What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

HijackThis Log

9 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Jake - 06-08-21 22:02:27.81
ComboFix 06.08.18 - Running from: C:\Documents and Settings\[removed]\Desktop

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\Documents and Settings\Jake\Application Data\Install.dat
C:\WINDOWS\system32\icon_mediamotor.exe
C:\WINDOWS\system32\ts_mediamotor.exe
C:\WINDOWS\media_motor_bundle.exe


((((((((((((((((((((((((((((((( Files Created from 2006-07-21 to 2006-08-21 ))))))))))))))))))))))))))))))))))


2006-08-19 20:02 90,112 C:\WINDOWS\system32\RegDACL.exe
2006-08-19 20:02 6,020 C:\clean.bat
2006-08-19 20:02 40,960 C:\WINDOWS\system32\swsc.exe
2006-08-19 20:02 4,096 C:\WINDOWS\system32\reboot.exe
2006-08-19 20:02 38,400 C:\WINDOWS\system32\moveex.exe
2006-08-19 04:57 520,192 C:\WINDOWS\system32\ati2sgag.exe
2006-08-17 20:29 306,688 C:\WINDOWS\IsUninst.exe
2006-08-02 18:12 307,200 C:\WINDOWS\system32\atiiiexx.dll
2006-08-02 18:02 26,112 C:\WINDOWS\system32\Ati2mdxx.exe
2006-08-02 18:02 114,688 C:\WINDOWS\system32\atipdlxx.dll
2006-08-02 18:00 53,248 C:\WINDOWS\system32\ATIDDC.DLL
2006-08-02 17:49 6,684,672 C:\WINDOWS\system32\atioglx1.dll
2006-08-02 17:45 5,136,384 C:\WINDOWS\system32\atioglxx.dll
2006-08-02 17:40 303,104 C:\WINDOWS\system32\ATIDEMGR.dll
2006-08-02 17:40 17,408 C:\WINDOWS\system32\atitvo32.dll
2006-07-28 16:17 82,432 C:\WINDOWS\system32\msxml4r.dll
2006-07-28 16:17 1,233,920 C:\WINDOWS\system32\msxml4.dll
2006-07-27 20:42 50,688 C:\WINDOWS\system32\wbhelp2.dll


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

Rootkit driver pe386 is present. A rootkit scan is required

2006-08-21 22:00 ——– d——– C:\Program Files\Mozilla Firefox
2006-08-21 17:00 ——– d——– C:\Program Files\ewido anti-spyware 4.0
2006-08-20 18:42 ——– d——– C:\Program Files\Common Files\Adobe
2006-08-19 20:12 ——– d——– C:\Program Files\HaxFix
2006-08-19 17:27 98304 –a—— C:\WINDOWS\system32\CmdLineExt.dll
2006-08-19 14:33 ——– d——– C:\Program Files\SpywareGuard
2006-08-19 04:58 ——– d——– C:\Program Files\ATI Technologies
2006-08-17 20:33 ——– d——– C:\Documents and Settings\Jake\Application Data\Adobe
2006-08-17 20:32 ——– d——– C:\Program Files\Common Files
2006-08-16 17:54 ——– d——– C:\Program Files\SpywareBlaster
2006-08-15 18:07 ——– d——– C:\Program Files\Deus Ex - Invisible War
2006-08-15 18:04 ——– d–h—– C:\Program Files\InstallShield Installation Information
2006-08-12 10:34 6020 –a—— C:\clean.bat
2006-08-11 16:33 ——– d——– C:\Program Files\Microsoft Games
2006-08-11 00:54 ——– d——– C:\Program Files\DivX
2006-08-10 23:26 ——– d——– C:\Program Files\Driver Cleaner Pro
2006-08-10 22:40 ——– d——– C:\Program Files\Registry Mechanic
2006-08-10 16:40 ——– d——– C:\Program Files\Internet Explorer
2006-08-10 16:37 ——– d——– C:\Documents and Settings\Jake\Application Data\My Battle for Middle-earth™ II Files
2006-08-08 03:23 ——– d——– C:\Program Files\InterActual
2006-08-06 22:38 ——– d——– C:\Program Files\Darkstar One Demo
2006-08-02 18:12 307200 –a—— C:\WINDOWS\system32\atiiiexx.dll
2006-08-02 18:08 258048 –a—— C:\WINDOWS\system32\ati2dvag.dll
2006-08-02 18:07 1681920 –a—— C:\WINDOWS\system32\drivers\ati2mtag.sys
2006-08-02 18:02 86016 –a—— C:\WINDOWS\system32\ati2evxx.dll
2006-08-02 18:02 77824 –a—— C:\WINDOWS\system32\Oemdspif.dll
2006-08-02 18:02 41984 –a—— C:\WINDOWS\system32\ati2edxx.dll
2006-08-02 18:02 26112 –a—— C:\WINDOWS\system32\Ati2mdxx.exe
2006-08-02 18:02 114688 –a—— C:\WINDOWS\system32\atipdlxx.dll
2006-08-02 18:01 401408 –a—— C:\WINDOWS\system32\ati2evxx.exe
2006-08-02 18:00 53248 –a—— C:\WINDOWS\system32\ATIDDC.DLL
2006-08-02 17:55 2373088 –a—— C:\WINDOWS\system32\ati3duag.dll
2006-08-02 17:51 2354720 –a—— C:\WINDOWS\system32\ativvaxx.dll
2006-08-02 17:49 6684672 –a—— C:\WINDOWS\system32\atioglx1.dll
2006-08-02 17:45 5136384 –a—— C:\WINDOWS\system32\atioglxx.dll
2006-08-02 17:41 208896 –a—— C:\WINDOWS\system32\atikvmag.dll
2006-08-02 17:40 303104 –a—— C:\WINDOWS\system32\ATIDEMGR.dll
2006-08-02 17:40 17408 –a—— C:\WINDOWS\system32\atitvo32.dll
2006-08-02 17:35 286720 –a—— C:\WINDOWS\system32\ati2cqag.dll
2006-08-02 17:27 520192 ——— C:\WINDOWS\system32\ati2sgag.exe
2006-08-02 04:25 ——– d——– C:\Program Files\Common Files\Microsoft Shared
2006-07-31 21:29 ——– d——– C:\Program Files\Common Files\AOL
2006-07-31 21:16 ——– d——– C:\Documents and Settings\Jake\Application Data\AOL
2006-07-31 20:55 ——– d——– C:\Program Files\CCleaner
2006-07-31 20:15 ——– d——– C:\Program Files\Windows Defender
2006-07-30 17:04 ——– d——– C:\Program Files\AIM
2006-07-30 00:07 ——– d——– C:\Program Files\Sierra
2006-07-29 22:53 ——– d—s—- C:\Documents and Settings\Jake\Application Data\Microsoft
2006-07-28 17:59 ——– d——– C:\Program Files\Electronic Arts
2006-07-28 16:41 ——– d——– C:\Documents and Settings\Jake\Application Data\Aim
2006-07-27 20:47 ——– d——– C:\Program Files\1 Click PC Fix 2006
2006-07-27 20:42 50688 –a—— C:\WINDOWS\system32\wbhelp2.dll
2006-07-27 17:50 ——– d——– C:\Program Files\Warcraft III
2006-07-27 16:04 33952 –a—— C:\WINDOWS\system32\drivers\oreans32.sys
2006-07-27 15:51 ——– d——– C:\Program Files\WinRAR
2006-07-27 15:51 ——– d——– C:\Documents and Settings\Jake\Application Data\Help
2006-07-27 09:24 679424 –a—— C:\WINDOWS\system32\inetcomm.dll
2006-07-25 18:47 223128 –a—— C:\WINDOWS\system32\drivers\dtscsi.sys
2006-07-25 18:47 ——– d——– C:\Program Files\DAEMON Tools
2006-07-25 18:45 643072 –a—— C:\WINDOWS\system32\drivers\sptd.sys
2006-07-23 01:19 ——– dr-h—– C:\Documents and Settings\Jake\Application Data\SecuROM
2006-07-21 04:24 72704 –a—— C:\WINDOWS\system32\hlink.dll
2006-07-18 03:09 178726 –a—— C:\WINDOWS\YazzleBundle-1119.exe
2006-07-18 03:08 32976 –a—— C:\WINDOWS\system32\uninstIcn.exe
2006-07-17 16:34 ——– d——– C:\Program Files\World of Warcraft
2006-07-15 03:47 ——– d——– C:\Program Files\THQ
2006-07-08 00:34 ——– d——– C:\Program Files\Common Files\EasyInfo
2006-07-02 11:44 223128 –a—— C:\WINDOWS\system32\drivers\vaxscsi.sys
2006-07-02 11:31 96256 –a—— C:\WINDOWS\system32\drivers\sptd0301.sys
2006-07-01 10:02 ——– d——– C:\Documents and Settings\Jake\Application Data\Sun
2006-07-01 09:44 ——– d——– C:\Program Files\Java
2006-07-01 09:41 ——– d——– C:\Program Files\Common Files\Java
2006-06-28 03:32 ——– d——– C:\Documents and Settings\Jake\Application Data\.BitTornado


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe"
"HostManager"="C:\\Program Files\\Common Files\\AOL\\1137850580\\ee\\AOLSoftware.exe"
"RTHDCPL"="RTHDCPL.EXE"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe"
"Windows Defender"="\"C:\\Program Files\\Windows Defender\\MSASCui.exe\" -hide"
"ATICCC"="\"C:\\Program Files\\ATI Technologies\\ATI.ACE\\CLIStart.exe\""
"!ewido"="\"C:\\Program Files\\ewido anti-spyware 4.0\\ewido.exe\" /minimized"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PowerBar"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\
00,00,01,00,00,00

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}"="Microsoft AntiMalware ShellExecuteHook"
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="ewido anti-spyware 4.0"




~ ~ ~ ~ ~ ~ ~ ~ Hijackthis Backups ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

backup-20060820-202509-418
O16 - DPF: {DECEAAA2-370A-49BB-9362-68C3A58DDC62} (SAIX) - http://static.zangocash.com/cab/Seekmo/ie/…97909f988f07a4e
backup-20060820-202509-534
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\MP Scheduled Scan.job

Completion time: Mon 08/21/2006 22:02:45.40
ComboFix.txt
Post #17
Download & unzip gmer to your desktop
Double click the gmer.exe to run it
Select the rootkit tab, make sure the Show All button is unticked, and press scan
When it has finished, right-click the [System] pe386 entry
Select Delete the service & then reboot your machine.
After Reboot, Run ComboFix again
When it has finished, post a fresh HijackThis log along with the fresh ComboFix log here
Post #19
Run gmer
Select the rootkit tab, make sure the Show All button is unticked, and press scan
When it has finished, select the Process tab
Click the restart button
After restart, run ComboFix again
Post a fresh ComboFix log along with a fresh HijackThis log here
Post #20
Logfile of HijackThis v1.99.1
Scan saved at 3:00:06 PM, on 8/22/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\AOL\1137850580\ee\AOLSoftware.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\HijackThis\Analyze.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1137850580\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1137813716414
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe




Jake - 06-08-22 14:58:56.45
ComboFix 06.08.18 - Running from: C:\Documents and Settings\[removed]\Desktop

((((((((((((((((((((((((((((((( Files Created from 2006-07-22 to 2006-08-22 ))))))))))))))))))))))))))))))))))


2006-08-19 20:02 90,112 C:\WINDOWS\system32\RegDACL.exe
2006-08-19 20:02 6,020 C:\clean.bat
2006-08-19 20:02 40,960 C:\WINDOWS\system32\swsc.exe
2006-08-19 20:02 4,096 C:\WINDOWS\system32\reboot.exe
2006-08-19 20:02 38,400 C:\WINDOWS\system32\moveex.exe
2006-08-19 04:57 520,192 C:\WINDOWS\system32\ati2sgag.exe
2006-08-17 20:29 306,688 C:\WINDOWS\IsUninst.exe
2006-08-02 18:12 307,200 C:\WINDOWS\system32\atiiiexx.dll
2006-08-02 18:02 26,112 C:\WINDOWS\system32\Ati2mdxx.exe
2006-08-02 18:02 114,688 C:\WINDOWS\system32\atipdlxx.dll
2006-08-02 18:00 53,248 C:\WINDOWS\system32\ATIDDC.DLL
2006-08-02 17:49 6,684,672 C:\WINDOWS\system32\atioglx1.dll
2006-08-02 17:45 5,136,384 C:\WINDOWS\system32\atioglxx.dll
2006-08-02 17:40 303,104 C:\WINDOWS\system32\ATIDEMGR.dll
2006-08-02 17:40 17,408 C:\WINDOWS\system32\atitvo32.dll
2006-07-28 16:17 82,432 C:\WINDOWS\system32\msxml4r.dll
2006-07-28 16:17 1,233,920 C:\WINDOWS\system32\msxml4.dll
2006-07-27 20:42 50,688 C:\WINDOWS\system32\wbhelp2.dll


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-08-22 14:58 ——– d——– C:\Program Files\Mozilla Firefox
2006-08-22 14:11 ——– d——– C:\Program Files\Common Files
2006-08-22 14:02 ——– d——– C:\Program Files\ewido anti-spyware 4.0
2006-08-19 20:12 ——– d——– C:\Program Files\HaxFix
2006-08-19 17:27 98304 –a—— C:\WINDOWS\system32\CmdLineExt.dll
2006-08-19 14:33 ——– d——– C:\Program Files\SpywareGuard
2006-08-19 04:58 ——– d——– C:\Program Files\ATI Technologies
2006-08-17 20:33 ——– d——– C:\Documents and Settings\Jake\Application Data\Adobe
2006-08-16 17:54 ——– d——– C:\Program Files\SpywareBlaster
2006-08-15 18:07 ——– d——– C:\Program Files\Deus Ex - Invisible War
2006-08-15 18:04 ——– d–h—– C:\Program Files\InstallShield Installation Information
2006-08-12 10:34 6020 –a—— C:\clean.bat
2006-08-11 16:33 ——– d——– C:\Program Files\Microsoft Games
2006-08-11 00:54 ——– d——– C:\Program Files\DivX
2006-08-10 23:26 ——– d——– C:\Program Files\Driver Cleaner Pro
2006-08-10 22:40 ——– d——– C:\Program Files\Registry Mechanic
2006-08-10 16:40 ——– d——– C:\Program Files\Internet Explorer
2006-08-10 16:37 ——– d——– C:\Documents and Settings\Jake\Application Data\My Battle for Middle-earth™ II Files
2006-08-08 03:23 ——– d——– C:\Program Files\InterActual
2006-08-06 22:38 ——– d——– C:\Program Files\Darkstar One Demo
2006-08-02 18:12 307200 –a—— C:\WINDOWS\system32\atiiiexx.dll
2006-08-02 18:08 258048 –a—— C:\WINDOWS\system32\ati2dvag.dll
2006-08-02 18:07 1681920 –a—— C:\WINDOWS\system32\drivers\ati2mtag.sys
2006-08-02 18:02 86016 –a—— C:\WINDOWS\system32\ati2evxx.dll
2006-08-02 18:02 77824 –a—— C:\WINDOWS\system32\Oemdspif.dll
2006-08-02 18:02 41984 –a—— C:\WINDOWS\system32\ati2edxx.dll
2006-08-02 18:02 26112 –a—— C:\WINDOWS\system32\Ati2mdxx.exe
2006-08-02 18:02 114688 –a—— C:\WINDOWS\system32\atipdlxx.dll
2006-08-02 18:01 401408 –a—— C:\WINDOWS\system32\ati2evxx.exe
2006-08-02 18:00 53248 –a—— C:\WINDOWS\system32\ATIDDC.DLL
2006-08-02 17:55 2373088 –a—— C:\WINDOWS\system32\ati3duag.dll
2006-08-02 17:51 2354720 –a—— C:\WINDOWS\system32\ativvaxx.dll
2006-08-02 17:49 6684672 –a—— C:\WINDOWS\system32\atioglx1.dll
2006-08-02 17:45 5136384 –a—— C:\WINDOWS\system32\atioglxx.dll
2006-08-02 17:41 208896 –a—— C:\WINDOWS\system32\atikvmag.dll
2006-08-02 17:40 303104 –a—— C:\WINDOWS\system32\ATIDEMGR.dll
2006-08-02 17:40 17408 –a—— C:\WINDOWS\system32\atitvo32.dll
2006-08-02 17:35 286720 –a—— C:\WINDOWS\system32\ati2cqag.dll
2006-08-02 17:27 520192 ——— C:\WINDOWS\system32\ati2sgag.exe
2006-08-02 04:25 ——– d——– C:\Program Files\Common Files\Microsoft Shared
2006-07-31 21:29 ——– d——– C:\Program Files\Common Files\AOL
2006-07-31 21:16 ——– d——– C:\Documents and Settings\Jake\Application Data\AOL
2006-07-31 20:55 ——– d——– C:\Program Files\CCleaner
2006-07-31 20:15 ——– d——– C:\Program Files\Windows Defender
2006-07-30 17:04 ——– d——– C:\Program Files\AIM
2006-07-30 00:07 ——– d——– C:\Program Files\Sierra
2006-07-29 22:53 ——– d—s—- C:\Documents and Settings\Jake\Application Data\Microsoft
2006-07-28 17:59 ——– d——– C:\Program Files\Electronic Arts
2006-07-28 16:41 ——– d——– C:\Documents and Settings\Jake\Application Data\Aim
2006-07-27 20:47 ——– d——– C:\Program Files\1 Click PC Fix 2006
2006-07-27 20:42 50688 –a—— C:\WINDOWS\system32\wbhelp2.dll
2006-07-27 17:50 ——– d——– C:\Program Files\Warcraft III
2006-07-27 16:04 33952 –a—— C:\WINDOWS\system32\drivers\oreans32.sys
2006-07-27 15:51 ——– d——– C:\Program Files\WinRAR
2006-07-27 15:51 ——– d——– C:\Documents and Settings\Jake\Application Data\Help
2006-07-27 09:24 679424 –a—— C:\WINDOWS\system32\inetcomm.dll
2006-07-25 18:47 223128 –a—— C:\WINDOWS\system32\drivers\dtscsi.sys
2006-07-25 18:47 ——– d——– C:\Program Files\DAEMON Tools
2006-07-25 18:45 643072 –a—— C:\WINDOWS\system32\drivers\sptd.sys
2006-07-23 01:19 ——– dr-h—– C:\Documents and Settings\Jake\Application Data\SecuROM
2006-07-21 04:24 72704 –a—— C:\WINDOWS\system32\hlink.dll
2006-07-18 03:09 178726 –a—— C:\WINDOWS\YazzleBundle-1119.exe
2006-07-18 03:08 32976 –a—— C:\WINDOWS\system32\uninstIcn.exe
2006-07-17 16:34 ——– d——– C:\Program Files\World of Warcraft
2006-07-15 03:47 ——– d——– C:\Program Files\THQ
2006-07-08 00:34 ——– d——– C:\Program Files\Common Files\EasyInfo
2006-07-02 11:44 223128 –a—— C:\WINDOWS\system32\drivers\vaxscsi.sys
2006-07-02 11:31 96256 –a—— C:\WINDOWS\system32\drivers\sptd0301.sys
2006-07-01 10:02 ——– d——– C:\Documents and Settings\Jake\Application Data\Sun
2006-07-01 09:44 ——– d——– C:\Program Files\Java
2006-07-01 09:41 ——– d——– C:\Program Files\Common Files\Java
2006-06-28 03:32 ——– d——– C:\Documents and Settings\Jake\Application Data\.BitTornado


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe"
"HostManager"="C:\\Program Files\\Common Files\\AOL\\1137850580\\ee\\AOLSoftware.exe"
"RTHDCPL"="RTHDCPL.EXE"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe"
"Windows Defender"="\"C:\\Program Files\\Windows Defender\\MSASCui.exe\" -hide"
"ATICCC"="\"C:\\Program Files\\ATI Technologies\\ATI.ACE\\CLIStart.exe\""
"!ewido"="\"C:\\Program Files\\ewido anti-spyware 4.0\\ewido.exe\" /minimized"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PowerBar"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\
00,00,01,00,00,00

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}"="Microsoft AntiMalware ShellExecuteHook"
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="ewido anti-spyware 4.0"



Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\MP Scheduled Scan.job

Completion time: Tue 08/22/2006 14:59:22.15
ComboFix.txt
ComboFix2.txt
Post #22 last edited
Seems to be ok, hasn't rebooted since I last posted, though I am still unable to access Windows firewall.
Post #25
I want to make sure the rootkit is gone :

Download AV_Fix
Run Avenger.exe
Your Machine will reboot automatically & you shall get an avenger log
Please post that log here
Post #26
Logfile of The Avenger version 1, by Swandog46 Running from registry key: \Registry\Machine\System\CurrentControlSet\Services\igkehyla ******************* Script file located at: \??\C:\WINDOWS\system32\fpdnsekf.txt Script file opened successfully. Script file read successfully Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: Registry key \Registry\Machine\System\CurrentControlSet\Services\pe386 not found! Unload of driver pe386 failed! Could not process line: pe386 Status: 0xc0000034 Registry key \Registry\Machine\System\CurrentControlSet\Services\msguard not found! Unload of driver msguard failed! Could not process line: msguard Status: 0xc0000034 Completed script processing. ******************* Finished! Terminate.
Post #27 last edited
OK

Go to Start, Run, type in services.msc then hit OK
Look for the Windows Firewall service
If it is not there:

Download sharedaccess.reg (only for systems running Windows XP Service Pack 2) and save to Desktop
Then double-click the file to merge the contents to the registry
The Services entry will be created
Reboot

After reboot, go to Start, Run, and type cmd.exe then hit OK

Type the following at the prompt: (EXACTLY as written with spaces))

NETSH FIREWALL RESET

Then hit Enter

Launch firewall applet from Control Panel, and then configure your Windows Firewall settings.

Let me know if that works!

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI