Looks like you're enjoying the discussion, but you're not signed up for an account. When you create an account, we remember exactly what you've read, so you always come right back where you left off. You also get notifications, here and via email, whenever new posts are made. You can like posts to share the love. 
Join 
This topic is locked
Thanks for instructions. Rogue Killer ran with no problems for me (I did have to download it to another machine). Log below, also ComboFix log:
RogueKiller V5.0.0 [04/30/2011] by Tigzy
contact at http://www.sur-la-toile.com
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.sur-la-to...-Remontees.html
Operating System: Windows XP (5.1.2600 Service Pack 3) 32 bits version
Started in : Safe mode
User: tony1 [Admin rights]
Mode: Scan -- Date : 05/02/2011 12:44:12
Bad processes: 0
Registry Entries: 0
HOSTS File:
127.0.0.1 localhost
Finished : << RKreport[1].txt >>
RKreport[1].txt
ComboFix 11-04-30.05 - tony1 02/05/2011 12:48:14.11.1 - x86 MINIMAL
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.804 [GMT 1:00]
Running from: c:\documents and settings\Perrin\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Perrin\Desktop\CFScript.txt
.
ADS - WINDOWS.0: deleted 0 bytes in 1 streams.
.
((((((((((((((((((((((((( Files Created from 2011-04-02 to 2011-05-02 )))))))))))))))))))))))))))))))
.
.
2011-05-02 11:40 . 2011-05-02 11:40 -------- d-----w- c:\windows.0\LastGood
2011-05-01 22:59 . 2011-05-01 22:59 -------- d-----w- c:\program files\ESET
2011-05-01 17:57 . 2011-04-20 23:29 719832 ------w- c:\program files\Mozilla Firefox\mozcpp19.dll
2011-05-01 17:57 . 2011-04-20 23:29 269272 ------w- c:\program files\Mozilla Firefox\freebl3.dll
2011-05-01 17:57 . 2011-04-20 23:29 16856 ------w- c:\program files\Mozilla Firefox\plugin-container.exe
2011-05-01 17:57 . 2011-04-20 23:29 166872 ------w- c:\program files\Mozilla Firefox\softokn3.dll
2011-05-01 14:20 . 2011-05-01 20:52 184691 ----a-w- c:\windows.0\explorermgr.exe
2011-05-01 14:19 . 2009-10-22 12:54 37392 ----a-w- c:\windows.0\system32\drivers\83466852.sys
2011-05-01 14:19 . 2009-10-09 22:31 315408 ----a-w- c:\windows.0\system32\drivers\8346685.sys
2011-05-01 14:19 . 2009-09-25 16:59 128016 ----a-w- c:\windows.0\system32\drivers\83466851.sys
2011-04-14 21:36 . 2011-05-01 14:20 -------- d-----w- c:\program files\kqhdmfdu
2011-04-11 22:11 . 2011-04-11 22:14 -------- d-----w- c:\documents and settings\Perrin\Application Data\avidemux
2011-04-11 22:11 . 2011-04-11 22:11 -------- d-----w- c:\program files\Avidemux 2.5
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-03-12 13:12 . 2011-03-12 13:12 51712 ----a-r- c:\documents and settings\Perrin\Application Data\Microsoft\Installer\{78D62D17-D970-42DA-B8CF-5E5576293B33}\Icon78D62D174.exe
2011-03-12 13:12 . 2011-03-12 13:12 51712 ----a-r- c:\documents and settings\Perrin\Application Data\Microsoft\Installer\{78D62D17-D970-42DA-B8CF-5E5576293B33}\Icon78D62D173.exe
2011-03-12 13:12 . 2011-03-12 13:12 51712 ----a-r- c:\documents and settings\Perrin\Application Data\Microsoft\Installer\{78D62D17-D970-42DA-B8CF-5E5576293B33}\Icon78D62D172.exe
2011-03-12 13:12 . 2011-03-12 13:12 27648 ----a-r- c:\documents and settings\Perrin\Application Data\Microsoft\Installer\{78D62D17-D970-42DA-B8CF-5E5576293B33}\Icon78D62D171.exe
2009-05-14 20:02 . 2009-05-14 20:02 3392872 ----a-w- c:\program files\Common Files\adlmint_libFNP.dll
2009-05-14 20:02 . 2009-05-14 20:02 3298152 ----a-w- c:\program files\Common Files\adlmint.dll
.
.
------- Sigcheck -------
.
[-] 2009-01-12 . 362BC5AF8EAF712832C58CC13AE05750 . 1614848 . . [5.1.2600.5512] . . c:\windows.0\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((( SnapShot_2011-04-21_18.52.49 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-07-28 10:29 . 2011-05-02 07:47 26238 c:\windows.0\system32\tablet.dat
- 2010-07-28 10:29 . 2011-04-21 18:31 26238 c:\windows.0\system32\tablet.dat
+ 2011-05-02 11:40 . 2009-10-22 12:54 37392 c:\windows.0\LastGood\system32\DRIVERS\92522832.sys
+ 2003-01-01 08:29 . 2009-03-08 14:09 638816 c:\windows.0\system32\dllcache\iexplore.exe
+ 2011-05-02 11:40 . 2009-09-25 16:59 128016 c:\windows.0\LastGood\system32\DRIVERS\92522831.sys
+ 2011-05-02 11:40 . 2009-10-09 22:31 315408 c:\windows.0\LastGood\system32\DRIVERS\9252283.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-12-30 149280]
"SoundMan"="SOUNDMAN.EXE" [2006-11-17 577536]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 602562]
"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" [2007-10-25 2178832]
"LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-10-25 563984]
.
c:\documents and settings\Perrin\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [N/A]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]
TabUserW.exe.lnk - c:\windows.0\system32\WTablet\TabUserW.exe [2010-7-28 77824]
VIA RAID TOOL.lnk - c:\program files\VIA\RAID\raid_tool.exe [N/A]
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Adobe\\Adobe Dreamweaver CS4\\Dreamweaver.exe"=
"c:\\Program Files\\Mozilla Thunderbird\\thunderbird.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
.
R0 83466852;83466852 Boot Guard Driver;c:\windows.0\system32\drivers\83466852.sys [01/05/2011 15:19 37392]
R0 viasraid;viasraid;c:\windows.0\system32\drivers\viasraid.sys [06/06/2010 17:07 77312]
S1 83466851;83466851;c:\windows.0\system32\drivers\83466851.sys [01/05/2011 15:19 128016]
S1 89349221;89349221;c:\windows.0\system32\DRIVERS\89349221.sys --> c:\windows.0\system32\DRIVERS\89349221.sys [?]
S1 89349222;89349222 Boot Guard Driver;c:\windows.0\system32\DRIVERS\89349222.sys --> c:\windows.0\system32\DRIVERS\89349222.sys [?]
S1 setup_9.0.0.722_01.05.2011_15-33drv;setup_9.0.0.722_01.05.2011_15-33drv;c:\windows.0\system32\DRIVERS\8934922.sys --> c:\windows.0\system32\DRIVERS\8934922.sys [?]
S2 ASTSRV;Nalpeiron Licensing Service;c:\windows.0\system32\ASTSRV.EXE [05/04/2010 16:41 57344]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [25/12/2010 14:45 136176]
S2 thdudf;TOSHIBA UDF2.5 Reader File System Driver;c:\windows.0\system32\drivers\thdudf.sys [29/01/2010 17:05 66944]
S3 scsiscan;SCSI Scanner Driver;c:\windows.0\system32\drivers\scsiscan.sys [24/01/2010 12:29 11520]
.
Contents of the 'Scheduled Tasks' folder
.
2011-05-02 c:\windows.0\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-12-25 13:45]
.
2011-05-02 c:\windows.0\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-12-25 13:45]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = iexplore
Trusted Zone: amazon.co.uk\www
Trusted Zone: ravenwoodfair.com\www
FF - ProfilePath - c:\documents and settings\Perrin\Application Data\Mozilla\Firefox\Profiles\pjo20krg.default\
FF - prefs.js: browser.startup.homepage - www.google.co.uk
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows.0\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: AVG Safe Search: {1E73965B-8B48-48be-9C8D-68B920ABC1C4} - c:\program files\AVG\AVG10\Firefox4
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-05-02 12:55
Windows 5.1.2600 Service Pack 3 NTFS
.
detected NTDLL code modification:
ZwQueryDirectoryFile
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
.
c:\documents and settings\Perrin\Start Menu\Programs\Startup\swypwijl.exe 184691 bytes executable
.
scan completed successfully
hidden files: 1
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-1960408961-413027322-1801674531-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{71D940F9-0E35-E0F0-1675-249C6C404004}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS.0\\system32\\Macromed\\Flash\\FlashUtil10o_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS.0\\system32\\Macromed\\Flash\\FlashUtil10o_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(240)
c:\windows.0\system32\Ati2evxx.dll
c:\windows.0\system32\atiadlxx.dll
.
- - - - - - - > 'explorer.exe'(816)
c:\windows.0\system32\WININET.dll
c:\program files\Windows Media Player\wmpband.dll
c:\windows.0\system32\ieframe.dll
.
Completion time: 2011-05-02 12:57:46
ComboFix-quarantined-files.txt 2011-05-02 11:57
ComboFix2.txt 2011-05-01 14:04
ComboFix3.txt 2011-04-21 18:54
ComboFix4.txt 2011-04-16 10:54
ComboFix5.txt 2011-05-02 11:47
.
Pre-Run: 103,652,724,736 bytes free
Post-Run: 103,670,792,192 bytes free
.
- - End Of File - - 6DE43922A2146F5CCC828037B6323128
At present I have left the machine running in safe mode until I hear further from you.
Very best - Tonyp
