What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved]Please Help - Hijackthis Log

7 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Thanks for taking the time to help me!

Stu


Logfile of HijackThis v1.99.1
Scan saved at 2:20:43 PM, on 7/8/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Support.com\bin\tgcmd.exe
C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe
C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\system32\yvhfkdiu.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
C:\WINDOWS\explorer.exe
C:\Program Files\HijackThis\HijackThis.exe

O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\Support.com\bin\tgcmd.exe" /server /startmonitor /deaf
O4 - HKLM\..\Run: [WinPatrol] C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe
O4 - HKLM\..\Run: [cctray] "C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {01010200-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Installer) - http://echat.qwest.supportsoft.com/sdccomm…ad/tgctlins.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{6BBABAA6-3D40-46B7-B0A8-7C28172A287C}: NameServer = 205.171.3.65,205.171.2.65
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: CaCCProvSP - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: DomainService - - C:\WINDOWS\system32\yvhfkdiu.exe
O23 - Service: VET Message Service (VETMSGNT) - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
Post #2
Hello egnal and welcome to the TomCoyote Forums

My name is Trevuren and I will be helping you with your problem.


Please download this file - combofix.exe by sUBs
  • Double click combofix.exe & follow the prompts.
  • When finished, it will produce a log. Please save that log to post in your next reply along with a fresh HJT log.
Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

Regards,

Trevuren
Post #3
Here is the file i believe to be the combofix log file - errdbg.cf

FINDSTR: Line 2662 is too long.
FINDSTR: Line 2673 is too long.
FINDSTR: Line 3508 is too long.
FINDSTR: Line 6664 is too long.
FINDSTR: Line 6691 is too long.
FINDSTR: Line 6718 is too long.

SteelWerX Registry Console Tool 2.0
Written by Bobbi Flekman 2006 ©

Error: Key: software\winpcap does not exist!

SteelWerX Extended Configuration Access Control Lists
Written by Bobbi Flekman 2006 ©

File/Folder: C:\WINDOWS\system32\windev-peers.ini does not exist

C:\Program Files\poolsv\k11u72.exe
C:\Program Files\poolsv\svhost.exe
C:\Program Files\poolsv\WinAntiSpyware2007FreeInstall.exe
C:\Program Files\poolsv\YazzleBundle-1549.exe
C:\tempb9\tmpTF.log
C:\temp\iee\tmpZTF.log
C:\WINDOWS\system32\o09PrEz\o09PrEz1099.exe
"C:\DOCUME~1\Owner\Desktop.\internet explorer.lnk"
"C:\WINDOWS\svhost.exe"
"C:\DOCUME~1\Owner\Desktop.\Install WinAntiSpyware 2007 .lnk"
"C:\Program Files\poolsv"
"C:\Program Files\svhost"
"C:\WINDOWS\system32\win"
"C:\tempb9"
"C:\temp\iee"
"C:\WINDOWS\system32\o09PrEz"
C:\WINDOWS\system32\jkklj.dll
C:\WINDOWS\system32\vturrsp.dll
Could Not Find C:\ComboFix\d-del2b.cf
/\cv@
SteelWerX Service Controller 2.0
Written by Bobbi Flekman © 2006

System Error. Code: 1060.
The specified service does not exist as an installed service

1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
"C:\Program Files\poolsv\k11u72.exe"
"C:\Program Files\poolsv\svhost.exe"
"C:\Program Files\poolsv\WinAntiSpyware2007FreeInstall.exe"
"C:\Program Files\poolsv\YazzleBundle-1549.exe"
"C:\tempb9\tmpTF.log"
"C:\temp\iee\tmpZTF.log"
"C:\WINDOWS\system32\o09PrEz\o09PrEz1099.exe"
"C:\DOCUME~1\Owner\Desktop.\internet explorer.lnk"
"C:\WINDOWS\svhost.exe"
"C:\DOCUME~1\Owner\Desktop.\Install WinAntiSpyware 2007 .lnk"
"C:\Program Files\poolsv"
"C:\Program Files\svhost"
"C:\WINDOWS\system32\win"
"C:\tempb9"
"C:\temp\iee"
"C:\WINDOWS\system32\o09PrEz"
C:\qoobox\Quarantine
C:\qoobox\Quarantine\C
C:\qoobox\Quarantine\catchme.log
C:\qoobox\Quarantine\Registry_backups
C:\qoobox\Quarantine\C\DOCUME~1
C:\qoobox\Quarantine\C\Program Files
C:\qoobox\Quarantine\C\Temp
C:\qoobox\Quarantine\C\WINDOWS
C:\qoobox\Quarantine\C\DOCUME~1\Owner
C:\qoobox\Quarantine\C\DOCUME~1\Owner\Desktop
C:\qoobox\Quarantine\C\DOCUME~1\Owner\Desktop\Install WinAntiSpyware 2007 .lnk.vir
C:\qoobox\Quarantine\C\DOCUME~1\Owner\Desktop\Internet Explorer.lnk.vir
C:\qoobox\Quarantine\C\Program Files\poolsv
C:\qoobox\Quarantine\C\Program Files\poolsv\k11u72.exe.vir
C:\qoobox\Quarantine\C\Program Files\poolsv\svhost.exe.vir
C:\qoobox\Quarantine\C\Program Files\poolsv\WinAntiSpyware2007FreeInstall.exe.vir
C:\qoobox\Quarantine\C\Program Files\poolsv\YazzleBundle-1549.exe.vir
C:\qoobox\Quarantine\C\Tempb9
C:\qoobox\Quarantine\C\Temp\iee
C:\qoobox\Quarantine\C\Tempb9\tmpTF.log.vir
C:\qoobox\Quarantine\C\Temp\iee\tmpZTF.log.vir
C:\qoobox\Quarantine\C\WINDOWS\svhost.exe.vir
C:\qoobox\Quarantine\C\WINDOWS\system32
C:\qoobox\Quarantine\C\WINDOWS\system32\aeffnmyq.dll.vir
C:\qoobox\Quarantine\C\WINDOWS\system32\apmkrccd.dll.vir
C:\qoobox\Quarantine\C\WINDOWS\system32\bumitmbp.dll.vir
C:\qoobox\Quarantine\C\WINDOWS\system32\cbyqnccy.dll.vir
C:\qoobox\Quarantine\C\WINDOWS\system32\cdagbsqj.dll.vir
C:\qoobox\Quarantine\C\WINDOWS\system32\cdvwxnbi.exe.vir
C:\qoobox\Quarantine\C\WINDOWS\system32\dswewmfk.dll.vir
C:\qoobox\Quarantine\C\WINDOWS\system32\gvnjndml.dll.vir
C:\qoobox\Quarantine\C\WINDOWS\system32\hlqguakd.dll.vir
C:\qoobox\Quarantine\C\WINDOWS\system32\ifiavjum.dll.vir
C:\qoobox\Quarantine\C\WINDOWS\system32\jkklj.dll.vir
C:\qoobox\Quarantine\C\WINDOWS\system32\jlkkj.bak1.vir
C:\qoobox\Quarantine\C\WINDOWS\system32\jlkkj.bak2.vir
C:\qoobox\Quarantine\C\WINDOWS\system32\jlkkj.ini.vir
C:\qoobox\Quarantine\C\WINDOWS\system32\jlkkj.ini2.vir
C:\qoobox\Quarantine\C\WINDOWS\system32\jlkkj.tmp.vir
C:\qoobox\Quarantine\C\WINDOWS\system32\jmbdywfb.dll.vir
C:\qoobox\Quarantine\C\WINDOWS\system32\jmouckce.dll.vir
C:\qoobox\Quarantine\C\WINDOWS\system32\klwweujb.dll.vir
C:\qoobox\Quarantine\C\WINDOWS\system32\kqiojcpm.dll.vir
C:\qoobox\Quarantine\C\WINDOWS\system32\lgiiwjlk.dll.vir
C:\qoobox\Quarantine\C\WINDOWS\system32\ljukwlhp.dll.vir
C:\qoobox\Quarantine\C\WINDOWS\system32\mhfuosxd.dll.vir
C:\qoobox\Quarantine\C\WINDOWS\system32\nftoeibf.dll.vir
C:\qoobox\Quarantine\C\WINDOWS\system32\nglnkvco.exe.vir
C:\qoobox\Quarantine\C\WINDOWS\system32\nwqexsir.dll.vir
C:\qoobox\Quarantine\C\WINDOWS\system32\o09PrEz
C:\qoobox\Quarantine\C\WINDOWS\system32\odmcpskp.dll.vir
C:\qoobox\Quarantine\C\WINDOWS\system32\owklssdf.dll.vir
C:\qoobox\Quarantine\C\WINDOWS\system32\prqaayor.dll.vir
C:\qoobox\Quarantine\C\WINDOWS\system32\prtgemnm.dll.vir
C:\qoobox\Quarantine\C\WINDOWS\system32\rxlusmtx.dll.vir
C:\qoobox\Quarantine\C\WINDOWS\system32\sggofkxm.dll.vir
C:\qoobox\Quarantine\C\WINDOWS\system32\spdtmgxm.dll.vir
C:\qoobox\Quarantine\C\WINDOWS\system32\suqulfyn.dll.vir
C:\qoobox\Quarantine\C\WINDOWS\system32\tanffdiq.dll.vir
C:\qoobox\Quarantine\C\WINDOWS\system32\tcqbfipn.dll.vir
C:\qoobox\Quarantine\C\WINDOWS\system32\tvtvvuhy.dll.vir
C:\qoobox\Quarantine\C\WINDOWS\system32\uglhokpv.dll.vir
C:\qoobox\Quarantine\C\WINDOWS\system32\vecrgscr.dll.vir
C:\qoobox\Quarantine\C\WINDOWS\system32\vobgdiok.dll.vir
C:\qoobox\Quarantine\C\WINDOWS\system32\vturrsp.dll.vir
C:\qoobox\Quarantine\C\WINDOWS\system32\wovaqanf.dll.vir
C:\qoobox\Quarantine\C\WINDOWS\system32\wwgjuthm.dll.vir
C:\qoobox\Quarantine\C\WINDOWS\system32\xrlolrtq.dll.vir
C:\qoobox\Quarantine\C\WINDOWS\system32\yeheuvxc.dll.vir
C:\qoobox\Quarantine\C\WINDOWS\system32\ysqrnies.dll.vir
C:\qoobox\Quarantine\C\WINDOWS\system32\yvvmlewq.dll.vir
C:\qoobox\Quarantine\C\WINDOWS\system32\o09PrEz\o09PrEz1099.exe.vir
C:\qoobox\Quarantine\Registry_backups\LEGACY_DOMAINSERVICE.reg.cf
C:\qoobox\Quarantine\Registry_backups\services_DomainService.reg.cf
The system cannot find the file specified.
File Not Found
C:\DOCUME~1\LOCALS~1\LOCALS~1\TEMPOR~1\Content.IE5\index.dat - The process cannot access the file because it is being used by another process.
C:\DOCUME~1\NETWOR~1\LOCALS~1\TEMPOR~1\Content.IE5\index.dat - The process cannot access the file because it is being used by another process.
C:\DOCUME~1\Owner\LOCALS~1\TEMPOR~1\Content.IE5\index.dat - The process cannot access the file because it is being used by another process.


Here is the new hijackthis log file -

Logfile of HijackThis v1.99.1
Scan saved at 5:20:10 PM, on 7/8/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Support.com\bin\tgcmd.exe
C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe
C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\Mozilla Firefox\firefox.exe
C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\HijackThis\HijackThis.exe

O2 - BHO: (no name) - {FD62605B-D456-42D7-A37C-B55B38EC1103} - C:\WINDOWS\system32\jkhhh.dll (file missing)
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\Support.com\bin\tgcmd.exe" /server /startmonitor /deaf
O4 - HKLM\..\Run: [WinPatrol] C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe
O4 - HKLM\..\Run: [cctray] "C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {01010200-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Installer) - http://echat.qwest.supportsoft.com/sdccomm…ad/tgctlins.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{6BBABAA6-3D40-46B7-B0A8-7C28172A287C}: NameServer = 205.171.3.65,205.171.2.65
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: efcdbyy - efcdbyy.dll (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: jkhhh - C:\WINDOWS\system32\jkhhh.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: CaCCProvSP - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: VET Message Service (VETMSGNT) - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe


thanks for your help

stu
Post #4
Unfortunately that is not the ComboFix log in question. When let run, the toll will cause a Notepad window to popup after several long minutes. This text file contains the ComboFix.txt log. You have to copy/paste that text into your reply. Inasmuch as that window is now closed, the log can be found here also C:\ComboFix.txt. Please copy/paste the content of that report into your reply. If that file does not exist, please run the tool again and stay at your machine without touching either the mouse or the keypad and post the log that should appear on your screen. This report is very important. Trevuren
Post #5
"Owner" - 2007-07-08 17:31:15 - ComboFix 07-07-09.5 - Service Pack 2


((((((((((((((((((((((((( Files Created from 2007-06-08 to 2007-07-08 )))))))))))))))))))))))))))))))


2007-07-08 16:57 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-07-08 14:36 50,708 –a—— C:\WINDOWS\system32\fpwboylq.exe
2007-07-08 14:30 50,708 –a—— C:\WINDOWS\system32\hwiftmtt.exe
2007-07-08 14:18 50,708 –a—— C:\WINDOWS\system32\rmrpbkej.exe
2007-07-08 14:10 164 –a—— C:\install.dat
2007-07-08 14:05 50,708 –a—— C:\WINDOWS\system32\jncrkxpa.exe
2007-07-08 12:17 50,708 –a—— C:\WINDOWS\system32\pvvwqaiw.exe
2007-07-08 12:03 50,708 –a—— C:\WINDOWS\system32\oaakprpl.exe
2007-07-08 11:20 50,708 –a—— C:\WINDOWS\system32\tnvnukbv.exe
2007-07-08 07:33 50,708 –a—— C:\WINDOWS\system32\bcwgyiwc.exe
2007-07-08 07:30 50,708 –a—— C:\WINDOWS\system32\segbydlm.exe
2007-07-08 07:22 50,708 –a—— C:\WINDOWS\system32\liuqcmoc.exe
2007-07-08 07:11 50,708 –a—— C:\WINDOWS\system32\xnamgnov.exe
2007-07-07 23:44 50,708 –a—— C:\WINDOWS\system32\snmdxwky.exe
2007-07-07 23:13 50,708 –a—— C:\WINDOWS\system32\nivevwei.exe
2007-07-07 22:59 50,708 –a—— C:\WINDOWS\system32\jrclmrup.exe
2007-07-07 19:42 50,708 –a—— C:\WINDOWS\system32\evxwjvvl.exe
2007-07-07 18:41 50,708 –a—— C:\WINDOWS\system32\bxjadcfa.exe
2007-07-07 18:19 d——– C:\WINDOWS\network diagnostic
2007-07-07 18:13 50,708 –a—— C:\WINDOWS\system32\eeohujem.exe
2007-07-07 08:20 50,708 –a—— C:\WINDOWS\system32\rqgjspkt.exe
2007-07-06 08:20 50,708 –a—— C:\WINDOWS\system32\yvhfkdiu.exe
2007-07-05 08:44 630,200 –a—— C:\WINDOWS\system32\drivers\vetefile.sys
2007-07-05 08:44 108,392 –a—— C:\WINDOWS\system32\drivers\veteboot.sys
2007-07-02 13:41 524,288 –a—— C:\WINDOWS\system32\DivXsm.exe
2007-07-02 13:41 3,596,288 –a—— C:\WINDOWS\system32\qt-dx331.dll
2007-07-02 13:41 200,704 –a—— C:\WINDOWS\system32\ssldivx.dll
2007-07-02 13:41 1,044,480 –a—— C:\WINDOWS\system32\libdivx.dll
2007-07-02 13:37 823,296 –a—— C:\WINDOWS\system32\divx_xx0c.dll
2007-07-02 13:37 823,296 –a—— C:\WINDOWS\system32\divx_xx07.dll
2007-07-02 13:37 802,816 –a—— C:\WINDOWS\system32\divx_xx11.dll
2007-07-02 13:37 740,442 –a—— C:\WINDOWS\system32\DivX.dll
2007-07-02 13:37 73,728 –a—— C:\WINDOWS\system32\dpl100.dll
2007-07-02 13:37 593,920 –a—— C:\WINDOWS\system32\dpuGUI11.dll
2007-07-02 13:37 57,344 –a—— C:\WINDOWS\system32\dpv11.dll
2007-07-02 13:37 53,248 –a—— C:\WINDOWS\system32\dpuGUI10.dll
2007-07-02 13:37 344,064 –a—— C:\WINDOWS\system32\dpus11.dll
2007-07-02 13:37 294,912 –a—— C:\WINDOWS\system32\dpu11.dll
2007-07-02 13:37 294,912 –a—— C:\WINDOWS\system32\dpu10.dll
2007-07-02 13:37 196,608 –a—— C:\WINDOWS\system32\dtu100.dll
2007-07-02 13:36 124,472 –a—— C:\WINDOWS\system32\DivXCodecUpdateChecker.exe
2007-07-02 13:36 12,288 –a—— C:\WINDOWS\system32\DivXWMPExtType.dll
2007-07-01 20:54 2,240 –a—— C:\WINDOWS\system32\tmp.reg


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-08 01:13:23 ——– d—–w C:\Program Files\DivX
2007-06-02 01:36:18 ——– d—–w C:\Program Files\Enercalc
2007-06-01 02:49:20 1,574,739 –sha-w C:\WINDOWS\system32\hhhkj.bak2
2007-05-31 02:48:50 1,588,682 –sha-w C:\WINDOWS\system32\hhhkj.bak1
2007-05-27 03:15:06 ——– d—–w C:\Program Files\AxBx
2007-05-22 01:31:08 ——– d—–r C:\Program Files\Support.com
2007-05-16 15:12:02 683,520 —-a-w C:\WINDOWS\system32\inetcomm.dll
2007-05-15 17:18:37 99,904 —-a-w C:\WINDOWS\system32\isafeif.dll
2007-05-15 17:18:37 79,424 —-a-w C:\WINDOWS\system32\vetredir.dll
2007-05-15 17:18:37 75,280 —-a-w C:\WINDOWS\system32\isafprod.dll
2007-05-15 17:18:37 32,528 —-a-w C:\WINDOWS\system32\drivers\vetmonnt.sys
2007-05-15 17:18:37 26,640 —-a-w C:\WINDOWS\system32\drivers\vet-filt.sys
2007-05-15 17:18:37 21,648 —-a-w C:\WINDOWS\system32\drivers\vetfddnt.sys
2007-05-15 17:18:37 21,392 —-a-w C:\WINDOWS\system32\drivers\vet-rec.sys
2007-04-25 14:21:15 144,896 —-a-w C:\WINDOWS\system32\schannel.dll
2007-04-18 16:12:23 2,854,400 —-a-w C:\WINDOWS\system32\msi.dll
2007-04-17 04:47:36 33,624 —-a-w C:\WINDOWS\system32\wups.dll
2007-04-17 04:45:54 1,710,936 —-a-w C:\WINDOWS\system32\wuaueng.dll
2007-04-17 04:45:48 549,720 —-a-w C:\WINDOWS\system32\wuapi.dll
2007-04-17 04:45:42 325,976 —-a-w C:\WINDOWS\system32\wucltui.dll
2007-04-17 04:45:36 203,096 —-a-w C:\WINDOWS\system32\wuweb.dll
2007-04-17 04:45:28 92,504 —-a-w C:\WINDOWS\system32\cdm.dll
2007-04-17 04:45:20 53,080 —-a-w C:\WINDOWS\system32\wuauclt.exe
2007-04-17 04:45:20 43,352 —-a-w C:\WINDOWS\system32\wups2.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FD62605B-D456-42D7-A37C-B55B38EC1103}]
C:\WINDOWS\system32\jkhhh.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"tgcmd"="C:\Program Files\Support.com\bin\tgcmd.exe" [2005-11-18 23:33]
"WinPatrol"="C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe" [2005-12-12 23:18]
"cctray"="C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe" [2007-06-14 11:14]
"CAVRID"="C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe" [2007-05-15 11:18]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2006-11-11 17:18]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:00]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"DefaultP17MIDI"=MidiDef.Exe
"DefaultP17"=P17Def.Exe

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Spyware Doctor"="C:\Program Files\Spyware Doctor\swdoctor.exe" /Q

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\efcdbyy]
efcdbyy.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\jkhhh]
C:\WINDOWS\system32\jkhhh.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL

*Newly Created Service* - CATCHME

**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-08 17:33:01
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-08 17:34:06
C:\ComboFix-quarantined-files.txt … 2007-07-08 17:34

— E O F —
Post #6
A. Please download VundoFix.exe to your desktop.
  • Double-click VundoFix.exe to run it.
  • Click the Scan for Vundo button.
  • Once it's done scanning, click the Remove Vundo button.
  • You will receive a prompt asking if you want to remove the files, click YES
  • Once you click yes, your desktop will go blank as it starts removing Vundo.
  • When completed, it will prompt that it will reboot your computer, click OK.
  • Please post the contents of C:\vundofix.txt and a new HiJackThis log.
Note: It is possible that VundoFix encountered a file it could not remove.
In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot.

B. Please run ComboFix again AFTER you have run VundoFix and produce the new log.


C. Reports/logs to post:
  • Vundofix.txt
  • ComboFix.txt
  • A new HijackThis.log

Trevuren
Post #7
VundoFix V6.5.4

Checking Java version…

Java version is 1.4.2.3
Old versions of java are exploitable and should be removed.

Scan started at 6:00:01 PM 7/8/2007

Listing files found while scanning….

C:\WINDOWS\system32\hhhkj.bak1
C:\WINDOWS\system32\hhhkj.bak2
C:\WINDOWS\system32\hhhkj.ini
C:\WINDOWS\system32\jkhhh.dll

Beginning removal…

Attempting to delete C:\WINDOWS\system32\hhhkj.bak1
C:\WINDOWS\system32\hhhkj.bak1 Has been deleted!

Attempting to delete C:\WINDOWS\system32\hhhkj.bak2
C:\WINDOWS\system32\hhhkj.bak2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\hhhkj.ini
C:\WINDOWS\system32\hhhkj.ini Has been deleted!

Performing Repairs to the registry.
Done!


"Owner" - 2007-07-08 17:31:15 - ComboFix 07-07-09.5 - Service Pack 2


((((((((((((((((((((((((( Files Created from 2007-06-08 to 2007-07-08 )))))))))))))))))))))))))))))))


2007-07-08 16:57 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-07-08 14:36 50,708 –a—— C:\WINDOWS\system32\fpwboylq.exe
2007-07-08 14:30 50,708 –a—— C:\WINDOWS\system32\hwiftmtt.exe
2007-07-08 14:18 50,708 –a—— C:\WINDOWS\system32\rmrpbkej.exe
2007-07-08 14:10 164 –a—— C:\install.dat
2007-07-08 14:05 50,708 –a—— C:\WINDOWS\system32\jncrkxpa.exe
2007-07-08 12:17 50,708 –a—— C:\WINDOWS\system32\pvvwqaiw.exe
2007-07-08 12:03 50,708 –a—— C:\WINDOWS\system32\oaakprpl.exe
2007-07-08 11:20 50,708 –a—— C:\WINDOWS\system32\tnvnukbv.exe
2007-07-08 07:33 50,708 –a—— C:\WINDOWS\system32\bcwgyiwc.exe
2007-07-08 07:30 50,708 –a—— C:\WINDOWS\system32\segbydlm.exe
2007-07-08 07:22 50,708 –a—— C:\WINDOWS\system32\liuqcmoc.exe
2007-07-08 07:11 50,708 –a—— C:\WINDOWS\system32\xnamgnov.exe
2007-07-07 23:44 50,708 –a—— C:\WINDOWS\system32\snmdxwky.exe
2007-07-07 23:13 50,708 –a—— C:\WINDOWS\system32\nivevwei.exe
2007-07-07 22:59 50,708 –a—— C:\WINDOWS\system32\jrclmrup.exe
2007-07-07 19:42 50,708 –a—— C:\WINDOWS\system32\evxwjvvl.exe
2007-07-07 18:41 50,708 –a—— C:\WINDOWS\system32\bxjadcfa.exe
2007-07-07 18:19 d——– C:\WINDOWS\network diagnostic
2007-07-07 18:13 50,708 –a—— C:\WINDOWS\system32\eeohujem.exe
2007-07-07 08:20 50,708 –a—— C:\WINDOWS\system32\rqgjspkt.exe
2007-07-06 08:20 50,708 –a—— C:\WINDOWS\system32\yvhfkdiu.exe
2007-07-05 08:44 630,200 –a—— C:\WINDOWS\system32\drivers\vetefile.sys
2007-07-05 08:44 108,392 –a—— C:\WINDOWS\system32\drivers\veteboot.sys
2007-07-02 13:41 524,288 –a—— C:\WINDOWS\system32\DivXsm.exe
2007-07-02 13:41 3,596,288 –a—— C:\WINDOWS\system32\qt-dx331.dll
2007-07-02 13:41 200,704 –a—— C:\WINDOWS\system32\ssldivx.dll
2007-07-02 13:41 1,044,480 –a—— C:\WINDOWS\system32\libdivx.dll
2007-07-02 13:37 823,296 –a—— C:\WINDOWS\system32\divx_xx0c.dll
2007-07-02 13:37 823,296 –a—— C:\WINDOWS\system32\divx_xx07.dll
2007-07-02 13:37 802,816 –a—— C:\WINDOWS\system32\divx_xx11.dll
2007-07-02 13:37 740,442 –a—— C:\WINDOWS\system32\DivX.dll
2007-07-02 13:37 73,728 –a—— C:\WINDOWS\system32\dpl100.dll
2007-07-02 13:37 593,920 –a—— C:\WINDOWS\system32\dpuGUI11.dll
2007-07-02 13:37 57,344 –a—— C:\WINDOWS\system32\dpv11.dll
2007-07-02 13:37 53,248 –a—— C:\WINDOWS\system32\dpuGUI10.dll
2007-07-02 13:37 344,064 –a—— C:\WINDOWS\system32\dpus11.dll
2007-07-02 13:37 294,912 –a—— C:\WINDOWS\system32\dpu11.dll
2007-07-02 13:37 294,912 –a—— C:\WINDOWS\system32\dpu10.dll
2007-07-02 13:37 196,608 –a—— C:\WINDOWS\system32\dtu100.dll
2007-07-02 13:36 124,472 –a—— C:\WINDOWS\system32\DivXCodecUpdateChecker.exe
2007-07-02 13:36 12,288 –a—— C:\WINDOWS\system32\DivXWMPExtType.dll
2007-07-01 20:54 2,240 –a—— C:\WINDOWS\system32\tmp.reg


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-08 01:13:23 ——– d—–w C:\Program Files\DivX
2007-06-02 01:36:18 ——– d—–w C:\Program Files\Enercalc
2007-06-01 02:49:20 1,574,739 –sha-w C:\WINDOWS\system32\hhhkj.bak2
2007-05-31 02:48:50 1,588,682 –sha-w C:\WINDOWS\system32\hhhkj.bak1
2007-05-27 03:15:06 ——– d—–w C:\Program Files\AxBx
2007-05-22 01:31:08 ——– d—–r C:\Program Files\Support.com
2007-05-16 15:12:02 683,520 —-a-w C:\WINDOWS\system32\inetcomm.dll
2007-05-15 17:18:37 99,904 —-a-w C:\WINDOWS\system32\isafeif.dll
2007-05-15 17:18:37 79,424 —-a-w C:\WINDOWS\system32\vetredir.dll
2007-05-15 17:18:37 75,280 —-a-w C:\WINDOWS\system32\isafprod.dll
2007-05-15 17:18:37 32,528 —-a-w C:\WINDOWS\system32\drivers\vetmonnt.sys
2007-05-15 17:18:37 26,640 —-a-w C:\WINDOWS\system32\drivers\vet-filt.sys
2007-05-15 17:18:37 21,648 —-a-w C:\WINDOWS\system32\drivers\vetfddnt.sys
2007-05-15 17:18:37 21,392 —-a-w C:\WINDOWS\system32\drivers\vet-rec.sys
2007-04-25 14:21:15 144,896 —-a-w C:\WINDOWS\system32\schannel.dll
2007-04-18 16:12:23 2,854,400 —-a-w C:\WINDOWS\system32\msi.dll
2007-04-17 04:47:36 33,624 —-a-w C:\WINDOWS\system32\wups.dll
2007-04-17 04:45:54 1,710,936 —-a-w C:\WINDOWS\system32\wuaueng.dll
2007-04-17 04:45:48 549,720 —-a-w C:\WINDOWS\system32\wuapi.dll
2007-04-17 04:45:42 325,976 —-a-w C:\WINDOWS\system32\wucltui.dll
2007-04-17 04:45:36 203,096 —-a-w C:\WINDOWS\system32\wuweb.dll
2007-04-17 04:45:28 92,504 —-a-w C:\WINDOWS\system32\cdm.dll
2007-04-17 04:45:20 53,080 —-a-w C:\WINDOWS\system32\wuauclt.exe
2007-04-17 04:45:20 43,352 —-a-w C:\WINDOWS\system32\wups2.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FD62605B-D456-42D7-A37C-B55B38EC1103}]
C:\WINDOWS\system32\jkhhh.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"tgcmd"="C:\Program Files\Support.com\bin\tgcmd.exe" [2005-11-18 23:33]
"WinPatrol"="C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe" [2005-12-12 23:18]
"cctray"="C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe" [2007-06-14 11:14]
"CAVRID"="C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe" [2007-05-15 11:18]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2006-11-11 17:18]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:00]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"DefaultP17MIDI"=MidiDef.Exe
"DefaultP17"=P17Def.Exe

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Spyware Doctor"="C:\Program Files\Spyware Doctor\swdoctor.exe" /Q

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\efcdbyy]
efcdbyy.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\jkhhh]
C:\WINDOWS\system32\jkhhh.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL

*Newly Created Service* - CATCHME

**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-08 17:33:01
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-08 17:34:06
C:\ComboFix-quarantined-files.txt … 2007-07-08 17:34

— E O F —

Logfile of HijackThis v1.99.1
Scan saved at 6:09:12 PM, on 7/8/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Support.com\bin\tgcmd.exe
C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe
C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32Info.exe
C:\Program Files\HijackThis\HijackThis.exe

O2 - BHO: (no name) - {FD62605B-D456-42D7-A37C-B55B38EC1103} - C:\WINDOWS\system32\jkhhh.dll (file missing)
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\Support.com\bin\tgcmd.exe" /server /startmonitor /deaf
O4 - HKLM\..\Run: [WinPatrol] C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe
O4 - HKLM\..\Run: [cctray] "C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {01010200-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Installer) - http://echat.qwest.supportsoft.com/sdccomm…ad/tgctlins.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{6BBABAA6-3D40-46B7-B0A8-7C28172A287C}: NameServer = 205.171.3.65,205.171.2.65
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: efcdbyy - efcdbyy.dll (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: jkhhh - C:\WINDOWS\system32\jkhhh.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: CaCCProvSP - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: VET Message Service (VETMSGNT) - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
Post #8
1. Please open Notepad
  • Click Start , then Run
  • Type notepad .exe in the Run Box.
2. Now copy/paste the entire content of the codebox below into the Notepad window:

File::
C:\WINDOWS\system32\fpwboylq.exe
C:\WINDOWS\system32\hwiftmtt.exe
C:\WINDOWS\system32\rmrpbkej.exe
C:\WINDOWS\system32\jncrkxpa.exe
C:\WINDOWS\system32\pvvwqaiw.exe
C:\WINDOWS\system32\oaakprpl.exe
C:\WINDOWS\system32\tnvnukbv.exe
C:\WINDOWS\system32\bcwgyiwc.exe
C:\WINDOWS\system32\segbydlm.exe
C:\WINDOWS\system32\liuqcmoc.exe
C:\WINDOWS\system32\xnamgnov.exe
C:\WINDOWS\system32\snmdxwky.exe
C:\WINDOWS\system32\nivevwei.exe
C:\WINDOWS\system32\jrclmrup.exe
C:\WINDOWS\system32\evxwjvvl.exe
C:\WINDOWS\system32\bxjadcfa.exe
C:\WINDOWS\system32\eeohujem.exe
C:\WINDOWS\system32\rqgjspkt.exe
C:\WINDOWS\system32\yvhfkdiu.exe
C:\WINDOWS\system32\hhhkj.bak2
C:\WINDOWS\system32\hhhkj.bak1

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FD62605B-D456-42D7-A37C-B55B38EC1103}]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\efcdbyy]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\jkhhh]


3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

[external image: Posted Image]


5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
  • Combofix.txt
  • A new HijackThis log.
Post #9
"Owner" - 2007-07-08 21:58:25 - ComboFix 07-07-09.5 - Service Pack 2
Command switches used :: C:\Documents and Settings\Owner\Desktop\cfscript.txt


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\system32\bcwgyiwc.exe
C:\WINDOWS\system32\bxjadcfa.exe
C:\WINDOWS\system32\eeohujem.exe
C:\WINDOWS\system32\evxwjvvl.exe
C:\WINDOWS\system32\fpwboylq.exe
C:\WINDOWS\system32\hwiftmtt.exe
C:\WINDOWS\system32\jncrkxpa.exe
C:\WINDOWS\system32\jrclmrup.exe
C:\WINDOWS\system32\liuqcmoc.exe
C:\WINDOWS\system32\nivevwei.exe
C:\WINDOWS\system32\oaakprpl.exe
C:\WINDOWS\system32\pvvwqaiw.exe
C:\WINDOWS\system32\rmrpbkej.exe
C:\WINDOWS\system32\rqgjspkt.exe
C:\WINDOWS\system32\segbydlm.exe
C:\WINDOWS\system32\snmdxwky.exe
C:\WINDOWS\system32\tnvnukbv.exe
C:\WINDOWS\system32\xnamgnov.exe
C:\WINDOWS\system32\yvhfkdiu.exe


((((((((((((((((((((((((( Files Created from 2007-06-09 to 2007-07-09 )))))))))))))))))))))))))))))))


2007-07-08 18:00 d——– C:\VundoFix Backups
2007-07-08 16:57 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-07-08 14:10 164 –a—— C:\install.dat
2007-07-07 18:19 d——– C:\WINDOWS\network diagnostic
2007-07-05 08:44 630,200 –a—— C:\WINDOWS\system32\drivers\vetefile.sys
2007-07-05 08:44 108,392 –a—— C:\WINDOWS\system32\drivers\veteboot.sys
2007-07-02 13:41 524,288 –a—— C:\WINDOWS\system32\DivXsm.exe
2007-07-02 13:41 3,596,288 –a—— C:\WINDOWS\system32\qt-dx331.dll
2007-07-02 13:41 200,704 –a—— C:\WINDOWS\system32\ssldivx.dll
2007-07-02 13:41 1,044,480 –a—— C:\WINDOWS\system32\libdivx.dll
2007-07-02 13:37 823,296 –a—— C:\WINDOWS\system32\divx_xx0c.dll
2007-07-02 13:37 823,296 –a—— C:\WINDOWS\system32\divx_xx07.dll
2007-07-02 13:37 802,816 –a—— C:\WINDOWS\system32\divx_xx11.dll
2007-07-02 13:37 740,442 –a—— C:\WINDOWS\system32\DivX.dll
2007-07-02 13:37 73,728 –a—— C:\WINDOWS\system32\dpl100.dll
2007-07-02 13:37 593,920 –a—— C:\WINDOWS\system32\dpuGUI11.dll
2007-07-02 13:37 57,344 –a—— C:\WINDOWS\system32\dpv11.dll
2007-07-02 13:37 53,248 –a—— C:\WINDOWS\system32\dpuGUI10.dll
2007-07-02 13:37 344,064 –a—— C:\WINDOWS\system32\dpus11.dll
2007-07-02 13:37 294,912 –a—— C:\WINDOWS\system32\dpu11.dll
2007-07-02 13:37 294,912 –a—— C:\WINDOWS\system32\dpu10.dll
2007-07-02 13:37 196,608 –a—— C:\WINDOWS\system32\dtu100.dll
2007-07-02 13:36 124,472 –a—— C:\WINDOWS\system32\DivXCodecUpdateChecker.exe
2007-07-02 13:36 12,288 –a—— C:\WINDOWS\system32\DivXWMPExtType.dll
2007-07-01 20:54 2,240 –a—— C:\WINDOWS\system32\tmp.reg


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-08 01:13:23 ——– d—–w C:\Program Files\DivX
2007-06-02 01:36:18 ——– d—–w C:\Program Files\Enercalc
2007-05-27 03:15:06 ——– d—–w C:\Program Files\AxBx
2007-05-22 01:31:08 ——– d—–r C:\Program Files\Support.com
2007-05-16 15:12:02 683,520 —-a-w C:\WINDOWS\system32\inetcomm.dll
2007-05-15 17:18:37 99,904 —-a-w C:\WINDOWS\system32\isafeif.dll
2007-05-15 17:18:37 79,424 —-a-w C:\WINDOWS\system32\vetredir.dll
2007-05-15 17:18:37 75,280 —-a-w C:\WINDOWS\system32\isafprod.dll
2007-05-15 17:18:37 32,528 —-a-w C:\WINDOWS\system32\drivers\vetmonnt.sys
2007-05-15 17:18:37 26,640 —-a-w C:\WINDOWS\system32\drivers\vet-filt.sys
2007-05-15 17:18:37 21,648 —-a-w C:\WINDOWS\system32\drivers\vetfddnt.sys
2007-05-15 17:18:37 21,392 —-a-w C:\WINDOWS\system32\drivers\vet-rec.sys
2007-04-25 14:21:15 144,896 —-a-w C:\WINDOWS\system32\schannel.dll
2007-04-18 16:12:23 2,854,400 —-a-w C:\WINDOWS\system32\msi.dll
2007-04-17 04:47:36 33,624 —-a-w C:\WINDOWS\system32\wups.dll
2007-04-17 04:45:54 1,710,936 —-a-w C:\WINDOWS\system32\wuaueng.dll
2007-04-17 04:45:48 549,720 —-a-w C:\WINDOWS\system32\wuapi.dll
2007-04-17 04:45:42 325,976 —-a-w C:\WINDOWS\system32\wucltui.dll
2007-04-17 04:45:36 203,096 —-a-w C:\WINDOWS\system32\wuweb.dll
2007-04-17 04:45:28 92,504 —-a-w C:\WINDOWS\system32\cdm.dll
2007-04-17 04:45:20 53,080 —-a-w C:\WINDOWS\system32\wuauclt.exe
2007-04-17 04:45:20 43,352 —-a-w C:\WINDOWS\system32\wups2.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"tgcmd"="C:\Program Files\Support.com\bin\tgcmd.exe" [2005-11-18 23:33]
"WinPatrol"="C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe" [2005-12-12 23:18]
"cctray"="C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe" [2007-06-14 11:14]
"CAVRID"="C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe" [2007-05-15 11:18]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2006-11-11 17:18]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:00]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"DefaultP17MIDI"=MidiDef.Exe
"DefaultP17"=P17Def.Exe

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Spyware Doctor"="C:\Program Files\Spyware Doctor\swdoctor.exe" /Q

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL


**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-08 22:00:39
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-08 22:01:27
C:\ComboFix-quarantined-files.txt … 2007-07-08 22:01
C:\ComboFix2.txt … 2007-07-08 18:08
C:\ComboFix3.txt … 2007-07-08 17:34

— E O F —

Logfile of HijackThis v1.99.1
Scan saved at 10:05:37 PM, on 7/8/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Support.com\bin\tgcmd.exe
C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe
C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\HijackThis\HijackThis.exe

O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\Support.com\bin\tgcmd.exe" /server /startmonitor /deaf
O4 - HKLM\..\Run: [WinPatrol] C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe
O4 - HKLM\..\Run: [cctray] "C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {01010200-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Installer) - http://echat.qwest.supportsoft.com/sdccomm…ad/tgctlins.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{6BBABAA6-3D40-46B7-B0A8-7C28172A287C}: NameServer = 205.171.3.65,205.171.2.65
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: CaCCProvSP - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: VET Message Service (VETMSGNT) - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
Post #10
A. Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. A malicious site could render Java content under older, vulnerable versions of Sun's software if the user has not removed them. Please follow these steps to remove older version Java components and update:
  • Download the latest version of Java Runtime Environment (JRE) 6 Update 2 and save it to your desktop.
  • Scroll down to where it says "Java Runtime Environment (JRE) 6u2…allows end-users to run Java applications".
  • Click the "Download" button to the right.
  • Read the License Agreement and then check the box that says: "Accept License Agreement".
  • The page will refresh.
  • Click on the link to download Windows Offline Installation and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Settings > Control Panel, double-click on and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u2-windows-i586-p.exe to install the newest version.

B. There is a file in your log of which I am unsure. For that reason, I need you to submit it to Jotti's for analysis.

1. Click HERE to get to Jotti's site.

2. At the top of the Jotti window, use the Browse button to locate the following file on your system:

C:\WINDOWS\system32\notepad.exe

3. Once you have located the file, click SUBMIT and the content of the file will be uploaded by the site and analysed.

4. Please provide me with the results of the analysis along with a fresh HJT log.

Regards,

Trevuren
Post #11
Service
Service load:
0% 100%
File: notepad.exe
Status:
OK(Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database)
MD5: 388b8fbc36a8558587afc90fb23a3b99
Packers detected:
-
Bit9 reports: No threat detected (more info)
Scanner results
Scan taken on 09 Jul 2007 05:37:09 (GMT)
A-Squared
Found nothing
AntiVir
Found nothing
ArcaVir
Found nothing
Avast
Found nothing
AVG Antivirus
Found nothing
BitDefender
Found nothing
ClamAV
Found nothing
Dr.Web
Found nothing
F-Prot Antivirus
Found nothing
F-Secure Anti-Virus
Found nothing
Fortinet
Found nothing
Kaspersky Anti-Virus
Found nothing
NOD32
Found nothing
Norman Virus Control
Found nothing
Panda Antivirus
Found nothing
Rising Antivirus
Found nothing
Sophos Antivirus
Found nothing
VirusBuster
Found nothing
VBA32
Found nothing


Logfile of HijackThis v1.99.1
Scan saved at 11:41:11 PM, on 7/8/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Support.com\bin\tgcmd.exe
C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe
C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\HijackThis\HijackThis.exe

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\Support.com\bin\tgcmd.exe" /server /startmonitor /deaf
O4 - HKLM\..\Run: [WinPatrol] C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe
O4 - HKLM\..\Run: [cctray] "C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {01010200-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Installer) - http://echat.qwest.supportsoft.com/sdccomm…ad/tgctlins.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{6BBABAA6-3D40-46B7-B0A8-7C28172A287C}: NameServer = 205.171.3.65,205.171.2.65
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: CaCCProvSP - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: VET Message Service (VETMSGNT) - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
Post #12
Your log looks good. If you have no more malware-related problems that you are aware of, just give me the OK and we can start the final but essential cleanup procedures and recommendations.

Trevuren
Post #13
Congratulations, your log shows that your SYSTEM IS CLEAN

There are a few things you must do once you are completely clean:

1. Time for some housekeeping

Please download the OTMoveIt by OldTimer
  • Save it to your desktop.
  • Run the tool by clicking on the icon.
  • Click the Cleanup button.
  • The tools that we used as well as this one will be removed from your system.

2. Please download ATF Cleaner by Atribune.
This program is for XP and Windows 2000 onlyDouble-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

3. Now Set a New Restore Point to prevent possible reinfection from an old one. Some of the malware you picked up could have been saved in System Restore. Since System Restore is a protected directory, your tools can not access it to delete these bad files which sometimes can reinfect your system. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state.

The easiest and safest way to do this is:
  • Go to Start > Programs > Accessories > System Tools and click "System Restore".
  • Choose the radio button marked "Create a Restore Point" on the first screen then click "Next". Give the R.P. a name then click "Create". The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
  • Then go to Start > Run and type: Cleanmgr
  • Click "OK".
  • Click the "More Options" Tab.
  • Click "Clean Up" in the System Restore section to remove all previous restore points except the newly created one.
Here are some tips to reduce the potential for spyware infection in the future:

Make sure you keep your Windows OS current by visiting Windows update
regularly to download and install any critical updates and service packs. With out these you are leaving the backdoor open.

I strongly recommend installing the following applications:
  • Spywareblaster <= SpywareBlaster will prevent spyware from being installed.
  • Spywareguard <= SpywareGuard offers realtime protection from spyware installation attempts.
  • How to use Ad-Aware to remove Spyware <= If you suspect that you have spyware installed on your computer, here are instructions on how to download, install and then use Ad-Aware.
  • How to use Spybot to remove Spyware <= If you suspect that you have spyware installed on your computer, here are instructions on how to download, install and then use Spybot. Similar to Ad-Aware, I strongly recommend both to catch most spyware.
To protect yourself further:
  • Spyad <= IE/Spyad places over 4000 websites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites.
  • MVPS Hosts file <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your coputer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
  • Google Toolbar <= Get the free google toolbar to help stop pop up windows.
And also see TonyKlein's good advice
So how did I get infected in the first place?

Regards,

Trevuren
Post #14
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI