What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved]Qwerty12.exe, Pop Ups, Slow Computer

11 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
my computer just recently started acting up. Its running slow, and I now have pop ups for supposed spyware removal compaines. I ran HiJackThis, and this is my log from that: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 1:11:46 PM, on 8/4/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe c:\program files\mcafee.com\agent\mcdetect.exe c:\PROGRA~1\mcafee.com\vso\mcshield.exe c:\PROGRA~1\mcafee.com\agent\mctskshd.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\mcafee.com\agent\McAgent.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Owner\Application Data\tmp3.tmp.exe C:\WINDOWS\system32\qwerty12.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank O2 - BHO: (no name) - {66b44022-d601-4c61-b661-3c942694ab93} - C:\WINDOWS\system32\kb1ass.dll O2 - BHO: (no name) - {C6039E6C-BDE9-4de5-BB40-768CAA584FDC} - C:\WINDOWS\system32\tmp4.tmp.dll O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\McAgent.exe O4 - HKLM\..\Run: [SystemOptimizer] rundll32.exe "C:\WINDOWS\hgdddd.dll",forkonce O20 - AppInit_DLLs: c:\windows\system32\ddayxut.dll O20 - Winlogon Notify: kb1ass - C:\WINDOWS\SYSTEM32\kb1ass.dll O23 - Service: AutoComplete Service (Autocomplete) - Acesoft - C:\Program Files\Acesoft\Tracks Eraser Pro\autocomp.exe O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\qwerty12.exe O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
Post #2
Hi! Welcome to the Tom Coyote forums.
My name is Scotty. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research.
Please be patient and I'd be grateful if you would note the following:
  • I will working be on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for this issue on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.

Please make a uninstall list using HijackThis
To access the Uninstall Manager you would do the following:

1. Start HijackThis
2. Click on the Config button
3. Click on the Misc Tools button
4. Click on the Open Uninstall Manager button.
5. Click on the Save list… button and specify where you would like to save this file. When you press Save button a notepad will open with the contents of that file. Simply copy and paste the contents of that notepad here in a reply.


Download and Run ComboFix
  • Download this file from below:

    Here
  • Disconnect from the Internet, than disable your anti-virus and any real-time anti-spyware monitors that are running.
  • Then double click combofix.exe & follow the prompts.
  • When finished, it shall produce a log for you. Post that log in your next reply with a new HijackThis log.
Note 1: Do not mouseclick combofix's window whilst it's running. That may cause it to stall
Note 2:Remember to re-enable your anti-virus and anti-spyware before reconnecting to the Internet.
Post #3
Hi Scotty, Here's my ComboFix Log:

ComboFix 07-08-05.3 - "Owner" 2007-08-04 16:36:34.1 [GMT -5:00] - NTFS
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.True
* Created a new restore point


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\a.exe
C:\DOCUME~1\Owner\APPLIC~1\tmp2.tmp.exe
C:\DOCUME~1\Owner\APPLIC~1\tmp3.tmp.exe
C:\DOCUME~1\Owner\APPLIC~1\tmp4.tmp.exe
C:\DOCUME~1\Owner\APPLIC~1\tmp7.tmp.exe
C:\DOCUME~1\Owner\APPLIC~1\tmp8.tmp.exe
C:\DOCUME~1\Owner\APPLIC~1\tmp9.tmp.exe
C:\WINDOWS\144.exe
C:\WINDOWS\system32\dn6899cc7f.dat
C:\WINDOWS\system32\kb1ass.dll
C:\WINDOWS\system32\qwerty12.exe
C:\WINDOWS\system32\tmp4.tmp.dll
C:\WINDOWS\xhelper.dll


((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


——-\LEGACY_DOMAINSERVICE
——-\DomainService


((((((((((((((((((((((((( Files Created from 2007-07-04 to 2007-08-04 )))))))))))))))))))))))))))))))


2007-08-04 16:57 92,726 –a—— C:\WINDOWS\SYSTEM32\lprimm.dll
2007-08-04 16:57 138,289 –a—— C:\WINDOWS\SYSTEM32\dn6899cc7f.dat
2007-08-04 16:57 105,478 –a—— C:\WINDOWS\SYSTEM32\jkhhh.exe
2007-08-04 16:34 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-08-04 16:00 131,448 –a—— C:\WINDOWS\vttstr.dll
2007-08-04 12:45 131,448 –a—— C:\WINDOWS\vtutsr.dll
2007-08-03 19:16 d——– C:\Program Files\Trend Micro
2007-08-03 19:12 131,464 –a—— C:\WINDOWS\urrqrp.dll
2007-08-03 18:51 131,464 –a—— C:\WINDOWS\rqonmn.dll
2007-08-03 18:23 13,380 –a—— C:\WINDOWS\SYSTEM32\ddayxut.dll
2007-07-30 21:44 84,992 –a—— C:\WINDOWS\WebAssist.dll
2007-07-22 16:40 23,616 –a—— C:\WINDOWS\SYSTEM32\flPWS85J.exe
2007-07-21 16:23 7,294 –a—— C:\qnwe.exe
2007-07-16 23:14 d——– C:\DOCUME~1\Owner\APPLIC~1\Viewpoint


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-03 18:35 ——— d——– C:\Program Files\Spyware Doctor
2007-07-30 21:51 23617 –a—— C:\WINDOWS\system32\d386o67N.exe
2007-07-05 00:06 ——— d——– C:\Program Files\Google
2007-07-03 10:12 ——— d——– C:\DOCUME~1\Owner\APPLIC~1\HouseCall 6.6
2003-04-06 20:46 226 –a—— C:\Program Files\INSTALL.LOG
2002-06-17 11:13 119009 –a—— C:\DOCUME~1\Owner\APPLIC~1\dl1.exe
2001-07-22 02:45:40 94,784 –sh–w C:\WINDOWS\twain.dll
2004-08-04 07:56:46 50,688 –sh–w C:\WINDOWS\twain_32.dll
2004-09-08 00:34:53 694,272 –sh–w C:\WINDOWS\SYSTEM\abrwave.exe
2004-09-08 03:47:38 694,272 –sh–w C:\WINDOWS\SYSTEM\wmscab.exe
2004-08-04 07:56:42 1,028,096 –sha-w C:\WINDOWS\SYSTEM32\mfc42.dll
2004-08-04 07:56:43 54,784 –sh–w C:\WINDOWS\SYSTEM32\msvcirt.dll
2004-08-04 07:56:43 413,696 –sha-w C:\WINDOWS\SYSTEM32\msvcp60.dll
2004-08-04 07:56:44 553,472 –sh–w C:\WINDOWS\SYSTEM32\oleaut32.dll
2004-08-04 07:56:44 83,456 –sha-w C:\WINDOWS\SYSTEM32\olepro32.dll
2004-08-04 07:56:55 11,776 –sh–w C:\WINDOWS\SYSTEM32\regsvr32.exe


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MCUpdateExe"="C:\PROGRA~1\mcafee.com\agent\McUpdate.exe" [2006-01-11 12:05]
"MCAgentExe"="c:\PROGRA~1\mcafee.com\agent\McAgent.exe" [2005-09-22 18:29]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\lprimm]
lprimm.dll 2007-08-04 16:57 92726 C:\WINDOWS\SYSTEM32\lprimm.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=c:\windows\system32\ddayxut.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, zwebauth.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DXM6Patch_981116]
C:\WINDOWS\p_981116.exe /Q:A

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
C:\WINDOWS\System32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpsysdrv]
c:\windows\system\hpsysdrv.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iestart]
C:\Program Files\Windows Media Player\wmplayer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
C:\Program Files\Microsoft Works\WkDetect.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
RUNDLL32.EXE NvQTwk,NvCplDaemon initialize

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PS2]
C:\WINDOWS\system32\ps2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Recguard]
C:\WINDOWS\SMINST\RECGUARD.EXE

R2 enodpl;enodpl;C:\WINDOWS\system32\drivers\enodpl.sys
R2 tandpl;tandpl;C:\WINDOWS\system32\drivers\tandpl.sys
R3 DLH5X;D-Link DL10050 based Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\DLH5XND5.sys
R3 ltmodem5;LT Modem Driver;C:\WINDOWS\system32\DRIVERS\ltmdmnt.sys
R3 ms_mpu401;Microsoft MPU-401 MIDI UART Driver;C:\WINDOWS\system32\drivers\msmpu401.sys
R3 MxlW2k;MxlW2k;C:\WINDOWS\system32\drivers\MxlW2k.sys
R3 Ps2;PS2;C:\WINDOWS\system32\DRIVERS\PS2.sys
R3 RT73;Belkin USB Network Adapter;C:\WINDOWS\system32\DRIVERS\rt73.sys
S3 gUSBSTOi;gUSBSTOi;\??\C:\DOCUME~1\Owner\LOCALS~1\Temp\gUSBSTOi.sys
S3 iAimFP0;iAimFP0;C:\WINDOWS\system32\DRIVERS\wADV01nt.sys
S3 iAimFP1;iAimFP1;C:\WINDOWS\system32\DRIVERS\wADV02NT.sys
S3 iAimFP2;iAimFP2;C:\WINDOWS\system32\DRIVERS\wADV05NT.sys
S3 iAimFP3;iAimFP3;C:\WINDOWS\system32\DRIVERS\wSiINTxx.sys
S3 iAimFP4;iAimFP4;C:\WINDOWS\system32\DRIVERS\wVchNTxx.sys
S3 iAimTV0;iAimTV0;C:\WINDOWS\system32\DRIVERS\wATV01nt.sys
S3 iAimTV1;iAimTV1;C:\WINDOWS\system32\DRIVERS\wATV02NT.sys
S3 iAimTV3;iAimTV3;C:\WINDOWS\system32\DRIVERS\wATV04nt.sys
S3 iAimTV4;iAimTV4;C:\WINDOWS\system32\DRIVERS\wCh7xxNT.sys
S3 rtl8029;Realtek RTL8029(AS)-based PCI Ethernet Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\RTL8029.SYS
S3 wanatw;WAN Miniport (ATW);C:\WINDOWS\system32\DRIVERS\wanatw4.sys


Contents of the 'Scheduled Tasks' folder
2007-08-04 05:01:02 C:\WINDOWS\Tasks\At1.job
2007-08-02 14:00:32 C:\WINDOWS\Tasks\At10.job - C:\WINDOWS\system32\d386o67N.exe
2007-08-02 15:00:36 C:\WINDOWS\Tasks\At11.job
2007-07-22 16:01:21 C:\WINDOWS\Tasks\At12.job - C:\WINDOWS\system32\d386o67N.exe
2007-07-22 17:00:34 C:\WINDOWS\Tasks\At13.job - C:\WINDOWS\system32\d386o67N.exe
2007-08-04 18:00:32 C:\WINDOWS\Tasks\At14.job - C:\WINDOWS\system32\d386o67N.exe
2007-07-21 19:01:24 C:\WINDOWS\Tasks\At15.job - C:\WINDOWS\system32\d386o67N.exe
2007-07-21 20:00:31 C:\WINDOWS\Tasks\At16.job - C:\WINDOWS\system32\d386o67N.exe
2007-08-04 21:00:30 C:\WINDOWS\Tasks\At17.job - C:\WINDOWS\system32\d386o67N.exe
2007-08-04 22:00:33 C:\WINDOWS\Tasks\At18.job - C:\WINDOWS\system32\d386o67N.exe
2007-07-22 23:00:33 C:\WINDOWS\Tasks\At19.job - C:\WINDOWS\system32\d386o67N.exe
2007-08-04 06:00:56 C:\WINDOWS\Tasks\At2.job - C:\WINDOWS\system32\d386o67N.exe
2007-08-04 00:00:31 C:\WINDOWS\Tasks\At20.job
2007-08-02 01:00:33 C:\WINDOWS\Tasks\At21.job - C:\WINDOWS\system32\d386o67N.exe
2007-08-02 02:00:30 C:\WINDOWS\Tasks\At22.job
2007-08-03 03:00:30 C:\WINDOWS\Tasks\At23.job - C:\WINDOWS\system32\d386o67N.exe
2007-08-03 04:00:34 C:\WINDOWS\Tasks\At24.job - C:\WINDOWS\system32\d386o67N.exe
2007-08-04 05:01:02 C:\WINDOWS\Tasks\At25.job - C:\WINDOWS\system32\flPWS85J.exe
2007-08-04 06:00:56 C:\WINDOWS\Tasks\At26.job - C:\WINDOWS\system32\flPWS85J.exe
2007-07-22 21:40:48 C:\WINDOWS\Tasks\At27.job - C:\WINDOWS\system32\flPWS85J.exe
2007-07-22 21:40:48 C:\WINDOWS\Tasks\At28.job - C:\WINDOWS\system32\flPWS85J.exe
2007-07-22 21:40:48 C:\WINDOWS\Tasks\At29.job - C:\WINDOWS\system32\flPWS85J.exe
2007-07-15 07:00:32 C:\WINDOWS\Tasks\At3.job - C:\WINDOWS\system32\d386o67N.exe
2007-07-22 21:40:48 C:\WINDOWS\Tasks\At30.job - C:\WINDOWS\system32\flPWS85J.exe
2007-07-22 21:40:48 C:\WINDOWS\Tasks\At31.job - C:\WINDOWS\system32\flPWS85J.exe
2007-07-22 21:40:48 C:\WINDOWS\Tasks\At32.job - C:\WINDOWS\system32\flPWS85J.exe
2007-08-03 13:00:34 C:\WINDOWS\Tasks\At33.job - C:\WINDOWS\system32\flPWS85J.exe
2007-08-02 14:00:32 C:\WINDOWS\Tasks\At34.job - C:\WINDOWS\system32\flPWS85J.exe
2007-08-02 15:00:36 C:\WINDOWS\Tasks\At35.job
2007-07-22 21:40:48 C:\WINDOWS\Tasks\At36.job - C:\WINDOWS\system32\flPWS85J.exe
2007-07-22 21:40:48 C:\WINDOWS\Tasks\At37.job
2007-08-04 18:00:32 C:\WINDOWS\Tasks\At38.job - C:\WINDOWS\system32\flPWS85J.exe
2007-07-22 21:40:48 C:\WINDOWS\Tasks\At39.job - C:\WINDOWS\system32\flPWS85J.exe
2007-06-13 04:56:26 C:\WINDOWS\Tasks\At4.job - C:\WINDOWS\system32\d386o67N.exe
2007-07-22 21:40:48 C:\WINDOWS\Tasks\At40.job - C:\WINDOWS\system32\flPWS85J.exe
2007-08-04 21:00:30 C:\WINDOWS\Tasks\At41.job - C:\WINDOWS\system32\flPWS85J.exe
2007-08-04 22:00:33 C:\WINDOWS\Tasks\At42.job - C:\WINDOWS\system32\flPWS85J.exe
2007-07-22 23:00:33 C:\WINDOWS\Tasks\At43.job - C:\WINDOWS\system32\flPWS85J.exe
2007-08-04 00:00:31 C:\WINDOWS\Tasks\At44.job - C:\WINDOWS\system32\flPWS85J.exe
2007-08-02 01:00:32 C:\WINDOWS\Tasks\At45.job - C:\WINDOWS\system32\flPWS85J.exe
2007-08-02 02:00:31 C:\WINDOWS\Tasks\At46.job - C:\WINDOWS\system32\flPWS85J.exe
2007-08-03 03:00:30 C:\WINDOWS\Tasks\At47.job - C:\WINDOWS\system32\flPWS85J.exe
2007-08-03 04:00:34 C:\WINDOWS\Tasks\At48.job - C:\WINDOWS\system32\flPWS85J.exe
2007-06-13 04:56:26 C:\WINDOWS\Tasks\At5.job - C:\WINDOWS\system32\d386o67N.exe
2007-06-13 04:56:26 C:\WINDOWS\Tasks\At6.job - C:\WINDOWS\system32\d386o67N.exe
2007-06-13 04:56:26 C:\WINDOWS\Tasks\At7.job - C:\WINDOWS\system32\d386o67N.exe
2007-06-13 04:56:26 C:\WINDOWS\Tasks\At8.job - C:\WINDOWS\system32\d386o67N.exe
2007-08-03 13:00:34 C:\WINDOWS\Tasks\At9.job - C:\WINDOWS\system32\d386o67N.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-04 16:57:47
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden registry entries …

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:00000031

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-04 17:02:32 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-08-04 17:01

— E O F —
Post #4
Hey Scotty… here's my Uninstall List you requested. Ad-Aware SE Personal Adobe Acrobat 5.0 Adobe Flash Player ActiveX AOL Instant Messenger Atomic Pop Battlecraft 1942 Battlefield 1942 Battlefield 1942: The Road To Rome BlasterBall Wild BroadJump Client Foundation Call of Duty Game of the Year Edition CorrectConnect DarkOrbit Detto Migration Kit DivX DivX Player Easy Internet Sign-up EAX Unified Empire Earth Exam Coach for Life & Health Insurance Version 2 Free Internet Eraser 2.05 GameSpy Arcade GemMaster Ghost Recon Google Toolbar for Internet Explorer HijackThis 2.0.2 HouseCall 6.6 hp center HP Instant Support HP Photo Printing Software HP PhotoSmart C200 Photo Imaging Software HP PhotoSmart Photo Printing Software Inactive HP Printer Drivers (Remove only) Inactive HP ScanJet Drivers (Remove only) J2SE Runtime Environment 5.0 Update 1 J2SE Runtime Environment 5.0 Update 4 J2SE Runtime Environment 5.0 Update 6 Java 2 Runtime Environment Standard Edition v1.3.1_04 Java 2 Runtime Environment, SE v1.4.2_08 MasterSplitter Program McAfee SecurityCenter McAfee VirusScan Medal of Honor Allied Assault Medal of Honor Allied Assault™ Spearhead Microsoft .NET Framework 1.1 Microsoft Age of Empires II Microsoft Data Access Components KB870669 Microsoft Money 2001 Microsoft Works 6.0 Microsoft Works and Money 2001 Setup Launcher Microsoft XML Parser and SDK Morpheus 1.9 MSN Gaming Zone MSXML4 Parser MUSICMATCH Jukebox My Photo Center Napster v2.0 BETA 10.4 Network Play System (Patching) NVIDIA Windows 2000/XP Display Drivers PC-Doctor for Windows PigPen PS2 Python 1.5 combined Win32 extensions Python 1.5.2 (final) Quicken Financial Center QuickTime RealOne Player S3 Gamma S3 Savage4 Family Display Switch2 Utility SabreWing 2 Security Update for Step By Step Interactive Training (KB898458) Security Update for Windows Media Player 9 (KB911565) Security Update for Windows XP (KB883939) Security Update for Windows XP (KB890046) Security Update for Windows XP (KB893756) Security Update for Windows XP (KB896358) Security Update for Windows XP (KB896422) Security Update for Windows XP (KB896423) Security Update for Windows XP (KB896424) Security Update for Windows XP (KB896428) Security Update for Windows XP (KB896688) Security Update for Windows XP (KB899587) Security Update for Windows XP (KB899588) Security Update for Windows XP (KB899591) Security Update for Windows XP (KB900725) Security Update for Windows XP (KB901017) Security Update for Windows XP (KB901214) Security Update for Windows XP (KB902400) Security Update for Windows XP (KB903235) Security Update for Windows XP (KB904706) Security Update for Windows XP (KB905414) Security Update for Windows XP (KB905749) Security Update for Windows XP (KB905915) Security Update for Windows XP (KB908519) Security Update for Windows XP (KB912919) Shockwave SimCity 2000® Special Edition Speedway Spy Sweeper Spyware Doctor 2.1 Tcl 8.0.5 for Windows Terminal Services Client The Playa The Sims Complete Collection Tom Clancy's Rainbow Six 3: Raven Shield Tracks Eraser Pro v5.0 ubi.com Ulead Photo Explorer 4.2 Update for Windows XP (KB894391) Update for Windows XP (KB896727) Update for Windows XP (KB898461) Update for Windows XP (KB910437) Viewpoint Manager (Remove Only) Viewpoint Media Player War Games Virtual Warfare Demo Windows Installer 3.1 (KB893803) Windows Installer 3.1 (KB893803) Windows XP Hotfix - KB834707 Windows XP Hotfix - KB867282 Windows XP Hotfix - KB873333 Windows XP Hotfix - KB873339 Windows XP Hotfix - KB885250 Windows XP Hotfix - KB885835 Windows XP Hotfix - KB885836 Windows XP Hotfix - KB886185 Windows XP Hotfix - KB887472 Windows XP Hotfix - KB887742 Windows XP Hotfix - KB888113 Windows XP Hotfix - KB888302 Windows XP Hotfix - KB890047 Windows XP Hotfix - KB890175 Windows XP Hotfix - KB890859 Windows XP Hotfix - KB890923 Windows XP Hotfix - KB891781 Windows XP Hotfix - KB893066 Windows XP Hotfix - KB893086 Windows XP Service Pack 2 XIII Yahoo! Anti-Spy Yahoo! extras Yahoo! Install Manager Yahoo! Internet Mail Yahoo! Messenger Yahoo! Toolbar
Post #5
Here's the HiJackThis Log again : Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 5:15:05 PM, on 8/4/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe c:\program files\mcafee.com\agent\mcdetect.exe c:\PROGRA~1\mcafee.com\vso\mcshield.exe c:\PROGRA~1\mcafee.com\agent\mctskshd.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\RunDll32.exe C:\PROGRA~1\mcafee.com\agent\McAgent.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\explorer.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\McAgent.exe O20 - AppInit_DLLs: c:\windows\system32\ddayxut.dll O20 - Winlogon Notify: lprimm - C:\WINDOWS\SYSTEM32\lprimm.dll O23 - Service: AutoComplete Service (Autocomplete) - Acesoft - C:\Program Files\Acesoft\Tracks Eraser Pro\autocomp.exe O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe – End of file - 1989 bytes
Post #6
Hi Maxwells

Open Notepad and Copy/Paste the text in the codebox below into it: 

File::
C:\WINDOWS\SYSTEM32\lprimm.dll
C:\WINDOWS\SYSTEM32\dn6899cc7f.dat
C:\WINDOWS\SYSTEM32\jkhhh.exe
C:\WINDOWS\vttstr.dll
C:\WINDOWS\vtutsr.dll
C:\WINDOWS\urrqrp.dll
C:\WINDOWS\rqonmn.dll
C:\WINDOWS\SYSTEM32\ddayxut.dll
C:\WINDOWS\WebAssist.dll
C:\WINDOWS\SYSTEM32\flPWS85J.exe
C:\qnwe.exe
C:\WINDOWS\system32\d386o67N.exe

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\lprimm]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=""

Save this as "CFScript"

[external image: Posted Image]


Refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log with a new HijackThis log.
Post #7
Here's the ComboFix Log… anything looking horrible so far??

ComboFix 07-08-05.3 - "Owner" 2007-08-04 17:27:25.2 [GMT -5:00] - NTFS
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.True
Command switches used :: C:\Documents and Settings\Owner\Desktop\CFScript.txt
* Created a new restore point

FILE::
C:\WINDOWS\SYSTEM32\lprimm.dll
C:\WINDOWS\SYSTEM32\dn6899cc7f.dat
C:\WINDOWS\SYSTEM32\jkhhh.exe
C:\WINDOWS\vttstr.dll
C:\WINDOWS\vtutsr.dll
C:\WINDOWS\urrqrp.dll
C:\WINDOWS\rqonmn.dll
C:\WINDOWS\SYSTEM32\ddayxut.dll
C:\WINDOWS\WebAssist.dll
C:\WINDOWS\SYSTEM32\flPWS85J.exe
C:\qnwe.exe
C:\WINDOWS\system32\d386o67N.exe


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\qnwe.exe
C:\WINDOWS\rqonmn.dll
C:\WINDOWS\system32\d386o67N.exe
C:\WINDOWS\SYSTEM32\ddayxut.dll
C:\WINDOWS\system32\dn6899cc7f.dat
C:\WINDOWS\SYSTEM32\flPWS85J.exe
C:\WINDOWS\system32\jkhhh.exe
C:\WINDOWS\system32\lprimm.dll
C:\WINDOWS\urrqrp.dll
C:\WINDOWS\vttstr.dll
C:\WINDOWS\vtutsr.dll
C:\WINDOWS\WebAssist.dll


((((((((((((((((((((((((( Files Created from 2007-07-04 to 2007-08-04 )))))))))))))))))))))))))))))))


2007-08-04 16:34 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-08-03 19:16 d——– C:\Program Files\Trend Micro
2007-07-16 23:14 d——– C:\DOCUME~1\Owner\APPLIC~1\Viewpoint


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-03 18:35 ——— d——– C:\Program Files\Spyware Doctor
2007-07-05 00:06 ——— d——– C:\Program Files\Google
2007-07-03 10:12 ——— d——– C:\DOCUME~1\Owner\APPLIC~1\HouseCall 6.6
2003-04-06 20:46 226 –a—— C:\Program Files\INSTALL.LOG
2002-06-17 11:13 119009 –a—— C:\DOCUME~1\Owner\APPLIC~1\dl1.exe
2001-07-22 02:45:40 94,784 –sh–w C:\WINDOWS\twain.dll
2004-08-04 07:56:46 50,688 –sh–w C:\WINDOWS\twain_32.dll
2004-09-08 00:34:53 694,272 –sh–w C:\WINDOWS\SYSTEM\abrwave.exe
2004-09-08 03:47:38 694,272 –sh–w C:\WINDOWS\SYSTEM\wmscab.exe
2004-08-04 07:56:42 1,028,096 –sha-w C:\WINDOWS\SYSTEM32\mfc42.dll
2004-08-04 07:56:43 54,784 –sh–w C:\WINDOWS\SYSTEM32\msvcirt.dll
2004-08-04 07:56:43 413,696 –sha-w C:\WINDOWS\SYSTEM32\msvcp60.dll
2004-08-04 07:56:44 553,472 –sh–w C:\WINDOWS\SYSTEM32\oleaut32.dll
2004-08-04 07:56:44 83,456 –sha-w C:\WINDOWS\SYSTEM32\olepro32.dll
2004-08-04 07:56:55 11,776 –sh–w C:\WINDOWS\SYSTEM32\regsvr32.exe


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MCUpdateExe"="C:\PROGRA~1\mcafee.com\agent\McUpdate.exe" [2006-01-11 12:05]
"MCAgentExe"="c:\PROGRA~1\mcafee.com\agent\McAgent.exe" [2005-09-22 18:29]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, zwebauth.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DXM6Patch_981116]
C:\WINDOWS\p_981116.exe /Q:A

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
C:\WINDOWS\System32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpsysdrv]
c:\windows\system\hpsysdrv.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iestart]
C:\Program Files\Windows Media Player\wmplayer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
C:\Program Files\Microsoft Works\WkDetect.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
RUNDLL32.EXE NvQTwk,NvCplDaemon initialize

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PS2]
C:\WINDOWS\system32\ps2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Recguard]
C:\WINDOWS\SMINST\RECGUARD.EXE

R2 enodpl;enodpl;C:\WINDOWS\system32\drivers\enodpl.sys
R2 tandpl;tandpl;C:\WINDOWS\system32\drivers\tandpl.sys
R3 DLH5X;D-Link DL10050 based Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\DLH5XND5.sys
R3 ltmodem5;LT Modem Driver;C:\WINDOWS\system32\DRIVERS\ltmdmnt.sys
R3 ms_mpu401;Microsoft MPU-401 MIDI UART Driver;C:\WINDOWS\system32\drivers\msmpu401.sys
R3 MxlW2k;MxlW2k;C:\WINDOWS\system32\drivers\MxlW2k.sys
R3 Ps2;PS2;C:\WINDOWS\system32\DRIVERS\PS2.sys
R3 RT73;Belkin USB Network Adapter;C:\WINDOWS\system32\DRIVERS\rt73.sys
S3 gUSBSTOi;gUSBSTOi;\??\C:\DOCUME~1\Owner\LOCALS~1\Temp\gUSBSTOi.sys
S3 iAimFP0;iAimFP0;C:\WINDOWS\system32\DRIVERS\wADV01nt.sys
S3 iAimFP1;iAimFP1;C:\WINDOWS\system32\DRIVERS\wADV02NT.sys
S3 iAimFP2;iAimFP2;C:\WINDOWS\system32\DRIVERS\wADV05NT.sys
S3 iAimFP3;iAimFP3;C:\WINDOWS\system32\DRIVERS\wSiINTxx.sys
S3 iAimFP4;iAimFP4;C:\WINDOWS\system32\DRIVERS\wVchNTxx.sys
S3 iAimTV0;iAimTV0;C:\WINDOWS\system32\DRIVERS\wATV01nt.sys
S3 iAimTV1;iAimTV1;C:\WINDOWS\system32\DRIVERS\wATV02NT.sys
S3 iAimTV3;iAimTV3;C:\WINDOWS\system32\DRIVERS\wATV04nt.sys
S3 iAimTV4;iAimTV4;C:\WINDOWS\system32\DRIVERS\wCh7xxNT.sys
S3 rtl8029;Realtek RTL8029(AS)-based PCI Ethernet Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\RTL8029.SYS
S3 wanatw;WAN Miniport (ATW);C:\WINDOWS\system32\DRIVERS\wanatw4.sys


Contents of the 'Scheduled Tasks' folder
2007-08-04 05:01:02 C:\WINDOWS\Tasks\At1.job
2007-08-02 14:00:32 C:\WINDOWS\Tasks\At10.job - C:\WINDOWS\system32\d386o67N.exe
2007-08-02 15:00:36 C:\WINDOWS\Tasks\At11.job
2007-07-22 16:01:21 C:\WINDOWS\Tasks\At12.job - C:\WINDOWS\system32\d386o67N.exe
2007-07-22 17:00:34 C:\WINDOWS\Tasks\At13.job - C:\WINDOWS\system32\d386o67N.exe
2007-08-04 18:00:32 C:\WINDOWS\Tasks\At14.job - C:\WINDOWS\system32\d386o67N.exe
2007-07-21 19:01:24 C:\WINDOWS\Tasks\At15.job - C:\WINDOWS\system32\d386o67N.exe
2007-07-21 20:00:31 C:\WINDOWS\Tasks\At16.job - C:\WINDOWS\system32\d386o67N.exe
2007-08-04 21:00:30 C:\WINDOWS\Tasks\At17.job - C:\WINDOWS\system32\d386o67N.exe
2007-08-04 22:00:33 C:\WINDOWS\Tasks\At18.job - C:\WINDOWS\system32\d386o67N.exe
2007-07-22 23:00:33 C:\WINDOWS\Tasks\At19.job - C:\WINDOWS\system32\d386o67N.exe
2007-08-04 06:00:56 C:\WINDOWS\Tasks\At2.job - C:\WINDOWS\system32\d386o67N.exe
2007-08-04 00:00:31 C:\WINDOWS\Tasks\At20.job
2007-08-02 01:00:33 C:\WINDOWS\Tasks\At21.job - C:\WINDOWS\system32\d386o67N.exe
2007-08-02 02:00:30 C:\WINDOWS\Tasks\At22.job
2007-08-03 03:00:30 C:\WINDOWS\Tasks\At23.job - C:\WINDOWS\system32\d386o67N.exe
2007-08-03 04:00:34 C:\WINDOWS\Tasks\At24.job - C:\WINDOWS\system32\d386o67N.exe
2007-08-04 05:01:02 C:\WINDOWS\Tasks\At25.job - C:\WINDOWS\system32\flPWS85J.exe
2007-08-04 06:00:56 C:\WINDOWS\Tasks\At26.job - C:\WINDOWS\system32\flPWS85J.exe
2007-07-22 21:40:48 C:\WINDOWS\Tasks\At27.job - C:\WINDOWS\system32\flPWS85J.exe
2007-07-22 21:40:48 C:\WINDOWS\Tasks\At28.job - C:\WINDOWS\system32\flPWS85J.exe
2007-07-22 21:40:48 C:\WINDOWS\Tasks\At29.job - C:\WINDOWS\system32\flPWS85J.exe
2007-07-15 07:00:32 C:\WINDOWS\Tasks\At3.job - C:\WINDOWS\system32\d386o67N.exe
2007-07-22 21:40:48 C:\WINDOWS\Tasks\At30.job - C:\WINDOWS\system32\flPWS85J.exe
2007-07-22 21:40:48 C:\WINDOWS\Tasks\At31.job - C:\WINDOWS\system32\flPWS85J.exe
2007-07-22 21:40:48 C:\WINDOWS\Tasks\At32.job - C:\WINDOWS\system32\flPWS85J.exe
2007-08-03 13:00:34 C:\WINDOWS\Tasks\At33.job - C:\WINDOWS\system32\flPWS85J.exe
2007-08-02 14:00:32 C:\WINDOWS\Tasks\At34.job - C:\WINDOWS\system32\flPWS85J.exe
2007-08-02 15:00:36 C:\WINDOWS\Tasks\At35.job
2007-07-22 21:40:48 C:\WINDOWS\Tasks\At36.job - C:\WINDOWS\system32\flPWS85J.exe
2007-07-22 21:40:48 C:\WINDOWS\Tasks\At37.job
2007-08-04 18:00:32 C:\WINDOWS\Tasks\At38.job - C:\WINDOWS\system32\flPWS85J.exe
2007-07-22 21:40:48 C:\WINDOWS\Tasks\At39.job - C:\WINDOWS\system32\flPWS85J.exe
2007-06-13 04:56:26 C:\WINDOWS\Tasks\At4.job - C:\WINDOWS\system32\d386o67N.exe
2007-07-22 21:40:48 C:\WINDOWS\Tasks\At40.job - C:\WINDOWS\system32\flPWS85J.exe
2007-08-04 21:00:30 C:\WINDOWS\Tasks\At41.job - C:\WINDOWS\system32\flPWS85J.exe
2007-08-04 22:00:33 C:\WINDOWS\Tasks\At42.job - C:\WINDOWS\system32\flPWS85J.exe
2007-07-22 23:00:33 C:\WINDOWS\Tasks\At43.job - C:\WINDOWS\system32\flPWS85J.exe
2007-08-04 00:00:31 C:\WINDOWS\Tasks\At44.job - C:\WINDOWS\system32\flPWS85J.exe
2007-08-02 01:00:32 C:\WINDOWS\Tasks\At45.job - C:\WINDOWS\system32\flPWS85J.exe
2007-08-02 02:00:31 C:\WINDOWS\Tasks\At46.job - C:\WINDOWS\system32\flPWS85J.exe
2007-08-03 03:00:30 C:\WINDOWS\Tasks\At47.job - C:\WINDOWS\system32\flPWS85J.exe
2007-08-03 04:00:34 C:\WINDOWS\Tasks\At48.job - C:\WINDOWS\system32\flPWS85J.exe
2007-06-13 04:56:26 C:\WINDOWS\Tasks\At5.job - C:\WINDOWS\system32\d386o67N.exe
2007-06-13 04:56:26 C:\WINDOWS\Tasks\At6.job - C:\WINDOWS\system32\d386o67N.exe
2007-06-13 04:56:26 C:\WINDOWS\Tasks\At7.job - C:\WINDOWS\system32\d386o67N.exe
2007-06-13 04:56:26 C:\WINDOWS\Tasks\At8.job - C:\WINDOWS\system32\d386o67N.exe
2007-08-03 13:00:34 C:\WINDOWS\Tasks\At9.job - C:\WINDOWS\system32\d386o67N.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-04 17:42:50
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden registry entries …

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:0000007e

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-04 17:47:25 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-08-04 17:46
C:\ComboFix2.txt … 2007-08-04 17:02

— E O F —
Post #8
Here's the latest HijackThis Log: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 5:50:19 PM, on 8/4/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe c:\program files\mcafee.com\agent\mcdetect.exe c:\PROGRA~1\mcafee.com\vso\mcshield.exe c:\PROGRA~1\mcafee.com\agent\mctskshd.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\mcafee.com\agent\McAgent.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\McAgent.exe O23 - Service: AutoComplete Service (Autocomplete) - Acesoft - C:\Program Files\Acesoft\Tracks Eraser Pro\autocomp.exe O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe – End of file - 1871 bytes
Post #9
Hi Maxwells

Your HijackThis log is remarkably empty. Have you no programs running, except for McAfee?

Open Notepad and Copy/Paste the text in the codebox below into it: 

File::
C:\WINDOWS\Tasks\At1.job
C:\WINDOWS\Tasks\At10.job
C:\WINDOWS\Tasks\At11.job
C:\WINDOWS\Tasks\At12.job
C:\WINDOWS\Tasks\At13.job
C:\WINDOWS\Tasks\At14.job
C:\WINDOWS\Tasks\At15.job
C:\WINDOWS\Tasks\At16.job
C:\WINDOWS\Tasks\At17.job
C:\WINDOWS\Tasks\At18.job
C:\WINDOWS\Tasks\At19.job
C:\WINDOWS\Tasks\At2.job
C:\WINDOWS\Tasks\At20.job
C:\WINDOWS\Tasks\At21.job
C:\WINDOWS\Tasks\At22.job
C:\WINDOWS\Tasks\At23.job
C:\WINDOWS\Tasks\At24.job
C:\WINDOWS\Tasks\At25.job
C:\WINDOWS\Tasks\At26.job
C:\WINDOWS\Tasks\At27.job
C:\WINDOWS\Tasks\At28.job
C:\WINDOWS\Tasks\At29.job
C:\WINDOWS\Tasks\At3.job
C:\WINDOWS\Tasks\At30.job
C:\WINDOWS\Tasks\At31.job
C:\WINDOWS\Tasks\At32.job
C:\WINDOWS\Tasks\At33.job
C:\WINDOWS\Tasks\At34.job
C:\WINDOWS\Tasks\At35.job
C:\WINDOWS\Tasks\At36.job
C:\WINDOWS\Tasks\At37.job
C:\WINDOWS\Tasks\At38.job
C:\WINDOWS\Tasks\At39.job
C:\WINDOWS\Tasks\At4.job
C:\WINDOWS\Tasks\At40.job
C:\WINDOWS\Tasks\At41.job
C:\WINDOWS\Tasks\At42.job
C:\WINDOWS\Tasks\At43.job
C:\WINDOWS\Tasks\At44.job
C:\WINDOWS\Tasks\At45.job
C:\WINDOWS\Tasks\At46.job
C:\WINDOWS\Tasks\At47.job
C:\WINDOWS\Tasks\At48.job
C:\WINDOWS\Tasks\At5.job
C:\WINDOWS\Tasks\At6.job
C:\WINDOWS\Tasks\At7.job
C:\WINDOWS\Tasks\At8.job
C:\WINDOWS\Tasks\At9.job

Save this as "CFScript"

[external image: Posted Image]


Refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log with a new HijackThis log.
  • Please go HERE to run PandaActiveScan…

  • Once you are on the Panda site click the Scan your PC button
  • A new window will open…click the Check Now button
  • Enter your Country
  • Enter your State/Province
  • Enter your e-mail address and click send
  • Select either Home User or Company
  • Click the big Scan Now button
  • If it wants to install an ActiveX component allow it
  • It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)

  • When download is complete, click on My Computer to start the scan
  • When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to your desktop.
Post the report back here with the CFScript log and new HijackThis log, please.
Post #10
Hi Scotty.. I'm not sure about why there's a short list on that HijackThis Log. I'm not all that incredibly techincal. Is it bad to not have a lot of processes? Also, what all are we doing so far? Is there anything on here you see that is some bad stuff? Or not so bad??

Here's the ComboFix Log:

ComboFix 07-08-05.3 - "Owner" 2007-08-04 18:19:17.3 [GMT -5:00] - NTFS
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.True
Command switches used :: C:\Documents and Settings\Owner\Desktop\CFScript.txt
* Created a new restore point

FILE::
C:\WINDOWS\Tasks\At1.job
C:\WINDOWS\Tasks\At10.job
C:\WINDOWS\Tasks\At11.job
C:\WINDOWS\Tasks\At12.job
C:\WINDOWS\Tasks\At13.job
C:\WINDOWS\Tasks\At14.job
C:\WINDOWS\Tasks\At15.job
C:\WINDOWS\Tasks\At16.job
C:\WINDOWS\Tasks\At17.job
C:\WINDOWS\Tasks\At18.job
C:\WINDOWS\Tasks\At19.job
C:\WINDOWS\Tasks\At2.job
C:\WINDOWS\Tasks\At20.job
C:\WINDOWS\Tasks\At21.job
C:\WINDOWS\Tasks\At22.job
C:\WINDOWS\Tasks\At23.job
C:\WINDOWS\Tasks\At24.job
C:\WINDOWS\Tasks\At25.job
C:\WINDOWS\Tasks\At26.job
C:\WINDOWS\Tasks\At27.job
C:\WINDOWS\Tasks\At28.job
C:\WINDOWS\Tasks\At29.job
C:\WINDOWS\Tasks\At3.job
C:\WINDOWS\Tasks\At30.job
C:\WINDOWS\Tasks\At31.job
C:\WINDOWS\Tasks\At32.job
C:\WINDOWS\Tasks\At33.job
C:\WINDOWS\Tasks\At34.job
C:\WINDOWS\Tasks\At35.job
C:\WINDOWS\Tasks\At36.job
C:\WINDOWS\Tasks\At37.job
C:\WINDOWS\Tasks\At38.job
C:\WINDOWS\Tasks\At39.job
C:\WINDOWS\Tasks\At4.job
C:\WINDOWS\Tasks\At40.job
C:\WINDOWS\Tasks\At41.job
C:\WINDOWS\Tasks\At42.job
C:\WINDOWS\Tasks\At43.job
C:\WINDOWS\Tasks\At44.job
C:\WINDOWS\Tasks\At45.job
C:\WINDOWS\Tasks\At46.job
C:\WINDOWS\Tasks\At47.job
C:\WINDOWS\Tasks\At48.job
C:\WINDOWS\Tasks\At5.job
C:\WINDOWS\Tasks\At6.job
C:\WINDOWS\Tasks\At7.job
C:\WINDOWS\Tasks\At8.job
C:\WINDOWS\Tasks\At9.job


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\Tasks\At1.job
C:\WINDOWS\Tasks\At10.job
C:\WINDOWS\Tasks\At11.job
C:\WINDOWS\Tasks\At12.job
C:\WINDOWS\Tasks\At13.job
C:\WINDOWS\Tasks\At14.job
C:\WINDOWS\Tasks\At15.job
C:\WINDOWS\Tasks\At16.job
C:\WINDOWS\Tasks\At17.job
C:\WINDOWS\Tasks\At18.job
C:\WINDOWS\Tasks\At19.job
C:\WINDOWS\Tasks\At2.job
C:\WINDOWS\Tasks\At20.job
C:\WINDOWS\Tasks\At21.job
C:\WINDOWS\Tasks\At22.job
C:\WINDOWS\Tasks\At23.job
C:\WINDOWS\Tasks\At24.job
C:\WINDOWS\Tasks\At25.job
C:\WINDOWS\Tasks\At26.job
C:\WINDOWS\Tasks\At27.job
C:\WINDOWS\Tasks\At28.job
C:\WINDOWS\Tasks\At29.job
C:\WINDOWS\Tasks\At3.job
C:\WINDOWS\Tasks\At30.job
C:\WINDOWS\Tasks\At31.job
C:\WINDOWS\Tasks\At32.job
C:\WINDOWS\Tasks\At33.job
C:\WINDOWS\Tasks\At34.job
C:\WINDOWS\Tasks\At35.job
C:\WINDOWS\Tasks\At36.job
C:\WINDOWS\Tasks\At37.job
C:\WINDOWS\Tasks\At38.job
C:\WINDOWS\Tasks\At39.job
C:\WINDOWS\Tasks\At4.job
C:\WINDOWS\Tasks\At40.job
C:\WINDOWS\Tasks\At41.job
C:\WINDOWS\Tasks\At42.job
C:\WINDOWS\Tasks\At43.job
C:\WINDOWS\Tasks\At44.job
C:\WINDOWS\Tasks\At45.job
C:\WINDOWS\Tasks\At46.job
C:\WINDOWS\Tasks\At47.job
C:\WINDOWS\Tasks\At48.job
C:\WINDOWS\Tasks\At5.job
C:\WINDOWS\Tasks\At6.job
C:\WINDOWS\Tasks\At7.job
C:\WINDOWS\Tasks\At8.job
C:\WINDOWS\Tasks\At9.job


((((((((((((((((((((((((( Files Created from 2007-07-04 to 2007-08-04 )))))))))))))))))))))))))))))))


2007-08-04 16:34 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-08-03 19:16 d——– C:\Program Files\Trend Micro
2007-07-16 23:14 d——– C:\DOCUME~1\Owner\APPLIC~1\Viewpoint


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-03 18:35 ——— d——– C:\Program Files\Spyware Doctor
2007-07-05 00:06 ——— d——– C:\Program Files\Google
2007-07-03 10:12 ——— d——– C:\DOCUME~1\Owner\APPLIC~1\HouseCall 6.6
2003-04-06 20:46 226 –a—— C:\Program Files\INSTALL.LOG
2002-06-17 11:13 119009 –a—— C:\DOCUME~1\Owner\APPLIC~1\dl1.exe
2001-07-22 02:45:40 94,784 –sh–w C:\WINDOWS\twain.dll
2004-08-04 07:56:46 50,688 –sh–w C:\WINDOWS\twain_32.dll
2004-09-08 00:34:53 694,272 –sh–w C:\WINDOWS\SYSTEM\abrwave.exe
2004-09-08 03:47:38 694,272 –sh–w C:\WINDOWS\SYSTEM\wmscab.exe
2004-08-04 07:56:42 1,028,096 –sha-w C:\WINDOWS\SYSTEM32\mfc42.dll
2004-08-04 07:56:43 54,784 –sh–w C:\WINDOWS\SYSTEM32\msvcirt.dll
2004-08-04 07:56:43 413,696 –sha-w C:\WINDOWS\SYSTEM32\msvcp60.dll
2004-08-04 07:56:44 553,472 –sh–w C:\WINDOWS\SYSTEM32\oleaut32.dll
2004-08-04 07:56:44 83,456 –sha-w C:\WINDOWS\SYSTEM32\olepro32.dll
2004-08-04 07:56:55 11,776 –sh–w C:\WINDOWS\SYSTEM32\regsvr32.exe


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MCUpdateExe"="C:\PROGRA~1\mcafee.com\agent\McUpdate.exe" [2006-01-11 12:05]
"MCAgentExe"="c:\PROGRA~1\mcafee.com\agent\McAgent.exe" [2005-09-22 18:29]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, zwebauth.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DXM6Patch_981116]
C:\WINDOWS\p_981116.exe /Q:A

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
C:\WINDOWS\System32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpsysdrv]
c:\windows\system\hpsysdrv.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iestart]
C:\Program Files\Windows Media Player\wmplayer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
C:\Program Files\Microsoft Works\WkDetect.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
RUNDLL32.EXE NvQTwk,NvCplDaemon initialize

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PS2]
C:\WINDOWS\system32\ps2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Recguard]
C:\WINDOWS\SMINST\RECGUARD.EXE

R2 enodpl;enodpl;C:\WINDOWS\system32\drivers\enodpl.sys
R2 tandpl;tandpl;C:\WINDOWS\system32\drivers\tandpl.sys
R3 DLH5X;D-Link DL10050 based Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\DLH5XND5.sys
R3 ltmodem5;LT Modem Driver;C:\WINDOWS\system32\DRIVERS\ltmdmnt.sys
R3 ms_mpu401;Microsoft MPU-401 MIDI UART Driver;C:\WINDOWS\system32\drivers\msmpu401.sys
R3 MxlW2k;MxlW2k;C:\WINDOWS\system32\drivers\MxlW2k.sys
R3 Ps2;PS2;C:\WINDOWS\system32\DRIVERS\PS2.sys
R3 RT73;Belkin USB Network Adapter;C:\WINDOWS\system32\DRIVERS\rt73.sys
S3 gUSBSTOi;gUSBSTOi;\??\C:\DOCUME~1\Owner\LOCALS~1\Temp\gUSBSTOi.sys
S3 iAimFP0;iAimFP0;C:\WINDOWS\system32\DRIVERS\wADV01nt.sys
S3 iAimFP1;iAimFP1;C:\WINDOWS\system32\DRIVERS\wADV02NT.sys
S3 iAimFP2;iAimFP2;C:\WINDOWS\system32\DRIVERS\wADV05NT.sys
S3 iAimFP3;iAimFP3;C:\WINDOWS\system32\DRIVERS\wSiINTxx.sys
S3 iAimFP4;iAimFP4;C:\WINDOWS\system32\DRIVERS\wVchNTxx.sys
S3 iAimTV0;iAimTV0;C:\WINDOWS\system32\DRIVERS\wATV01nt.sys
S3 iAimTV1;iAimTV1;C:\WINDOWS\system32\DRIVERS\wATV02NT.sys
S3 iAimTV3;iAimTV3;C:\WINDOWS\system32\DRIVERS\wATV04nt.sys
S3 iAimTV4;iAimTV4;C:\WINDOWS\system32\DRIVERS\wCh7xxNT.sys
S3 rtl8029;Realtek RTL8029(AS)-based PCI Ethernet Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\RTL8029.SYS
S3 wanatw;WAN Miniport (ATW);C:\WINDOWS\system32\DRIVERS\wanatw4.sys


**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-04 18:30:12
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden registry entries …

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:000000e8

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-04 18:32:25
C:\ComboFix-quarantined-files.txt … 2007-08-04 18:31
C:\ComboFix2.txt … 2007-08-04 17:47
C:\ComboFix3.txt … 2007-08-04 17:02

— E O F —
Post #11
Hi We're almost done. Will need that Panda scan report and new HJT log. I dont think it's a bad thing, having a short log. It is a bit unusual.
Post #12
Ok… sounds good. Maybe you will be able to tell me what all had me messed up after I post the rest of this stuff. I really do appreciate your help. Hang with me for a few more minutes… I'm wraping up the Panda Scan now.
Post #13
Here's my Panda Scan: Incident Status Location Adware:adware/savenow Not disinfected Windows Registry Hacktool:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\menu.jr-57e3489c-27f76421.zip[Dummy.class] Virus:Trj/ClassLoader.P Disinfected C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\menu.jr-57e3489c-27f76421.zip[Worker.class] Adware:Adware/SpySheriff Not disinfected C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\menu.jr-57e3489c-27f76421.zip[javautil.zip][loader.exe] Spyware:Cookie/Winantivirus Not disinfected C:\Documents and Settings\Owner\Cookies\owner@winantivirus[2].txt Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\Documents and Settings\Owner\Desktop\ComboFix.exe[nircmd.exe] Security Risk:HackTool/Gendel.A Not disinfected C:\gendel32.exe Potentially unwanted tool:Application/KillApp.B Not disinfected C:\hp\bin\KillIt.exe Virus:Generic Malware Disinfected C:\Program Files\GameSpy Arcade\Services\_common\PortraitLoader.dll Spyware:Spyware/Support Not disinfected C:\Program Files\Support.com\bin\tgcmd.exe Spyware:Spyware/New.net Not disinfected C:\Program Files\Yahoo!\YPSR\Quarantine\20050903083727531.zip[WINDOWS/NDNuninstall4_34.exe] Spyware:Spyware/New.net Not disinfected C:\Program Files\Yahoo!\YPSR\Quarantine\20050903083727531.zip[WINDOWS/NDNuninstall4_50.exe] Spyware:Spyware/New.net Not disinfected C:\Program Files\Yahoo!\YPSR\Quarantine\20050903083727531.zip[WINDOWS/NDNuninstall4_80.exe] Spyware:Spyware/New.net Not disinfected C:\Program Files\Yahoo!\YPSR\Quarantine\20050903083727531.zip[WINDOWS/NDNuninstall4_88.exe] Virus:Generic Trojan Disinfected C:\QooBox\Quarantine\C\a.exe.vir Adware:Adware/PopupSearches Not disinfected C:\QooBox\Quarantine\C\DOCUME~1\Owner\APPLIC~1\tmp3.tmp.exe.vir Adware:Adware/PopupSearches Not disinfected C:\QooBox\Quarantine\C\DOCUME~1\Owner\APPLIC~1\tmp8.tmp.exe.vir Virus:W32/ZlFake.A.drp Disinfected C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\d386o67N.exe.vir Virus:Trj/Agent.GAN Disinfected C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\flPWS85J.exe.vir Adware:Adware/PopupSearches Not disinfected C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\qwerty12.exe.vir Virus:Generic Trojan Disinfected C:\QooBox\Quarantine\C\WINDOWS\xhelper.dll.vir Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\WINDOWS\nircmd.exe Spyware:Spyware/Virtumonde Not disinfected C:\WINDOWS\SYSTEM\abrwave.exe Spyware:Spyware/Virtumonde Not disinfected C:\WINDOWS\SYSTEM\wmscab.exe
Post #14
Here's my HijackThis Log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:26:32 PM, on 8/4/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\PROGRA~1\mcafee.com\agent\McAgent.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\McAgent.exe
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O23 - Service: AutoComplete Service (Autocomplete) - Acesoft - C:\Program Files\Acesoft\Tracks Eraser Pro\autocomp.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

–
End of file - 2012 bytes
Post #15
Hi Maxwells

What you had was pretty much a few trojans and Vundo. Once one trojan gets on your system it opens up a door to let other malware in. I will make recommendations on staying clean at the end.

Open Notepad and Copy/Paste the text in the codebox below into it: 

File::
C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\menu.jr-57e3489c-27f76421.zip
C:\Documents and Settings\Owner\Cookies\owner@winantivirus[2].txt
C:\gendel32.exe
C:\WINDOWS\SYSTEM\abrwave.exe
C:\WINDOWS\SYSTEM\wmscab.exe

Folder::
C:\Program Files\Support.com
C:\Program Files\Yahoo!\YPSR\Quarantine\20050903083727531.zip

Save this as "CFScript"

[external image: Posted Image]


Refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI