What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Please help, winlogon.exe and logon.scr problem

14 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
At first I noticed that Windiws Update has stopped working. As usual i tried to fix the problem by myself, but this is too complicated. I forgot what I have already did, hundred things… and my pc still infected . There are 6 winlogon.exe and 5 logon.scr running Please advice, thank you so much.
Post #2

**In any case where you happen to be busy or unable to give us a reply, we would be grateful if you keep us informed in advance and we will be more than happy to wait. Failure to do so we will have your thread closed in THREE(3) days. :)


Hello there, andrevtw

:welcome:

I'm Conspire, I'll be glad to help you with your computer problems.

Please observe these rules while we work:
  • Read the entire procedure
  • It is important to perform ALL actions in sequence.
  • If you don't know, stop and ask! Don't keep going on.
  • Please reply to this thread. Do not start a new topic.
  • Stick with me till you're given the all clear.
  • Remember, absence of symptoms does not mean the infection is all gone.
  • Don't attempt to clean your computer with any tools other than the ones I ask you to use during the cleanup process.

IMPORTANT NOTE : Please do not delete anything unless instructed to. Remember to backup all your important data(if possible) before moving on.
Post #3
Hello there,

Download OTL to your Desktop
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • Click on Minimal Output at the top
  • Download the following file scan.txt to your Desktop. Click here to download it. You may need to right click on it and select "Save"
  • Double click inside the Custom Scan box at the bottom
  • A window will appear saying "Click OK to load a custom scan from a file or Cancel to cancel"
  • Click the OK button and navigate to the file scan.txt which we just saved to your desktop
  • Select scan.txt and click Open. Writing will now appear under the Custom Scan box
  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan won't take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time and post them in your topic
===================================================

[external image: Posted Image]
  • Please download GMER from one of the following locations, and save it to your desktop:
  • Main Mirror
    This version will download a randomly named file (Recommended)
  • Zip Mirror
    This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.
  • Extract the contents of the zipped file to desktop (applicable only to Zip mirror) .
  • Double click [external image: Posted Image] or [external image: Posted Image] on your desktop.
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.
    [external image: Posted Image]

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and attach it in your reply.
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

===================================================

Download Security Check by screen317 from here or here.
  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.
===================================================

On your next reply please post :
OTL log
GMER log
Checkup log

Please STOP and let me know if you have any problems in performing with the steps above or any questions you may have.

Good Day!
Post #4
Thank you so much Conspire :) All instruction followed, was no problem at all Just one thing, the OTL didn't gave 2 report…. there;s no Extras.Txt. maybe because the machine was unused for more than 3 months …was afraid that the virus would steal any password i use while online :) Everything else was done as described without any problem and the results are attached here, thank you so much ++++++++++++++++++++++++++++++

Attachments:

Post #5 last edited
You're welcome

OTL did not generate Extras.txt because you ran it 3 times. It will only produce the extra log on its first run. Also, it is highly inadvisable to run ComboFix without supervision. The reason why we strongly oppose to the idea of running without request from helpers is because it often takes more than 2 rounds to eradicate.

If you don't mind, copy/paste the contents of the log instead of attaching it. Separate into 2 or more post if you have to. It would make our research and review easier. Thanks :)

Please delete the existing copy of ComboFix, if any, and do the following :-

Please read through these instructions to familiarize yourself with what to expect when this tool runs

Refer to the ComboFix User's Guide

Download ComboFix from one of these locations:

Link 1
Link 2


* IMPORTANT- Save ComboFix.exe to your Desktop

====================================================

Disable your AntiVirus and AntiSpyware applications as they will interfere with our tools and the removal. If you are unsure how to do this, please refer to our sticky topic How to disable your security applications

====================================================


Double click on ComboFix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


[external image: Posted Image]


Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:


[external image: Posted Image]


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply for further review.
Post #6
Thank you so much, sorry for the inconvenience…

While downloading ComboFix and reading the User Guide, did I do wrong by uninstalling ComboFix: before deleting it.
And when double clicking the new downloaded ComboFix, i thought it will ask me to install and i would save it to the desktop
but ComboFix running and i didnt have time to close any program or windows, so just let it work uninterrupted as suggested.
seems that everything was done without any problem

here the log :

———————————-

ComboFix 12-08-09.01 - edi 10/08/2012 23:46:13.4.4 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1468 [GMT 7:00]
Running from: d:\dokumen\Downloads\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
——-\Legacy_KERNELMEMORY
.
.
((((((((((((((((((((((((( Files Created from 2012-07-10 to 2012-08-10 )))))))))))))))))))))))))))))))
.
.
2012-08-10 16:28 . 2012-08-10 16:28 ——– d—–w- C:\V3CFix
2012-08-09 21:32 . 2012-08-09 21:32 ——– d—–w- c:\program files\Mozilla Maintenance Service
2012-08-09 21:31 . 2012-07-14 00:17 157608 —-a-w- c:\program files\Mozilla Firefox\maintenanceservice_installer.exe
2012-08-09 21:31 . 2012-07-14 00:17 113120 —-a-w- c:\program files\Mozilla Firefox\maintenanceservice.exe
2012-08-09 21:31 . 2012-07-14 00:16 770384 —-a-w- c:\program files\Mozilla Firefox\msvcr100.dll
2012-08-09 21:31 . 2012-07-14 00:16 421200 —-a-w- c:\program files\Mozilla Firefox\msvcp100.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-08-10 16:57 . 2010-03-04 08:20 17488 —-a-w- c:\windows\gdrv.sys
2012-08-10 01:04 . 2012-04-15 04:56 426184 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-08-10 01:04 . 2011-12-29 17:48 70344 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-07-14 00:17 . 2011-09-03 18:29 136672 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
2006-10-12 03:09 94208 –sh–w- c:\windows\system32\SalaatTime.dll
.
.
——- Sigcheck ——-
Note: Unsigned files aren't necessarily malware.
.
[-] 2008-11-20 . 362BC5AF8EAF712832C58CC13AE05750 . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2012-02-29 17151624]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"RTHDCPL"="RTHDCPL.EXE" [2009-06-25 17887232]
"RemoteControl8"="c:\program files\CyberLink\PowerDVD8\PDVD8Serv.exe" [2009-04-15 91432]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-05-27 413696]
"PDVD8LanguageShortcut"="c:\program files\CyberLink\PowerDVD8\Language\Language.exe" [2009-04-15 50472]
"NvMediaCenter"="NvMCTray.dll" [2012-02-10 108352]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2012-02-10 15494464]
"LGODDFU"="c:\program files\lg_fwupdate\lgfw.exe" [2012-08-09 27760]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2006-05-16 86960]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-08-11 249856]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"CLMLServer"="c:\program files\CyberLink\Power2Go\CLMLSvc.exe" [2009-06-03 103720]
"AdobeCS5ServiceManager"="c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-21 406992]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-09-16 497648]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe" [2012-04-04 36760]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" [2012-04-04 815512]
"HpMessage"="c:\program files\NComputing vSpace\KmMsg.exe" [2009-12-03 610354]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]
.
c:\documents and settings\N_A.MASTES\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
.
c:\documents and settings\andrie\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
OneNote Table Of Contents.onetoc2 [2011-6-18 3656]
.
c:\documents and settings\edi\Start Menu\Programs\Startup\
MagicDisc.lnk - c:\program files\MagicDisc\MagicDisc.exe [2011-8-3 546816]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoPublishingWizard"= 1 (0x1)
"NoWebServices"= 1 (0x1)
"NoOnlinePrintsWizard"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\KmWinLog]
2009-12-03 03:57 512054 —-a-w- c:\windows\system32\Kmlogon.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UCam_Menu]
2009-02-17 14:21 218408 ——w- c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateLBPShortCut]
2009-05-19 15:16 222504 ——w- c:\program files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateP2GoShortCut]
2009-05-19 15:16 222504 ——w- c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdatePPShortCut]
2009-05-19 15:16 222504 ——w- c:\program files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdatePSTShortCut]
2009-09-29 09:22 210216 ——w- c:\program files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"PanService"=2 (0x2)
"Macromedia Licensing Service"=3 (0x3)
"FreemakeVideoCapture"=2 (0x2)
"CDROM_Eject_H"=2 (0x2)
"avast! Antivirus"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD8\\PowerDVD8.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Google\\Google Earth\\plugin\\geplugin.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\windows\\system32\\sessmgr.exe"=
"c:\\Program Files\\GameHouse Games Collection\\GameHouse Sudoku\\GHSudoku.exe"=
"c:\\Documents and Settings\\edi\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Documents and Settings\\edi\\Local Settings\\Application Data\\Google Translator\\Google Translator.exe"=
"c:\\Program Files\\NComputing vSpace\\KMUPDATE.EXE"=
"c:\\Program Files\\Adobe\\Adobe Help\\Adobe Help.exe"=
"c:\\Program Files\\TeamViewer\\Version7\\TeamViewer.exe"=
"c:\\Program Files\\TeamViewer\\Version7\\TeamViewer_Service.exe"=
"c:\\Premier75\\BASlink\\BASlink.exe"=
"c:\\Program Files\\FinalMediaPlayer\\FMPCheckForUpdates.exe"=
"c:\\windows\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Smartfren Connex CE682 UI\\App.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:*:Disabled:Adobe CSI CS4
"3581:TCP"= 3581:TCP:MultiuserPortTCP3581
"3581:UDP"= 3581:UDP:MultiuserPortUDP3581
"3597:TCP"= 3597:TCP:MultiuserPortTCP3597
"3645:TCP"= 3645:TCP:MultiuserPortTCP3645
.
R0 HpPciVga;Multiuser PCI VGA Station Driver (MultiScreen);c:\windows\system32\drivers\KmWpsMs.sys [06/05/2012 20:53 144674]
R0 HpStore;Multiuser Devices Control Service;c:\windows\system32\drivers\KmStore.sys [06/05/2012 20:53 13721]
R0 HpUsbKeyboard;Multiuser USB Keyboard Class Driver;c:\windows\system32\drivers\KmKbdCls.sys [06/05/2012 20:53 32065]
R0 HpUsbMouse;Multiuser USB Mouse Class Driver;c:\windows\system32\drivers\KmMouCls.sys [06/05/2012 20:53 29089]
R1 HpHelper;Multiuser User Mode Helper Driver;c:\windows\system32\drivers\KmHlprk.sys [06/05/2012 20:53 26723]
R2 CDROM_Eject_H;CDROM_Eject_H;c:\program files\Smartfren Connex CE682 UI\HEject.exe [06/05/2012 19:26 267776]
R2 ES lite Service;ES lite Service for program management.;c:\program files\Gigabyte\EasySaver\essvr.exe [04/03/2010 13:44 68136]
R2 HpLegacyKeyboard;Multiuser Legacy Keyboard Port Driver;c:\windows\system32\drivers\KmJBox.sys [06/05/2012 20:53 49951]
R2 HpService;Multiuser Service;System32\KmServc.exe –> System32\KmServc.exe [?]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [06/05/2012 18:27 654408]
R2 npf;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [12/02/2011 4:23 35088]
R2 Skype C2C Service;Skype C2C Service;c:\documents and settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe [05/07/2012 18:41 3048136]
R3 HpXpKbdPnp;Multiuser Keyboard Control Service;c:\windows\system32\drivers\KmKbdPnp.sys [06/05/2012 20:53 6753]
R3 HpXpMouPnp;Multiuser mouse Control Service;c:\windows\system32\drivers\KmMouPnp.sys [06/05/2012 20:53 6337]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [06/05/2012 18:27 22344]
R3 X300;X300;c:\windows\system32\drivers\X300M.SYS [06/05/2012 20:53 4159397]
R3 X300Audio;X300 Virtual Audio Driver;c:\windows\system32\drivers\X3HAudio.sys [06/05/2012 20:53 17689]
R3 x300bus;X300 Bus Enumerator;c:\windows\system32\drivers\X300Bus.sys [06/05/2012 20:53 723462]
S0 15472878;15472878;c:\windows\system32\drivers\83557149.sys –> c:\windows\system32\drivers\83557149.sys [?]
S0 psdqdgaa;psdqdgaa;c:\windows\system32\drivers\ilaogtfl.sys –> c:\windows\system32\drivers\ilaogtfl.sys [?]
S0 tujaltry;tujaltry;c:\windows\system32\drivers\desqhhe.sys –> c:\windows\system32\drivers\desqhhe.sys [?]
S0 xxtmaie;xxtmaie;c:\windows\system32\drivers\gpitckww.sys –> c:\windows\system32\drivers\gpitckww.sys [?]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [06/11/2010 16:59 136176]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [22/02/2012 14:02 2348352]
S2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [29/02/2012 9:16 158856]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [15/04/2012 11:56 250056]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [04/03/2010 13:47 1684736]
S3 avfwim;AvFw Packet Filter Miniport;c:\windows\system32\DRIVERS\avfwim.sys –> c:\windows\system32\DRIVERS\avfwim.sys [?]
S3 cmntusbser;Mobile Connector USB Device for Legacy Serial Communication Device;c:\windows\system32\drivers\cmntusbser.sys [03/09/2011 22:19 110080]
S3 cpudrv;cpudrv;c:\program files\SystemRequirementsLab\cpudrv.sys [02/06/2011 10:08 11336]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [06/11/2010 16:59 136176]
S3 HpXpHidCls;Multiuser HID Device Control Service;c:\windows\system32\drivers\KmHidCls.sys [06/05/2012 20:53 6016]
S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [10/08/2012 4:32 113120]
S3 qcusbser;Thinkwill USB Device for Legacy Serial Communication;c:\windows\system32\drivers\qcusbser.sys [23/01/2012 18:44 105984]
S3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [19/02/2010 13:37 517096]
S3 USB_BusEnum_H;EVDO Telecom USB Bus Enumerator h;c:\windows\system32\drivers\USB_BusEnum_H.sys [06/05/2012 19:26 38400]
S3 USB_ETS_H;EVDO Rev A Service USB port h;c:\windows\system32\drivers\USB_ETS_H.sys [06/05/2012 19:26 16128]
S3 USB_WinMux_H;EVDO Telecom USB MUX Serial Port h;c:\windows\system32\drivers\USB_WinMux_H.sys [06/05/2012 19:26 30080]
S3 UsbModemDriver;EVDO Rev A USB Modem h;c:\windows\system32\drivers\USB_MODEM_H.sys [06/05/2012 19:26 21504]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [28/08/2011 19:51 639224]
.
Contents of the 'Scheduled Tasks' folder
.
2012-08-10 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-15 01:04]
.
2012-08-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-11-06 18:20]
.
2012-08-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-11-06 18:20]
.
2012-08-10 c:\windows\Tasks\User_Feed_Synchronization-{8156EAED-8E9E-4BD4-8E2C-F988EBF4A243}.job
- c:\windows\system32\msfeedssync.exe [2009-03-07 21:31]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://isearch.avg.com/?cid={39F11AB7-1510-4A30-8DBC-1420ACD3B96D}&mid=3acb002152f147d1b449d1199ce1661c-c1f0b663659ce70f0a456e617ace9a1bf6b9c65f&lang=en&ds=rn011&pr=sa&d=2012-02-22 08:17&v=9.0.0.23&sap=hp
uSearchURL,(Default) = hxxp://id.rd.yahoo.com/customize/ycomp/defaults/su/*http://id.yahoo.com
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: Interfaces\{846423BF-EC04-4F71-8B98-1BDC04194D06}: NameServer = 10.17.125.228 10.17.125.229
TCP: Interfaces\{982484CC-DAEB-4CA7-BD53-18FF1FBA5C3A}: NameServer = 203.130.196.155,202.134.0.61
FF - ProfilePath - c:\documents and settings\edi\Application Data\Mozilla\Firefox\Profiles\e9sl24b3.default\
FF - prefs.js: browser.search.defaulturl - hxxp://id.search.yahoo.com/search?fr=ffsp1&p=
FF - prefs.js: browser.startup.homepage - hxxps://www.facebook.com/
FF - prefs.js: network.proxy.type - 0
FF - user.js: yahoo.ytff.general.dontshowhpoffer - true
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-08-10 23:59
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(632)
c:\windows\system32\Kmlogon.dll
.
- - - - - - - > 'winlogon.exe'(576)
c:\windows\system32\Kmlogon.dll
.
- - - - - - - > 'winlogon.exe'(736)
c:\windows\system32\Kmlogon.dll
.
- - - - - - - > 'winlogon.exe'(1116)
c:\windows\system32\Kmlogon.dll
.
- - - - - - - > 'winlogon.exe'(1060)
c:\windows\system32\Kmlogon.dll
.
- - - - - - - > 'winlogon.exe'(1704)
c:\windows\system32\Kmlogon.dll
.
- - - - - - - > 'explorer.exe'(1508)
c:\windows\system32\WININET.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86\MSVCR80.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\windows\System32\KmServc.exe
c:\windows\system32\nvsvc32.exe
c:\program files\CyberLink\Shared files\RichVideo.exe
c:\windows\system32\wscntfy.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\RunDLL32.exe
.
**************************************************************************
.
Completion time: 2012-08-11 00:04:31 - machine was rebooted
ComboFix-quarantined-files.txt 2012-08-10 17:04
ComboFix2.txt 2012-05-09 00:08
.
Pre-Run: 73.094.135.808 bytes free
Post-Run: 72.984.772.608 bytes free
.
- - End Of File - - 34239D243650BBE44FD53790A67A290F
Post #7
And here's from C.Combofix.txt :


ComboFix 12-08-09.01 - edi 10/08/2012 23:46:13.4.4 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1468 [GMT 7:00]
Running from: d:\dokumen\Downloads\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
——-\Legacy_KERNELMEMORY
.
.
((((((((((((((((((((((((( Files Created from 2012-07-10 to 2012-08-10 )))))))))))))))))))))))))))))))
.
.
2012-08-10 16:28 . 2012-08-10 16:28 ——– d—–w- C:\V3CFix
2012-08-09 21:32 . 2012-08-09 21:32 ——– d—–w- c:\program files\Mozilla Maintenance Service
2012-08-09 21:31 . 2012-07-14 00:17 157608 —-a-w- c:\program files\Mozilla Firefox\maintenanceservice_installer.exe
2012-08-09 21:31 . 2012-07-14 00:17 113120 —-a-w- c:\program files\Mozilla Firefox\maintenanceservice.exe
2012-08-09 21:31 . 2012-07-14 00:16 770384 —-a-w- c:\program files\Mozilla Firefox\msvcr100.dll
2012-08-09 21:31 . 2012-07-14 00:16 421200 —-a-w- c:\program files\Mozilla Firefox\msvcp100.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-08-10 16:57 . 2010-03-04 08:20 17488 —-a-w- c:\windows\gdrv.sys
2012-08-10 01:04 . 2012-04-15 04:56 426184 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-08-10 01:04 . 2011-12-29 17:48 70344 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-07-14 00:17 . 2011-09-03 18:29 136672 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
2006-10-12 03:09 94208 –sh–w- c:\windows\system32\SalaatTime.dll
.
.
——- Sigcheck ——-
Note: Unsigned files aren't necessarily malware.
.
[-] 2008-11-20 . 362BC5AF8EAF712832C58CC13AE05750 . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2012-02-29 17151624]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"RTHDCPL"="RTHDCPL.EXE" [2009-06-25 17887232]
"RemoteControl8"="c:\program files\CyberLink\PowerDVD8\PDVD8Serv.exe" [2009-04-15 91432]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-05-27 413696]
"PDVD8LanguageShortcut"="c:\program files\CyberLink\PowerDVD8\Language\Language.exe" [2009-04-15 50472]
"NvMediaCenter"="NvMCTray.dll" [2012-02-10 108352]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2012-02-10 15494464]
"LGODDFU"="c:\program files\lg_fwupdate\lgfw.exe" [2012-08-09 27760]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2006-05-16 86960]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-08-11 249856]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"CLMLServer"="c:\program files\CyberLink\Power2Go\CLMLSvc.exe" [2009-06-03 103720]
"AdobeCS5ServiceManager"="c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-21 406992]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-09-16 497648]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe" [2012-04-04 36760]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" [2012-04-04 815512]
"HpMessage"="c:\program files\NComputing vSpace\KmMsg.exe" [2009-12-03 610354]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]
.
c:\documents and settings\N_A.MASTES\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
.
c:\documents and settings\andrie\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
OneNote Table Of Contents.onetoc2 [2011-6-18 3656]
.
c:\documents and settings\edi\Start Menu\Programs\Startup\
MagicDisc.lnk - c:\program files\MagicDisc\MagicDisc.exe [2011-8-3 546816]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoPublishingWizard"= 1 (0x1)
"NoWebServices"= 1 (0x1)
"NoOnlinePrintsWizard"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\KmWinLog]
2009-12-03 03:57 512054 —-a-w- c:\windows\system32\Kmlogon.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UCam_Menu]
2009-02-17 14:21 218408 ——w- c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateLBPShortCut]
2009-05-19 15:16 222504 ——w- c:\program files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateP2GoShortCut]
2009-05-19 15:16 222504 ——w- c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdatePPShortCut]
2009-05-19 15:16 222504 ——w- c:\program files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdatePSTShortCut]
2009-09-29 09:22 210216 ——w- c:\program files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"PanService"=2 (0x2)
"Macromedia Licensing Service"=3 (0x3)
"FreemakeVideoCapture"=2 (0x2)
"CDROM_Eject_H"=2 (0x2)
"avast! Antivirus"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD8\\PowerDVD8.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Google\\Google Earth\\plugin\\geplugin.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\windows\\system32\\sessmgr.exe"=
"c:\\Program Files\\GameHouse Games Collection\\GameHouse Sudoku\\GHSudoku.exe"=
"c:\\Documents and Settings\\edi\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Documents and Settings\\edi\\Local Settings\\Application Data\\Google Translator\\Google Translator.exe"=
"c:\\Program Files\\NComputing vSpace\\KMUPDATE.EXE"=
"c:\\Program Files\\Adobe\\Adobe Help\\Adobe Help.exe"=
"c:\\Program Files\\TeamViewer\\Version7\\TeamViewer.exe"=
"c:\\Program Files\\TeamViewer\\Version7\\TeamViewer_Service.exe"=
"c:\\Premier75\\BASlink\\BASlink.exe"=
"c:\\Program Files\\FinalMediaPlayer\\FMPCheckForUpdates.exe"=
"c:\\windows\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Smartfren Connex CE682 UI\\App.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:*:Disabled:Adobe CSI CS4
"3581:TCP"= 3581:TCP:MultiuserPortTCP3581
"3581:UDP"= 3581:UDP:MultiuserPortUDP3581
"3597:TCP"= 3597:TCP:MultiuserPortTCP3597
"3645:TCP"= 3645:TCP:MultiuserPortTCP3645
.
R0 HpPciVga;Multiuser PCI VGA Station Driver (MultiScreen);c:\windows\system32\drivers\KmWpsMs.sys [06/05/2012 20:53 144674]
R0 HpStore;Multiuser Devices Control Service;c:\windows\system32\drivers\KmStore.sys [06/05/2012 20:53 13721]
R0 HpUsbKeyboard;Multiuser USB Keyboard Class Driver;c:\windows\system32\drivers\KmKbdCls.sys [06/05/2012 20:53 32065]
R0 HpUsbMouse;Multiuser USB Mouse Class Driver;c:\windows\system32\drivers\KmMouCls.sys [06/05/2012 20:53 29089]
R1 HpHelper;Multiuser User Mode Helper Driver;c:\windows\system32\drivers\KmHlprk.sys [06/05/2012 20:53 26723]
R2 CDROM_Eject_H;CDROM_Eject_H;c:\program files\Smartfren Connex CE682 UI\HEject.exe [06/05/2012 19:26 267776]
R2 ES lite Service;ES lite Service for program management.;c:\program files\Gigabyte\EasySaver\essvr.exe [04/03/2010 13:44 68136]
R2 HpLegacyKeyboard;Multiuser Legacy Keyboard Port Driver;c:\windows\system32\drivers\KmJBox.sys [06/05/2012 20:53 49951]
R2 HpService;Multiuser Service;System32\KmServc.exe –> System32\KmServc.exe [?]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [06/05/2012 18:27 654408]
R2 npf;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [12/02/2011 4:23 35088]
R2 Skype C2C Service;Skype C2C Service;c:\documents and settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe [05/07/2012 18:41 3048136]
R3 HpXpKbdPnp;Multiuser Keyboard Control Service;c:\windows\system32\drivers\KmKbdPnp.sys [06/05/2012 20:53 6753]
R3 HpXpMouPnp;Multiuser mouse Control Service;c:\windows\system32\drivers\KmMouPnp.sys [06/05/2012 20:53 6337]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [06/05/2012 18:27 22344]
R3 X300;X300;c:\windows\system32\drivers\X300M.SYS [06/05/2012 20:53 4159397]
R3 X300Audio;X300 Virtual Audio Driver;c:\windows\system32\drivers\X3HAudio.sys [06/05/2012 20:53 17689]
R3 x300bus;X300 Bus Enumerator;c:\windows\system32\drivers\X300Bus.sys [06/05/2012 20:53 723462]
S0 15472878;15472878;c:\windows\system32\drivers\83557149.sys –> c:\windows\system32\drivers\83557149.sys [?]
S0 psdqdgaa;psdqdgaa;c:\windows\system32\drivers\ilaogtfl.sys –> c:\windows\system32\drivers\ilaogtfl.sys [?]
S0 tujaltry;tujaltry;c:\windows\system32\drivers\desqhhe.sys –> c:\windows\system32\drivers\desqhhe.sys [?]
S0 xxtmaie;xxtmaie;c:\windows\system32\drivers\gpitckww.sys –> c:\windows\system32\drivers\gpitckww.sys [?]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [06/11/2010 16:59 136176]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [22/02/2012 14:02 2348352]
S2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [29/02/2012 9:16 158856]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [15/04/2012 11:56 250056]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [04/03/2010 13:47 1684736]
S3 avfwim;AvFw Packet Filter Miniport;c:\windows\system32\DRIVERS\avfwim.sys –> c:\windows\system32\DRIVERS\avfwim.sys [?]
S3 cmntusbser;Mobile Connector USB Device for Legacy Serial Communication Device;c:\windows\system32\drivers\cmntusbser.sys [03/09/2011 22:19 110080]
S3 cpudrv;cpudrv;c:\program files\SystemRequirementsLab\cpudrv.sys [02/06/2011 10:08 11336]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [06/11/2010 16:59 136176]
S3 HpXpHidCls;Multiuser HID Device Control Service;c:\windows\system32\drivers\KmHidCls.sys [06/05/2012 20:53 6016]
S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [10/08/2012 4:32 113120]
S3 qcusbser;Thinkwill USB Device for Legacy Serial Communication;c:\windows\system32\drivers\qcusbser.sys [23/01/2012 18:44 105984]
S3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [19/02/2010 13:37 517096]
S3 USB_BusEnum_H;EVDO Telecom USB Bus Enumerator h;c:\windows\system32\drivers\USB_BusEnum_H.sys [06/05/2012 19:26 38400]
S3 USB_ETS_H;EVDO Rev A Service USB port h;c:\windows\system32\drivers\USB_ETS_H.sys [06/05/2012 19:26 16128]
S3 USB_WinMux_H;EVDO Telecom USB MUX Serial Port h;c:\windows\system32\drivers\USB_WinMux_H.sys [06/05/2012 19:26 30080]
S3 UsbModemDriver;EVDO Rev A USB Modem h;c:\windows\system32\drivers\USB_MODEM_H.sys [06/05/2012 19:26 21504]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [28/08/2011 19:51 639224]
.
Contents of the 'Scheduled Tasks' folder
.
2012-08-10 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-15 01:04]
.
2012-08-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-11-06 18:20]
.
2012-08-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-11-06 18:20]
.
2012-08-10 c:\windows\Tasks\User_Feed_Synchronization-{8156EAED-8E9E-4BD4-8E2C-F988EBF4A243}.job
- c:\windows\system32\msfeedssync.exe [2009-03-07 21:31]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://isearch.avg.com/?cid={39F11AB7-1510-4A30-8DBC-1420ACD3B96D}&mid=3acb002152f147d1b449d1199ce1661c-c1f0b663659ce70f0a456e617ace9a1bf6b9c65f&lang=en&ds=rn011&pr=sa&d=2012-02-22 08:17&v=9.0.0.23&sap=hp
uSearchURL,(Default) = hxxp://id.rd.yahoo.com/customize/ycomp/defaults/su/*http://id.yahoo.com
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: Interfaces\{846423BF-EC04-4F71-8B98-1BDC04194D06}: NameServer = 10.17.125.228 10.17.125.229
TCP: Interfaces\{982484CC-DAEB-4CA7-BD53-18FF1FBA5C3A}: NameServer = 203.130.196.155,202.134.0.61
FF - ProfilePath - c:\documents and settings\edi\Application Data\Mozilla\Firefox\Profiles\e9sl24b3.default\
FF - prefs.js: browser.search.defaulturl - hxxp://id.search.yahoo.com/search?fr=ffsp1&p=
FF - prefs.js: browser.startup.homepage - hxxps://www.facebook.com/
FF - prefs.js: network.proxy.type - 0
FF - user.js: yahoo.ytff.general.dontshowhpoffer - true
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-08-10 23:59
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(632)
c:\windows\system32\Kmlogon.dll
.
- - - - - - - > 'winlogon.exe'(576)
c:\windows\system32\Kmlogon.dll
.
- - - - - - - > 'winlogon.exe'(736)
c:\windows\system32\Kmlogon.dll
.
- - - - - - - > 'winlogon.exe'(1116)
c:\windows\system32\Kmlogon.dll
.
- - - - - - - > 'winlogon.exe'(1060)
c:\windows\system32\Kmlogon.dll
.
- - - - - - - > 'winlogon.exe'(1704)
c:\windows\system32\Kmlogon.dll
.
- - - - - - - > 'explorer.exe'(1508)
c:\windows\system32\WININET.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86\MSVCR80.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\windows\System32\KmServc.exe
c:\windows\system32\nvsvc32.exe
c:\program files\CyberLink\Shared files\RichVideo.exe
c:\windows\system32\wscntfy.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\RunDLL32.exe
.
**************************************************************************
.
Completion time: 2012-08-11 00:04:31 - machine was rebooted
ComboFix-quarantined-files.txt 2012-08-10 17:04
ComboFix2.txt 2012-05-09 00:08
.
Pre-Run: 73.094.135.808 bytes free
Post-Run: 72.984.772.608 bytes free
.
- - End Of File - - 34239D243650BBE44FD53790A67A290F
Post #8
Hello,

No you didn't do anything wrong. Just that we strongly discourage people to run it because we use uninstall switch to actually remove CF after using it. This switch does quite a number of routine of clean ups behind the scenes to ensure the computer is back up and running. Deleting it manually will only remove the icons itself. But of course, I'm not here to make you feel guilty and I'm sorry if I made you feel that way but that's not my intention.

Go to My Computer-> Tools-> Folder Options-> View tab:
  • Under the Hidden files and folders heading:
  • Select - Show hidden files and folders.
  • Uncheck- Hide protected operating system files (recommended) option.
  • Also, make sure there is no checkmark beside Hide file extensions for known file types.
  • Click OK. (Remember to Hide files and folders once done)

Please go to one of the below sites to scan the following files:
Virus Total (Recommended)
jotti.org
VirScan


click on Browse, and upload the following file for analysis:
c:\windows\system32\drivers\83557149.sys
c:\windows\system32\drivers\ilaogtfl.sys
c:\windows\system32\drivers\desqhhe.sys
c:\windows\system32\drivers\gpitckww.sys

Then click Submit. Allow the file to be scanned, and then please copy and paste the results link(for Virus Total) here for me to see.
If it says already scanned – click "reanalyze now"
Please post the results in your next reply.
Post #9
Thank you a lot, anything i would do to ease the healing process :) Always feeling guilty if taking somebody's valuable time too much in helping me… Strangely i couldn't find all those file you asked for, and i wouldn't dare to search in another folder :). here attached the screenshot

Attachments:

Post #10 last edited
We are volunteers, don't worry about it. :)

Please follow all previous instructions regarding security programs.

Open a new Notepad session
  • Click the Start button, click run
  • in the run box type notepad
  • click ok
  • In the notepad, Click "Format" and be certain that Word Wrap is not checked.
  • Copy and paste all the text in the code box below into the Notepad. Do Not copy the word CODE

File::
c:\windows\system32\drivers\83557149.sys
c:\windows\system32\drivers\ilaogtfl.sys
c:\windows\system32\drivers\desqhhe.sys
c:\windows\system32\drivers\gpitckww.sys

Driver::
15472878
psdqdgaa
tujaltry
xxtmaie


In the notepad
  • Click File, Save as…, and set the Save in to your Desktop
  • In the filename box, type (including quotation marks) as the filename: "CFScript.txt"
  • Click save
Using your mouse left button, drag the new file CFscript.txt and drop it on the ComboFix.exe icon as shown below.

This will start ComboFix again.Close all browser/windows first.

When finished, it shall produce a log for you. Please post that log, C:\ComboFix.txt, in your next reply.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

[external image: Posted Image]
Post #11
Thank you.
Done as instructed. here is the ComboFix.txt


ComboFix 12-08-09.01 - edi 11/08/2012 19:49:49.5.4 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1514 [GMT 7:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\edi\Desktop\CFScript.txt
.
FILE ::
"c:\windows\system32\drivers\83557149.sys"
"c:\windows\system32\drivers\desqhhe.sys"
"c:\windows\system32\drivers\gpitckww.sys"
"c:\windows\system32\drivers\ilaogtfl.sys"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
——-\Service_15472878
——-\Service_psdqdgaa
——-\Service_tujaltry
——-\Service_xxtmaie
.
.
((((((((((((((((((((((((( Files Created from 2012-07-11 to 2012-08-11 )))))))))))))))))))))))))))))))
.
.
2012-08-10 16:28 . 2012-08-10 16:28 ——– d—–w- C:\V3CFix
2012-08-09 21:32 . 2012-08-09 21:32 ——– d—–w- c:\program files\Mozilla Maintenance Service
2012-08-09 21:31 . 2012-07-14 00:17 157608 —-a-w- c:\program files\Mozilla Firefox\maintenanceservice_installer.exe
2012-08-09 21:31 . 2012-07-14 00:17 113120 —-a-w- c:\program files\Mozilla Firefox\maintenanceservice.exe
2012-08-09 21:31 . 2012-07-14 00:16 770384 —-a-w- c:\program files\Mozilla Firefox\msvcr100.dll
2012-08-09 21:31 . 2012-07-14 00:16 421200 —-a-w- c:\program files\Mozilla Firefox\msvcp100.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-08-11 13:04 . 2010-03-04 08:20 17488 —-a-w- c:\windows\gdrv.sys
2012-08-10 01:04 . 2012-04-15 04:56 426184 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-08-10 01:04 . 2011-12-29 17:48 70344 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-07-14 00:17 . 2011-09-03 18:29 136672 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
2006-10-12 03:09 94208 –sh–w- c:\windows\system32\SalaatTime.dll
.
.
——- Sigcheck ——-
Note: Unsigned files aren't necessarily malware.
.
[-] 2008-11-20 . 362BC5AF8EAF712832C58CC13AE05750 . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((( SnapShot@2012-08-10_16.59.26 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-08-11 13:04 . 2012-08-11 13:04 16384 c:\windows\temp\Perflib_Perfdata_600.dat
+ 2004-08-04 11:00 . 2012-08-11 13:08 98562 c:\windows\system32\perfc009.dat
- 2004-08-04 11:00 . 2012-08-10 11:00 98562 c:\windows\system32\perfc009.dat
+ 2004-08-04 11:00 . 2012-08-11 13:08 528394 c:\windows\system32\perfh009.dat
- 2004-08-04 11:00 . 2012-08-10 11:00 528394 c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2012-02-29 17151624]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"RTHDCPL"="RTHDCPL.EXE" [2009-06-25 17887232]
"RemoteControl8"="c:\program files\CyberLink\PowerDVD8\PDVD8Serv.exe" [2009-04-15 91432]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-05-27 413696]
"PDVD8LanguageShortcut"="c:\program files\CyberLink\PowerDVD8\Language\Language.exe" [2009-04-15 50472]
"NvMediaCenter"="NvMCTray.dll" [2012-02-10 108352]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2012-02-10 15494464]
"LGODDFU"="c:\program files\lg_fwupdate\lgfw.exe" [2012-08-09 27760]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2006-05-16 86960]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-08-11 249856]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"CLMLServer"="c:\program files\CyberLink\Power2Go\CLMLSvc.exe" [2009-06-03 103720]
"AdobeCS5ServiceManager"="c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-21 406992]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-09-16 497648]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe" [2012-04-04 36760]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" [2012-04-04 815512]
"HpMessage"="c:\program files\NComputing vSpace\KmMsg.exe" [2009-12-03 610354]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]
.
c:\documents and settings\N_A.MASTES\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
.
c:\documents and settings\andrie\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
OneNote Table Of Contents.onetoc2 [2011-6-18 3656]
.
c:\documents and settings\edi\Start Menu\Programs\Startup\
MagicDisc.lnk - c:\program files\MagicDisc\MagicDisc.exe [2011-8-3 546816]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoPublishingWizard"= 1 (0x1)
"NoWebServices"= 1 (0x1)
"NoOnlinePrintsWizard"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\KmWinLog]
2009-12-03 03:57 512054 —-a-w- c:\windows\system32\Kmlogon.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UCam_Menu]
2009-02-17 14:21 218408 ——w- c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateLBPShortCut]
2009-05-19 15:16 222504 ——w- c:\program files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateP2GoShortCut]
2009-05-19 15:16 222504 ——w- c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdatePPShortCut]
2009-05-19 15:16 222504 ——w- c:\program files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdatePSTShortCut]
2009-09-29 09:22 210216 ——w- c:\program files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"PanService"=2 (0x2)
"Macromedia Licensing Service"=3 (0x3)
"FreemakeVideoCapture"=2 (0x2)
"CDROM_Eject_H"=2 (0x2)
"avast! Antivirus"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD8\\PowerDVD8.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Google\\Google Earth\\plugin\\geplugin.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\windows\\system32\\sessmgr.exe"=
"c:\\Program Files\\GameHouse Games Collection\\GameHouse Sudoku\\GHSudoku.exe"=
"c:\\Documents and Settings\\edi\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Documents and Settings\\edi\\Local Settings\\Application Data\\Google Translator\\Google Translator.exe"=
"c:\\Program Files\\NComputing vSpace\\KMUPDATE.EXE"=
"c:\\Program Files\\Adobe\\Adobe Help\\Adobe Help.exe"=
"c:\\Program Files\\TeamViewer\\Version7\\TeamViewer.exe"=
"c:\\Program Files\\TeamViewer\\Version7\\TeamViewer_Service.exe"=
"c:\\Premier75\\BASlink\\BASlink.exe"=
"c:\\Program Files\\FinalMediaPlayer\\FMPCheckForUpdates.exe"=
"c:\\windows\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Smartfren Connex CE682 UI\\App.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:*:Disabled:Adobe CSI CS4
"3581:TCP"= 3581:TCP:MultiuserPortTCP3581
"3581:UDP"= 3581:UDP:MultiuserPortUDP3581
"3597:TCP"= 3597:TCP:MultiuserPortTCP3597
"3645:TCP"= 3645:TCP:MultiuserPortTCP3645
.
R0 HpPciVga;Multiuser PCI VGA Station Driver (MultiScreen);c:\windows\system32\drivers\KmWpsMs.sys [06/05/2012 20:53 144674]
R0 HpStore;Multiuser Devices Control Service;c:\windows\system32\drivers\KmStore.sys [06/05/2012 20:53 13721]
R0 HpUsbKeyboard;Multiuser USB Keyboard Class Driver;c:\windows\system32\drivers\KmKbdCls.sys [06/05/2012 20:53 32065]
R0 HpUsbMouse;Multiuser USB Mouse Class Driver;c:\windows\system32\drivers\KmMouCls.sys [06/05/2012 20:53 29089]
R1 HpHelper;Multiuser User Mode Helper Driver;c:\windows\system32\drivers\KmHlprk.sys [06/05/2012 20:53 26723]
R2 CDROM_Eject_H;CDROM_Eject_H;c:\program files\Smartfren Connex CE682 UI\HEject.exe [06/05/2012 19:26 267776]
R2 ES lite Service;ES lite Service for program management.;c:\program files\Gigabyte\EasySaver\essvr.exe [04/03/2010 13:44 68136]
R2 HpLegacyKeyboard;Multiuser Legacy Keyboard Port Driver;c:\windows\system32\drivers\KmJBox.sys [06/05/2012 20:53 49951]
R2 HpService;Multiuser Service;System32\KmServc.exe –> System32\KmServc.exe [?]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [06/05/2012 18:27 654408]
R2 npf;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [12/02/2011 4:23 35088]
R2 Skype C2C Service;Skype C2C Service;c:\documents and settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe [05/07/2012 18:41 3048136]
R3 HpXpKbdPnp;Multiuser Keyboard Control Service;c:\windows\system32\drivers\KmKbdPnp.sys [06/05/2012 20:53 6753]
R3 HpXpMouPnp;Multiuser mouse Control Service;c:\windows\system32\drivers\KmMouPnp.sys [06/05/2012 20:53 6337]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [06/05/2012 18:27 22344]
R3 X300;X300;c:\windows\system32\drivers\X300M.SYS [06/05/2012 20:53 4159397]
R3 X300Audio;X300 Virtual Audio Driver;c:\windows\system32\drivers\X3HAudio.sys [06/05/2012 20:53 17689]
R3 x300bus;X300 Bus Enumerator;c:\windows\system32\drivers\X300Bus.sys [06/05/2012 20:53 723462]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [06/11/2010 16:59 136176]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [22/02/2012 14:02 2348352]
S2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [29/02/2012 9:16 158856]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [15/04/2012 11:56 250056]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [04/03/2010 13:47 1684736]
S3 avfwim;AvFw Packet Filter Miniport;c:\windows\system32\DRIVERS\avfwim.sys –> c:\windows\system32\DRIVERS\avfwim.sys [?]
S3 cmntusbser;Mobile Connector USB Device for Legacy Serial Communication Device;c:\windows\system32\drivers\cmntusbser.sys [03/09/2011 22:19 110080]
S3 cpudrv;cpudrv;c:\program files\SystemRequirementsLab\cpudrv.sys [02/06/2011 10:08 11336]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [06/11/2010 16:59 136176]
S3 HpXpHidCls;Multiuser HID Device Control Service;c:\windows\system32\drivers\KmHidCls.sys [06/05/2012 20:53 6016]
S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [10/08/2012 4:32 113120]
S3 qcusbser;Thinkwill USB Device for Legacy Serial Communication;c:\windows\system32\drivers\qcusbser.sys [23/01/2012 18:44 105984]
S3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [19/02/2010 13:37 517096]
S3 USB_BusEnum_H;EVDO Telecom USB Bus Enumerator h;c:\windows\system32\drivers\USB_BusEnum_H.sys [06/05/2012 19:26 38400]
S3 USB_ETS_H;EVDO Rev A Service USB port h;c:\windows\system32\drivers\USB_ETS_H.sys [06/05/2012 19:26 16128]
S3 USB_WinMux_H;EVDO Telecom USB MUX Serial Port h;c:\windows\system32\drivers\USB_WinMux_H.sys [06/05/2012 19:26 30080]
S3 UsbModemDriver;EVDO Rev A USB Modem h;c:\windows\system32\drivers\USB_MODEM_H.sys [06/05/2012 19:26 21504]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [28/08/2011 19:51 639224]
.
Contents of the 'Scheduled Tasks' folder
.
2012-08-11 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-15 01:04]
.
2012-08-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-11-06 18:20]
.
2012-08-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-11-06 18:20]
.
2012-08-11 c:\windows\Tasks\User_Feed_Synchronization-{8156EAED-8E9E-4BD4-8E2C-F988EBF4A243}.job
- c:\windows\system32\msfeedssync.exe [2009-03-07 21:31]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://isearch.avg.com/?cid={39F11AB7-1510-4A30-8DBC-1420ACD3B96D}∣=3acb002152f147d1b449d1199ce1661c-c1f0b663659ce70f0a456e617ace9a1bf6b9c65f⟨=en&ds;=rn011≺=sa&d;=2012-02-22 08:17&v;=9.0.0.23&sap;=hp
uSearchURL,(Default) = hxxp://id.rd.yahoo.com/customize/ycomp/defaults/su/*http://id.yahoo.com
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: Interfaces\{982484CC-DAEB-4CA7-BD53-18FF1FBA5C3A}: NameServer = 203.130.196.155,202.134.0.61
FF - ProfilePath - c:\documents and settings\edi\Application Data\Mozilla\Firefox\Profiles\e9sl24b3.default\
FF - prefs.js: browser.search.defaulturl - hxxp://id.search.yahoo.com/search?fr=ffsp1&p;=
FF - prefs.js: browser.startup.homepage - hxxps://www.facebook.com/
FF - prefs.js: network.proxy.type - 0
FF - user.js: yahoo.ytff.general.dontshowhpoffer - true
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-08-11 20:06
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(640)
c:\windows\system32\Kmlogon.dll
.
- - - - - - - > 'winlogon.exe'(288)
c:\windows\system32\Kmlogon.dll
.
- - - - - - - > 'winlogon.exe'(1504)
c:\windows\system32\Kmlogon.dll
.
- - - - - - - > 'winlogon.exe'(2088)
c:\windows\system32\Kmlogon.dll
.
- - - - - - - > 'winlogon.exe'(2220)
c:\windows\system32\Kmlogon.dll
.
- - - - - - - > 'winlogon.exe'(2348)
c:\windows\system32\Kmlogon.dll
.
- - - - - - - > 'explorer.exe'(3640)
c:\windows\system32\WININET.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86\MSVCR80.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\windows\System32\KmServc.exe
c:\windows\system32\nvsvc32.exe
c:\program files\CyberLink\Shared files\RichVideo.exe
c:\windows\system32\wscntfy.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\RunDLL32.exe
.
**************************************************************************
.
Completion time: 2012-08-11 20:10:51 - machine was rebooted
ComboFix-quarantined-files.txt 2012-08-11 13:10
ComboFix2.txt 2012-08-10 17:04
ComboFix3.txt 2012-05-09 00:08
.
Pre-Run: 72.996.003.840 bytes free
Post-Run: 72.973.242.368 bytes free
.
- - End Of File - - 4C23C1234B05B8A2AFE333E92828217D
Post #13
Thank you, All is done, the program just rebooted the pc The WIndows Update still can not be accessed, all text in the tab are grey out, nothing can be clicked And i see there are still several winlogon.exe and logon.scr running
Post #14 last edited
I don't see winlogon or logon instances in the log. Is there any other symptom which you can describe to me?

Please download Farbar Service Scanner and run it on the computer with the issue.
  • Make sure the following options are checked:
    • Internet Services
    • Windows Firewall
    • System Restore
    • Security Center
    • Windows Update
  • Press "Scan".
  • It will create a log (FSS.txt) in the same directory the tool is run.
  • Please copy and paste the log to your reply.
Post #15
Thank you, from the FSS.txt is attached and attached also the screenshot of the Taskmanager where winlogon.exe and logon.scr can be seen… while the first screenshot displayed, i put the taskmanger beside the screenshot and scrolled to show the logon.scr then took a new screenshot so they are looked side by side :) Farbar Service Scanner Version: 06-08-2012 Ran by [removed] (administrator) on 11-08-2012 at 22:59:54 Running from "C:\Documents and Settings\edi\Desktop" Microsoft Windows XP Professional Service Pack 3 (X86) Boot Mode: Normal **************************************************************** Internet Services: ============ Connection Status: ============== Localhost is accessible. WAN connected Google IP is accessible. Google.com is accessible. Yahoo IP is accessible. Yahoo.com is accessible. Windows Firewall: ============= Firewall Disabled Policy: ================== System Restore: ============ System Restore Disabled Policy: ======================== Security Center: ============ Windows Update: ============ Windows Autoupdate Disabled Policy: ============================ File Check: ======== C:\WINDOWS\system32\dhcpcsvc.dll => MD5 is legit C:\WINDOWS\system32\Drivers\afd.sys => MD5 is legit C:\WINDOWS\system32\Drivers\netbt.sys => MD5 is legit C:\WINDOWS\system32\Drivers\tcpip.sys => MD5 is legit C:\WINDOWS\system32\Drivers\ipsec.sys => MD5 is legit C:\WINDOWS\system32\dnsrslvr.dll => MD5 is legit C:\WINDOWS\system32\ipnathlp.dll => MD5 is legit C:\WINDOWS\system32\netman.dll => MD5 is legit C:\WINDOWS\system32\wbem\WMIsvc.dll => MD5 is legit C:\WINDOWS\system32\srsvc.dll => MD5 is legit C:\WINDOWS\system32\Drivers\sr.sys => MD5 is legit C:\WINDOWS\system32\wscsvc.dll => MD5 is legit C:\WINDOWS\system32\wbem\WMIsvc.dll => MD5 is legit C:\WINDOWS\system32\wuauserv.dll => MD5 is legit C:\WINDOWS\system32\qmgr.dll => MD5 is legit C:\WINDOWS\system32\es.dll => MD5 is legit C:\WINDOWS\system32\cryptsvc.dll => MD5 is legit C:\WINDOWS\system32\svchost.exe => MD5 is legit C:\WINDOWS\system32\rpcss.dll => MD5 is legit C:\WINDOWS\system32\services.exe => MD5 is legit Extra List: ======= avfwim(9) Gpc(6) IPSec(4) NetBT(5) PSched(7) Tcpip(3) 0x0900000004000000010000000200000003000000050000000600000007000000090000000A0000 00 IpSec Tag value is correct. **** End of log ****

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI