What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Help Needed With Possible Blaster Worm Problem

27 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #31
You'll need to keep the drives physically separate or cross contamination will just continue here. Is the OS intact on that second drive - is it bootable as a stand alone setup? One plan would be to clean this drive, then do the same to the other, but one at a time. I can see the infeciton has returned some tricks to block progress, including hidden folders with the same names as file names, causing Windows to use the wrong path when you try to run something like cmd.exe. We'll have to be cautious removing those, as some tools won't know the difference in some cases (and as it is not designed for this type of file tricks, be very cautious about trying to use that Duplicate File Remover item or any tools we don't discuss here).


Likely overkill, but let's have ComboFix assist with two fake folder removals, which should open the door for the removal of the others.


Open Notepad (Start > Run > in the Open field type: notepad)
Click: OK

Copy/ paste the text below to Notepad:

Suspect::
C:\Limit.exe
File:: 
C:\Limit.exe
Folder::
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\system32\command.com
C:\WINDOWS\system32\cmd.com

Save as CFScript.txt
Change the "Save as type" to "All Files"
Save it to the Desktop.


[external image: Posted Image]

Referring to the picture above, drag CFScript.txt into ComboFix.exe

When the scan completes it will create a new C:\ComboFix.txt. Post that log in your next reply.

CAUTION: Do not mouse-click ComboFix while it is running. It may cause it to stall.


Post back that log. Also for the Silent Runners we have may not have used so far, Go Here and download Silent Runners to your desktop. Run it, and post back here the log it creates. If your AV queries the script, allow it to run. It's not malicious. It will create a file named Startup Programs, and will notify when the scan is complete. Copy the log from the Startup Programs file back here.

Also ComboFix will have generated a zipped file on your desktop called Submit [Date Time].zip. See if you can again go here and follow the instructions to upload the that file.
Post #32 last edited
When i used dupliacte file remover it was only for music and picture files, i wouldn't trust myself using it for system files.

This is the log for ComboFix :

ComboFix 07-08-17.2 - "bigsi69" 2007-08-20 15:02:22.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.712 [GMT 1:00]
Command switches used :: C:\Documents and Settings\bigsi69\Desktop\CFScript.txt
* Created a new restore point

FILE::
C:\Limit.exe


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\Limit.exe
C:\WINDOWS\system32\cmd.com
C:\WINDOWS\system32\command.com
C:\WINDOWS\system32\taskmgr.exe


((((((((((((((((((((((((( Files Created from 2007-07-20 to 2007-08-20 )))))))))))))))))))))))))))))))


2007-08-20 10:57 388,608 –a—— C:\WINDOWS\system32\cmd.exe
2007-08-19 10:58 d——– C:\Program Files\Nokia
2007-08-19 10:58 d——– C:\Program Files\Common Files\PCSuite
2007-08-19 10:58 d——– C:\Program Files\Common Files\Nokia
2007-08-19 10:50 d-a—— C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
2007-08-19 10:50 d——– C:\Program Files\Your Uninstaller 2006
2007-08-19 10:50 d——– C:\DOCUME~1\bigsi69\APPLIC~1\URSoft
2007-08-15 15:55 d——– C:\Program Files\MSXML 6.0
2007-08-13 18:55 d——– C:\DOCUME~1\bigsi69\APPLIC~1\Ahead
2007-08-13 18:52 d——– C:\Program Files\coverXP
2007-08-13 18:22 d——– C:\Program Files\Common Files\Ahead
2007-08-13 18:22 d——– C:\Program Files\Ahead
2007-08-13 16:30 d——– C:\WINDOWS\ERUNT
2007-08-13 09:43 d——– C:\Program Files\MSXML 4.0
2007-08-12 21:19 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ahead
2007-08-12 21:16 d——– C:\Program Files\Nero
2007-08-12 21:16 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Nero
2007-08-12 18:38 d——– C:\Program Files\Blubster
2007-08-12 17:36 d——– C:\Program Files\Duplicate File Remover
2007-08-12 16:22 146,432 –a—— C:\WINDOWS\regedit.exe
2007-08-11 21:17 d——– C:\DOCUME~1\bigsi69\Phone Browser
2007-08-11 21:11 d——– C:\Program Files\PC Connectivity Solution
2007-08-11 21:11 d——– C:\Program Files\DIFX
2007-08-11 21:11 d——– C:\DOCUME~1\bigsi69\APPLIC~1\PC Suite
2007-08-11 21:11 d——– C:\DOCUME~1\bigsi69\APPLIC~1\Nokia
2007-08-11 21:11 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\PC Suite
2007-08-11 21:10 90,624 –a—— C:\WINDOWS\system32\nmwcdcls.dll
2007-08-11 21:10 d—-c— C:\WINDOWS\system32\DRVSTORE
2007-08-11 21:10 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Installations
2007-08-11 16:37 d——– C:\DOCUME~1\bigsi69\APPLIC~1\WinRAR
2007-08-11 15:53 d——– C:\WINDOWS\pss
2007-08-10 20:28 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-08-10 20:23 d——– C:\VundoFix Backups
2007-08-10 17:35 d——– C:\Program Files\SlySoft
2007-08-10 03:56 d——– C:\DOCUME~1\bigsi69\APPLIC~1\Azureus
2007-08-10 03:53 d——– C:\Program Files\Azureus
2007-08-09 20:01 d——– C:\Program Files\Real
2007-08-09 20:01 d——– C:\Program Files\Common Files\xing shared
2007-08-09 20:01 d——– C:\Program Files\Common Files\Real
2007-08-09 20:01 d——– C:\DOCUME~1\bigsi69\APPLIC~1\Real
2007-08-09 17:30 d——– C:\WINDOWS\CSC
2007-08-09 16:16 d——– C:\Program Files\Google
2007-08-09 16:16 d——– C:\DOCUME~1\bigsi69\APPLIC~1\Google
2007-08-09 16:16 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
2007-08-09 15:19 524,288 –ah—– C:\DOCUME~1\ADMINI~1\NTUSER.DAT
2007-08-09 08:19 d——– C:\DOCUME~1\bigsi69\APPLIC~1\vlc
2007-08-09 06:26 d——– C:\Program Files\Windows Media Connect 2
2007-08-09 06:25 d——– C:\WINDOWS\system32\LogFiles
2007-08-09 06:25 d——– C:\WINDOWS\system32\drivers\UMDF
2007-08-09 06:23 d——– C:\WINDOWS\network diagnostic
2007-08-09 06:18 d——– C:\Program Files\MSBuild
2007-08-09 06:15 d——– C:\WINDOWS\system32\XPSViewer
2007-08-09 06:15 d——– C:\Program Files\Reference Assemblies
2007-08-09 06:14 14,048 ——— C:\WINDOWS\system32\spmsg2.dll
2007-08-09 06:08 23,040 ——— C:\WINDOWS\kb913800.exe
2007-08-08 06:53 d——– C:\WINDOWS\RegisteredPackages
2007-08-08 06:50 d——– C:\WINDOWS\system32\URTTemp
2007-08-08 06:39 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
2007-08-08 06:36 23,856 –a—— C:\WINDOWS\system32\spupdsvc.exe
2007-08-08 06:36 d——– C:\WINDOWS\system32\PreInstall
2007-08-08 06:34 d–hs—- C:\DOCUME~1\bigsi69\UserData
2007-08-08 06:34 d——– C:\WINDOWS\system32\SoftwareDistribution
2007-08-08 06:26 8 –a—— C:\WINDOWS\system32\nvModes.dat
2007-08-08 06:26 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\nView_Profiles
2007-08-08 06:24 208,896 –a—— C:\WINDOWS\system32\NVUNINST.EXE
2007-08-08 06:24 208,896 –a—— C:\WINDOWS\system32\nvudisp.exe
2007-08-08 06:24 d——– C:\WINDOWS\nview
2007-08-08 06:23 d——– C:\NVIDIA
2007-08-08 06:21 90,112 -r——- C:\WINDOWS\soundman.exe
2007-08-08 06:21 82,944 –a—— C:\WINDOWS\system32\drivers\wdmaud.sys
2007-08-08 06:21 7,552 –a—— C:\WINDOWS\system32\drivers\MSKSSRV.sys
2007-08-08 06:21 60,800 –a—— C:\WINDOWS\system32\drivers\sysaudio.sys
2007-08-08 06:21 60,288 –a—— C:\WINDOWS\system32\drivers\drmk.sys
2007-08-08 06:21 6,400 –a—— C:\WINDOWS\system32\drivers\splitter.sys
2007-08-08 06:21 54,272 –a—— C:\WINDOWS\system32\drivers\swmidi.sys
2007-08-08 06:21 52,864 –a—— C:\WINDOWS\system32\drivers\DMusic.sys
2007-08-08 06:21 5,376 –a—— C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2007-08-08 06:21 40,960 -r——- C:\WINDOWS\system32\ChCfg.exe
2007-08-08 06:21 4,992 –a—— C:\WINDOWS\system32\drivers\MSPQM.sys
2007-08-08 06:21 4,096 –a—— C:\WINDOWS\system32\ksuser.dll
2007-08-08 06:21 3,727,680 -r——- C:\WINDOWS\system32\drivers\alcxwdm.sys
2007-08-08 06:21 2,944 –a—— C:\WINDOWS\system32\drivers\drmkaud.sys
2007-08-08 06:21 172,416 –a—— C:\WINDOWS\system32\drivers\kmixer.sys
2007-08-08 06:21 157,184 -r——- C:\WINDOWS\system32\RtlCPAPI.dll
2007-08-08 06:21 145,792 –a—— C:\WINDOWS\system32\drivers\portcls.sys
2007-08-08 06:21 142,464 –a—— C:\WINDOWS\system32\drivers\aec.sys
2007-08-08 06:21 10,459,136 -r——- C:\WINDOWS\system32\RTLCPL.exe
2007-08-08 06:21 d——– C:\Program Files\Realtek Sound Manager
2007-08-08 06:21 d——– C:\Program Files\AvRack
2007-08-08 06:20 307,200 -r——- C:\WINDOWS\alcupd.exe
2007-08-08 06:20 212,992 -r——- C:\WINDOWS\alcrmv.exe
2007-08-08 06:20 d–h—– C:\Program Files\InstallShield Installation Information
2007-08-08 06:20 d——– C:\Program Files\Realtek AC97
2007-08-08 06:20 d——– C:\Program Files\Common Files\InstallShield
2007-08-08 06:19 5,824 –a—— C:\WINDOWS\system32\drivers\ASUSHWIO.SYS
2007-08-08 06:19 5,810 -ra—— C:\WINDOWS\system32\drivers\ASACPI.sys
2007-08-08 06:17 4,718,592 –ah—– C:\DOCUME~1\bigsi69\NTUSER.DAT
2007-08-08 06:15 1,310,720 –ah—– C:\DOCUME~1\LOCALS~1\NTUSER.DAT
2007-08-08 06:15 d——– C:\WINDOWS\SoftwareDistribution
2007-08-08 06:15 d——– C:\WINDOWS\Prefetch


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2010-08-08 03:13 ——— d——– C:\DOCUME~1\bigsi69\APPLIC~1\Lavasoft
2010-08-08 03:12 ——— d——– C:\Program Files\Lavasoft
2010-08-08 03:12 ——— d——– C:\Program Files\Common Files\Wise Installation Wizard
2008-08-08 02:56 ——— d——– C:\DOCUME~1\bigsi69\APPLIC~1\SopCast
2008-08-08 02:55 ——— d——– C:\Program Files\VideoLAN
2008-08-08 02:53 ——— d——– C:\Program Files\SopCast
2008-08-08 01:04 2970 –a—— C:\WINDOWS\pchealth\helpctr\PackageStore\SkuStore.bin
2008-08-08 01:03 8972 –a—— C:\WINDOWS\pchealth\helpctr\Config\Cntstore.bin
2007-08-13 18:47 ——— d——– C:\Program Files\EPSON
2007-07-04 09:48 132904 –a—— C:\WINDOWS\system32\drivers\imagesrv.sys
2007-07-04 09:48 11304 –a—— C:\WINDOWS\system32\drivers\imagedrv.sys
2007-06-27 19:05 972072 –a—— C:\WINDOWS\UNNeroMediaHome.exe
2007-06-26 14:12 972072 –a—— C:\WINDOWS\UNNeroVision.exe
2007-06-26 07:08 1104896 –a—— C:\WINDOWS\system32\msxml3.dll
2007-06-24 11:05 557056 -r-hs—- C:\WINDOWS\system32\MSCONFIG.EXE
2007-06-24 11:05 557056 -r-hs—- C:\WINDOWS\MSCONFIG.EXE
2007-06-19 14:31 282112 –a—— C:\WINDOWS\system32\gdi32.dll
2007-06-13 11:23 1033216 –a—— C:\WINDOWS\explorer.exe
2007-06-08 08:11 831048 –a—— C:\WINDOWS\system32\WudfUpdate_01005.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-05 13:56]
"nwiz"="nwiz.exe" [2007-04-19 13:26 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-04-19 13:26]
"PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 15:10]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-04-19 13:26]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-15 13:00]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Nokia.PCSync"=C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray]
"C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

R3 FETNDIS;VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\fetnd5.sys


**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-20 15:03:33
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-20 15:04:02
C:\ComboFix-quarantined-files.txt … 2007-08-20 15:03
C:\ComboFix2.txt … 2007-08-20 11:22

— E O F —




And this is the one from silent runners:



"Silent Runners.vbs", revision 52, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
———————————

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
"MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"ehTray" = "C:\WINDOWS\ehome\ehtray.exe" [MS]
"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]
"NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS]
"PCSuiteTrayApplication" = "C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup" ["Nokia"]
"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)
-> {HKLM…CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\PROGRA~1\SPYBOT~1\SDHelper.dll" ["Safer Networking Limited"]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)
-> {HKLM…CLSID} = "SSVHelper Class"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll" ["Sun Microsystems, Inc."]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Display Panning CPL Extension"
-> {HKLM…CLSID} = "Display Panning CPL Extension"
\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "HyperTerminal Icon Ext"
-> {HKLM…CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]
"{EFA24E62-B078-11d0-89E4-00C04FC9E26E}" = "History Band"
-> {HKLM…CLSID} = "History Band"
\InProcServer32\(Default) = "C:\WINDOWS\system32\shdocvw.dll" [MS]
"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"
-> {HKLM…CLSID} = "DesktopContext Class"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"
-> {HKLM…CLSID} = "NVIDIA CPL Extension"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"
-> {HKLM…CLSID} = "Desktop Explorer"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
-> {HKLM…CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"
-> {HKLM…CLSID} = "nView Desktop Context Menu"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM…CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player"
-> {HKLM…CLSID} = "RealOne Player Context Menu Class"
\InProcServer32\(Default) = "C:\Program Files\Real\RealPlayer\rpshell.dll" ["RealNetworks, Inc."]
"{97F68CE3-7146-45FF-BE24-D9A7DD7CB8A2}" = "NeroCoverEd Live Icons"
-> {HKLM…CLSID} = "NeroCoverEdLiveIcons Class"
\InProcServer32\(Default) = "C:\Program Files\Nero\Nero 7\Nero CoverDesigner\CoverEdExtension.dll" ["Nero AG"]
"{B327765E-D724-4347-8B16-78AE18552FC3}" = "NeroDigitalIconHandler"
-> {HKLM…CLSID} = "NeroDigitalIconHandler Class"
\InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"]
"{7F1CF152-04F8-453A-B34C-E609530A9DC8}" = "NeroDigitalPropSheetHandler"
-> {HKLM…CLSID} = "NeroDigitalPropSheetHandler Class"
\InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"]
"{416651E4-9C3C-11D9-8BDE-F66BAD1E3F3A}" = "Nokia Phone Browser"
-> {HKLM…CLSID} = "Nokia Phone Browser"
\InProcServer32\(Default) = "C:\Program Files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll" ["Nokia"]

HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\
"WPDShServiceObj" = "{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"
-> {HKLM…CLSID} = "WPDShServiceObj Class"
\InProcServer32\(Default) = "C:\WINDOWS\system32\WPDShServiceObj.dll" [MS]

HKLM\Software\Classes\Folder\shellex\ColumnHandlers\
{7D4D6379-F301-4311-BEBA-E26EB0561882}\(Default) = "NeroDigitalExt.NeroDigitalColumnHandler"
-> {HKLM…CLSID} = "NeroDigitalColumnHandler Class"
\InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
Cover Designer\(Default) = "{73FCA462-9BD5-4065-A73F-A8E5F6904EF7}"
-> {HKLM…CLSID} = "NeroCoverEdContextMenu Class"
\InProcServer32\(Default) = "C:\Program Files\Nero\Nero 7\Nero CoverDesigner\CoverEdExtension.dll" ["Nero AG"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM…CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
DFR_CMN\(Default) = "{EBDF1A20-2606-0907-1980-0020FF3E97F9}"
-> {HKLM…CLSID} = " "
\InProcServer32\(Default) = "C:\PROGRA~1\DUPLIC~1\dfr_cmn.dll" [null data]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM…CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM…CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]


Default executables:
——————–

<> HKLM\Software\Classes\scrfile\shell\open\command\(Default) = ""%1" %*" [file not found]


Group Policies {GPedit.msc branch and setting}:
———————————————–

Note: detected settings may not have any effect.

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\

"shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Shutdown: Allow system to be shut down without having to log on}

"undockwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Devices: Allow undock without having to log on}

"InstallVisualStyle" = (REG_EXPAND_SZ) C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
{unrecognized setting}

"InstallTheme" = (REG_EXPAND_SZ) C:\WINDOWS\Resources\Themes\Royale.theme
{unrecognized setting}


Active Desktop and Wallpaper:
—————————–

Active Desktop may be disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

Displayed if Active Desktop enabled and wallpaper not set by Group Policy:
HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
"Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Wallpaper1.bmp"

Displayed if Active Desktop disabled and wallpaper not set by Group Policy:
HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Documents and Settings\bigsi69\Local Settings\Application Data\Microsoft\Wallpaper1.bmp"


Winsock2 Service Provider DLLs:
——————————-

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 13
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05


Toolbars, Explorer Bars, Extensions:
————————————

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Console"
"CLSIDExtension" = "{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC}"
-> {HKCU…CLSID} = "Java Plug-in 1.6.0_02"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll" ["Sun Microsystems, Inc."]
-> {HKLM…CLSID} = "Java Plug-in 1.6.0_02"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll" ["Sun Microsystems, Inc."]

{E2E2DD38-D088-4134-82B7-F2BA38496583}\
"MenuText" = "@xpsp3res.dll,-20001"
"Exec" = "%windir%\Network Diagnostic\xpnetdiag.exe" [MS]

{FB5F1910-F110-11D2-BB9E-00C04F795683}\
"ButtonText" = "Messenger"
"MenuText" = "Windows Messenger"
"Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS]


Running Services (Display Name, Service Name, Path {Service DLL}):
——————————————————————

Media Center Extender Service, McrdSvc, "C:\WINDOWS\ehome\mcrdsvc.exe" [MS]
Media Center Receiver Service, ehRecvr, "C:\WINDOWS\eHome\ehRecvr.exe" [MS]
Media Center Scheduler Service, ehSched, "C:\WINDOWS\eHome\ehSched.exe" [MS]
NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"]
Windows Driver Foundation - User-mode Driver Framework, WudfSvc, "C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup" {"C:\WINDOWS\System32\WUDFSvc.dll" [MS]}


Print Monitors:
—————

HKLM\System\CurrentControlSet\Control\Print\Monitors\
EPSON V6 2KMonitor\Driver = "EBPMON24.DLL" ["SEIKO EPSON CORPORATION"]


———- (launch time: 2007-08-20 15:22:43)
<>: Suspicious data at a malware launch point.

+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
DLL launch points, use the -supp parameter or answer "No" at the
first message box and "Yes" at the second message box.
———- (total run time: 39 seconds, including 18 seconds for message boxes)



When ComboFix had run it required me to upload the file to bleeping computer again, i have also uploaded the combofix zip file to you as requested.
Unfortunately the operating system on my other drive is corrupt so i don't believe it is usable.

When would it be possible to re-attach my second drive as there are items on there i may need in the next few days ?
Post #33
I truly have not thought about the best solution relating to that other drive. Again the issue here is an autorun infection, so installs itself when any drives are connected, as well as this is a system file replacing infection, and the second drive has system files. Best to concentrate on getting this clean now, then see how it can be sued to repair the other.

I did receive that file, thanks. ComboFix automatically has a specific send option when using that Submit function and when necessary that as surely a benefit. It does use the autoruns functions we have been removing a few times over here, as well as the empty folders named like system files (so when Windows looks through the environment paths for what files to use it selects those first). Looking good here, so let's get the remainder now.


Open Notepad (Start - Run, type notepad then press Enter) and copy the following text into a new file:

@ECHO OFF
cd C:\windows\system32
attrib -s -h -r MSCONFIG.EXE
del MSCONFIG.EXE
cd C:\windows
attrib -s -h -r MSCONFIG.EXE
del MSCONFIG.EXE
EXIT

Save the file to the desktop as remconf.bat and make sure the "Save as type" field says "All files".

Then double-click on remconf.bat. A window should open and close fairly quickly — this is normal.


Then navigate to the following folder and see if there is a copy of MSCONFIG.EXE there. If not, go here and download the XP SP1 copy and place it in that folder (that version should do for here).

C:\WINDOWS\PCHealth\HelpCtr\Binaries


Now click to run the Flash_Disinfector.exe again.



Then reboot, and run ComboFix again and post that log back here please. Also try different functions there (regedit etc.) and report back if any do not work or cause errors.
Post #34
I am still not able to run flash disinfector since disconnecting my other drive, the following error appears:

Windows No Disk
Exception Processing Message c0000013 Parameters 75b6bf9c 4 75b6bf9c 75b6bf9c

I am unsure if this is relevant but the drive i have disconnected is currently set as the master and the one i'm using now is set to slave, that is how i used to have it set up until it corrupted, i just never changed them round as there seemed to be any problem. Whether this is causing the error i'm unsure.

So as i'm unable to run flash disinfector this is the ComboFix log:

ComboFix 07-08-17.2 - "bigsi69" 2007-08-21 16:11:17.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.734 [GMT 1:00]


((((((((((((((((((((((((( Files Created from 2007-07-21 to 2007-08-21 )))))))))))))))))))))))))))))))


2007-08-21 16:03 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-08-21 16:03 drahs—- C:\autorun.inf
2007-08-20 21:27 d——– C:\Program Files\Common Files\PCSuite
2007-08-20 21:27 d——– C:\Program Files\Common Files\Nokia
2007-08-20 21:26 8,320 –a—— C:\WINDOWS\system32\drivers\nmwcdc.sys
2007-08-20 21:26 65,536 –a—— C:\WINDOWS\system32\nmwcdcocls.dll
2007-08-20 21:26 137,216 –a—— C:\WINDOWS\system32\drivers\nmwcd.sys
2007-08-20 21:26 12,288 –a—— C:\WINDOWS\system32\drivers\nmwcdcm.sys
2007-08-20 21:26 12,288 –a—— C:\WINDOWS\system32\drivers\nmwcdcj.sys
2007-08-20 21:26 d——– C:\Program Files\Nokia
2007-08-20 17:46 37,768 -ra—— C:\WINDOWS\system32\drivers\wceusbsh.sys
2007-08-20 17:42 d——– C:\Program Files\Mio Technology
2007-08-20 10:57 388,608 –a—— C:\WINDOWS\system32\cmd.exe
2007-08-19 10:50 d-a—— C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
2007-08-19 10:50 d——– C:\Program Files\Your Uninstaller 2006
2007-08-19 10:50 d——– C:\DOCUME~1\bigsi69\APPLIC~1\URSoft
2007-08-15 15:55 d——– C:\Program Files\MSXML 6.0
2007-08-13 18:55 d——– C:\DOCUME~1\bigsi69\APPLIC~1\Ahead
2007-08-13 18:52 d——– C:\Program Files\coverXP
2007-08-13 18:22 d——– C:\Program Files\Common Files\Ahead
2007-08-13 18:22 d——– C:\Program Files\Ahead
2007-08-13 16:30 d——– C:\WINDOWS\ERUNT
2007-08-13 09:43 d——– C:\Program Files\MSXML 4.0
2007-08-12 21:19 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ahead
2007-08-12 21:16 d——– C:\Program Files\Nero
2007-08-12 21:16 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Nero
2007-08-12 18:38 d——– C:\Program Files\Blubster
2007-08-12 17:36 d——– C:\Program Files\Duplicate File Remover
2007-08-12 16:22 146,432 –a—— C:\WINDOWS\regedit.exe
2007-08-11 21:17 d——– C:\DOCUME~1\bigsi69\Phone Browser
2007-08-11 21:11 d——– C:\Program Files\PC Connectivity Solution
2007-08-11 21:11 d——– C:\Program Files\DIFX
2007-08-11 21:11 d——– C:\DOCUME~1\bigsi69\APPLIC~1\PC Suite
2007-08-11 21:11 d——– C:\DOCUME~1\bigsi69\APPLIC~1\Nokia
2007-08-11 21:11 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\PC Suite
2007-08-11 21:10 90,624 –a—— C:\WINDOWS\system32\nmwcdcls.dll
2007-08-11 21:10 d—-c— C:\WINDOWS\system32\DRVSTORE
2007-08-11 21:10 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Installations
2007-08-11 16:37 d——– C:\DOCUME~1\bigsi69\APPLIC~1\WinRAR
2007-08-11 15:53 d——– C:\WINDOWS\pss
2007-08-10 20:23 d——– C:\VundoFix Backups
2007-08-10 17:35 d——– C:\Program Files\SlySoft
2007-08-10 03:56 d——– C:\DOCUME~1\bigsi69\APPLIC~1\Azureus
2007-08-10 03:53 d——– C:\Program Files\Azureus
2007-08-09 20:01 d——– C:\Program Files\Real
2007-08-09 20:01 d——– C:\Program Files\Common Files\xing shared
2007-08-09 20:01 d——– C:\Program Files\Common Files\Real
2007-08-09 20:01 d——– C:\DOCUME~1\bigsi69\APPLIC~1\Real
2007-08-09 17:30 d——– C:\WINDOWS\CSC
2007-08-09 16:16 d——– C:\Program Files\Google
2007-08-09 16:16 d——– C:\DOCUME~1\bigsi69\APPLIC~1\Google
2007-08-09 16:16 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
2007-08-09 15:19 524,288 –ah—– C:\DOCUME~1\ADMINI~1\NTUSER.DAT
2007-08-09 08:19 d——– C:\DOCUME~1\bigsi69\APPLIC~1\vlc
2007-08-09 06:26 d——– C:\Program Files\Windows Media Connect 2
2007-08-09 06:25 d——– C:\WINDOWS\system32\LogFiles
2007-08-09 06:25 d——– C:\WINDOWS\system32\drivers\UMDF
2007-08-09 06:23 d——– C:\WINDOWS\network diagnostic
2007-08-09 06:18 d——– C:\Program Files\MSBuild
2007-08-09 06:15 d——– C:\WINDOWS\system32\XPSViewer
2007-08-09 06:15 d——– C:\Program Files\Reference Assemblies
2007-08-09 06:14 14,048 ——— C:\WINDOWS\system32\spmsg2.dll
2007-08-09 06:08 23,040 ——— C:\WINDOWS\kb913800.exe
2007-08-08 06:53 d——– C:\WINDOWS\RegisteredPackages
2007-08-08 06:50 d——– C:\WINDOWS\system32\URTTemp
2007-08-08 06:39 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
2007-08-08 06:36 23,856 –a—— C:\WINDOWS\system32\spupdsvc.exe
2007-08-08 06:36 d——– C:\WINDOWS\system32\PreInstall
2007-08-08 06:34 d–hs—- C:\DOCUME~1\bigsi69\UserData
2007-08-08 06:34 d——– C:\WINDOWS\system32\SoftwareDistribution
2007-08-08 06:26 8 –a—— C:\WINDOWS\system32\nvModes.dat
2007-08-08 06:26 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\nView_Profiles
2007-08-08 06:24 208,896 –a—— C:\WINDOWS\system32\NVUNINST.EXE
2007-08-08 06:24 208,896 –a—— C:\WINDOWS\system32\nvudisp.exe
2007-08-08 06:24 d——– C:\WINDOWS\nview
2007-08-08 06:23 d——– C:\NVIDIA
2007-08-08 06:21 90,112 -r——- C:\WINDOWS\soundman.exe
2007-08-08 06:21 82,944 –a—— C:\WINDOWS\system32\drivers\wdmaud.sys
2007-08-08 06:21 7,552 –a—— C:\WINDOWS\system32\drivers\MSKSSRV.sys
2007-08-08 06:21 60,800 –a—— C:\WINDOWS\system32\drivers\sysaudio.sys
2007-08-08 06:21 60,288 –a—— C:\WINDOWS\system32\drivers\drmk.sys
2007-08-08 06:21 6,400 –a—— C:\WINDOWS\system32\drivers\splitter.sys
2007-08-08 06:21 54,272 –a—— C:\WINDOWS\system32\drivers\swmidi.sys
2007-08-08 06:21 52,864 –a—— C:\WINDOWS\system32\drivers\DMusic.sys
2007-08-08 06:21 5,376 –a—— C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2007-08-08 06:21 40,960 -r——- C:\WINDOWS\system32\ChCfg.exe
2007-08-08 06:21 4,992 –a—— C:\WINDOWS\system32\drivers\MSPQM.sys
2007-08-08 06:21 4,096 –a—— C:\WINDOWS\system32\ksuser.dll
2007-08-08 06:21 3,727,680 -r——- C:\WINDOWS\system32\drivers\alcxwdm.sys
2007-08-08 06:21 2,944 –a—— C:\WINDOWS\system32\drivers\drmkaud.sys
2007-08-08 06:21 172,416 –a—— C:\WINDOWS\system32\drivers\kmixer.sys
2007-08-08 06:21 157,184 -r——- C:\WINDOWS\system32\RtlCPAPI.dll
2007-08-08 06:21 145,792 –a—— C:\WINDOWS\system32\drivers\portcls.sys
2007-08-08 06:21 142,464 –a—— C:\WINDOWS\system32\drivers\aec.sys
2007-08-08 06:21 10,459,136 -r——- C:\WINDOWS\system32\RTLCPL.exe
2007-08-08 06:21 d——– C:\Program Files\Realtek Sound Manager
2007-08-08 06:21 d——– C:\Program Files\AvRack
2007-08-08 06:20 307,200 -r——- C:\WINDOWS\alcupd.exe
2007-08-08 06:20 212,992 -r——- C:\WINDOWS\alcrmv.exe
2007-08-08 06:20 d–h—– C:\Program Files\InstallShield Installation Information


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2010-08-08 03:13 ——— d——– C:\DOCUME~1\bigsi69\APPLIC~1\Lavasoft
2010-08-08 03:12 ——— d——– C:\Program Files\Lavasoft
2010-08-08 03:12 ——— d——– C:\Program Files\Common Files\Wise Installation Wizard
2008-08-08 02:56 ——— d——– C:\DOCUME~1\bigsi69\APPLIC~1\SopCast
2008-08-08 02:55 ——— d——– C:\Program Files\VideoLAN
2008-08-08 02:53 ——— d——– C:\Program Files\SopCast
2008-08-08 01:04 2970 –a—— C:\WINDOWS\pchealth\helpctr\PackageStore\SkuStore.bin
2008-08-08 01:03 8972 –a—— C:\WINDOWS\pchealth\helpctr\Config\Cntstore.bin
2007-08-13 18:47 ——— d——– C:\Program Files\EPSON
2007-07-04 09:48 132904 –a—— C:\WINDOWS\system32\drivers\imagesrv.sys
2007-07-04 09:48 11304 –a—— C:\WINDOWS\system32\drivers\imagedrv.sys
2007-06-27 19:05 972072 –a—— C:\WINDOWS\UNNeroMediaHome.exe
2007-06-26 14:12 972072 –a—— C:\WINDOWS\UNNeroVision.exe
2007-06-26 07:08 1104896 –a—— C:\WINDOWS\system32\msxml3.dll
2007-06-19 14:31 282112 –a—— C:\WINDOWS\system32\gdi32.dll
2007-06-13 11:23 1033216 –a—— C:\WINDOWS\explorer.exe
2007-06-08 08:11 831048 –a—— C:\WINDOWS\system32\WudfUpdate_01005.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-05 13:56]
"nwiz"="nwiz.exe" [2007-04-19 13:26 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-04-19 13:26]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-04-19 13:26]
"PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 15:10]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-15 13:00]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Nokia.PCSync"=C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
MioSync.lnk - C:\Program Files\Mio Technology\MioSync\mioSync.exe [2007-08-20 17:42:19]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray]
"C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

R3 FETNDIS;VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\fetnd5.sys


**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-21 16:12:41
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-21 16:13:05
C:\ComboFix-quarantined-files.txt … 2007-08-21 16:13
C:\ComboFix2.txt … 2007-08-20 15:04
C:\ComboFix3.txt … 2007-08-20 11:22

— E O F —


I've tested Msconfig, Regedit and they both seem to work fine, only one i'm having problems with is Task Manager, i don't seem to have had that working for a while….

<_<
Post #35
I haven't looked in all of where FlashDisinfector checks so it may be reading from it's own previously stored autorun file - I will try to check on that. So the drive isolation may give some issues with that. Task Manager was also slotted to have a bogus folder replace it, so instead of picking through different parts here let's use the infection's own shopping list for making sure all those folders are removed.


Delete the earlier CFScript.txt file you created and open notepad again and copy/paste the text in the quotebox below into it:

Folder::
C:\windows\system32\taskmgr.exe
C:\WINDOWS\system32\dllcache\taskmgr.exe
C:\windows\regedit.exe
C:\WINDOWS\system32\dllcache\regedit.exe
C:\windows\system32\cmd.exe
C:\windows\system32\command.com
C:\windows\system32\cmd.com
C:\WINDOWS\system32\dllcache\cmd.exe
C:\WINDOWS\system32\dllcache\command.com
C:\WINDOWS\system32\dllcache\cmd.com
C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe
C:\WINDOWS\system32\dllcache\msconfig.exe

Save this as "CFScript"

(include the "quotation marks" with the name)



[external image: Posted Image]

Referring to the picture above, drag CFScript.txt into ComboFix.exe

When the fix completes it will create a C:\ComboFix.txt log. Please post that log in your next reply.



Then two suspect files, and additional checks, and we may be ready to talk about the other drive and cleaning it.

Locate the following and again upload them here.

C:\WINDOWS\system32\EXButton.oca
C:\WINDOWS\system32\MSWINSCK.oca



And click on the attachment below and download Getautoruns.zip to your desktop. Right click the desktop, select New - Folder, and unzip Getautoruns.zip in that folder. This will create a file named Getautoruns.bat. Click on that file and allow it to run, and post back here the contents of the autos.txt file it creates.



Also open notepad again and copy/paste the text in the quotebox below into it:

@ECHO OFF
if exist show2.txt del /q show2.txt
cd C:\Windows\System32
dir /A:-D /O:S > c:\show2.txt
cd C:\Windows
dir /A:-D /O:S >> c:\show2.txt & start notepad c:\show2.txt

Then go to File - Save as…, and save the file to your desktop as "Look32.bat" (be sure to include the quotes "" in the name). Then click on look32.bat to run the file check. Once that completes a text box will open. This will be a long list of files, sorted by size. I need you to locate from that list any files that are specifically 557056 bytes, and post those back here please. Likely more a fishing expedition but good to be sure.

Attachments:

Post #36
This is the log that combofix created:


ComboFix 07-08-17.2 - "bigsi69" 2007-08-22 14:40:39.5 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.744 [GMT 1:00]
Command switches used :: C:\Documents and Settings\bigsi69\Desktop\CFScript
* Created a new restore point


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe\
C:\windows\regedit.exe\
C:\windows\system32\cmd.exe\
C:\WINDOWS\system32\dllcache\cmd.com
C:\WINDOWS\system32\dllcache\cmd.exe
C:\WINDOWS\system32\dllcache\command.com
C:\WINDOWS\system32\dllcache\msconfig.exe
C:\WINDOWS\system32\dllcache\regedit.exe
C:\WINDOWS\system32\dllcache\taskmgr.exe


((((((((((((((((((((((((( Files Created from 2007-07-22 to 2007-08-22 )))))))))))))))))))))))))))))))


2007-08-21 16:03 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-08-21 16:03 drahs—- C:\autorun.inf
2007-08-20 21:27 d——– C:\Program Files\Common Files\PCSuite
2007-08-20 21:27 d——– C:\Program Files\Common Files\Nokia
2007-08-20 21:26 8,320 –a—— C:\WINDOWS\system32\drivers\nmwcdc.sys
2007-08-20 21:26 65,536 –a—— C:\WINDOWS\system32\nmwcdcocls.dll
2007-08-20 21:26 137,216 –a—— C:\WINDOWS\system32\drivers\nmwcd.sys
2007-08-20 21:26 12,288 –a—— C:\WINDOWS\system32\drivers\nmwcdcm.sys
2007-08-20 21:26 12,288 –a—— C:\WINDOWS\system32\drivers\nmwcdcj.sys
2007-08-20 21:26 d——– C:\Program Files\Nokia
2007-08-20 17:46 37,768 -ra—— C:\WINDOWS\system32\drivers\wceusbsh.sys
2007-08-20 17:42 d——– C:\Program Files\Mio Technology
2007-08-20 10:57 388,608 –a—— C:\WINDOWS\system32\cmd.exe
2007-08-19 10:50 d-a—— C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
2007-08-19 10:50 d——– C:\Program Files\Your Uninstaller 2006
2007-08-19 10:50 d——– C:\DOCUME~1\bigsi69\APPLIC~1\URSoft
2007-08-15 15:55 d——– C:\Program Files\MSXML 6.0
2007-08-13 18:55 d——– C:\DOCUME~1\bigsi69\APPLIC~1\Ahead
2007-08-13 18:52 d——– C:\Program Files\coverXP
2007-08-13 18:22 d——– C:\Program Files\Common Files\Ahead
2007-08-13 18:22 d——– C:\Program Files\Ahead
2007-08-13 16:30 d——– C:\WINDOWS\ERUNT
2007-08-13 09:43 d——– C:\Program Files\MSXML 4.0
2007-08-12 21:19 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ahead
2007-08-12 21:16 d——– C:\Program Files\Nero
2007-08-12 21:16 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Nero
2007-08-12 18:38 d——– C:\Program Files\Blubster
2007-08-12 17:36 d——– C:\Program Files\Duplicate File Remover
2007-08-12 16:22 146,432 –a—— C:\WINDOWS\regedit.exe
2007-08-11 21:17 d——– C:\DOCUME~1\bigsi69\Phone Browser
2007-08-11 21:11 d——– C:\Program Files\PC Connectivity Solution
2007-08-11 21:11 d——– C:\Program Files\DIFX
2007-08-11 21:11 d——– C:\DOCUME~1\bigsi69\APPLIC~1\PC Suite
2007-08-11 21:11 d——– C:\DOCUME~1\bigsi69\APPLIC~1\Nokia
2007-08-11 21:11 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\PC Suite
2007-08-11 21:10 90,624 –a—— C:\WINDOWS\system32\nmwcdcls.dll
2007-08-11 21:10 d—-c— C:\WINDOWS\system32\DRVSTORE
2007-08-11 21:10 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Installations
2007-08-11 16:37 d——– C:\DOCUME~1\bigsi69\APPLIC~1\WinRAR
2007-08-11 15:53 d——– C:\WINDOWS\pss
2007-08-10 20:23 d——– C:\VundoFix Backups
2007-08-10 17:35 d——– C:\Program Files\SlySoft
2007-08-10 03:56 d——– C:\DOCUME~1\bigsi69\APPLIC~1\Azureus
2007-08-10 03:53 d——– C:\Program Files\Azureus
2007-08-09 20:01 d——– C:\Program Files\Real
2007-08-09 20:01 d——– C:\Program Files\Common Files\xing shared
2007-08-09 20:01 d——– C:\Program Files\Common Files\Real
2007-08-09 20:01 d——– C:\DOCUME~1\bigsi69\APPLIC~1\Real
2007-08-09 17:30 d——– C:\WINDOWS\CSC
2007-08-09 16:16 d——– C:\Program Files\Google
2007-08-09 16:16 d——– C:\DOCUME~1\bigsi69\APPLIC~1\Google
2007-08-09 16:16 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
2007-08-09 15:19 524,288 –ah—– C:\DOCUME~1\ADMINI~1\NTUSER.DAT
2007-08-09 08:19 d——– C:\DOCUME~1\bigsi69\APPLIC~1\vlc
2007-08-09 06:26 d——– C:\Program Files\Windows Media Connect 2
2007-08-09 06:25 d——– C:\WINDOWS\system32\LogFiles
2007-08-09 06:25 d——– C:\WINDOWS\system32\drivers\UMDF
2007-08-09 06:23 d——– C:\WINDOWS\network diagnostic
2007-08-09 06:18 d——– C:\Program Files\MSBuild
2007-08-09 06:15 d——– C:\WINDOWS\system32\XPSViewer
2007-08-09 06:15 d——– C:\Program Files\Reference Assemblies
2007-08-09 06:14 14,048 ——— C:\WINDOWS\system32\spmsg2.dll
2007-08-09 06:08 23,040 ——— C:\WINDOWS\kb913800.exe
2007-08-08 06:53 d——– C:\WINDOWS\RegisteredPackages
2007-08-08 06:50 d——– C:\WINDOWS\system32\URTTemp
2007-08-08 06:39 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
2007-08-08 06:36 23,856 –a—— C:\WINDOWS\system32\spupdsvc.exe
2007-08-08 06:36 d——– C:\WINDOWS\system32\PreInstall
2007-08-08 06:34 d–hs—- C:\DOCUME~1\bigsi69\UserData
2007-08-08 06:34 d——– C:\WINDOWS\system32\SoftwareDistribution
2007-08-08 06:26 8 –a—— C:\WINDOWS\system32\nvModes.dat
2007-08-08 06:26 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\nView_Profiles
2007-08-08 06:24 208,896 –a—— C:\WINDOWS\system32\NVUNINST.EXE
2007-08-08 06:24 208,896 –a—— C:\WINDOWS\system32\nvudisp.exe
2007-08-08 06:24 d——– C:\WINDOWS\nview
2007-08-08 06:23 d——– C:\NVIDIA
2007-08-08 06:21 90,112 -r——- C:\WINDOWS\soundman.exe
2007-08-08 06:21 82,944 –a—— C:\WINDOWS\system32\drivers\wdmaud.sys
2007-08-08 06:21 7,552 –a—— C:\WINDOWS\system32\drivers\MSKSSRV.sys
2007-08-08 06:21 60,800 –a—— C:\WINDOWS\system32\drivers\sysaudio.sys
2007-08-08 06:21 60,288 –a—— C:\WINDOWS\system32\drivers\drmk.sys
2007-08-08 06:21 6,400 –a—— C:\WINDOWS\system32\drivers\splitter.sys
2007-08-08 06:21 54,272 –a—— C:\WINDOWS\system32\drivers\swmidi.sys
2007-08-08 06:21 52,864 –a—— C:\WINDOWS\system32\drivers\DMusic.sys
2007-08-08 06:21 5,376 –a—— C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2007-08-08 06:21 40,960 -r——- C:\WINDOWS\system32\ChCfg.exe
2007-08-08 06:21 4,992 –a—— C:\WINDOWS\system32\drivers\MSPQM.sys
2007-08-08 06:21 4,096 –a—— C:\WINDOWS\system32\ksuser.dll
2007-08-08 06:21 3,727,680 -r——- C:\WINDOWS\system32\drivers\alcxwdm.sys
2007-08-08 06:21 2,944 –a—— C:\WINDOWS\system32\drivers\drmkaud.sys
2007-08-08 06:21 172,416 –a—— C:\WINDOWS\system32\drivers\kmixer.sys
2007-08-08 06:21 157,184 -r——- C:\WINDOWS\system32\RtlCPAPI.dll
2007-08-08 06:21 145,792 –a—— C:\WINDOWS\system32\drivers\portcls.sys
2007-08-08 06:21 142,464 –a—— C:\WINDOWS\system32\drivers\aec.sys
2007-08-08 06:21 10,459,136 -r——- C:\WINDOWS\system32\RTLCPL.exe
2007-08-08 06:21 d——– C:\Program Files\Realtek Sound Manager
2007-08-08 06:21 d——– C:\Program Files\AvRack
2007-08-08 06:20 307,200 -r——- C:\WINDOWS\alcupd.exe
2007-08-08 06:20 212,992 -r——- C:\WINDOWS\alcrmv.exe
2007-08-08 06:20 d–h—– C:\Program Files\InstallShield Installation Information


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2010-08-08 03:13 ——— d——– C:\DOCUME~1\bigsi69\APPLIC~1\Lavasoft
2010-08-08 03:12 ——— d——– C:\Program Files\Lavasoft
2010-08-08 03:12 ——— d——– C:\Program Files\Common Files\Wise Installation Wizard
2008-08-08 02:56 ——— d——– C:\DOCUME~1\bigsi69\APPLIC~1\SopCast
2008-08-08 02:55 ——— d——– C:\Program Files\VideoLAN
2008-08-08 02:53 ——— d——– C:\Program Files\SopCast
2008-08-08 01:04 2970 –a—— C:\WINDOWS\pchealth\helpctr\PackageStore\SkuStore.bin
2008-08-08 01:03 8972 –a—— C:\WINDOWS\pchealth\helpctr\Config\Cntstore.bin
2007-08-13 18:47 ——— d——– C:\Program Files\EPSON
2007-07-04 09:48 132904 –a—— C:\WINDOWS\system32\drivers\imagesrv.sys
2007-07-04 09:48 11304 –a—— C:\WINDOWS\system32\drivers\imagedrv.sys
2007-06-27 19:05 972072 –a—— C:\WINDOWS\UNNeroMediaHome.exe
2007-06-26 14:12 972072 –a—— C:\WINDOWS\UNNeroVision.exe
2007-06-26 07:08 1104896 –a—— C:\WINDOWS\system32\msxml3.dll
2007-06-19 14:31 282112 –a—— C:\WINDOWS\system32\gdi32.dll
2007-06-13 11:23 1033216 –a—— C:\WINDOWS\explorer.exe
2007-06-08 08:11 831048 –a—— C:\WINDOWS\system32\WudfUpdate_01005.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-05 13:56]
"nwiz"="nwiz.exe" [2007-04-19 13:26 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-04-19 13:26]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-04-19 13:26]
"PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 15:10]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-15 13:00]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Nokia.PCSync"=C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
MioSync.lnk - C:\Program Files\Mio Technology\MioSync\mioSync.exe [2007-08-20 17:42:19]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray]
"C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

R3 FETNDIS;VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\fetnd5.sys


**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-22 14:42:02
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-22 14:42:27
C:\ComboFix-quarantined-files.txt … 2007-08-22 14:42
C:\ComboFix2.txt … 2007-08-21 16:13
C:\ComboFix3.txt … 2007-08-20 15:04

— E O F —


I was not able to download the zip file you mentioned at the bottom of your post ,when i tried to click on it all i got was a tom coyote error saying i did not have permission to access the file even though i was logged in, also the two " .oca" files you told me to search for in system32 i could not find all i could find was ".ocx" files of the same name, i did not know if you wanted me to upload these.

I have not done the rest of the things you suggested in your reply until i find out what to do about these current issues.
Post #37
It is my understanding attachment download is available to registered forum users. The file is to scan for specific autorun functions, so as only a scan step you can continue with the remainder of the steps while we get this done as well. To simplify things just PM me an email address to send a file copy to as an attachment.
Post #39
do i need to upload the ".ocx" files i found instead of the ".oca" that you suggested, as there were no ".oca" files to be found…
Post #40
i was not able to run the Getautoruns file as i keep getting the windows exception processing message that i get when i try and run flash disinfector. I think i need to remove both my drives and swap the jumpers from slave to master and vice versa. Unfortunately i'm going away for a week from tomorrow so this will be my last post until a week on sunday, i hope this isn't a problem as i really appreciate the time and effort you're putting into helping me with this situation. and i hope to hear from you next week. Thanks again bigsi69 :thumbup:
Post #42
Hello again, I've changed the jumper settings on my sole hard drive so it is now the master, unfortunately both flash disinfector and Getautoruns.bat are still both giving me the windows exception error that i spoke about before. I have uploaded what i hope are he two files you requested in your last post. I also ran the Look32.bat and found no files that were 557056 bytes. Thanks again for your time. bigsi69
Post #43
Sole drive and master meaning the drives are not physically connected, yes? Again due to having to entire system drive folders/files on the both drives they are cross-infecting regardless of our attempts. I admit I will have to mentally re-engage here after the break. I did receive the files, thanks. MSWINSCK.ocx is a legitimate Windows file. The other is what appears to be the ActiveX installer for an interactive toolbar button provided by a Chinese software Eleven-T (EX Button V 1.00). What exactly did you download, and from where? Eleven-T's web domain is no longer, and the only source I found for the file was a Chinese source site with this description (search engine translation):

1、 EX按扭控件V1.00为早期版本魔鬼按钮控件V1.20的升级版本，功能更强大、运行更稳定； 1, EX button controls V1.00 for the early version of the devil button controls V1.20 upgrade, more powerful, more stable operation;
2、 比之魔鬼按钮控件做了较大的改进，改正了较多的Bug。 2, the devil button controls than do the larger improvements corrected more Bug. 在部分功能的实现上也采用了不同的方法； In some of the functions is also used different methods;
3、 内置四种经典样式，即WindowsXP、OfficeXP、Raised和.NET样式。 Three, four built-in classic style, WindowsXP, OfficeXP, and Raised. NET forms. 更方便的换肤功能可以帮您做出各式各样精美的按钮； Eurocargo more convenient function can help you make all kinds of delicious button;
4、 支持Alt快捷键、Tab键、方向键、空格键等所有普通按钮的键盘操作。 4, support Alt keys, Tab key, key, key spaces all ordinary button keypad. 对按钮的Cancel和Default属性也有较好的支持； Cancel button on the attribute and Default have good support;
5、 依然保留了MouseOut事件、去掉了ResClick方法、新增加了MouseIn事件和BtnShBackColor方法； 5, still retains MouseOut, removed ResClick methods, and new events and increased MouseIn BtnShBackColor methods;
6、 同样支持图标功能，图标屏蔽色，灰显图标以及PowerIcon等属性功能。 6, the same support functions icon, icon shielding color, gray icon and PowerIcon significant attributes such as function. 此外还具有显示或隐藏虚线焦点框等功能； It also shows a dotted line focus frame or hidden functions;
7、 按钮标题可以实现多行显示，例：.Caption="第一行" & VbCrlf & "第二行"； 7, buttons can achieve multiple lines heading that cases:. Caption = "first line" & & VbCrlf "second line";
8、 可以设置图标和标题的排列方式，标题的对齐方式，以及四边边距和图标与标题的间距； 8, and the icon can be set up with the title, the title of alignment, and the edges of the border and heading icon spacing;
9、 通过CRad可以调整按钮四个顶点的圆角半径； 9 through CRad four buttons can be adjusted peak of the radius;
10、附带的演示程序中有多个按钮皮肤示例及使用说明。 10, the fringe Demonstration Program in a number of buttons and use the skin sample.

If you have the Asian language pack installed you will see the Chinese characters - if not likely only see small rows of squares. Maybe you will recognize from that what the file's use is - scans do not pick it up as infection but it may have been part of an install package that included the infection.


For now post back a clarification on the drive status, and also delete the ComboFix.exe you have and download a fresh version from here to your desktop, and click the downloaded file to run the repair.

When the command window opens, select 1 (and Enter). Allow the scan to run. When completed a text window will appear - please copy/paste the contents back here. This log can also be found at C:\ComboFix.txt.

A caution - do not touch your mouse/keyboard until the scan has completed. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs, please reboot to restore the desktop.

Post back the C:\ComboFix log if you would.
Post #44
I only have the one (master) drive connected at the moment, i have not reconnected my other drive since you told me not to, as for the chinese toolbar button i have no idea whatsoever where this has come from , i no for definite i have not installed any such thing although i cannot say that my children haven't, although they do deny it.

Here is the log for Combofix :

ComboFix 07-09-04.4 - "bigsi69" 2007-09-04 19:14:01.6 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.716 [GMT 1:00]
* Created a new restore point


((((((((((((((((((((((((( Files Created from 2007-08-04 to 2007-09-04 )))))))))))))))))))))))))))))))


2007-09-03 15:27 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-08-23 20:34 d——– C:\Program Files\One-click Ringtone Converter
2007-08-21 16:03 drahs—- C:\autorun.inf
2007-08-20 21:27 d——– C:\Program Files\Common Files\PCSuite
2007-08-20 21:27 d——– C:\Program Files\Common Files\Nokia
2007-08-20 21:26 8,320 –a—— C:\WINDOWS\system32\drivers\nmwcdc.sys
2007-08-20 21:26 65,536 –a—— C:\WINDOWS\system32\nmwcdcocls.dll
2007-08-20 21:26 137,216 –a—— C:\WINDOWS\system32\drivers\nmwcd.sys
2007-08-20 21:26 12,288 –a—— C:\WINDOWS\system32\drivers\nmwcdcm.sys
2007-08-20 21:26 12,288 –a—— C:\WINDOWS\system32\drivers\nmwcdcj.sys
2007-08-20 21:26 d——– C:\Program Files\Nokia
2007-08-20 17:46 37,768 -ra—— C:\WINDOWS\system32\drivers\wceusbsh.sys
2007-08-20 17:42 d——– C:\Program Files\Mio Technology
2007-08-20 10:57 388,608 –a—— C:\WINDOWS\system32\cmd.exe
2007-08-19 10:50 d-a—— C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
2007-08-19 10:50 d——– C:\Program Files\Your Uninstaller 2006
2007-08-19 10:50 d——– C:\DOCUME~1\bigsi69\APPLIC~1\URSoft
2007-08-15 15:55 d——– C:\Program Files\MSXML 6.0
2007-08-13 18:55 d——– C:\DOCUME~1\bigsi69\APPLIC~1\Ahead
2007-08-13 18:52 d——– C:\Program Files\coverXP
2007-08-13 18:22 d——– C:\Program Files\Common Files\Ahead
2007-08-13 18:22 d——– C:\Program Files\Ahead
2007-08-13 16:30 d——– C:\WINDOWS\ERUNT
2007-08-13 09:43 d——– C:\Program Files\MSXML 4.0
2007-08-12 21:19 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ahead
2007-08-12 21:16 d——– C:\Program Files\Nero
2007-08-12 21:16 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Nero
2007-08-12 18:38 d——– C:\Program Files\Blubster
2007-08-12 17:36 d——– C:\Program Files\Duplicate File Remover
2007-08-12 16:22 146,432 –a—— C:\WINDOWS\regedit.exe
2007-08-11 21:17 d——– C:\DOCUME~1\bigsi69\Phone Browser
2007-08-11 21:11 d——– C:\Program Files\PC Connectivity Solution
2007-08-11 21:11 d——– C:\Program Files\DIFX
2007-08-11 21:11 d——– C:\DOCUME~1\bigsi69\APPLIC~1\PC Suite
2007-08-11 21:11 d——– C:\DOCUME~1\bigsi69\APPLIC~1\Nokia
2007-08-11 21:11 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\PC Suite
2007-08-11 21:10 90,624 –a—— C:\WINDOWS\system32\nmwcdcls.dll
2007-08-11 21:10 d—-c— C:\WINDOWS\system32\DRVSTORE
2007-08-11 21:10 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Installations
2007-08-11 16:37 d——– C:\DOCUME~1\bigsi69\APPLIC~1\WinRAR
2007-08-11 15:53 d——– C:\WINDOWS\pss
2007-08-10 20:23 d——– C:\VundoFix Backups
2007-08-10 17:35 d——– C:\Program Files\SlySoft
2007-08-10 03:56 d——– C:\DOCUME~1\bigsi69\APPLIC~1\Azureus
2007-08-10 03:53 d——– C:\Program Files\Azureus
2007-08-09 20:01 d——– C:\Program Files\Real
2007-08-09 20:01 d——– C:\Program Files\Common Files\xing shared
2007-08-09 20:01 d——– C:\Program Files\Common Files\Real
2007-08-09 20:01 d——– C:\DOCUME~1\bigsi69\APPLIC~1\Real
2007-08-09 16:16 d——– C:\Program Files\Google
2007-08-09 16:16 d——– C:\DOCUME~1\bigsi69\APPLIC~1\Google
2007-08-09 16:16 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
2007-08-09 08:19 d——– C:\DOCUME~1\bigsi69\APPLIC~1\vlc
2007-08-09 06:26 d——– C:\Program Files\Windows Media Connect 2
2007-08-09 06:25 d——– C:\WINDOWS\system32\LogFiles
2007-08-09 06:25 d——– C:\WINDOWS\system32\drivers\UMDF
2007-08-09 06:18 d——– C:\Program Files\MSBuild
2007-08-09 06:15 d——– C:\WINDOWS\system32\XPSViewer
2007-08-09 06:15 d——– C:\Program Files\Reference Assemblies
2007-08-09 06:14 14,048 ——— C:\WINDOWS\system32\spmsg2.dll
2007-08-09 06:08 23,040 ——— C:\WINDOWS\kb913800.exe
2007-08-08 06:50 d——– C:\WINDOWS\system32\URTTemp
2007-08-08 06:36 23,856 –a—— C:\WINDOWS\system32\spupdsvc.exe
2007-08-08 06:34 d–hs—- C:\DOCUME~1\bigsi69\UserData
2007-08-08 06:26 8 –a—— C:\WINDOWS\system32\nvModes.dat
2007-08-08 06:26 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\nView_Profiles
2007-08-08 06:24 208,896 –a—— C:\WINDOWS\system32\NVUNINST.EXE
2007-08-08 06:24 208,896 –a—— C:\WINDOWS\system32\nvudisp.exe
2007-08-08 06:24 d——– C:\WINDOWS\nview
2007-08-08 06:23 d——– C:\NVIDIA
2007-08-08 06:21 d——– C:\Program Files\Realtek Sound Manager
2007-08-08 06:21 d——– C:\Program Files\AvRack
2007-08-08 06:20 307,200 -r——- C:\WINDOWS\alcupd.exe
2007-08-08 06:20 212,992 -r——- C:\WINDOWS\alcrmv.exe
2007-08-08 06:20 d–h—– C:\Program Files\InstallShield Installation Information
2007-08-08 06:20 d——– C:\Program Files\Realtek AC97
2007-08-08 06:20 d——– C:\Program Files\Common Files\InstallShield
2007-08-08 06:19 5,824 –a—— C:\WINDOWS\system32\drivers\ASUSHWIO.SYS
2007-08-08 06:19 5,810 -ra—— C:\WINDOWS\system32\drivers\ASACPI.sys
2007-08-08 06:11 d——– C:\Program Files\microsoft frontpage
2007-08-08 06:09 d–hs—- C:\DOCUME~1\ALLUSE~1\DRM
2007-08-08 06:08 99,840 –a–c— C:\WINDOWS\system32\dllcache\helphost.exe
2007-08-08 06:08 6,656 –a–c— C:\WINDOWS\system32\dllcache\hcappres.dll
2007-08-08 06:08 35,328 –a–c— C:\WINDOWS\system32\dllcache\notiflag.exe
2007-08-08 06:08 28,160 –a–c— C:\WINDOWS\system32\dllcache\msoobe.exe
2007-08-08 06:08 21,504 –a–c— C:\WINDOWS\system32\dllcache\brpinfo.dll
2007-08-08 06:08 11,264 –a–c— C:\WINDOWS\system32\dllcache\atrace.dll
2007-08-08 06:08 11,264 –a—— C:\WINDOWS\system32\atrace.dll
2007-08-08 06:05 21,640 –a—— C:\WINDOWS\system32\emptyregdb.dat
2007-08-08 06:04 7,093,760 –a—— C:\WINDOWS\system32\space.scr
2007-08-08 06:04 5,068,800 –a—— C:\WINDOWS\system32\davinci.scr
2007-08-08 06:04 4,396,544 –a—— C:\WINDOWS\system32\wpgldfsh.scr
2007-08-08 06:04 3,343,360 –a—— C:\WINDOWS\system32\nature.scr
2007-08-08 06:04 20,576 –a—— C:\WINDOWS\system32\drivers\pxhelp20.sys
2007-08-08 06:04 1,742,336 –a—— C:\WINDOWS\system32\mypixdx.scr
2007-08-08 06:04 d——– C:\Program Files\Windows Plus
2007-08-08 05:54 3,072 –a—— C:\WINDOWS\system32\drivers\audstub.sys
2007-08-08 05:53 57,472 –a—— C:\WINDOWS\system32\drivers\redbook.sys
2007-08-08 05:53 27,165 –a—— C:\WINDOWS\system32\drivers\fetnd5.sys
2007-08-08 05:53 20,992 –a—— C:\WINDOWS\system32\drivers\RTL8139.sys


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2010-08-08 03:13 ——— d——– C:\DOCUME~1\bigsi69\APPLIC~1\Lavasoft
2010-08-08 03:12 ——— d——– C:\Program Files\Lavasoft
2010-08-08 03:12 ——— d——– C:\Program Files\Common Files\Wise Installation Wizard
2010-08-08 02:49 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2008-08-08 02:58 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\NVIDIA
2008-08-08 02:56 ——— d——– C:\DOCUME~1\bigsi69\APPLIC~1\SopCast
2008-08-08 02:55 ——— d——– C:\Program Files\VideoLAN
2008-08-08 02:53 ——— d——– C:\Program Files\SopCast
2007-08-13 18:47 ——— d——– C:\Program Files\EPSON
2007-07-30 19:19 92504 –a—— C:\WINDOWS\system32\cdm.dll
2007-07-30 19:19 549720 –a—— C:\WINDOWS\system32\wuapi.dll
2007-07-30 19:19 53080 –a—— C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 43352 –a—— C:\WINDOWS\system32\wups2.dll
2007-07-30 19:19 325976 –a—— C:\WINDOWS\system32\wucltui.dll
2007-07-30 19:19 203096 –a—— C:\WINDOWS\system32\wuweb.dll
2007-07-30 19:19 1712984 –a—— C:\WINDOWS\system32\wuaueng.dll
2007-07-30 19:18 33624 –a—— C:\WINDOWS\system32\wups.dll
2007-07-04 09:48 132904 –a—— C:\WINDOWS\system32\drivers\imagesrv.sys
2007-07-04 09:48 11304 –a—— C:\WINDOWS\system32\drivers\imagedrv.sys
2007-06-27 19:05 972072 –a—— C:\WINDOWS\UNNeroMediaHome.exe
2007-06-26 14:12 972072 –a—— C:\WINDOWS\UNNeroVision.exe
2007-06-26 07:08 1104896 –a—— C:\WINDOWS\system32\msxml3.dll
2007-06-19 14:31 282112 –a—— C:\WINDOWS\system32\gdi32.dll
2007-06-13 11:23 1033216 –a—— C:\WINDOWS\explorer.exe
2007-06-08 08:11 831048 –a—— C:\WINDOWS\system32\WudfUpdate_01005.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-05 13:56]
"nwiz"="nwiz.exe" [2007-04-19 13:26 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-04-19 13:26]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-04-19 13:26]
"PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 15:10]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-15 13:00]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Nokia.PCSync"=C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog

C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup\
MioSync.lnk - C:\Program Files\Mio Technology\MioSync\mioSync.exe [2007-08-20 17:42:19]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray]
"C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot


**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-04 19:15:37
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-09-04 19:16:07
C:\ComboFix-quarantined-files.txt … 2007-09-04 19:16
C:\ComboFix2.txt … 2007-08-22 14:42
C:\ComboFix3.txt … 2007-08-21 16:13

— E O F —
Post #45
Almost looks like ComboFix was blocked from some registry review in that last log. I checked the Flash_Disinfector run and wonder if some commands it uses that rely on existing settings are either blocked or not locating the correct settings (called environmental settings). Let's capture info on that as well as assess what is still being blocked here.


Download Deckard's System Scanner (DSS) to your Desktop. Note: You must be logged onto an account with administrator privileges.


1. Close all applications and windows.
2. Double-click on dss.exe to run it, and follow the prompts.
3. When the scan is complete, it will create two text files - main.txt <- this one will be maximized and extra.txt<-this one will be minimized on your Taskbar.
4. Copy/paste both logs back here please (they will also be located at C:\Deckard\System Scanner).

Make sure you notice the extra.txt second log that will show as minimized on your Task Bar, "Maximize" that and be sure to paste those contents here as well.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI