tugboat
very first thing. I've got to hit ok before it will boot.
I took some pictures and will copy and paste them into this reply.
It doesn't seem to want to paste to this reply. Is there a way to attach them?
Spyware / Malware / Virus Removal
[Closed]Irs.gov
23 min read
rigacci
Doing the combofix is more important. It's important to take care of the bugs first. Otherwise, they can regenerate.
It does sound like the error may be BIOS-based.
tugboat
Here's the combofix log:
"Steve" - 07/11/2007 10:17:30 - ComboFix 07-07-03.9 - Service Pack 4
((((((((((((((((((((((((( Files Created from 2007-06-11 to 2007-07-11 )))))))))))))))))))))))))))))))
2007-07-10 16:01 16,384 –a—-t- D:\WINNT\system32\Perflib_Perfdata_664.dat
2007-07-04 00:42 d——– D:\WINNT\winsxs
2007-07-04 00:41 d——– D:\Program Files\MSECache
2007-07-03 23:27 51,200 –a—— D:\WINNT\nircmd.exe
2007-07-03 09:51 d——– D:\TEMP\ZB
2007-06-30 11:58 10,438 –a—— D:\dnsbak.reg
2007-06-20 10:36 69,632 –a—— D:\WINNT\system32\JSMUXMON.DLL
2007-06-20 10:36 59,604 –a—— D:\WINNT\system32\drivers\JSFAX.SYS
2007-06-20 10:36 56,672 –a—— D:\WINNT\system32\drivers\JSSCAN.SYS
2007-06-20 10:36 50,352 –a—— D:\WINNT\system32\drivers\JSDBG.SYS
2007-06-20 10:36 35,360 –a—— D:\WINNT\system32\JETRES16.DLL
2007-06-20 10:36 327,680 –a—— D:\WINNT\system32\JETRES32.DLL
2007-06-20 10:36 23,176 –a—— D:\WINNT\system32\JSUSD.DLL
2007-06-20 10:36 173,880 –a—— D:\WINNT\system32\drivers\JSMUX.SYS
2007-06-20 09:43 107,008 –a—— D:\WINNT\system32\HOTRES32.DLL
2007-06-20 08:16 36,864 -ra—— D:\WINNT\system32\RunSetup.dll
2007-06-19 19:38 d——– D:\WINNT\system32\SoftwareDistribution
2007-06-12 11:35 88,396 -ra—— D:\WINNT\system32\JF_JBIG.DLL
2007-06-12 11:35 149,680 -ra—— D:\WINNT\system32\HP3150PS.DLL
2007-06-08 08:37 d——– D:\tweek
2007-06-07 17:11 d——– D:\TEMP
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-07-11 16:17:04 ——– d—–w D:\WINNT\Profiles\Steve.000\APPLIC~1\.purple
2007-07-10 22:36:59 ——– d—–w D:\WINNT\Profiles\Steve.000\APPLIC~1\ZoomBrowser EX
2007-06-24 05:02:25 ——– d—–w D:\Program Files\Google
2007-06-20 16:36:27 ——– d—a-w D:\Program Files\Common Files\efax
2007-05-20 23:41:09 ——– d—–w D:\WINNT\Profiles\Steve.000\APPLIC~1\gtk-2.0
2007-05-14 00:02:04 ——– d—–w D:\Program Files\Bonjour
2007-04-25 07:52:16 147,216 —-a-w D:\WINNT\system32\SCHANNEL.DLL
2007-04-17 04:47:36 33,624 —-a-w D:\WINNT\system32\wups.dll
2007-04-17 04:45:54 1,710,936 —-a-w D:\WINNT\system32\wuaueng.dll
2007-04-17 04:45:48 549,720 —-a-w D:\WINNT\system32\wuapi.dll
2007-04-17 04:45:42 325,976 —-a-w D:\WINNT\system32\wucltui.dll
2007-04-17 04:45:36 203,096 —-a-w D:\WINNT\system32\wuweb.dll
2007-04-17 04:45:28 92,504 —-a-w D:\WINNT\system32\cdm.dll
2007-04-17 04:45:20 53,080 —-a-w D:\WINNT\system32\wuauclt.exe
2007-04-17 04:45:20 43,352 —-a-w D:\WINNT\system32\wups2.dll
2007-04-17 04:44:20 271,224 —-a-w D:\WINNT\system32\mucltui.dll
2007-04-17 04:44:18 208,248 —-a-w D:\WINNT\system32\muweb.dll
2007-04-16 12:44:08 54,032 —-a-w D:\WINNT\system32\mpr.dll
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
01/12/06 09:38p 63128 –a—— D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
05/12/04 01:03a 744960 -r——- C:\PROGRA~1\SPYBOT~1\SDHelper.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
01/19/07 11:55p 2403392 -ra—— d:\program files\google\googletoolbar4.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RoxioDragToDisc"="D:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe" [12/09/03 07:24p]
"RoxioEngineUtility"="D:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe" [05/01/03 07:44p]
"projselector"="D:\Program Files\Common Files\Roxio Shared\Project Selector\projselector.exe" [12/09/03 07:37p]
"OneTouch Monitor"="D:\PROGRA~1\VISION~1\ONETOU~2.EXE" [10/16/01 08:08a]
"Adobe Photo Downloader"="D:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [06/06/05 11:46p]
"Synchronization Manager"="mobsync.exe" [06/19/03 01:05p D:\WINNT\system32\mobsync.exe]
"AVG7_CC"="D:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [04/17/07 09:24a]
"QuickTime Task"="D:\Program Files\QuickTime\qttask.exe" [10/25/06 07:58p]
"Picasa Media Detector"="D:\Program Files\Picasa2\PicasaMediaDetector.exe" [12/11/06 06:36p]
"iTunesHelper"="D:\Program Files\iTunes\iTunesHelper.exe" [10/30/06 10:36a]
"OM_Monitor"="D:\Program Files\OLYMPUS\OLYMPUS Master\FirstStart.exe" [05/16/06 06:50p]
"Tweak UI"="TWEAKUI.CPL" [06/18/00 02:03p D:\WINNT\system32\TWEAKUI.CPL]
"TkBellExe"="D:\Program Files\Common Files\Real\Update_OB\realsched.exe" [11/15/04 07:48p]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OM_Monitor"="D:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe" [05/16/06 06:51p]
"BitTorrent"="D:\Program Files\BitTorrent\bittorrent.exe" [11/29/06 09:50p]
"swg"="D:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [04/11/07 08:33a]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"=D:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{A213B520-C6C2-11d0-AF9D-008029E1027E}"="D:\Program Files\Symantec\WinFax\WfxSeh32.Dll" [07/27/98 06:54a]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" [09/28/06 08:13a]
"{FA010552-4A27-4cb1-A1BB-3E2D697F1639}"="c:\Program Files\InterMute\SpySubtract\sshook.dll" [10/23/06 05:44p]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, msnsspc.dll, digest.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\b9t7ROH8V]
iedestrt.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\bxxs5]
RunDLL32.EXE D:\WINNT\bxxs5.dll,DllRun
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\fjflzrlfshzh]
D:\WINNT\system32\mdffqg.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpsysconf1]
D:\WINNT\system32\tlbvvak.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\icdd7ee6]
rundll32.exe D:\WINNT\system32\icdd7ee6.dll,EnableRunDLL32
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iel2cde8]
rundll32.exe D:\WINNT\system32\iel2cde8.dll,EnableRunDLL32
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\inetmgr]
D:\PROGRA~1\INTERN~2\inetmgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\li01f948]
rundll32.exe D:\WINNT\system32\li01f948.dll,EnableRunDLL32
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LXSUPMON]
D:\WINNT\system32\LXSUPMON.EXE RUN
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nssysconf]
D:\WINNT\system32\eobawmw.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PPWebCap]
D:\PROGRA~1\ScanSoft\PAPERP~1\PPWebCap.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\qq2X3Ej]
idqautou.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"D:\Program Files\QuickTime\qttask.exe" -atboottime
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\readdb40]
rundll32.exe D:\WINNT\system32\readdb40.dll,EnableRunDLL32
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Synchronization Manager]
mobsync.exe /logon
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TV Media]
D:\Program Files\TV Media\Tvm.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFaxAppPortStarter]
wfxsnt40.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinTools]
D:\Program Files\Common Files\WinTools\WToolsA.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\wm41a398]
rundll32.exe D:\WINNT\system32\wm41a398.dll,EnableRunDLL32
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"TkBellExe"="D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
"QuickTime Task"="D:\Program Files\QuickTime\qttask.exe" -atboottime
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - netsvcs
WmdmPmSN
Contents of the 'Scheduled Tasks' folder
2007-06-16 04:00:01 D:\WINNT\tasks\Daily Backup.job
2007-07-10 20:49:03 D:\WINNT\tasks\Daily2.job
**************************************************************************
catchme 0.3.914 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-11 10:20:36
Windows 5.0.2195 Service Pack 4 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
Completion time: 07/11/2007 10:21:38
D:\ComboFix-quarantined-files.txt … 07/11/07 10:21a
D:\ComboFix2.txt … 07/03/07 11:41p
— E O F —
"Steve" - 07/11/2007 10:17:30 - ComboFix 07-07-03.9 - Service Pack 4
((((((((((((((((((((((((( Files Created from 2007-06-11 to 2007-07-11 )))))))))))))))))))))))))))))))
2007-07-10 16:01 16,384 –a—-t- D:\WINNT\system32\Perflib_Perfdata_664.dat
2007-07-04 00:42 d——– D:\WINNT\winsxs
2007-07-04 00:41 d——– D:\Program Files\MSECache
2007-07-03 23:27 51,200 –a—— D:\WINNT\nircmd.exe
2007-07-03 09:51 d——– D:\TEMP\ZB
2007-06-30 11:58 10,438 –a—— D:\dnsbak.reg
2007-06-20 10:36 69,632 –a—— D:\WINNT\system32\JSMUXMON.DLL
2007-06-20 10:36 59,604 –a—— D:\WINNT\system32\drivers\JSFAX.SYS
2007-06-20 10:36 56,672 –a—— D:\WINNT\system32\drivers\JSSCAN.SYS
2007-06-20 10:36 50,352 –a—— D:\WINNT\system32\drivers\JSDBG.SYS
2007-06-20 10:36 35,360 –a—— D:\WINNT\system32\JETRES16.DLL
2007-06-20 10:36 327,680 –a—— D:\WINNT\system32\JETRES32.DLL
2007-06-20 10:36 23,176 –a—— D:\WINNT\system32\JSUSD.DLL
2007-06-20 10:36 173,880 –a—— D:\WINNT\system32\drivers\JSMUX.SYS
2007-06-20 09:43 107,008 –a—— D:\WINNT\system32\HOTRES32.DLL
2007-06-20 08:16 36,864 -ra—— D:\WINNT\system32\RunSetup.dll
2007-06-19 19:38 d——– D:\WINNT\system32\SoftwareDistribution
2007-06-12 11:35 88,396 -ra—— D:\WINNT\system32\JF_JBIG.DLL
2007-06-12 11:35 149,680 -ra—— D:\WINNT\system32\HP3150PS.DLL
2007-06-08 08:37 d——– D:\tweek
2007-06-07 17:11 d——– D:\TEMP
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-07-11 16:17:04 ——– d—–w D:\WINNT\Profiles\Steve.000\APPLIC~1\.purple
2007-07-10 22:36:59 ——– d—–w D:\WINNT\Profiles\Steve.000\APPLIC~1\ZoomBrowser EX
2007-06-24 05:02:25 ——– d—–w D:\Program Files\Google
2007-06-20 16:36:27 ——– d—a-w D:\Program Files\Common Files\efax
2007-05-20 23:41:09 ——– d—–w D:\WINNT\Profiles\Steve.000\APPLIC~1\gtk-2.0
2007-05-14 00:02:04 ——– d—–w D:\Program Files\Bonjour
2007-04-25 07:52:16 147,216 —-a-w D:\WINNT\system32\SCHANNEL.DLL
2007-04-17 04:47:36 33,624 —-a-w D:\WINNT\system32\wups.dll
2007-04-17 04:45:54 1,710,936 —-a-w D:\WINNT\system32\wuaueng.dll
2007-04-17 04:45:48 549,720 —-a-w D:\WINNT\system32\wuapi.dll
2007-04-17 04:45:42 325,976 —-a-w D:\WINNT\system32\wucltui.dll
2007-04-17 04:45:36 203,096 —-a-w D:\WINNT\system32\wuweb.dll
2007-04-17 04:45:28 92,504 —-a-w D:\WINNT\system32\cdm.dll
2007-04-17 04:45:20 53,080 —-a-w D:\WINNT\system32\wuauclt.exe
2007-04-17 04:45:20 43,352 —-a-w D:\WINNT\system32\wups2.dll
2007-04-17 04:44:20 271,224 —-a-w D:\WINNT\system32\mucltui.dll
2007-04-17 04:44:18 208,248 —-a-w D:\WINNT\system32\muweb.dll
2007-04-16 12:44:08 54,032 —-a-w D:\WINNT\system32\mpr.dll
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
01/12/06 09:38p 63128 –a—— D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
05/12/04 01:03a 744960 -r——- C:\PROGRA~1\SPYBOT~1\SDHelper.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
01/19/07 11:55p 2403392 -ra—— d:\program files\google\googletoolbar4.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RoxioDragToDisc"="D:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe" [12/09/03 07:24p]
"RoxioEngineUtility"="D:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe" [05/01/03 07:44p]
"projselector"="D:\Program Files\Common Files\Roxio Shared\Project Selector\projselector.exe" [12/09/03 07:37p]
"OneTouch Monitor"="D:\PROGRA~1\VISION~1\ONETOU~2.EXE" [10/16/01 08:08a]
"Adobe Photo Downloader"="D:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [06/06/05 11:46p]
"Synchronization Manager"="mobsync.exe" [06/19/03 01:05p D:\WINNT\system32\mobsync.exe]
"AVG7_CC"="D:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [04/17/07 09:24a]
"QuickTime Task"="D:\Program Files\QuickTime\qttask.exe" [10/25/06 07:58p]
"Picasa Media Detector"="D:\Program Files\Picasa2\PicasaMediaDetector.exe" [12/11/06 06:36p]
"iTunesHelper"="D:\Program Files\iTunes\iTunesHelper.exe" [10/30/06 10:36a]
"OM_Monitor"="D:\Program Files\OLYMPUS\OLYMPUS Master\FirstStart.exe" [05/16/06 06:50p]
"Tweak UI"="TWEAKUI.CPL" [06/18/00 02:03p D:\WINNT\system32\TWEAKUI.CPL]
"TkBellExe"="D:\Program Files\Common Files\Real\Update_OB\realsched.exe" [11/15/04 07:48p]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OM_Monitor"="D:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe" [05/16/06 06:51p]
"BitTorrent"="D:\Program Files\BitTorrent\bittorrent.exe" [11/29/06 09:50p]
"swg"="D:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [04/11/07 08:33a]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"=D:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{A213B520-C6C2-11d0-AF9D-008029E1027E}"="D:\Program Files\Symantec\WinFax\WfxSeh32.Dll" [07/27/98 06:54a]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" [09/28/06 08:13a]
"{FA010552-4A27-4cb1-A1BB-3E2D697F1639}"="c:\Program Files\InterMute\SpySubtract\sshook.dll" [10/23/06 05:44p]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, msnsspc.dll, digest.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\b9t7ROH8V]
iedestrt.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\bxxs5]
RunDLL32.EXE D:\WINNT\bxxs5.dll,DllRun
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\fjflzrlfshzh]
D:\WINNT\system32\mdffqg.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpsysconf1]
D:\WINNT\system32\tlbvvak.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\icdd7ee6]
rundll32.exe D:\WINNT\system32\icdd7ee6.dll,EnableRunDLL32
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iel2cde8]
rundll32.exe D:\WINNT\system32\iel2cde8.dll,EnableRunDLL32
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\inetmgr]
D:\PROGRA~1\INTERN~2\inetmgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\li01f948]
rundll32.exe D:\WINNT\system32\li01f948.dll,EnableRunDLL32
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LXSUPMON]
D:\WINNT\system32\LXSUPMON.EXE RUN
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nssysconf]
D:\WINNT\system32\eobawmw.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PPWebCap]
D:\PROGRA~1\ScanSoft\PAPERP~1\PPWebCap.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\qq2X3Ej]
idqautou.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"D:\Program Files\QuickTime\qttask.exe" -atboottime
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\readdb40]
rundll32.exe D:\WINNT\system32\readdb40.dll,EnableRunDLL32
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Synchronization Manager]
mobsync.exe /logon
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TV Media]
D:\Program Files\TV Media\Tvm.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFaxAppPortStarter]
wfxsnt40.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinTools]
D:\Program Files\Common Files\WinTools\WToolsA.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\wm41a398]
rundll32.exe D:\WINNT\system32\wm41a398.dll,EnableRunDLL32
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"TkBellExe"="D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
"QuickTime Task"="D:\Program Files\QuickTime\qttask.exe" -atboottime
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - netsvcs
WmdmPmSN
Contents of the 'Scheduled Tasks' folder
2007-06-16 04:00:01 D:\WINNT\tasks\Daily Backup.job
2007-07-10 20:49:03 D:\WINNT\tasks\Daily2.job
**************************************************************************
catchme 0.3.914 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-11 10:20:36
Windows 5.0.2195 Service Pack 4 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
Completion time: 07/11/2007 10:21:38
D:\ComboFix-quarantined-files.txt … 07/11/07 10:21a
D:\ComboFix2.txt … 07/03/07 11:41p
— E O F —
tugboat
also, when I do combofix it says error: Cannot fix creg.cf Error accessing the Registry
rigacci
Don't know about that error but errors are sometimes a sign of infections.
Please do the following:
OK, there are quite a few bugs still there. This next process should take care of them.
1. Please open Notepad
Click Start, then Run
Type notepad.exe in the Run Box.
2. Now copy/paste the entire content of the codebox below into the Notepad window:
3. Save the above as CFScript.txt
4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.
[external image: Posted Image]
5. After reboot, (in case it asks to reboot), please post the Combofix.txt log into your next reply.
Please do the following:
OK, there are quite a few bugs still there. This next process should take care of them.
1. Please open Notepad
Click Start, then Run
Type notepad.exe in the Run Box.
2. Now copy/paste the entire content of the codebox below into the Notepad window:
File::
D:\iedestrt.exe
D:\idqautou.exe
D:\WINNT\bxxs5.dll
D:\WINNT\system32\mdffqg.exe
D:\WINNT\system32\tlbvvak.exe
D:\WINNT\system32\icdd7ee6.dll
D:\WINNT\system32\iel2cde8.dll
D:\WINNT\system32\li01f948.dll
D:\WINNT\system32\eobawmw.exe
D:\WINNT\system32\readdb40.dll
D:\WINNT\system32\wm41a398.dll
D:\PROGRA~1\INTERN~2\inetmgr.exe
FileLook::
D:\WINNT\Profiles\Steve.000\Application Data\.purple
Folder::
D:\Program Files\TV Media
D:\Program Files\Common Files\WinTools
Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\b9t7ROH8V]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\bxxs5]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\fjflzrlfshzh]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpsysconf1]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\icdd7ee6]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iel2cde8]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\inetmgr]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\li01f948]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nssysconf]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\qq2X3Ej]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\readdb40]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TV Media]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinTools]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\wm41a398]
3. Save the above as CFScript.txt
4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.
[external image: Posted Image]
5. After reboot, (in case it asks to reboot), please post the Combofix.txt log into your next reply.
tugboat
as soon as I started to copy the log into combofix I got the error message, Cannot open, shoot, I closed the window and forget. Anyhow, it's the same error message Cannot fix creg.cf Error accessing the Registry" I'll reboot now although it didn't ask me to.
-s
tugboat
Here's the log
"Steve" - 07/11/2007 22:17:29 - ComboFix 07-07-03.9 - Service Pack 4
Command switches used :: F:\My Documents\CFScript.txt
((((((((((((((((((((((((( Files Created from 2007-06-12 to 2007-07-12 )))))))))))))))))))))))))))))))
2007-07-11 21:52 16,384 –a—-t- D:\WINNT\system32\Perflib_Perfdata_3bc.dat
2007-07-10 16:01 16,384 –a—-t- D:\WINNT\system32\Perflib_Perfdata_664.dat
2007-07-04 00:42 d——– D:\WINNT\winsxs
2007-07-04 00:41 d——– D:\Program Files\MSECache
2007-07-03 23:27 51,200 –a—— D:\WINNT\nircmd.exe
2007-07-03 09:51 d——– D:\TEMP\ZB
2007-06-30 11:58 10,438 –a—— D:\dnsbak.reg
2007-06-20 10:36 69,632 –a—— D:\WINNT\system32\JSMUXMON.DLL
2007-06-20 10:36 59,604 –a—— D:\WINNT\system32\drivers\JSFAX.SYS
2007-06-20 10:36 56,672 –a—— D:\WINNT\system32\drivers\JSSCAN.SYS
2007-06-20 10:36 50,352 –a—— D:\WINNT\system32\drivers\JSDBG.SYS
2007-06-20 10:36 35,360 –a—— D:\WINNT\system32\JETRES16.DLL
2007-06-20 10:36 327,680 –a—— D:\WINNT\system32\JETRES32.DLL
2007-06-20 10:36 23,176 –a—— D:\WINNT\system32\JSUSD.DLL
2007-06-20 10:36 173,880 –a—— D:\WINNT\system32\drivers\JSMUX.SYS
2007-06-20 09:43 107,008 –a—— D:\WINNT\system32\HOTRES32.DLL
2007-06-20 08:16 36,864 -ra—— D:\WINNT\system32\RunSetup.dll
2007-06-19 19:38 d——– D:\WINNT\system32\SoftwareDistribution
2007-06-12 11:35 88,396 -ra—— D:\WINNT\system32\JF_JBIG.DLL
2007-06-12 11:35 149,680 -ra—— D:\WINNT\system32\HP3150PS.DLL
2007-06-08 08:37 d——– D:\tweek
2007-06-07 17:11 d——– D:\TEMP
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-07-12 03:52:57 1,636 —-a-w D:\WINNT\system32\d3d9caps.dat
2007-07-12 03:49:39 ——– d—–w D:\WINNT\Profiles\Steve.000\APPLIC~1\.purple
2007-07-10 22:36:59 ——– d—–w D:\WINNT\Profiles\Steve.000\APPLIC~1\ZoomBrowser EX
2007-06-24 05:02:25 ——– d—–w D:\Program Files\Google
2007-06-20 16:36:27 ——– d—a-w D:\Program Files\Common Files\efax
2007-05-20 23:41:09 ——– d—–w D:\WINNT\Profiles\Steve.000\APPLIC~1\gtk-2.0
2007-05-14 00:02:04 ——– d—–w D:\Program Files\Bonjour
2007-04-25 07:52:16 147,216 —-a-w D:\WINNT\system32\SCHANNEL.DLL
2007-04-17 04:47:36 33,624 —-a-w D:\WINNT\system32\wups.dll
2007-04-17 04:45:54 1,710,936 —-a-w D:\WINNT\system32\wuaueng.dll
2007-04-17 04:45:48 549,720 —-a-w D:\WINNT\system32\wuapi.dll
2007-04-17 04:45:42 325,976 —-a-w D:\WINNT\system32\wucltui.dll
2007-04-17 04:45:36 203,096 —-a-w D:\WINNT\system32\wuweb.dll
2007-04-17 04:45:28 92,504 —-a-w D:\WINNT\system32\cdm.dll
2007-04-17 04:45:20 53,080 —-a-w D:\WINNT\system32\wuauclt.exe
2007-04-17 04:45:20 43,352 —-a-w D:\WINNT\system32\wups2.dll
2007-04-17 04:44:20 271,224 —-a-w D:\WINNT\system32\mucltui.dll
2007-04-17 04:44:18 208,248 —-a-w D:\WINNT\system32\muweb.dll
2007-04-16 12:44:08 54,032 —-a-w D:\WINNT\system32\mpr.dll
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
01/12/06 09:38p 63128 –a—— D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
05/12/04 01:03a 744960 -r——- C:\PROGRA~1\SPYBOT~1\SDHelper.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
01/19/07 11:55p 2403392 -ra—— d:\program files\google\googletoolbar4.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RoxioDragToDisc"="D:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe" [12/09/03 07:24p]
"RoxioEngineUtility"="D:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe" [05/01/03 07:44p]
"projselector"="D:\Program Files\Common Files\Roxio Shared\Project Selector\projselector.exe" [12/09/03 07:37p]
"OneTouch Monitor"="D:\PROGRA~1\VISION~1\ONETOU~2.EXE" [10/16/01 08:08a]
"Adobe Photo Downloader"="D:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [06/06/05 11:46p]
"Synchronization Manager"="mobsync.exe" [06/19/03 01:05p D:\WINNT\system32\mobsync.exe]
"AVG7_CC"="D:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [04/17/07 09:24a]
"QuickTime Task"="D:\Program Files\QuickTime\qttask.exe" [10/25/06 07:58p]
"Picasa Media Detector"="D:\Program Files\Picasa2\PicasaMediaDetector.exe" [12/11/06 06:36p]
"iTunesHelper"="D:\Program Files\iTunes\iTunesHelper.exe" [10/30/06 10:36a]
"OM_Monitor"="D:\Program Files\OLYMPUS\OLYMPUS Master\FirstStart.exe" [05/16/06 06:50p]
"Tweak UI"="TWEAKUI.CPL" [06/18/00 02:03p D:\WINNT\system32\TWEAKUI.CPL]
"TkBellExe"="D:\Program Files\Common Files\Real\Update_OB\realsched.exe" [11/15/04 07:48p]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OM_Monitor"="D:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe" [05/16/06 06:51p]
"BitTorrent"="D:\Program Files\BitTorrent\bittorrent.exe" [11/29/06 09:50p]
"swg"="D:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [04/11/07 08:33a]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"=D:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{A213B520-C6C2-11d0-AF9D-008029E1027E}"="D:\Program Files\Symantec\WinFax\WfxSeh32.Dll" [07/27/98 06:54a]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" [09/28/06 08:13a]
"{FA010552-4A27-4cb1-A1BB-3E2D697F1639}"="c:\Program Files\InterMute\SpySubtract\sshook.dll" [10/23/06 05:44p]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, msnsspc.dll, digest.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\b9t7ROH8V]
iedestrt.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\bxxs5]
RunDLL32.EXE D:\WINNT\bxxs5.dll,DllRun
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\fjflzrlfshzh]
D:\WINNT\system32\mdffqg.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpsysconf1]
D:\WINNT\system32\tlbvvak.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\icdd7ee6]
rundll32.exe D:\WINNT\system32\icdd7ee6.dll,EnableRunDLL32
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iel2cde8]
rundll32.exe D:\WINNT\system32\iel2cde8.dll,EnableRunDLL32
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\inetmgr]
D:\PROGRA~1\INTERN~2\inetmgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\li01f948]
rundll32.exe D:\WINNT\system32\li01f948.dll,EnableRunDLL32
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LXSUPMON]
D:\WINNT\system32\LXSUPMON.EXE RUN
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nssysconf]
D:\WINNT\system32\eobawmw.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PPWebCap]
D:\PROGRA~1\ScanSoft\PAPERP~1\PPWebCap.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\qq2X3Ej]
idqautou.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"D:\Program Files\QuickTime\qttask.exe" -atboottime
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\readdb40]
rundll32.exe D:\WINNT\system32\readdb40.dll,EnableRunDLL32
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Synchronization Manager]
mobsync.exe /logon
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TV Media]
D:\Program Files\TV Media\Tvm.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFaxAppPortStarter]
wfxsnt40.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinTools]
D:\Program Files\Common Files\WinTools\WToolsA.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\wm41a398]
rundll32.exe D:\WINNT\system32\wm41a398.dll,EnableRunDLL32
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"TkBellExe"="D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
"QuickTime Task"="D:\Program Files\QuickTime\qttask.exe" -atboottime
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - netsvcs
WmdmPmSN
Contents of the 'Scheduled Tasks' folder
2007-06-16 04:00:01 D:\WINNT\tasks\Daily Backup.job
2007-07-11 20:49:07 D:\WINNT\tasks\Daily2.job
**************************************************************************
catchme 0.3.914 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-11 22:20:55
Windows 5.0.2195 Service Pack 4 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
Completion time: 07/11/2007 22:22:27
D:\ComboFix-quarantined-files.txt … 07/11/07 10:22p
D:\ComboFix2.txt … 07/11/07 10:21a
D:\ComboFix3.txt … 07/03/07 11:41p
— E O F —
"Steve" - 07/11/2007 22:17:29 - ComboFix 07-07-03.9 - Service Pack 4
Command switches used :: F:\My Documents\CFScript.txt
((((((((((((((((((((((((( Files Created from 2007-06-12 to 2007-07-12 )))))))))))))))))))))))))))))))
2007-07-11 21:52 16,384 –a—-t- D:\WINNT\system32\Perflib_Perfdata_3bc.dat
2007-07-10 16:01 16,384 –a—-t- D:\WINNT\system32\Perflib_Perfdata_664.dat
2007-07-04 00:42 d——– D:\WINNT\winsxs
2007-07-04 00:41 d——– D:\Program Files\MSECache
2007-07-03 23:27 51,200 –a—— D:\WINNT\nircmd.exe
2007-07-03 09:51 d——– D:\TEMP\ZB
2007-06-30 11:58 10,438 –a—— D:\dnsbak.reg
2007-06-20 10:36 69,632 –a—— D:\WINNT\system32\JSMUXMON.DLL
2007-06-20 10:36 59,604 –a—— D:\WINNT\system32\drivers\JSFAX.SYS
2007-06-20 10:36 56,672 –a—— D:\WINNT\system32\drivers\JSSCAN.SYS
2007-06-20 10:36 50,352 –a—— D:\WINNT\system32\drivers\JSDBG.SYS
2007-06-20 10:36 35,360 –a—— D:\WINNT\system32\JETRES16.DLL
2007-06-20 10:36 327,680 –a—— D:\WINNT\system32\JETRES32.DLL
2007-06-20 10:36 23,176 –a—— D:\WINNT\system32\JSUSD.DLL
2007-06-20 10:36 173,880 –a—— D:\WINNT\system32\drivers\JSMUX.SYS
2007-06-20 09:43 107,008 –a—— D:\WINNT\system32\HOTRES32.DLL
2007-06-20 08:16 36,864 -ra—— D:\WINNT\system32\RunSetup.dll
2007-06-19 19:38 d——– D:\WINNT\system32\SoftwareDistribution
2007-06-12 11:35 88,396 -ra—— D:\WINNT\system32\JF_JBIG.DLL
2007-06-12 11:35 149,680 -ra—— D:\WINNT\system32\HP3150PS.DLL
2007-06-08 08:37 d——– D:\tweek
2007-06-07 17:11 d——– D:\TEMP
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-07-12 03:52:57 1,636 —-a-w D:\WINNT\system32\d3d9caps.dat
2007-07-12 03:49:39 ——– d—–w D:\WINNT\Profiles\Steve.000\APPLIC~1\.purple
2007-07-10 22:36:59 ——– d—–w D:\WINNT\Profiles\Steve.000\APPLIC~1\ZoomBrowser EX
2007-06-24 05:02:25 ——– d—–w D:\Program Files\Google
2007-06-20 16:36:27 ——– d—a-w D:\Program Files\Common Files\efax
2007-05-20 23:41:09 ——– d—–w D:\WINNT\Profiles\Steve.000\APPLIC~1\gtk-2.0
2007-05-14 00:02:04 ——– d—–w D:\Program Files\Bonjour
2007-04-25 07:52:16 147,216 —-a-w D:\WINNT\system32\SCHANNEL.DLL
2007-04-17 04:47:36 33,624 —-a-w D:\WINNT\system32\wups.dll
2007-04-17 04:45:54 1,710,936 —-a-w D:\WINNT\system32\wuaueng.dll
2007-04-17 04:45:48 549,720 —-a-w D:\WINNT\system32\wuapi.dll
2007-04-17 04:45:42 325,976 —-a-w D:\WINNT\system32\wucltui.dll
2007-04-17 04:45:36 203,096 —-a-w D:\WINNT\system32\wuweb.dll
2007-04-17 04:45:28 92,504 —-a-w D:\WINNT\system32\cdm.dll
2007-04-17 04:45:20 53,080 —-a-w D:\WINNT\system32\wuauclt.exe
2007-04-17 04:45:20 43,352 —-a-w D:\WINNT\system32\wups2.dll
2007-04-17 04:44:20 271,224 —-a-w D:\WINNT\system32\mucltui.dll
2007-04-17 04:44:18 208,248 —-a-w D:\WINNT\system32\muweb.dll
2007-04-16 12:44:08 54,032 —-a-w D:\WINNT\system32\mpr.dll
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
01/12/06 09:38p 63128 –a—— D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
05/12/04 01:03a 744960 -r——- C:\PROGRA~1\SPYBOT~1\SDHelper.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
01/19/07 11:55p 2403392 -ra—— d:\program files\google\googletoolbar4.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RoxioDragToDisc"="D:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe" [12/09/03 07:24p]
"RoxioEngineUtility"="D:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe" [05/01/03 07:44p]
"projselector"="D:\Program Files\Common Files\Roxio Shared\Project Selector\projselector.exe" [12/09/03 07:37p]
"OneTouch Monitor"="D:\PROGRA~1\VISION~1\ONETOU~2.EXE" [10/16/01 08:08a]
"Adobe Photo Downloader"="D:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [06/06/05 11:46p]
"Synchronization Manager"="mobsync.exe" [06/19/03 01:05p D:\WINNT\system32\mobsync.exe]
"AVG7_CC"="D:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [04/17/07 09:24a]
"QuickTime Task"="D:\Program Files\QuickTime\qttask.exe" [10/25/06 07:58p]
"Picasa Media Detector"="D:\Program Files\Picasa2\PicasaMediaDetector.exe" [12/11/06 06:36p]
"iTunesHelper"="D:\Program Files\iTunes\iTunesHelper.exe" [10/30/06 10:36a]
"OM_Monitor"="D:\Program Files\OLYMPUS\OLYMPUS Master\FirstStart.exe" [05/16/06 06:50p]
"Tweak UI"="TWEAKUI.CPL" [06/18/00 02:03p D:\WINNT\system32\TWEAKUI.CPL]
"TkBellExe"="D:\Program Files\Common Files\Real\Update_OB\realsched.exe" [11/15/04 07:48p]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OM_Monitor"="D:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe" [05/16/06 06:51p]
"BitTorrent"="D:\Program Files\BitTorrent\bittorrent.exe" [11/29/06 09:50p]
"swg"="D:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [04/11/07 08:33a]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"=D:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{A213B520-C6C2-11d0-AF9D-008029E1027E}"="D:\Program Files\Symantec\WinFax\WfxSeh32.Dll" [07/27/98 06:54a]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" [09/28/06 08:13a]
"{FA010552-4A27-4cb1-A1BB-3E2D697F1639}"="c:\Program Files\InterMute\SpySubtract\sshook.dll" [10/23/06 05:44p]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, msnsspc.dll, digest.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\b9t7ROH8V]
iedestrt.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\bxxs5]
RunDLL32.EXE D:\WINNT\bxxs5.dll,DllRun
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\fjflzrlfshzh]
D:\WINNT\system32\mdffqg.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpsysconf1]
D:\WINNT\system32\tlbvvak.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\icdd7ee6]
rundll32.exe D:\WINNT\system32\icdd7ee6.dll,EnableRunDLL32
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iel2cde8]
rundll32.exe D:\WINNT\system32\iel2cde8.dll,EnableRunDLL32
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\inetmgr]
D:\PROGRA~1\INTERN~2\inetmgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\li01f948]
rundll32.exe D:\WINNT\system32\li01f948.dll,EnableRunDLL32
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LXSUPMON]
D:\WINNT\system32\LXSUPMON.EXE RUN
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nssysconf]
D:\WINNT\system32\eobawmw.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PPWebCap]
D:\PROGRA~1\ScanSoft\PAPERP~1\PPWebCap.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\qq2X3Ej]
idqautou.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"D:\Program Files\QuickTime\qttask.exe" -atboottime
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\readdb40]
rundll32.exe D:\WINNT\system32\readdb40.dll,EnableRunDLL32
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Synchronization Manager]
mobsync.exe /logon
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TV Media]
D:\Program Files\TV Media\Tvm.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFaxAppPortStarter]
wfxsnt40.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinTools]
D:\Program Files\Common Files\WinTools\WToolsA.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\wm41a398]
rundll32.exe D:\WINNT\system32\wm41a398.dll,EnableRunDLL32
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"TkBellExe"="D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
"QuickTime Task"="D:\Program Files\QuickTime\qttask.exe" -atboottime
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - netsvcs
WmdmPmSN
Contents of the 'Scheduled Tasks' folder
2007-06-16 04:00:01 D:\WINNT\tasks\Daily Backup.job
2007-07-11 20:49:07 D:\WINNT\tasks\Daily2.job
**************************************************************************
catchme 0.3.914 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-11 22:20:55
Windows 5.0.2195 Service Pack 4 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
Completion time: 07/11/2007 22:22:27
D:\ComboFix-quarantined-files.txt … 07/11/07 10:22p
D:\ComboFix2.txt … 07/11/07 10:21a
D:\ComboFix3.txt … 07/03/07 11:41p
— E O F —
rigacci
Any idea why this says drive F:\ 
You are running ComboFix from your Desktop, no? And it would be best to also save the text file to your desktop.
More to follow….
You are running ComboFix from your Desktop, no? And it would be best to also save the text file to your desktop.
Here's the log
"Steve" - 07/11/2007 22:17:29 - ComboFix 07-07-03.9 - Service Pack 4
Command switches used :: F:\My Documents\CFScript.txt
More to follow….
tugboat
For some reason, it didn't save it to the desktop although I asked it to. I found it in my documents which were saved to an f drive which is an extra drive I installed for video and photo downloads. My computer is sort of screwed up anyway. I need to reinstall my wn2000, defrag my drives, get rid of my c and d volumes on my home drive, etc. F is my main storage drive.
rigacci
1. Backup Your Registry with ERUNT
Note: to restore your registry, go to the folder and start ERDNT.exe
2. Launch Notepad, and copy/paste everything in the codebox below into the new document, including the word REGEDIT4. Go up to "File Save As" and click the drop-down box to change the "Save As Type" to "All Files" and save it to your desktop as fixme.reg.
3. Locate fixme.reg on your Desktop. It should look like this [external image: Posted Image]. Double-click on it. You will receive a prompt similar to: "Do you wish to merge the information into the registry?". Answer Yes and wait for a message to appear similar to Merged Successfully.
Now, please download OTMoveIt by Oldtimer and save it to your desktop.
Run OTMoveIt:
Please double-click OTMoveIt.exe to run it.
Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):
Return to OTMoveIt, right click on the "Paste List of Files/Folders to be moved" window and choose Paste.
Click the red Moveit! button.
Copy everything on the Results window to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it on your next reply.
Close OTMoveIt
(If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.)
Click the red Moveit! button.
Please "Copy" the results from the "Results" window (to the right) and then "Paste" them into your next reply on the forum.
Reboot into Normal Mode.
In your next reply please include the following:
The OTMoveIt log.
Thanks.
- Please use the following link and scroll down to ERUNT and download it.
http://aumha.org/freeware/freeware.php - For version with the Installer:
Use the setup program to install ERUNT on your computer - For the zipped version:
Unzip all the files into a folder of your choice.
Note: to restore your registry, go to the folder and start ERDNT.exe
2. Launch Notepad, and copy/paste everything in the codebox below into the new document, including the word REGEDIT4. Go up to "File Save As" and click the drop-down box to change the "Save As Type" to "All Files" and save it to your desktop as fixme.reg.
REGEDIT4
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\b9t7ROH8V]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\bxxs5]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\fjflzrlfshzh]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpsysconf1]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\icdd7ee6]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iel2cde8]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\inetmgr]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\li01f948]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nssysconf]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\qq2X3Ej]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\readdb40]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TV Media]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinTools]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\wm41a398]
3. Locate fixme.reg on your Desktop. It should look like this [external image: Posted Image]. Double-click on it. You will receive a prompt similar to: "Do you wish to merge the information into the registry?". Answer Yes and wait for a message to appear similar to Merged Successfully.
Now, please download OTMoveIt by Oldtimer and save it to your desktop.
Run OTMoveIt:
Please double-click OTMoveIt.exe to run it.
Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):
D:\iedestrt.exe
D:\idqautou.exe
D:\WINNT\bxxs5.dll
D:\WINNT\system32\mdffqg.exe
D:\WINNT\system32\tlbvvak.exe
D:\WINNT\system32\icdd7ee6.dll
D:\WINNT\system32\iel2cde8.dll
D:\WINNT\system32\li01f948.dll
D:\WINNT\system32\eobawmw.exe
D:\WINNT\system32\readdb40.dll
D:\WINNT\system32\wm41a398.dll
D:\PROGRA~1\INTERN~2\inetmgr.exe
Return to OTMoveIt, right click on the "Paste List of Files/Folders to be moved" window and choose Paste.
Click the red Moveit! button.
Copy everything on the Results window to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it on your next reply.
Close OTMoveIt
(If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.)
Click the red Moveit! button.
Please "Copy" the results from the "Results" window (to the right) and then "Paste" them into your next reply on the forum.
Reboot into Normal Mode.
In your next reply please include the following:
The OTMoveIt log.
Thanks.
tugboat
wow!
This will have to wait for the weekend.
This would almost be worth a webex session, so you could get right in to this computer and really see what's happeneing.
I'll get back to you when I get to do this, sometime in the next couple of days.
thanks a bunch for your perserverance.
Perserverance furthers, you will cross the great water (I Ching)
rigacci
No problem.
It would help to post a new HJT log as well, after the fix. OK?
tugboat
when I do a search for OTMoveIt, there are so many posts for this program that I can't find a place to download it. Do you have a direct link for a download? Please send it. Thanks. doing a search for download OTMoveIt.exe gets a zillion reference but no place to actually download.
tugboat
here are the result for OTMoveIt.
File/Folder D:\iedestrt.exe not found.
File/Folder D:\idqautou.exe not found.
File/Folder D:\WINNT\bxxs5.dll not found.
OTMoveIt log
File/Folder D:\WINNT\system32\mdffqg.exe not found.
File/Folder D:\WINNT\system32\tlbvvak.exe not found.
File/Folder D:\WINNT\system32\icdd7ee6.dll not found.
File/Folder D:\WINNT\system32\iel2cde8.dll not found.
File/Folder D:\WINNT\system32\li01f948.dll not found.
File/Folder D:\WINNT\system32\eobawmw.exe not found.
File/Folder D:\WINNT\system32\readdb40.dll not found.
File/Folder D:\WINNT\system32\wm41a398.dll not found.
File/Folder D:\PROGRA~1\INTERN~2\inetmgr.exe not found.
Created on 07/26/2007 14:11:52
rigacci
OK, as far as OTMoveIt, I had a link in my message. I probably should have been more clear and used "HERE", like I sometimes do.
It has been too long between posts to not think that you might have had changes to your system. It's always best to try and clean a machine as quickly as possible, before things can mutate.
I would like you to run ComboFix again. Please download it to your desktop from HERE.
This is the most recent version and should be used rather than the one you have on your computer now. You should delete that copy.
Run ComboFix again and allow it to save a logfile.
Do not touch your mouse or keyboard while it is scanning. It could cause it to stall.
Reboot your computer afterwards and then run HJT and create a new log.
Please post the ComboFix log as well as the HJT log.
I'll check it out and get back to you the same day.
Thanks.
You didn't mention if the Fixme.reg went through OK but sending the ComboFix log will tell me that.
It has been too long between posts to not think that you might have had changes to your system. It's always best to try and clean a machine as quickly as possible, before things can mutate.
I would like you to run ComboFix again. Please download it to your desktop from HERE.
This is the most recent version and should be used rather than the one you have on your computer now. You should delete that copy.
Run ComboFix again and allow it to save a logfile.
Do not touch your mouse or keyboard while it is scanning. It could cause it to stall.
Reboot your computer afterwards and then run HJT and create a new log.
Please post the ComboFix log as well as the HJT log.
I'll check it out and get back to you the same day.
Thanks.
You didn't mention if the Fixme.reg went through OK but sending the ComboFix log will tell me that.
Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI