,466,816 bytes free
Post-Run: 67,433,431,040 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn
.
- - End Of File - - 51653EC13B4648F3DF7EF7612A4E0C12
Post #10
Few more things to do. :)

1) aswMBR
Download aswMBR.exe ( 511KB ) to your desktop.

Double click aswMBR.exe to run it

[external image: Posted Image]
Click the "Scan" button to start scan

[external image: Posted Image]
On completion of the scan click save log, save it to your desktop and post in your next reply.

2) MBAM
You already have Malwarebytes' Anti-Malware installed.
  • Open MBAM and update to the latest definitions (Update -> Update)
  • Once the program has updated, select Perform quick scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected .
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
  • Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.

3) ESET
  • Please go here then click on: [external image: Posted Image]

    Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
    All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.

  • Select the option YES, I accept the Terms of Use then click on: [external image: Posted Image]
  • When prompted allow the Add-On/Active X to install.
  • Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
  • Now click on Advanced Settings and select the following:
    • Scan for potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth Technology
  • Now click on: [external image: Posted Image]
  • The virus signature database… will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
  • When completed the Online Scan will begin automatically.
  • Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
  • When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
  • Now click on: [external image: Posted Image]
  • Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
  • Copy and paste that log as a reply to this topic.

4) What You Will Need To Post:
  • aswMBR log
  • MBAM log
  • ESET log
Post #13 last edited
No. I also checked the internet options, and it is set to automatically detect as it should be. Also the scan works on another computer on the network.
Post #14
Are you using Internet Explorer or Firefox? Try swapping browsers, if you have another installed, or retry the process to see if it was just a glitch. Otherwise let me know if it's still playing up and I'll give you instructions for a different scanner.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI