What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Internet Virus

5 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16 last edited
I did what you said and when my computer restarted it froze while making the log…I couldnt open any programs, couldnt control alt delete to bring up the task manager. I waited a bit more and still everything remained frozen. Though I did notice on launch that the Zone Labs scan didnt start up. Should I try again? Also I included File:: in the notepad save.
Post #18
ComboFix 07-06-18.2 - C:\Documents and Settings\Owner\Desktop\ComboFix.exe
"Owner" - 2007-07-04 1:58:47 - Service Pack 2 NTFS
Command switches used :: C:\Documents and Settings\Owner\Desktop\ComboFix-Do.txt


((((((((((((((((((((((((( Files Created from 2007-06-04 to 2007-07-04 )))))))))))))))))))))))))))))))


2007-07-03 15:07 d——– C:\setups
2007-07-03 15:01 d——– C:\Program Files\createinstall free
2007-07-03 02:27 61,952 –a—— C:\WINDOWS\system32\execryptorvb.dll
2007-07-03 02:27 d——– C:\Program Files\EXECryptor
2007-07-02 22:43 20,480 –a—— C:\WINDOWS\system32\H@tKeysH@@k.DLL
2007-07-02 21:44 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-07-02 20:44 d——– C:\Program Files\ERUNT BACKUP
2007-07-02 12:00 49,152 –a—— C:\WINDOWS\nircmd.exe
2007-07-02 01:42 d——– C:\WINDOWS\CAVTemp
2007-07-02 01:05 1,021,504 –a—— C:\WINDOWS\system32\vete.dll
2007-07-02 00:34 4,212 —h—– C:\WINDOWS\system32\zllictbl.dat
2007-07-02 00:33 77,824 –a—— C:\WINDOWS\system32\driverif.dll
2007-07-02 00:33 75,776 –a—— C:\WINDOWS\zllsputility.exe
2007-07-02 00:33 645,904 –a—— C:\WINDOWS\system32\drivers\vetmonnt.sys
2007-07-02 00:33 21,605 –a—— C:\WINDOWS\system32\drivers\vet-filt.sys
2007-07-02 00:33 15,668 –a—— C:\WINDOWS\system32\drivers\vet-rec.sys
2007-07-02 00:33 12,288 –a—— C:\WINDOWS\system32\vetntmsg.dll
2007-07-02 00:33 115,088 –a—— C:\WINDOWS\system32\drivers\vetfddnt.sys
2007-07-02 00:33 11,264 –a—— C:\WINDOWS\system32\SpOrder.dll
2007-07-02 00:32 d——– C:\WINDOWS\system32\ZoneLabs
2007-07-02 00:32 d——– C:\WINDOWS\Internet Logs
2007-06-27 01:02 d——– C:\Program Files\KONAMI
2007-06-26 18:29 d——– C:\Program Files\Hide My IP 2007
2007-06-26 01:43 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\pcgdemo
2007-06-26 01:40 d——– C:\Program Files\PC Guard for Win32 V5 DEMO
2007-06-26 01:32 d——– C:\Program Files\LICENCE PROTECTOR
2007-06-26 01:25 d——– C:\myLicenses
2007-06-26 01:15 d——– C:\Program Files\Info2000
2007-06-26 01:15 d——– C:\Program Files\Common Files\Info2000Libraries
2007-06-25 12:17 684 –a—— C:\WINDOWS\mozver.dat
2007-06-24 16:52 5,888 –a—— C:\WINDOWS\system32\drivers\imagedrv.sys
2007-06-24 16:52 127,488 –a—— C:\WINDOWS\system32\drivers\imagesrv.sys
2007-06-24 16:51 476,320 –a—— C:\WINDOWS\system32\ImagXpr7.dll
2007-06-24 16:51 471,040 –a—— C:\WINDOWS\system32\ImagXRA7.dll
2007-06-24 16:51 364,544 ——— C:\WINDOWS\system32\TwnLib4.dll
2007-06-24 16:51 262,144 –a—— C:\WINDOWS\system32\ImagXR7.dll
2007-06-24 16:51 155,648 –a—— C:\WINDOWS\system32\NeroCheck.exe
2007-06-24 16:51 106,496 –a—— C:\WINDOWS\system32\TwnLib20.dll
2007-06-24 16:51 1,568,768 –a—— C:\WINDOWS\system32\ImagX7.dll
2007-06-24 16:51 d——– C:\Program Files\Common Files\Ahead
2007-06-24 12:50 d——– C:\WINDOWS\network diagnostic
2007-06-24 12:28 d——– C:\DOCUME~1\Owner\Incomplete
2007-06-24 12:28 d——– C:\DOCUME~1\Owner\APPLIC~1\Google
2007-06-24 12:04 d——– C:\Program Files\Cucusoft
2007-06-24 11:17 221,184 –a—— C:\WINDOWS\system32\wmpns.dll
2007-06-24 11:17 d——– C:\WINDOWS\system32\LogFiles
2007-06-24 03:30 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
2007-06-24 00:09 d——– C:\DOCUME~1\Owner\APPLIC~1\LimeWire
2007-06-24 00:05 d——– C:\Program Files\LimeWire
2007-06-23 23:43 5,852 –ahs—- C:\WINDOWS\system32\KGyGaAvL.sys
2007-06-23 23:43 d——– C:\Program Files\Google
2007-06-23 23:42 d——– C:\Program Files\DivX
2007-06-23 23:35 d——– C:\Program Files\WinAVI Video Converter
2007-06-23 23:30 d——– C:\WINDOWS\system32\rbaembmn
2007-06-23 23:07 d——– C:\Program Files\SmartDVDCreatorPro
2007-06-23 20:38 d——– C:\Program Files\AviSynth 2.5
2007-06-23 20:37 d——– C:\Program Files\Avi2Dvd
2007-06-23 17:31 d——– C:\Program Files\Ahead
2007-06-22 23:51 d——– C:\Program Files\KGC Website
2007-06-22 23:48 d——– C:\Program Files\FTP Commander Pro
2007-06-22 23:19 d——– C:\Program Files\Easy Graphic Converter
2007-06-22 23:08 d——– C:\Program Files\Common Files\Adobe Systems Shared
2007-06-22 23:08 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Macrovision
2007-06-22 20:11 d–h—– C:\WINDOWS\$hf_mig$
2007-06-22 20:04 d——– C:\DOCUME~1\Owner\APPLIC~1\Ahead
2007-06-22 20:04 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ahead
2007-06-22 20:00 d——– C:\Program Files\Nero
2007-06-22 19:58 d——– C:\WINDOWS\RegisteredPackages
2007-06-21 21:50 d——– C:\DOCUME~1\Owner\APPLIC~1\dvdcss
2007-06-21 19:56 d——– C:\DOCUME~1\Owner\APPLIC~1\teamspeak2
2007-06-21 16:28 950,272 –a—— C:\WINDOWS\system32\INetFlashDll.dll
2007-06-21 16:28 40,960 –a—— C:\WINDOWS\system32\FlxGdFR.dll
2007-06-21 16:28 158,213 –a—— C:\WINDOWS\system32\MSCmCDE.dll
2007-06-21 16:28 141,312 –a—— C:\WINDOWS\system32\MSCmCFR.dll
2007-06-21 16:28 d——– C:\Program Files\SWF Viewer
2007-06-21 09:50 d——– C:\Program Files\Ares
2007-06-21 09:43 d——– C:\WINDOWS\system32\AGEIA
2007-06-21 09:43 d——– C:\Program Files\AGEIA Technologies
2007-06-20 18:56 271,224 –a—— C:\WINDOWS\system32\mucltui.dll
2007-06-20 17:26 d——– C:\DOCUME~1\Owner\APPLIC~1\vlc
2007-06-20 17:24 d——– C:\Program Files\VideoLAN
2007-06-20 17:21 d——– C:\Program Files\FlexHEX
2007-06-20 16:53 d-a—— C:\Program Files\Teamspeak2_RC2
2007-06-20 16:34 d——– C:\DOCUME~1\Owner\APPLIC~1\WinRAR
2007-06-20 16:13 d——– C:\DOCUME~1\Owner\APPLIC~1\ArcSoft
2007-06-20 15:13 0 –a—— C:\WINDOWS\nsreg.dat
2007-06-20 01:13 d–hs—- C:\System Volume Information
2007-06-20 01:12 21,504 –a—— C:\WINDOWS\system32\hidserv.dll
2007-06-20 01:11 9,600 –a—— C:\WINDOWS\system32\drivers\hidusb.sys
2007-06-20 01:11 82,944 –a—— C:\WINDOWS\system32\drivers\wdmaud.sys
2007-06-20 01:11 7,552 –a—— C:\WINDOWS\system32\drivers\mskssrv.sys
2007-06-20 01:11 60,800 –a—— C:\WINDOWS\system32\drivers\sysaudio.sys
2007-06-20 01:11 6,400 –a—— C:\WINDOWS\system32\drivers\splitter.sys
2007-06-20 01:11 54,272 –a—— C:\WINDOWS\system32\drivers\swmidi.sys
2007-06-20 01:11 52,864 –a—— C:\WINDOWS\system32\drivers\dmusic.sys
2007-06-20 01:11 5,376 –a—— C:\WINDOWS\system32\drivers\mspclock.sys
2007-06-20 01:11 4,992 –a—— C:\WINDOWS\system32\drivers\mspqm.sys
2007-06-20 01:11 31,616 –a—— C:\WINDOWS\system32\drivers\usbccgp.sys


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-06-27 05:02:53 ——– d–h–w C:\Program Files\InstallShield Installation Information
2007-06-24 18:53:03 ——– d—–w C:\DOCUME~1\Owner\APPLIC~1\VERITAS
2007-06-23 03:00:24 ——– d—–w C:\Program Files\Common Files\InstallShield
2007-06-20 03:29:59 ——– d—–w C:\Program Files\Messenger
2007-06-20 03:29:41 ——– d—–w C:\Program Files\Movie Maker
2007-06-20 03:27:45 ——– d—–w C:\Program Files\Windows NT
2007-06-20 02:31:35 ——– d—–w C:\Program Files\Common Files\Symantec Shared
2007-06-20 02:31:17 ——– d—–w C:\Program Files\Symantec
2007-06-20 02:24:34 ——– d–h–w C:\Program Files\WindowsUpdate
2007-06-20 02:16:29 ——– d—–w C:\Program Files\Arcsoft
2007-04-23 00:15:18 200,704 —-a-w C:\WINDOWS\system32\ssldivx.dll
2007-04-23 00:15:18 1,044,480 —-a-w C:\WINDOWS\system32\libdivx.dll
2007-04-17 02:45:54 1,710,936 —-a-w C:\WINDOWS\system32\wuaueng.dll
2007-04-17 02:45:28 92,504 —-a-w C:\WINDOWS\system32\cdm.dll
2007-04-17 02:45:20 53,080 —-a-w C:\WINDOWS\system32\wuauclt.exe
2007-04-17 02:43:44 203,096 —-a-w C:\WINDOWS\system32\wuweb.dll
2007-04-17 02:43:40 208,248 —-a-w C:\WINDOWS\system32\muweb.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

My computer seems to be running a bit better. Didnt have to restart after the scan this time and havent had any popups since. Can I assume the previous scan that froze my computer on restart cured it?


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx [2001-03-02 22:02]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 03:43]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="NvQTwk" []
"nwiz"="nwiz.exe" [2002-05-03 20:06 C:\WINDOWS\system32\nwiz.exe]
"CamMonitor"="c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe" [2002-06-18 02:11]
"KBD"="C:\HP\KBD\KBD.EXE" [2001-07-07 00:56]
"StorageGuard"="C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" [2002-05-09 11:01]
"DDCM"="C:\Program Files\WildTangent\DDC\DDCManager\DDCMan.exe" [2002-06-08 04:18]
"DDCActiveMenu"="C:\Program Files\WildTangent\DDC\ActiveMenu\DDCActiveMenu.exe" [2002-06-08 04:20]
"ATIPTA"="atiptaxx.exe" [2002-06-21 16:17 C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe]
"AlcxMonitor"="ALCXMNTR.EXE" [2004-09-07 13:47 C:\WINDOWS\ALCXMNTR.EXE]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 16:41]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-06-22 21:35]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]
"Zone Labs Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2006-05-31 17:52]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 03:56]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" []
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{7C24493F-3D23-4258-9426-42C5FC3B8211}"="C:\WINDOWS\system32\mljigec.dll" []


Contents of the 'Scheduled Tasks' folder
2002-07-27 03:33:50 C:\WINDOWS\tasks\Symantec NetDetect.job

**************************************************************************

catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-04 02:02:30
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

**************************************************************************

Completion time: 2007-07-04 2:03:54
C:\ComboFix-quarantined-files.txt … 2007-07-02 12:31
C:\ComboFix2.txt … 2007-07-02 22:29
C:\ComboFix3.txt … 2007-07-02 12:31

— E O F —
Post #19 last edited
My computer seems to be running a bit better. Didnt have to restart after the scan this time and havent had any popups since. Can I assume the previous scan that froze my computer on restart cured it?



ComboFix 07-06-18.2 - C:\Documents and Settings\Owner\Desktop\ComboFix.exe
"Owner" - 2007-07-04 1:58:47 - Service Pack 2 NTFS
Command switches used :: C:\Documents and Settings\Owner\Desktop\ComboFix-Do.txt


((((((((((((((((((((((((( Files Created from 2007-06-04 to 2007-07-04 )))))))))))))))))))))))))))))))


2007-07-03 15:07 d——– C:\setups
2007-07-03 15:01 d——– C:\Program Files\createinstall free
2007-07-03 02:27 61,952 –a—— C:\WINDOWS\system32\execryptorvb.dll
2007-07-03 02:27 d——– C:\Program Files\EXECryptor
2007-07-02 22:43 20,480 –a—— C:\WINDOWS\system32\H@tKeysH@@k.DLL
2007-07-02 21:44 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-07-02 20:44 d——– C:\Program Files\ERUNT BACKUP
2007-07-02 12:00 49,152 –a—— C:\WINDOWS\nircmd.exe
2007-07-02 01:42 d——– C:\WINDOWS\CAVTemp
2007-07-02 01:05 1,021,504 –a—— C:\WINDOWS\system32\vete.dll
2007-07-02 00:34 4,212 —h—– C:\WINDOWS\system32\zllictbl.dat
2007-07-02 00:33 77,824 –a—— C:\WINDOWS\system32\driverif.dll
2007-07-02 00:33 75,776 –a—— C:\WINDOWS\zllsputility.exe
2007-07-02 00:33 645,904 –a—— C:\WINDOWS\system32\drivers\vetmonnt.sys
2007-07-02 00:33 21,605 –a—— C:\WINDOWS\system32\drivers\vet-filt.sys
2007-07-02 00:33 15,668 –a—— C:\WINDOWS\system32\drivers\vet-rec.sys
2007-07-02 00:33 12,288 –a—— C:\WINDOWS\system32\vetntmsg.dll
2007-07-02 00:33 115,088 –a—— C:\WINDOWS\system32\drivers\vetfddnt.sys
2007-07-02 00:33 11,264 –a—— C:\WINDOWS\system32\SpOrder.dll
2007-07-02 00:32 d——– C:\WINDOWS\system32\ZoneLabs
2007-07-02 00:32 d——– C:\WINDOWS\Internet Logs
2007-06-27 01:02 d——– C:\Program Files\KONAMI
2007-06-26 18:29 d——– C:\Program Files\Hide My IP 2007
2007-06-26 01:43 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\pcgdemo
2007-06-26 01:40 d——– C:\Program Files\PC Guard for Win32 V5 DEMO
2007-06-26 01:32 d——– C:\Program Files\LICENCE PROTECTOR
2007-06-26 01:25 d——– C:\myLicenses
2007-06-26 01:15 d——– C:\Program Files\Info2000
2007-06-26 01:15 d——– C:\Program Files\Common Files\Info2000Libraries
2007-06-25 12:17 684 –a—— C:\WINDOWS\mozver.dat
2007-06-24 16:52 5,888 –a—— C:\WINDOWS\system32\drivers\imagedrv.sys
2007-06-24 16:52 127,488 –a—— C:\WINDOWS\system32\drivers\imagesrv.sys
2007-06-24 16:51 476,320 –a—— C:\WINDOWS\system32\ImagXpr7.dll
2007-06-24 16:51 471,040 –a—— C:\WINDOWS\system32\ImagXRA7.dll
2007-06-24 16:51 364,544 ——— C:\WINDOWS\system32\TwnLib4.dll
2007-06-24 16:51 262,144 –a—— C:\WINDOWS\system32\ImagXR7.dll
2007-06-24 16:51 155,648 –a—— C:\WINDOWS\system32\NeroCheck.exe
2007-06-24 16:51 106,496 –a—— C:\WINDOWS\system32\TwnLib20.dll
2007-06-24 16:51 1,568,768 –a—— C:\WINDOWS\system32\ImagX7.dll
2007-06-24 16:51 d——– C:\Program Files\Common Files\Ahead
2007-06-24 12:50 d——– C:\WINDOWS\network diagnostic
2007-06-24 12:28 d——– C:\DOCUME~1\Owner\Incomplete
2007-06-24 12:28 d——– C:\DOCUME~1\Owner\APPLIC~1\Google
2007-06-24 12:04 d——– C:\Program Files\Cucusoft
2007-06-24 11:17 221,184 –a—— C:\WINDOWS\system32\wmpns.dll
2007-06-24 11:17 d——– C:\WINDOWS\system32\LogFiles
2007-06-24 03:30 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
2007-06-24 00:09 d——– C:\DOCUME~1\Owner\APPLIC~1\LimeWire
2007-06-24 00:05 d——– C:\Program Files\LimeWire
2007-06-23 23:43 5,852 –ahs—- C:\WINDOWS\system32\KGyGaAvL.sys
2007-06-23 23:43 d——– C:\Program Files\Google
2007-06-23 23:42 d——– C:\Program Files\DivX
2007-06-23 23:35 d——– C:\Program Files\WinAVI Video Converter
2007-06-23 23:30 d——– C:\WINDOWS\system32\rbaembmn
2007-06-23 23:07 d——– C:\Program Files\SmartDVDCreatorPro
2007-06-23 20:38 d——– C:\Program Files\AviSynth 2.5
2007-06-23 20:37 d——– C:\Program Files\Avi2Dvd
2007-06-23 17:31 d——– C:\Program Files\Ahead
2007-06-22 23:51 d——– C:\Program Files\KGC Website
2007-06-22 23:48 d——– C:\Program Files\FTP Commander Pro
2007-06-22 23:19 d——– C:\Program Files\Easy Graphic Converter
2007-06-22 23:08 d——– C:\Program Files\Common Files\Adobe Systems Shared
2007-06-22 23:08 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Macrovision
2007-06-22 20:11 d–h—– C:\WINDOWS\$hf_mig$
2007-06-22 20:04 d——– C:\DOCUME~1\Owner\APPLIC~1\Ahead
2007-06-22 20:04 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ahead
2007-06-22 20:00 d——– C:\Program Files\Nero
2007-06-22 19:58 d——– C:\WINDOWS\RegisteredPackages
2007-06-21 21:50 d——– C:\DOCUME~1\Owner\APPLIC~1\dvdcss
2007-06-21 19:56 d——– C:\DOCUME~1\Owner\APPLIC~1\teamspeak2
2007-06-21 16:28 950,272 –a—— C:\WINDOWS\system32\INetFlashDll.dll
2007-06-21 16:28 40,960 –a—— C:\WINDOWS\system32\FlxGdFR.dll
2007-06-21 16:28 158,213 –a—— C:\WINDOWS\system32\MSCmCDE.dll
2007-06-21 16:28 141,312 –a—— C:\WINDOWS\system32\MSCmCFR.dll
2007-06-21 16:28 d——– C:\Program Files\SWF Viewer
2007-06-21 09:50 d——– C:\Program Files\Ares
2007-06-21 09:43 d——– C:\WINDOWS\system32\AGEIA
2007-06-21 09:43 d——– C:\Program Files\AGEIA Technologies
2007-06-20 18:56 271,224 –a—— C:\WINDOWS\system32\mucltui.dll
2007-06-20 17:26 d——– C:\DOCUME~1\Owner\APPLIC~1\vlc
2007-06-20 17:24 d——– C:\Program Files\VideoLAN
2007-06-20 17:21 d——– C:\Program Files\FlexHEX
2007-06-20 16:53 d-a—— C:\Program Files\Teamspeak2_RC2
2007-06-20 16:34 d——– C:\DOCUME~1\Owner\APPLIC~1\WinRAR
2007-06-20 16:13 d——– C:\DOCUME~1\Owner\APPLIC~1\ArcSoft
2007-06-20 15:13 0 –a—— C:\WINDOWS\nsreg.dat
2007-06-20 01:13 d–hs—- C:\System Volume Information
2007-06-20 01:12 21,504 –a—— C:\WINDOWS\system32\hidserv.dll
2007-06-20 01:11 9,600 –a—— C:\WINDOWS\system32\drivers\hidusb.sys
2007-06-20 01:11 82,944 –a—— C:\WINDOWS\system32\drivers\wdmaud.sys
2007-06-20 01:11 7,552 –a—— C:\WINDOWS\system32\drivers\mskssrv.sys
2007-06-20 01:11 60,800 –a—— C:\WINDOWS\system32\drivers\sysaudio.sys
2007-06-20 01:11 6,400 –a—— C:\WINDOWS\system32\drivers\splitter.sys
2007-06-20 01:11 54,272 –a—— C:\WINDOWS\system32\drivers\swmidi.sys
2007-06-20 01:11 52,864 –a—— C:\WINDOWS\system32\drivers\dmusic.sys
2007-06-20 01:11 5,376 –a—— C:\WINDOWS\system32\drivers\mspclock.sys
2007-06-20 01:11 4,992 –a—— C:\WINDOWS\system32\drivers\mspqm.sys
2007-06-20 01:11 31,616 –a—— C:\WINDOWS\system32\drivers\usbccgp.sys


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-06-27 05:02:53 ——– d–h–w C:\Program Files\InstallShield Installation Information
2007-06-24 18:53:03 ——– d—–w C:\DOCUME~1\Owner\APPLIC~1\VERITAS
2007-06-23 03:00:24 ——– d—–w C:\Program Files\Common Files\InstallShield
2007-06-20 03:29:59 ——– d—–w C:\Program Files\Messenger
2007-06-20 03:29:41 ——– d—–w C:\Program Files\Movie Maker
2007-06-20 03:27:45 ——– d—–w C:\Program Files\Windows NT
2007-06-20 02:31:35 ——– d—–w C:\Program Files\Common Files\Symantec Shared
2007-06-20 02:31:17 ——– d—–w C:\Program Files\Symantec
2007-06-20 02:24:34 ——– d–h–w C:\Program Files\WindowsUpdate
2007-06-20 02:16:29 ——– d—–w C:\Program Files\Arcsoft
2007-04-23 00:15:18 200,704 —-a-w C:\WINDOWS\system32\ssldivx.dll
2007-04-23 00:15:18 1,044,480 —-a-w C:\WINDOWS\system32\libdivx.dll
2007-04-17 02:45:54 1,710,936 —-a-w C:\WINDOWS\system32\wuaueng.dll
2007-04-17 02:45:28 92,504 —-a-w C:\WINDOWS\system32\cdm.dll
2007-04-17 02:45:20 53,080 —-a-w C:\WINDOWS\system32\wuauclt.exe
2007-04-17 02:43:44 203,096 —-a-w C:\WINDOWS\system32\wuweb.dll
2007-04-17 02:43:40 208,248 —-a-w C:\WINDOWS\system32\muweb.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx [2001-03-02 22:02]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 03:43]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="NvQTwk" []
"nwiz"="nwiz.exe" [2002-05-03 20:06 C:\WINDOWS\system32\nwiz.exe]
"CamMonitor"="c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe" [2002-06-18 02:11]
"KBD"="C:\HP\KBD\KBD.EXE" [2001-07-07 00:56]
"StorageGuard"="C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" [2002-05-09 11:01]
"DDCM"="C:\Program Files\WildTangent\DDC\DDCManager\DDCMan.exe" [2002-06-08 04:18]
"DDCActiveMenu"="C:\Program Files\WildTangent\DDC\ActiveMenu\DDCActiveMenu.exe" [2002-06-08 04:20]
"ATIPTA"="atiptaxx.exe" [2002-06-21 16:17 C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe]
"AlcxMonitor"="ALCXMNTR.EXE" [2004-09-07 13:47 C:\WINDOWS\ALCXMNTR.EXE]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 16:41]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-06-22 21:35]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]
"Zone Labs Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2006-05-31 17:52]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 03:56]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" []
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{7C24493F-3D23-4258-9426-42C5FC3B8211}"="C:\WINDOWS\system32\mljigec.dll" []


Contents of the 'Scheduled Tasks' folder
2002-07-27 03:33:50 C:\WINDOWS\tasks\Symantec NetDetect.job

**************************************************************************

catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-04 02:02:30
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

**************************************************************************

Completion time: 2007-07-04 2:03:54
C:\ComboFix-quarantined-files.txt … 2007-07-02 12:31
C:\ComboFix2.txt … 2007-07-02 22:29
C:\ComboFix3.txt … 2007-07-02 12:31

— E O F —
Post #21
Logfile of HijackThis v1.99.1
Scan saved at 8:12:09 AM, on 7/4/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\WildTangent\DDC\DDCManager\DDCMan.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Xfire\xfire.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ares\Ares.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis\Spyware.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us6.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://us6.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us6.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O3 - Toolbar: hp toolkit - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\HP\EXPLOREBAR\HPTOOLKT.DLL
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [DDCM] "C:\Program Files\WildTangent\DDC\DDCManager\DDCMan.exe" -Background
O4 - HKLM\..\Run: [DDCActiveMenu] "C:\Program Files\WildTangent\DDC\ActiveMenu\DDCActiveMenu.exe" -boot
O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Kuma_Tray.lnk = C:\Program Files\Kuma Games\kgsystray\Kuma_tray.exe
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1182306321608
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1182306315186
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\system32\ZoneLabs\isafe.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Post #22
You can remove any programs / Tools I had you install. Use Add/Remove Programs to remove if listed there otherwise just delete them and empty recycle bin.

Log looks good :D


You need to create a new Clean restore point.

Note: This will remove all previous Restore Points

Turn off System Restore:

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

Restart your computer, turn it back on.

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Remove the Check Turn off System Restore.
Click Apply, and then click OK.

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Check "Hide file extensions for known file types."
Under the "Hidden files" folder, Uncheck "Show hidden files and folders."
Check "Hide protected operating system files."
Click Apply, and then click OK.



If you dont have any programs like these, I would recommend that you get them.
Spywareblaster,
Spywareguard.


Also get a FREE FIREWALL and FREE ANTI VIRUS if you need one.

Only run one Anti-Virus and Firewall program.

It is critical to have both a firewall and anti virus to protect your system.

Keep your system up to date and run Adaware & Spybot, once a week works, and hopefully you will be ok from here on. Both are available below.

Do not use Ad-aware if you have McAfee's VirusScan and AntiSpyware


Safe Surfing. :D

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein
Post #25
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI