What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed]Security Console Family Of Malware

1 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Machine went on a vacation and has just returned to me. My case was closed (382836) so I am posting results of actions followed in reply by LDTate. Couldn't find out how to reopen the case or contact someone who could. Thanks for the help.
———————————————————————
Hello and welcome to the forums

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»

Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time.

Next:

Download ComboFix from Here or Here to your Desktop.
Double click combofix.exe and follow the prompts.
When finished, it shall produce a log for you, combofix.txt.Post that log and a HiJackthis log in your next reply
Note: Do not mouseclick combofix's window while its running. That may cause it to stall


——————————————————–

Logfile of HijackThis v1.99.1
Scan saved at 12:12, on 2007-07-20
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\Program Files\WatchGuard\Mobile User VPN\IreIKE.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Wave Systems Corp\Common\DataServer.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\Program Files\WatchGuard\Mobile User VPN\IPSecMon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.7\bin\tcsd_win32.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\wnupdate.exe
C:\WINDOWS\csrss.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Print Server\PTP\PSDiagnostic.exe
C:\WINDOWS\System\CmFlywav.exe
C:\Program Files\Linksys Wireless-G Music Bridge\WMB54G.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\Apoint\HidFind.exe
C:\Program Files\Napster\napster.exe
C:\Documents and Settings\All Users\Application Data\qtynqxkr.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\NetWaiting\netWaiting.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\WatchGuard\Mobile User VPN\SafeCfg.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\Program Files\Internet Explorer\iexplore.exe
c:\program files\common files\installshield\updateservice\isuspm.exe
C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.uspto.gov/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http://BAMBAM:8080
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [Document Manager] C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [USPTO Direct Recovery] "C:\Program Files\USPTO\etdirrcv.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe -Embedding -boot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [PrintServer Diagnostic] C:\Program Files\Print Server\PTP\PSDiagnostic.exe
O4 - HKLM\..\Run: [Linksys WMB54G Utility] C:\Program Files\Linksys Wireless-G Music Bridge\WMB54G.exe -R
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [NapsterShell] C:\Program Files\Napster\napster.exe /systray
O4 - HKLM\..\Run: [qtynqxkr.exe] C:\Documents and Settings\All Users\Application Data\qtynqxkr.exe
O4 - HKLM\..\Run: [csrss] C:\WINDOWS\csrss.exe
O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AdobeUpdateManager.exe" AcPro7_0_8 -reboot 1
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: EMBASSY Trust Suite Secure Update.lnk = C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe
O4 - Global Startup: Mobile User VPN.lnk = C:\Program Files\WatchGuard\Mobile User VPN\SafeCfg.exe
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = FoggLaw.local
O17 - HKLM\Software\..\Telephony: DomainName = FoggLaw.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = FoggLaw.local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = FoggLaw.local
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = FoggLaw.local
O20 - AppInit_DLLs: wxvault.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: DataSvr2 - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Common\DataServer.exe
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: SafeNet Monitor Service (IPSECMON) - SafeNet - C:\Program Files\WatchGuard\Mobile User VPN\IPSecMon.exe
O23 - Service: SafeNet IKE Service (IreIKE) - SafeNet - C:\Program Files\WatchGuard\Mobile User VPN\IreIKE.exe
O23 - Service: MSSQL$MICROSOFTSMLBIZ - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe" -sMICROSOFTSMLBIZ (file missing)
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SQLAgent$MICROSOFTSMLBIZ - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlagent.EXE" -i MICROSOFTSMLBIZ (file missing)
O23 - Service: NTRU Hybrid TSS v2.0.7 TCS (tcsd_win32.exe) - Unknown owner - C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.7\bin\tcsd_win32.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: WinUpdate - ZSoft - C:\WINDOWS\system32\wnupdate.exe
O23 - Service: Intel® PROSet/Wireless SSO Service (WLANKEEPER) - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe





"David" - 2007-07-20 12:09:08 - ComboFix 07-07-17.8 - Service Pack 2 NTFS


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\csrss.exe
C:\WINDOWS\system32\~.exe
C:\WINDOWS\system32\scchk32.exe
C:\WINDOWS\system32\wmvds32.dll


((((((((((((((((((((((((( Files Created from 2007-06-20 to 2007-07-20 )))))))))))))))))))))))))))))))


2007-07-20 12:08 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-07-20 10:48 d——– C:\WINDOWS\system32\jomgpike
2007-07-20 10:48 d——– C:\Program Files\Xjnmljzv
2007-07-20 10:48 d——– C:\Program Files\SecCenter
2007-07-20 10:48 d——– C:\Program Files\ozmdqhuj
2007-07-20 10:48 d——– C:\Program Files\Akoodipr
2007-07-20 08:22 d——– C:\Program Files\Syrneafi
2007-07-04 14:34 17,408 –a—— C:\WINDOWS\system32\wnupdate.exe
2007-06-27 18:47 56,320 –a—— C:\DOCUME~1\ALLUSE~1\APPLIC~1\qtynqxkr.exe
2007-06-23 21:35 914 –a—— C:\pdrviofc3.exe
2007-06-23 21:35 914 –a—— C:\pdrviofc2.exe
2007-06-23 21:35 914 –a—— C:\pdrviofc1.exe
2007-06-20 15:30 d——– C:\WINDOWS\pss
2007-06-20 15:28 d——– C:\Program Files\RogueRemover
2007-06-20 15:12 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-06-20 12:57 d——– C:\Program Files\Lavasoft
2007-06-20 12:57 d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-06-20 12:57 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-18 15:39:51 166,477 —-a-w C:\WINDOWS\system32\nvModes.dat
2007-07-18 10:30:58 ——– d—–w C:\DOCUME~1\david\APPLIC~1\Wave Systems Corp
2007-06-17 16:08:20 ——– d—–w C:\Program Files\Common Files\Roxio Shared
2007-06-17 16:08:16 ——– d—–w C:\Program Files\Roxio
2007-06-17 16:08:16 ——– d—–w C:\DOCUME~1\david\APPLIC~1\Roxio
2007-06-17 15:59:28 ——– d—–w C:\Program Files\Common Files\sndp202
2007-06-17 15:59:25 ——– d–h–w C:\Program Files\InstallShield Installation Information
2007-06-16 17:27:54 2,273 —-a-w C:\DOCUME~1\david\APPLIC~1\SAS7_000.DAT
2007-06-11 22:54:31 ——– d—–w C:\DOCUME~1\david\APPLIC~1\OfficeUpdate12
2007-06-04 20:18:48 9,344 —-a-w C:\WINDOWS\system32\drivers\NSDriver.sys
2007-06-04 20:17:02 8,320 —-a-w C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-06-04 20:14:56 6,272 —-a-w C:\WINDOWS\system32\drivers\AWRTPD.sys
2007-05-25 14:34:29 ——– d—–w C:\Program Files\DYMO Label
2007-05-21 16:36:16 524,288 —-a-w C:\WINDOWS\opuc.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2006-01-12 20:38 63128 –a—— C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5CA3D70E-1895-11CF-8E15-001234567890}]
2005-09-08 05:20 110652 –a—— C:\WINDOWS\System32\DLA\DLASHX_W.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]
2005-09-24 00:41 231160 –a—— C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2005-10-07 12:13]
"nwiz"="nwiz.exe" [2006-05-01 15:46 C:\WINDOWS\system32\nwiz.exe]
"NVHotkey"="nvHotkey.dll" [2006-05-01 15:46 C:\WINDOWS\system32\nvhotkey.dll]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-11-19 17:48]
"IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2005-12-28 11:55]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2005-12-28 11:56]
"SigmatelSysTrayApp"="stsystra.exe" [2006-03-24 16:30 C:\WINDOWS\stsystra.exe]
"Document Manager"="C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe" [2006-03-09 12:26]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-12-09 20:29]
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2006-04-06 14:58]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2005-02-16 16:15]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-16 16:15]
"Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2006-01-12 20:52]
"@"="" []
"USPTO Direct Recovery"="C:\Program Files\USPTO\etdirrcv.exe" [2006-07-25 17:02]
"SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-09-29 16:00]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-10-25 19:58]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-10-30 10:36]
"PrintServer Diagnostic"="C:\Program Files\Print Server\PTP\PSDiagnostic.exe" [2004-11-24 17:09]
"Linksys WMB54G Utility"="C:\Program Files\Linksys Wireless-G Music Bridge\WMB54G.exe" [2005-11-23 01:26]
"vptray"="C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe" [2003-05-21 01:21]
"NapsterShell"="C:\Program Files\Napster\napster.exe" [2007-01-12 19:36]
"qtynqxkr.exe"="C:\Documents and Settings\All Users\Application Data\qtynqxkr.exe" [2007-06-29 13:52]
"csrss"="C:\WINDOWS\csrss.exe" []

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ModemOnHold"="C:\Program Files\NetWaiting\netWaiting.exe" [2003-09-10 02:24]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:00]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AdobeUpdateManager.exe" [2006-03-30 16:45]

C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup
Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2006-07-25 12:21:13]
Bluetooth Manager.lnk - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng1.exe [2005-06-16 11:11:42]
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2006-07-16 18:19:39]
EMBASSY Trust Suite Secure Update.lnk - C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe [2005-11-30 09:39:02]
Mobile User VPN.lnk - C:\Program Files\WatchGuard\Mobile User VPN\SafeCfg.exe [2006-07-25 16:21:50]
Service Manager.lnk - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2005-05-03 22:07:32]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=wxvault.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages msv1_0 wvauth

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\aawservice]


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b5ea9094-6e69-11db-80b1-001641742d97}]
AutoRun\command- explorer.exe /n,/e,\


Contents of the 'Scheduled Tasks' folder
2007-07-16 21:12:00 C:\WINDOWS\tasks\AppleSoftwareUpdate.job

**************************************************************************

catchme 0.3.1040 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-20 12:11:10
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden registry entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-20 12:11:38
C:\ComboFix-quarantined-files.txt … 2007-07-20 12:11

— E O F —
Post #2
Do you know what these directories or programs are?
C:\WINDOWS\system32\jomgpike
C:\Program Files\Xjnmljzv
C:\Program Files\SecCenter
C:\Program Files\ozmdqhuj
C:\Program Files\Akoodipr
C:\Program Files\Syrneafi
Post #4
Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\pdrviofc3.exe
C:\pdrviofc2.exe
C:\pdrviofc1.exe
C:\Documents and Settings\All Users\Application Data\qtynqxkr.exe

Folder::
C:\WINDOWS\system32\jomgpike
C:\Program Files\Xjnmljzv
C:\Program Files\SecCenter
C:\Program Files\ozmdqhuj
C:\Program Files\Akoodipr
C:\Program Files\Syrneafi

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"qtynqxkr.exe"=-
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b5ea9094-6e69-11db-80b1-001641742d97}]


Save this as Save this as "CFScript"


[external image: Posted Image]

Refering to the picture above, drag CFScript.txt into ComboFix.exe

Then post the results log
Post #5
Followed your script / combofix instructions:

"david" - 2007-07-23 16:51:05 - ComboFix 07-07-17.8 - Service Pack 2 NTFS
Command switches used :: C:\Documents and Settings\david\Desktop\CFScript.txt


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\Documents and Settings\All Users\Application Data\qtynqxkr.exe
C:\pdrviofc1.exe
C:\pdrviofc2.exe
C:\pdrviofc3.exe
C:\Program Files\Akoodipr
C:\Program Files\Akoodipr\uovsdtfh.exe
C:\Program Files\ozmdqhuj
C:\Program Files\ozmdqhuj\qzqrkpwb.dll
C:\Program Files\SecCenter
C:\Program Files\SecCenter\scprot4.exe
C:\Program Files\Syrneafi
C:\Program Files\Syrneafi\hmnapjgw(2).dll
C:\Program Files\Xjnmljzv
C:\Program Files\Xjnmljzv\ntspyttc.dll
C:\WINDOWS\csrss.exe
C:\WINDOWS\system32\jomgpike
C:\WINDOWS\system32\jomgpike\bg1.gif
C:\WINDOWS\system32\jomgpike\bgtop.gif
C:\WINDOWS\system32\jomgpike\bottom1.gif
C:\WINDOWS\system32\jomgpike\essentials.gif
C:\WINDOWS\system32\jomgpike\icon1.ico
C:\WINDOWS\system32\jomgpike\install1.gif
C:\WINDOWS\system32\jomgpike\left1.gif
C:\WINDOWS\system32\jomgpike\li.gif
C:\WINDOWS\system32\jomgpike\logo.gif
C:\WINDOWS\system32\jomgpike\main.htm
C:\WINDOWS\system32\jomgpike\mainframe.htm
C:\WINDOWS\system32\jomgpike\reinstall1.gif
C:\WINDOWS\system32\jomgpike\right1.gif
C:\WINDOWS\system32\jomgpike\s1.htm
C:\WINDOWS\system32\jomgpike\s2.htm
C:\WINDOWS\system32\jomgpike\s3.htm
C:\WINDOWS\system32\jomgpike\SMTop1.gif
C:\WINDOWS\system32\jomgpike\SMTop2.gif
C:\WINDOWS\system32\jomgpike\SMTop3.gif
C:\WINDOWS\system32\jomgpike\SMTop4.gif
C:\WINDOWS\system32\jomgpike\soft1_off.gif
C:\WINDOWS\system32\jomgpike\soft1_off_ext.gif
C:\WINDOWS\system32\jomgpike\soft1_on.gif
C:\WINDOWS\system32\jomgpike\soft1_on_ext.gif
C:\WINDOWS\system32\jomgpike\soft2_off.gif
C:\WINDOWS\system32\jomgpike\soft2_off_ext.gif
C:\WINDOWS\system32\jomgpike\soft2_on.gif
C:\WINDOWS\system32\jomgpike\soft2_on_ext.gif
C:\WINDOWS\system32\jomgpike\soft3_off.gif
C:\WINDOWS\system32\jomgpike\soft3_off_ext.gif
C:\WINDOWS\system32\jomgpike\soft3_on.gif
C:\WINDOWS\system32\jomgpike\soft3_on_ext.gif
C:\WINDOWS\system32\jomgpike\softbottom_off.gif
C:\WINDOWS\system32\jomgpike\softbottom_on.gif
C:\WINDOWS\system32\jomgpike\softleft_off.gif
C:\WINDOWS\system32\jomgpike\softleft_on.gif
C:\WINDOWS\system32\jomgpike\top1.gif
C:\WINDOWS\system32\jomgpike\top2.gif
C:\WINDOWS\system32\jomgpike\turnoff1.gif
C:\WINDOWS\system32\jomgpike\turnon1.gif


((((((((((((((((((((((((( Files Created from 2007-06-23 to 2007-07-23 )))))))))))))))))))))))))))))))


2007-07-23 07:46 d——– C:\Program Files\Zeacxzyl
2007-07-23 07:46 d——– C:\Program Files\Ubflmvno
2007-07-22 07:07 d——– C:\Program Files\gtgxgxoz
2007-07-20 20:53 d——– C:\Program Files\zifyjkra
2007-07-20 20:53 d——– C:\Program Files\Dizahmui
2007-07-20 20:53 d——– C:\Program Files\Cpnjlivh
2007-07-20 12:11 29,696 –a—— C:\WINDOWS\csrss.exe
2007-07-20 12:08 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-07-04 14:34 17,408 –a—— C:\WINDOWS\system32\wnupdate.exe


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-23 12:45:44 ——– d—–w C:\DOCUME~1\david\APPLIC~1\Wave Systems Corp
2007-07-18 15:39:51 166,477 —-a-w C:\WINDOWS\system32\nvModes.dat
2007-06-27 17:27:52 ——– d—–w C:\Program Files\RogueRemover
2007-06-20 17:57:50 ——– d—–w C:\Program Files\Lavasoft
2007-06-20 17:57:08 ——– d—–w C:\Program Files\Common Files\Wise Installation Wizard
2007-06-17 16:08:20 ——– d—–w C:\Program Files\Common Files\Roxio Shared
2007-06-17 16:08:16 ——– d—–w C:\Program Files\Roxio
2007-06-17 16:08:16 ——– d—–w C:\DOCUME~1\david\APPLIC~1\Roxio
2007-06-17 15:59:28 ——– d—–w C:\Program Files\Common Files\sndp202
2007-06-17 15:59:25 ——– d–h–w C:\Program Files\InstallShield Installation Information
2007-06-16 17:27:54 2,273 —-a-w C:\DOCUME~1\david\APPLIC~1\SAS7_000.DAT
2007-06-11 22:54:31 ——– d—–w C:\DOCUME~1\david\APPLIC~1\OfficeUpdate12
2007-06-04 20:18:48 9,344 —-a-w C:\WINDOWS\system32\drivers\NSDriver.sys
2007-06-04 20:17:02 8,320 —-a-w C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-06-04 20:14:56 6,272 —-a-w C:\WINDOWS\system32\drivers\AWRTPD.sys
2007-05-25 14:34:29 ——– d—–w C:\Program Files\DYMO Label
2007-05-21 16:36:16 524,288 —-a-w C:\WINDOWS\opuc.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2006-01-12 20:38 63128 –a—— C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{38818482-587A-D55C-2154-057925C3E96C}]
2007-07-23 07:46 98304 –a—— C:\Program Files\Zeacxzyl\zbvwguou.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5CA3D70E-1895-11CF-8E15-001234567890}]
2005-09-08 05:20 110652 –a—— C:\WINDOWS\System32\DLA\DLASHX_W.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]
2005-09-24 00:41 231160 –a—— C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2005-10-07 12:13]
"nwiz"="nwiz.exe" [2006-05-01 15:46 C:\WINDOWS\system32\nwiz.exe]
"NVHotkey"="nvHotkey.dll" [2006-05-01 15:46 C:\WINDOWS\system32\nvhotkey.dll]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-11-19 17:48]
"IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2005-12-28 11:55]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2005-12-28 11:56]
"SigmatelSysTrayApp"="stsystra.exe" [2006-03-24 16:30 C:\WINDOWS\stsystra.exe]
"Document Manager"="C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe" [2006-03-09 12:26]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-12-09 20:29]
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2006-04-06 14:58]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2005-02-16 16:15]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-16 16:15]
"Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2006-01-12 20:52]
"@"="" []
"USPTO Direct Recovery"="C:\Program Files\USPTO\etdirrcv.exe" [2006-07-25 17:02]
"SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-09-29 16:00]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-10-25 19:58]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-10-30 10:36]
"PrintServer Diagnostic"="C:\Program Files\Print Server\PTP\PSDiagnostic.exe" [2004-11-24 17:09]
"Linksys WMB54G Utility"="C:\Program Files\Linksys Wireless-G Music Bridge\WMB54G.exe" [2005-11-23 01:26]
"vptray"="C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe" [2003-05-21 01:21]
"NapsterShell"="C:\Program Files\Napster\napster.exe" [2007-01-12 19:36]
"zifyjkra"="C:\Program Files\zifyjkra\zojwvsjy.dll" [2007-07-20 20:53]
"gtgxgxoz"="C:\Program Files\gtgxgxoz\crahivyt.dll" [2007-07-22 07:07]
"csrss"="C:\WINDOWS\csrss.exe" [2007-07-23 16:53]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ModemOnHold"="C:\Program Files\NetWaiting\netWaiting.exe" [2003-09-10 02:24]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:00]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AdobeUpdateManager.exe" [2006-03-30 16:45]

C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup
Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2006-07-25 12:21:13]
Bluetooth Manager.lnk - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng1.exe [2005-06-16 11:11:42]
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2006-07-16 18:19:39]
EMBASSY Trust Suite Secure Update.lnk - C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe [2005-11-30 09:39:02]
Mobile User VPN.lnk - C:\Program Files\WatchGuard\Mobile User VPN\SafeCfg.exe [2006-07-25 16:21:50]
Service Manager.lnk - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2005-05-03 22:07:32]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=wxvault.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages msv1_0 wvauth

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\aawservice]


Contents of the 'Scheduled Tasks' folder
2007-07-23 21:12:00 C:\WINDOWS\tasks\AppleSoftwareUpdate.job

**************************************************************************

catchme 0.3.1040 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-23 16:53:43
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden registry entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-23 16:54:15
C:\ComboFix-quarantined-files.txt … 2007-07-23 16:54
C:\ComboFix2.txt … 2007-07-20 12:11

— E O F —
Post #6 last edited
Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\Program Files\Zeacxzyl\zbvwguou.dll

Folder::
C:\Program Files\Zeacxzyl

Registry::
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{38818482-587A-D55C-2154-057925C3E96C}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{38818482-587A-D55C-2154-057925C3E96C}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"zifyjkra"=-
"gtgxgxoz"=-
"csrss"="-


Save this as Save this as "CFScript"


[external image: Posted Image]

Refering to the picture above, drag CFScript.txt into ComboFix.exe

Then post the results log
Post #7
Here it is. How is it going?

"David" - 2007-07-24 0:04:10 - ComboFix 07-07-17.8 - Service Pack 2 NTFS
Command switches used :: C:\Documents and Settings\david\Desktop\CFScript.txt


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\Program Files\Zeacxzyl
C:\Program Files\Zeacxzyl\zbvwguou.dll
C:\WINDOWS\system32\_000005_.tmp.dll
C:\WINDOWS\system32\_000007_.tmp.dll
C:\WINDOWS\system32\_000008_.tmp.dll


((((((((((((((((((((((((( Files Created from 2007-06-24 to 2007-07-24 )))))))))))))))))))))))))))))))


2007-07-23 23:09 d——– C:\Program Files\MSXML 6.0
2007-07-23 23:09 d——– C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-07-23 23:05 d——– C:\WINDOWS\network diagnostic
2007-07-23 23:01 d——– C:\Program Files\MSXML 4.0
2007-07-23 23:00 d——– C:\Program Files\MSBuild
2007-07-23 22:58 d——– C:\WINDOWS\system32\XPSViewer
2007-07-23 22:57 d——– C:\Program Files\Reference Assemblies
2007-07-23 22:56 14,048 ——— C:\WINDOWS\system32\spmsg2.dll
2007-07-23 22:56 d——– C:\bebde2bad5b403213688bba4bbbe11
2007-07-23 22:55 d——– C:bc9d0489ce7b742eb0f1753
2007-07-23 22:54 d——– C:\WINDOWS\system32\LogFiles
2007-07-23 22:54 d——– C:\WINDOWS\system32\drivers\UMDF
2007-07-23 22:54 d——– C:\13dce9340f3c077b7eaf872d
2007-07-23 22:53 d——– C:\ed7f64169df9e70815245fca73c2
2007-07-23 22:41 36,352 ——— C:\WINDOWS\system32\tsgqec.dll
2007-07-23 22:41 288,768 ——— C:\WINDOWS\system32\rhttpaa.dll
2007-07-23 22:41 116,736 ——— C:\WINDOWS\system32\aaclient.dll
2007-07-23 22:15 76,560 –a—— C:\WINDOWS\system32\drivers\tmcomm.sys
2007-07-23 20:18 d——– C:\DOCUME~1\david\.housecall6.6
2007-07-23 07:46 d——– C:\Program Files\Ubflmvno
2007-07-22 07:07 d——– C:\Program Files\gtgxgxoz
2007-07-20 20:53 d——– C:\Program Files\zifyjkra
2007-07-20 20:53 d——– C:\Program Files\Dizahmui
2007-07-20 20:53 d——– C:\Program Files\Cpnjlivh
2007-07-20 12:08 51,200 –a—— C:\WINDOWS\nircmd.exe


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-24 03:55:51 ——– d—–w C:\Program Files\Windows Media Connect 2
2007-07-23 12:45:44 ——– d—–w C:\DOCUME~1\david\APPLIC~1\Wave Systems Corp
2007-07-18 15:39:51 166,477 —-a-w C:\WINDOWS\system32\nvModes.dat
2007-06-27 17:27:52 ——– d—–w C:\Program Files\RogueRemover
2007-06-20 17:57:50 ——– d—–w C:\Program Files\Lavasoft
2007-06-20 17:57:08 ——– d—–w C:\Program Files\Common Files\Wise Installation Wizard
2007-06-17 16:08:20 ——– d—–w C:\Program Files\Common Files\Roxio Shared
2007-06-17 16:08:16 ——– d—–w C:\Program Files\Roxio
2007-06-17 16:08:16 ——– d—–w C:\DOCUME~1\david\APPLIC~1\Roxio
2007-06-17 15:59:28 ——– d—–w C:\Program Files\Common Files\sndp202
2007-06-17 15:59:25 ——– d–h–w C:\Program Files\InstallShield Installation Information
2007-06-16 17:27:54 2,273 —-a-w C:\DOCUME~1\david\APPLIC~1\SAS7_000.DAT
2007-06-11 22:54:31 ——– d—–w C:\DOCUME~1\david\APPLIC~1\OfficeUpdate12
2007-06-04 20:18:48 9,344 —-a-w C:\WINDOWS\system32\drivers\NSDriver.sys
2007-06-04 20:17:02 8,320 —-a-w C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-06-04 20:14:56 6,272 —-a-w C:\WINDOWS\system32\drivers\AWRTPD.sys
2007-05-25 14:34:29 ——– d—–w C:\Program Files\DYMO Label
2007-05-21 16:36:16 524,288 —-a-w C:\WINDOWS\opuc.dll
2007-05-16 15:12:02 683,520 —-a-w C:\WINDOWS\system32\inetcomm.dll
2007-04-25 14:21:15 144,896 —-a-w C:\WINDOWS\system32\schannel.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2006-01-12 20:38 63128 –a—— C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5CA3D70E-1895-11CF-8E15-001234567890}]
2005-09-08 05:20 110652 –a—— C:\WINDOWS\System32\DLA\DLASHX_W.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]
2005-09-24 00:41 231160 –a—— C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2005-10-07 12:13]
"nwiz"="nwiz.exe" [2006-05-01 15:46 C:\WINDOWS\system32\nwiz.exe]
"NVHotkey"="nvHotkey.dll" [2006-05-01 15:46 C:\WINDOWS\system32\nvhotkey.dll]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-11-19 17:48]
"IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2005-12-28 11:55]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2005-12-28 11:56]
"SigmatelSysTrayApp"="stsystra.exe" [2006-03-24 16:30 C:\WINDOWS\stsystra.exe]
"Document Manager"="C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe" [2006-03-09 12:26]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-12-09 20:29]
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2006-04-06 14:58]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2005-02-16 16:15]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-16 16:15]
"Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2006-01-12 20:52]
"@"="" []
"USPTO Direct Recovery"="C:\Program Files\USPTO\etdirrcv.exe" [2006-07-25 17:02]
"SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-09-29 16:00]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-10-25 19:58]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-10-30 10:36]
"PrintServer Diagnostic"="C:\Program Files\Print Server\PTP\PSDiagnostic.exe" [2004-11-24 17:09]
"Linksys WMB54G Utility"="C:\Program Files\Linksys Wireless-G Music Bridge\WMB54G.exe" [2005-11-23 01:26]
"vptray"="C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe" [2003-05-21 01:21]
"NapsterShell"="C:\Program Files\Napster\napster.exe" [2007-01-12 19:36]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ModemOnHold"="C:\Program Files\NetWaiting\netWaiting.exe" [2003-09-10 02:24]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:00]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AdobeUpdateManager.exe" [2006-03-30 16:45]

C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup
Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2006-07-25 12:21:13]
Bluetooth Manager.lnk - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng1.exe [2005-06-16 11:11:42]
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2006-07-16 18:19:39]
EMBASSY Trust Suite Secure Update.lnk - C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe [2005-11-30 09:39:02]
Mobile User VPN.lnk - C:\Program Files\WatchGuard\Mobile User VPN\SafeCfg.exe [2006-07-25 16:21:50]
Service Manager.lnk - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2005-05-03 22:07:32]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=wxvault.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages msv1_0 wvauth

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\aawservice]


Contents of the 'Scheduled Tasks' folder
2007-07-23 21:12:00 C:\WINDOWS\tasks\AppleSoftwareUpdate.job

**************************************************************************

catchme 0.3.1040 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-24 00:05:42
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden registry entries …

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:000004eb

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-24 0:06:25
C:\ComboFix-quarantined-files.txt … 2007-07-24 00:06
C:\ComboFix2.txt … 2007-07-23 21:37
C:\ComboFix3.txt … 2007-07-23 16:54

— E O F —
Post #8
Open notepad and copy/paste the text in the quotebox below into it:

Folder::
C:\Program Files\Ubflmvno
C:\Program Files\gtgxgxoz
C:\Program Files\zifyjkra
C:\Program Files\Dizahmui
C:\Program Files\Cpnjlivh
C:\bebde2bad5b403213688bba4bbbe11
C:bc9d0489ce7b742eb0f1753
C:\13dce9340f3c077b7eaf872d
C:\ed7f64169df9e70815245fca73c2


Save this as Save this as "CFScript"


[external image: Posted Image]

Refering to the picture above, drag CFScript.txt into ComboFix.exe

Then post the results log
Post #9
"david" - 2007-07-26 11:45:54 - ComboFix 07-07-17.8 - Service Pack 2 NTFS
Command switches used :: C:\Documents and Settings\david\Desktop\CFScript.txt


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\13dce9340f3c077b7eaf872d
C:\13dce9340f3c077b7eaf872d\update\update.exe
C:\13dce9340f3c077b7eaf872d\update\updspapi.dll
C:\13dce9340f3c077b7eaf872d\update\wpdinstallutil.dll
C:\bebde2bad5b403213688bba4bbbe11
C:\ed7f64169df9e70815245fca73c2
C:\ed7f64169df9e70815245fca73c2\update\update.exe
C:\ed7f64169df9e70815245fca73c2\update\updspapi.dll
C:\ed7f64169df9e70815245fca73c2\update\wudfcustom.dll
C:\Program Files\Cpnjlivh
C:\Program Files\Cpnjlivh\xmeileyw.exe
C:\Program Files\Dizahmui
C:\Program Files\Dizahmui\haksjaff.dll
C:\Program Files\gtgxgxoz
C:\Program Files\gtgxgxoz\crahivyt.dll
C:\Program Files\Ubflmvno
C:\Program Files\Ubflmvno\fmoanjgc.exe
C:\Program Files\zifyjkra
C:\Program Files\zifyjkra\zojwvsjy.dll


((((((((((((((((((((((((( Files Created from 2007-06-26 to 2007-07-26 )))))))))))))))))))))))))))))))


2007-07-23 23:09 d——– C:\Program Files\MSXML 6.0
2007-07-23 23:09 d——– C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-07-23 23:05 d——– C:\WINDOWS\network diagnostic
2007-07-23 23:01 d——– C:\Program Files\MSXML 4.0
2007-07-23 23:00 d——– C:\Program Files\MSBuild
2007-07-23 22:58 d——– C:\WINDOWS\system32\XPSViewer
2007-07-23 22:57 d——– C:\Program Files\Reference Assemblies
2007-07-23 22:56 14,048 ——— C:\WINDOWS\system32\spmsg2.dll
2007-07-23 22:55 d——– C:bc9d0489ce7b742eb0f1753
2007-07-23 22:54 d——– C:\WINDOWS\system32\LogFiles
2007-07-23 22:54 d——– C:\WINDOWS\system32\drivers\UMDF
2007-07-23 22:41 36,352 ——— C:\WINDOWS\system32\tsgqec.dll
2007-07-23 22:41 288,768 ——— C:\WINDOWS\system32\rhttpaa.dll
2007-07-23 22:41 116,736 ——— C:\WINDOWS\system32\aaclient.dll
2007-07-23 22:15 76,560 –a—— C:\WINDOWS\system32\drivers\tmcomm.sys
2007-07-23 20:18 d——– C:\DOCUME~1\david\.housecall6.6
2007-07-20 12:08 51,200 –a—— C:\WINDOWS\nircmd.exe


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-26 16:34:11 737,280 —-a-w C:\WINDOWS\iun6002.exe
2007-07-25 16:15:53 166,501 —-a-w C:\WINDOWS\system32\nvModes.dat
2007-07-25 13:23:46 ——– d—–w C:\DOCUME~1\david\APPLIC~1\Wave Systems Corp
2007-07-24 18:36:58 ——– d–h–w C:\Program Files\InstallShield Installation Information
2007-07-24 03:55:51 ——– d—–w C:\Program Files\Windows Media Connect 2
2007-06-27 17:27:52 ——– d—–w C:\Program Files\RogueRemover
2007-06-20 17:57:50 ——– d—–w C:\Program Files\Lavasoft
2007-06-20 17:57:08 ——– d—–w C:\Program Files\Common Files\Wise Installation Wizard
2007-06-17 16:08:20 ——– d—–w C:\Program Files\Common Files\Roxio Shared
2007-06-17 16:08:16 ——– d—–w C:\Program Files\Roxio
2007-06-17 16:08:16 ——– d—–w C:\DOCUME~1\david\APPLIC~1\Roxio
2007-06-17 15:59:28 ——– d—–w C:\Program Files\Common Files\sndp202
2007-06-16 17:27:54 2,273 —-a-w C:\DOCUME~1\david\APPLIC~1\SAS7_000.DAT
2007-06-11 22:54:31 ——– d—–w C:\DOCUME~1\david\APPLIC~1\OfficeUpdate12
2007-06-04 20:18:48 9,344 —-a-w C:\WINDOWS\system32\drivers\NSDriver.sys
2007-06-04 20:17:02 8,320 —-a-w C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-06-04 20:14:56 6,272 —-a-w C:\WINDOWS\system32\drivers\AWRTPD.sys
2007-05-21 16:36:16 524,288 —-a-w C:\WINDOWS\opuc.dll
2007-05-16 15:12:02 683,520 —-a-w C:\WINDOWS\system32\inetcomm.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2006-01-12 20:38 63128 –a—— C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5CA3D70E-1895-11CF-8E15-001234567890}]
2005-09-08 05:20 110652 –a—— C:\WINDOWS\System32\DLA\DLASHX_W.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]
2005-09-24 00:41 231160 –a—— C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2005-10-07 12:13]
"nwiz"="nwiz.exe" [2006-05-01 15:46 C:\WINDOWS\system32\nwiz.exe]
"NVHotkey"="nvHotkey.dll" [2006-05-01 15:46 C:\WINDOWS\system32\nvhotkey.dll]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-11-19 17:48]
"IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2005-12-28 11:55]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2005-12-28 11:56]
"SigmatelSysTrayApp"="stsystra.exe" [2006-03-24 16:30 C:\WINDOWS\stsystra.exe]
"Document Manager"="C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe" [2006-03-09 12:26]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-12-09 20:29]
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2006-04-06 14:58]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2005-02-16 16:15]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-16 16:15]
"Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2006-01-12 20:52]
"@"="" []
"USPTO Direct Recovery"="C:\Program Files\USPTO\etdirrcv.exe" [2006-07-25 17:02]
"SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-09-29 16:00]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-10-25 19:58]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-10-30 10:36]
"PrintServer Diagnostic"="C:\Program Files\Print Server\PTP\PSDiagnostic.exe" [2004-11-24 17:09]
"Linksys WMB54G Utility"="C:\Program Files\Linksys Wireless-G Music Bridge\WMB54G.exe" [2005-11-23 01:26]
"vptray"="C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe" [2003-05-21 01:21]
"NapsterShell"="C:\Program Files\Napster\napster.exe" [2007-01-12 19:36]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ModemOnHold"="C:\Program Files\NetWaiting\netWaiting.exe" [2003-09-10 02:24]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:00]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AdobeUpdateManager.exe" [2006-03-30 16:45]

C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup
Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2006-07-25 12:21:13]
Bluetooth Manager.lnk - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng1.exe [2005-06-16 11:11:42]
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2006-07-16 18:19:39]
EMBASSY Trust Suite Secure Update.lnk - C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe [2005-11-30 09:39:02]
Mobile User VPN.lnk - C:\Program Files\WatchGuard\Mobile User VPN\SafeCfg.exe [2006-07-25 16:21:50]
Service Manager.lnk - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2005-05-03 22:07:32]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=wxvault.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages msv1_0 wvauth

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\aawservice]


Contents of the 'Scheduled Tasks' folder
2007-07-23 21:12:00 C:\WINDOWS\tasks\AppleSoftwareUpdate.job

**************************************************************************

catchme 0.3.1040 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-26 11:48:12
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden registry entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-26 11:48:44
C:\ComboFix-quarantined-files.txt … 2007-07-26 11:48
C:\ComboFix2.txt … 2007-07-24 00:06
C:\ComboFix3.txt … 2007-07-23 21:37

— E O F —

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI