[Resolved]Poker And Winantivirus Pop Ups

Hi,
I am trying to resolve an issue on a friends laptop and hve come to the conclusion I need help, to this end I have attached my hijackthis log.
Please can some help me solve this.
Thanks in advance
Alamb200

Logfile of HijackThis v1.99.1
Scan saved at 17:23:10, on 07/08/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Compaq\EAB\EabServr.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Windows\system32\ctfmon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Tesco.net
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\Compaq\EAB\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] c:\compaq\cpqsetup\cpqset.exe
O4 - HKLM\..\Run: [GAEA] "C:\Program Files\O2\PCSuite\Launcher.exe" -tray
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SystemOptimizer] rundll32.exe "C:\Windows\system32\qcjldbgc.dll",forkonce
O4 - HKLM\..\RunServices: [Network Host Service] qranbsw32.exe
O4 - HKLM\..\RunServices: [msvccc66] svcchosst.exe
O4 - HKLM\..\RunServices: [Auto File System Conversion Utility] C:\Windows\System32\wbem\scricon.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\Windows\system32\ctfmon.exe
O4 - HKCU\..\Run: [johnj3155] C:\Windows\system32\srvcc.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.tesco.net
O15 - Trusted Zone: http://register-tesco.qa.business.ntl.com
O15 - Trusted Zone: http://memberservices.tesco.net
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://eu-housecall.trendmicro-europe.com/…ivex/hcImpl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1186386822579
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1186387008717
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\Windows\system32\WPDShServiceObj.dll
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: DomainService - Unknown owner - C:\Windows\System32\qwerty12.exe (file missing)
O23 - Service: ms hexidecimal defx (mshexdefx) - Unknown owner - C:\Windows\system32\dllcache\ivchost.exe (file missing)
O23 - Service: sysmgr64 - Unknown owner - C:\Windows\sysmgr64.exe (file missing)
O23 - Service: wlmsngr - Unknown owner - C:\Windows\wlmsngr.exe (file missing)

Hello alamb200

My name is SNOWHITE and I will be helping you with your Malware problem.

There is a backdoor trojan detected on your system. This gives hackers full access to everything stored on the computer!

I recommend these actions:

1) use a known secure computer to change all of your online passwords
2) contact your bank and credit card company for possible unauthorised transactions

More info can be found here:


How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?

Some further reading:

Security Management - May 2004
Help: I Got Hacked. Now What Do I Do?
http://www.microsoft.com/technet/community…gmt/sm0504.mspx

Security Management - July 2004
Help: I Got Hacked. Now What Do I Do? Part II
http://www.microsoft.com/technet/community…gmt/sm0704.mspx

Though the Trojan has been identified and can be killed, because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of Trojan, the best course of action would be a reformat and reinstall of the OS.

When should I re-format? How should I reinstall?
http://www.dslreports.com/faq/10063

If you choose to format and reinstall see this link for instructions:
http://www.cyberwalker.net/faqs/how-tos/reinstall-faq.html

We can attempt to clean this machine but i can't guarantee that it will be 100% secure afterwards.

Should you have any questions, please feel free to ask.

If you decide not to re-format please follow these steps:

PLEASE READ THIS POST COMPLETELY, IT MAY MAKE IT EASIER FOR YOU IF YOU COPY AND PASTE THIS POST INTO A NEW TEXT DOCUMENT OR PRINT IT FOR REFERENCE LATER

Please follow the steps below exactly in the order they are written:

Step #1

Please download VundoFix.exe to your desktop

• Double-click VundoFix.exe to run it.
• Click the Scan for Vundo button.
• Once it's done scanning, click the Remove Vundo button.
• You will receive a prompt asking if you want to remove the files, click YES
• Once you click yes, your desktop will go blank as it starts removing Vundo.
• When completed, it will prompt that it will reboot your computer, click OK.
• Please post the contents of C:\vundofix.txt and a new HiJackThis log in a reply to this thread.

Note: It is possible that VundoFix encountered a file it could not remove. In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button" when VundoFix appears upon rebooting.

Step #2

Download SDFix and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in Safe Mode by doing the following :

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
• Instead of Windows loading as normal, the Advanced Options Menu should appear;
• Select the first option, to run Windows in Safe Mode, then press Enter.
• Choose your usual account.

• Open the extracted SDFix folder and double click RunThis.bat to start the script.
• Type Y to begin the cleanup process.
• It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
• Press any Key and it will restart the PC.
• When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
• Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
  (Report.txt will also be copied to Clipboard ready for posting back on the forum).
• Finally paste the contents of the Report.txt back on the forum with a new HijackThis log

Step #3

Please download Deckard's System Scanner (DSS) and save it to your Desktop.

• Close all other windows before proceeding.
• Double-click on dss.exe and follow the prompts.
• When it has finished, dss will open two Notepads main.txt and extra.txt – please copy (CTRL+A and then CTRL+C) and paste (CTRL+V) the contents of main.txt and extra.txt in your next reply.

In your next post please include the following reports:

• VundoFix report
• SDFix report
• dss scan reports main.txt and extra.txt

Let me know how the things went.

Regards,

Hi'
Thanks for your help with this, the logs are posted below:
Vundo Fix Report

VundoFix V6.5.7

Checking Java version…

Sun Java not detected
Scan started at 08:52:56 08/08/2007

Listing files found while scanning….

C:\windows\system32\anjgiomx.dll
C:\windows\system32\byxywwu.dll
C:\Windows\system32\cgbdljcq.ini
C:\Windows\System32\ddccy.dll
C:\windows\system32\dqwyjbvr.dll
C:\Windows\System32\fccaxuv.dll
C:\windows\system32\fcfjsiok.dll
C:\windows\system32\ftbqmhqw.dll
C:\windows\system32\koisjfcf.ini
C:\windows\system32\nnnnolj.dll
C:\Windows\system32\qcjldbgc.dll
C:\windows\system32\rvbjywqd.ini
C:\Windows\System32\sayasyni.dll
C:\windows\system32\ssqnopp.dll
C:\windows\system32\wqhmqbtf.ini
C:\windows\system32\xmoigjna.ini
C:\windows\system32\xxywxxu.dll
C:\windows\system32\yccdd.bak1
C:\windows\system32\yccdd.bak2
C:\windows\system32\yccdd.ini
C:\Windows\System32\yccdd.ini2
C:\windows\system32\yccdd.tmp

Beginning removal…

Attempting to delete C:\windows\system32\anjgiomx.dll
C:\windows\system32\anjgiomx.dll Has been deleted!

Attempting to delete C:\windows\system32\byxywwu.dll
C:\windows\system32\byxywwu.dll Has been deleted!

Attempting to delete C:\Windows\system32\cgbdljcq.ini
C:\Windows\system32\cgbdljcq.ini Has been deleted!

Attempting to delete C:\Windows\System32\ddccy.dll
C:\Windows\System32\ddccy.dll Has been deleted!

Attempting to delete C:\windows\system32\dqwyjbvr.dll
C:\windows\system32\dqwyjbvr.dll Has been deleted!

Attempting to delete C:\Windows\System32\fccaxuv.dll
C:\Windows\System32\fccaxuv.dll Has been deleted!

Attempting to delete C:\windows\system32\fcfjsiok.dll
C:\windows\system32\fcfjsiok.dll Has been deleted!

Attempting to delete C:\windows\system32\ftbqmhqw.dll
C:\windows\system32\ftbqmhqw.dll Has been deleted!

Attempting to delete C:\windows\system32\koisjfcf.ini
C:\windows\system32\koisjfcf.ini Has been deleted!

Attempting to delete C:\windows\system32\nnnnolj.dll
C:\windows\system32\nnnnolj.dll Has been deleted!

Attempting to delete C:\Windows\system32\qcjldbgc.dll
C:\Windows\system32\qcjldbgc.dll Could not be deleted.

Attempting to delete C:\windows\system32\rvbjywqd.ini
C:\windows\system32\rvbjywqd.ini Has been deleted!

Attempting to delete C:\windows\system32\ssqnopp.dll
C:\windows\system32\ssqnopp.dll Has been deleted!

Attempting to delete C:\windows\system32\wqhmqbtf.ini
C:\windows\system32\wqhmqbtf.ini Has been deleted!

Attempting to delete C:\windows\system32\xmoigjna.ini
C:\windows\system32\xmoigjna.ini Has been deleted!

Attempting to delete C:\windows\system32\xxywxxu.dll
C:\windows\system32\xxywxxu.dll Has been deleted!

Attempting to delete C:\windows\system32\yccdd.bak1
C:\windows\system32\yccdd.bak1 Has been deleted!

Attempting to delete C:\windows\system32\yccdd.bak2
C:\windows\system32\yccdd.bak2 Has been deleted!

Attempting to delete C:\windows\system32\yccdd.ini
C:\windows\system32\yccdd.ini Has been deleted!

Attempting to delete C:\Windows\System32\yccdd.ini2
C:\Windows\System32\yccdd.ini2 Has been deleted!

Attempting to delete C:\windows\system32\yccdd.tmp
C:\windows\system32\yccdd.tmp Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V6.5.7

Checking Java version…

Sun Java not detected
Scan started at 09:08:02 08/08/2007

Listing files found while scanning….

C:\windows\system32\qcjldbgc.dll

Beginning removal…

Attempting to delete C:\windows\system32\qcjldbgc.dll
C:\windows\system32\qcjldbgc.dll Has been deleted!

Performing Repairs to the registry.
Done!

SDFix Report

SDFix: Version 1.96

Run by [removed] on 08/08/2007 at 09:27

Microsoft Windows XP [Version 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:

Name:
DomainService
mshexdefx
sysmgr64
wlmsngr

ImagePath:
C:\Windows\System32\qwerty12.exe /service
"C:\Windows\system32\dllcache\ivchost.exe"
"C:\Windows\sysmgr64.exe"
"C:\Windows\wlmsngr.exe"

DomainService - Deleted
mshexdefx - Deleted
sysmgr64 - Deleted
wlmsngr - Deleted



Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting…


Normal Mode:
Checking Files:

Trojan Files Found:

C:\134730~1 - Deleted
C:\Windows\Downloaded Program Files\UERS_9999_N91S1502NetInstaller.exe - Deleted
C:\Windows\system32\alog.txt - Deleted
C:\Windows\system32\commands.xml - Deleted
C:\Windows\system32\cookie.dat - Deleted
C:\Windows\system32\help.txt - Deleted
C:\Windows\system32\i - Deleted
C:\Windows\system32\ps.dat - Deleted
C:\Windows\system32\TFTP1212 - Deleted
C:\Windows\Temp\removalfile.bat - Deleted



Removing Temp Files…

ADS Check:

C:\Windows
No streams found.

C:\Windows\system32
No streams found.

C:\Windows\system32\svchost.exe
No streams found.

C:\Windows\system32\ntoskrnl.exe
No streams found.



Final Check:

Remaining Services:
——————



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\\Windows\\System32\\wbem\\scricon.exe"="C:\\Windows\\System32\\wbem\\scricon.exe:*:Enabled:Auto File System Conversion Utility"
"C:\\Windows\\System32\\qwerty12.exe"="C:\\Windows\\System32\\qwe"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

Remaining Files:
—————

Backups Folder: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes:

C:\Documents and Settings\Cal\NetHood\ftp.microsoft.com\Desktop.ini
C:\Documents and Settings\Cal\Local Settings\Temp\diwsbshv.dll
C:\Documents and Settings\Cal\Local Settings\Temp\kndckjsn.dll
C:\Documents and Settings\Cal\Local Settings\Temp\lxccsafi.dll
C:\Documents and Settings\Cal\Local Settings\Temp\xbldjuof.dll
C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp
C:\Program Files\InterActual\InterActual Player\iti2.tmp

Finished

Main.txt
Deckard's System Scanner v20070807.62
Run by [removed] on 2007-08-08 at 09:43:15
Computer is in Normal Mode.
——————————————————————————–

– System Restore ————————————————————–

Successfully created a Deckard's System Scanner Restore Point.


– Last 5 Restore Point(s) –
24: 2007-08-08 08:43:45 UTC - RP24 - Deckard's System Scanner Restore Point
23: 2007-08-07 13:49:23 UTC - RP23 - Software Distribution Service 3.0
22: 2007-08-07 08:44:45 UTC - RP22 - Software Distribution Service 3.0
21: 2007-08-06 15:47:13 UTC - RP21 - Software Distribution Service 3.0
20: 2007-08-06 15:23:48 UTC - RP20 - Software Distribution Service 3.0


– First Restore Point –
1: 2007-08-04 15:57:23 UTC - RP1 - System Checkpoint


Backed up registry hives.
Performed disk cleanup.

Total Physical Memory: 240 MiB (512 MiB recommended).


– HijackThis (run as Cal.exe) ————————————————-

Logfile of HijackThis v1.99.1
Scan saved at 09:45:43, on 08/08/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Windows\system32\wscntfy.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Compaq\EAB\EabServr.exe
C:\Program Files\O2\PCSuite\Launcher.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Windows\system32\ctfmon.exe
C:\Program Files\O2\PCSuite\ConMgmt.exe
C:\Documents and Settings\Cal\Desktop\dss.exe
C:\HIJACK~1\Cal.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Tesco.net
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {06F509AE-5405-4A3A-9AF9-E2EDA3E4C20F} - C:\Windows\System32\ddccy.dll (file missing)
O2 - BHO: H - {395AFD48-29EF-4dd4-B00B-70BA74BD1B7A} - soierw.dll (file missing)
O2 - BHO: (no name) - {DC1B5EFC-472D-40BD-BF89-E8521E72E7E0} - C:\Windows\System32\yeegifll.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\Compaq\EAB\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] c:\compaq\cpqsetup\cpqset.exe
O4 - HKLM\..\Run: [GAEA] "C:\Program Files\O2\PCSuite\Launcher.exe" -tray
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\RunServices: [Network Host Service] qranbsw32.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\Windows\system32\ctfmon.exe
O4 - HKCU\..\Run: [johnj3155] C:\Windows\system32\srvcc.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.tesco.net
O15 - Trusted Zone: http://register-tesco.qa.business.ntl.com
O15 - Trusted Zone: http://memberservices.tesco.net
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://eu-housecall.trendmicro-europe.com/…ivex/hcImpl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1186386822579
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1186387008717
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\Windows\system32\WPDShServiceObj.dll
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe


– File Associations ———————————————————–

All associations okay.


– Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ———————

R1 ClntMgmt.sys - c:\windows\system32\drivers\clntmgmt.sys

Hi,
I have run both of the apps and the logs are below.
Thanks again for your help

ComboFix 07-08-09.3 - "Cal" 2007-08-10 9:27:04.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.60 [GMT 1:00]
* Created a new restore point


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\Windows\system32\nvs2.inf


((((((((((((((((((((((((( Files Created from 2007-07-10 to 2007-08-10 )))))))))))))))))))))))))))))))


2007-08-10 09:25 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-08-08 09:43 d——– C:\Deckard
2007-08-08 09:26 d——– C:\WINDOWS\ERUNT
2007-08-08 08:52 d——– C:\VundoFix Backups
2007-08-07 17:22 d——– C:\Hijackthis
2007-08-07 17:21 d——– C:\hijacjthis
2007-08-07 16:29 d——– C:\DOCUME~1\Cal\.housecall6.6
2007-08-07 11:06 d——– C:\Program Files\MSXML 6.0
2007-08-07 11:02 d——– C:\Program Files\MSBuild
2007-08-07 10:53 d——– C:\WINDOWS\system32\XPSViewer
2007-08-07 10:49 d——– C:\Program Files\Reference Assemblies
2007-08-07 10:46 14,048 ——— C:\WINDOWS\system32\spmsg2.dll
2007-08-07 10:44 d——– C:\a692d0d97c1f801765e25e675332a4
2007-08-07 10:36 d——– C:\Program Files\Windows Media Connect 2
2007-08-07 10:23 d——– C:\WINDOWS\system32\LogFiles
2007-08-07 10:23 d——– C:\WINDOWS\system32\drivers\UMDF
2007-08-07 09:37 36,352 ——— C:\WINDOWS\system32\tsgqec.dll
2007-08-07 09:37 288,768 ——— C:\WINDOWS\system32\rhttpaa.dll
2007-08-07 09:37 116,736 ——— C:\WINDOWS\system32\aaclient.dll
2007-08-06 17:32 33,792 –a—— C:\WINDOWS\system32\dllcache\custsat.dll
2007-08-06 17:32 d——– C:\WINDOWS\network diagnostic
2007-08-06 17:13 23,040 ——— C:\WINDOWS\system32\dllcache\fltmc.exe
2007-08-06 17:13 16,896 ——— C:\WINDOWS\system32\dllcache\fltlib.dll
2007-08-06 17:13 128,896 ——— C:\WINDOWS\system32\dllcache\fltmgr.sys
2007-08-06 14:55 d–h—– C:\WINDOWS\$hf_mig$
2007-08-06 14:55 d——– C:\WINDOWS\system32\PreInstall
2007-08-06 14:35 d——– C:\WINDOWS\Prefetch
2007-08-06 13:48 95,424 ——— C:\WINDOWS\system32\drivers\slnthal.sys
2007-08-06 13:48 937,984 ——— C:\WINDOWS\system32\winbrand.dll
2007-08-06 13:48 9,728 ——— C:\WINDOWS\system32\comsdupd.exe
2007-08-06 13:48 81,408 ——— C:\WINDOWS\system32\wscsvc.dll
2007-08-06 13:48 8,192 ——— C:\WINDOWS\system32\smbinst.exe
2007-08-06 13:48 78,464 ——— C:\WINDOWS\system32\drivers\usbvideo.sys
2007-08-06 13:48 78,336 –a—— C:\WINDOWS\system32\ieencode.dll
2007-08-06 13:48 75,776 ——— C:\WINDOWS\system32\strmfilt.dll
2007-08-06 13:48 73,832 ——— C:\WINDOWS\system32\slcoinst.dll
2007-08-06 13:48 73,796 ——— C:\WINDOWS\system32\slserv.exe
2007-08-06 13:48 73,216 ——— C:\WINDOWS\system32\drivers\atintuxx.sys
2007-08-06 13:48 71,680 ——— C:\WINDOWS\system32\blastcln.exe
2007-08-06 13:48 7,680 ——— C:\WINDOWS\system32\kbdsmsno.dll
2007-08-06 13:48 7,680 ——— C:\WINDOWS\system32\kbdsmsfi.dll
2007-08-06 13:48 7,168 ——— C:\WINDOWS\system32\kbdukx.dll
2007-08-06 13:48 7,168 ——— C:\WINDOWS\system32\kbdno1.dll
2007-08-06 13:48 7,168 ——— C:\WINDOWS\system32\kbdfi1.dll
2007-08-06 13:48 7,168 ——— C:\WINDOWS\system32\hccoin.dll
2007-08-06 13:48 685,056 ——— C:\WINDOWS\system32\drivers\hsfcxts2.sys
2007-08-06 13:48 67,584 ——— C:\WINDOWS\system32\drivers\sdbus.sys
2007-08-06 13:48 63,663 ——— C:\WINDOWS\system32\drivers\ati1rvxx.sys
2007-08-06 13:48 63,488 ——— C:\WINDOWS\system32\drivers\atinxsxx.sys
2007-08-06 13:48 60,416 ——— C:\WINDOWS\system32\fwcfg.dll
2007-08-06 13:48 6,656 ——— C:\WINDOWS\system32\kbdinmal.dll
2007-08-06 13:48 6,656 ——— C:\WINDOWS\system32\kbdinben.dll
2007-08-06 13:48 6,144 ——— C:\WINDOWS\system32\kbdmlt48.dll
2007-08-06 13:48 6,144 ——— C:\WINDOWS\system32\kbdmlt47.dll
2007-08-06 13:48 6,144 ——— C:\WINDOWS\system32\kbdinbe1.dll
2007-08-06 13:48 6,016 ——— C:\WINDOWS\system32\drivers\smbali.sys
2007-08-06 13:48 59,648 ——— C:\WINDOWS\system32\drivers\rfcomm.sys
2007-08-06 13:48 58,880 –a—— C:\WINDOWS\system32\pnrpnsp.dll
2007-08-06 13:48 57,856 ——— C:\WINDOWS\system32\drivers\atinbtxx.sys
2007-08-06 13:48 56,623 ——— C:\WINDOWS\system32\drivers\ati1btxx.sys
2007-08-06 13:48 553,984 –a—— C:\WINDOWS\system32\p2psvc.dll
2007-08-06 13:48 52,224 ——— C:\WINDOWS\system32\drivers\atinraxx.sys
2007-08-06 13:48 516,768 ——— C:\WINDOWS\system32\ativvaxx.dll
2007-08-06 13:48 50,688 ——— C:\WINDOWS\system32\btpanui.dll
2007-08-06 13:48 50,176 ——— C:\WINDOWS\system32\xmlprovi.dll
2007-08-06 13:48 5,632 ——— C:\WINDOWS\system32\kbdmaori.dll
2007-08-06 13:48 49,152 ——— C:\WINDOWS\system32\powercfg.exe
2007-08-06 13:48 46,464 ——— C:\WINDOWS\system32\drivers\gagp30kx.sys
2007-08-06 13:48 452,736 ——— C:\WINDOWS\system32\drivers\mtxparhm.sys
2007-08-06 13:48 44,928 ——— C:\WINDOWS\system32\drivers\agpcpq.sys
2007-08-06 13:48 44,672 ——— C:\WINDOWS\system32\drivers\uagp35.sys
2007-08-06 13:48 44,032 ——— C:\WINDOWS\system32\twext.dll
2007-08-06 13:48 43,008 ——— C:\WINDOWS\system32\drivers\amdagp.sys
2007-08-06 13:48 42,752 ——— C:\WINDOWS\system32\drivers\alim1541.sys
2007-08-06 13:48 42,240 ——— C:\WINDOWS\system32\drivers\viaagp.sys
2007-08-06 13:48 41,088 ——— C:\WINDOWS\system32\drivers\sisagp.sys
2007-08-06 13:48 404,990 ——— C:\WINDOWS\system32\drivers\slntamr.sys
2007-08-06 13:48 40,832 ——— C:\WINDOWS\system32\drivers\irbus.sys
2007-08-06 13:48 4,274,816 ——— C:\WINDOWS\system32\nv4_disp.dll
2007-08-06 13:48 4,255 ——— C:\WINDOWS\system32\drivers\adv01nt5.dll
2007-08-06 13:48 4,096 ——— C:\WINDOWS\system32\dsprpres.dll
2007-08-06 13:48 397,056 ——— C:\WINDOWS\system32\s3gnb.dll
2007-08-06 13:48 38,016 ——— C:\WINDOWS\system32\drivers\bthmodem.sys
2007-08-06 13:48 377,984 ——— C:\WINDOWS\system32\ati2dvaa.dll
2007-08-06 13:48 36,463 ——— C:\WINDOWS\system32\drivers\ati1tuxx.sys
2007-08-06 13:48 36,096 ——— C:\WINDOWS\system32\drivers\intelppm.sys
2007-08-06 13:48 35,456 ——— C:\WINDOWS\system32\drivers\bthprint.sys
2007-08-06 13:48 34,735 ——— C:\WINDOWS\system32\drivers\ati1xsxx.sys
2007-08-06 13:48 327,040 ——— C:\WINDOWS\system32\drivers\ati2mtaa.sys
2007-08-06 13:48 32,866 ——— C:\WINDOWS\system32\slrundll.exe
2007-08-06 13:48 32,866 ——— C:\WINDOWS\slrundll.exe
2007-08-06 13:48 32,768 ——— C:\WINDOWS\system32\ativtmxx.dll
2007-08-06 13:48 32,768 ——— C:\WINDOWS\system32\asr_pfu.exe
2007-08-06 13:48 32,285 ——— C:\WINDOWS\system32\hsfcisp2.dll
2007-08-06 13:48 313,344 –a—— C:\WINDOWS\system32\p2pgraph.dll
2007-08-06 13:48 31,744 ——— C:\WINDOWS\system32\drivers\atinxbxx.sys
2007-08-06 13:48 30,671 ——— C:\WINDOWS\system32\drivers\ati1raxx.sys
2007-08-06 13:48 30,208 ——— C:\WINDOWS\system32\bthserv.dll
2007-08-06 13:48 30,080 ——— C:\WINDOWS\system32\drivers\rndismpx.sys
2007-08-06 13:48 3,967 ——— C:\WINDOWS\system32\drivers\adv02nt5.dll


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-06 16:57 ——— d——– C:\Program Files\Messenger
2007-08-06 16:36 ——— d——– C:\Program Files\Google
2007-08-06 13:47 ——— d——– C:\Program Files\Movie Maker
2007-08-06 13:38 ——— d——– C:\Program Files\Windows NT
2007-08-06 08:54 ——— d–h—– C:\Program Files\WindowsUpdate
2007-07-09 21:39 ——— d–h—– C:\Program Files\InstallShield Installation Information
2007-07-09 21:39 ——— d——– C:\Program Files\Activision
2007-07-05 17:56 ——— d——– C:\Program Files\LimeWire
2007-05-16 16:12 86528 ——— C:\Windows\system32\dllcache\directdb.dll
2007-05-16 16:12 85504 ——— C:\Windows\system32\dllcache\wabimp.dll
2007-05-16 16:12 683520 –a—— C:\Windows\system32\inetcomm.dll
2007-05-16 16:12 683520 ——— C:\Windows\system32\dllcache\inetcomm.dll
2007-05-16 16:12 510976 ——— C:\Windows\system32\dllcache\wab32.dll
2007-05-16 16:12 1314816 ——— C:\Windows\system32\dllcache\msoe.dll
2003-04-28 21:23 33712 –a–c— C:\DOCUME~1\Cal\APPLIC~1\GDIPFONTCACHEV1.DAT
2002-10-11 06:28 1938 –a–c— C:\Program Files\Readme.txt


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06F509AE-5405-4A3A-9AF9-E2EDA3E4C20F}]
C:\Windows\System32\ddccy.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{395AFD48-29EF-4dd4-B00B-70BA74BD1B7A}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DC1B5EFC-472D-40BD-BF89-E8521E72E7E0}]
2007-08-02 22:12 121364 –a—— C:\Windows\System32\yeegifll.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIModeChange"="Ati2mdxx.exe" [2002-04-07 23:23 C:\WINDOWS\system32\Ati2mdxx.exe]
"AtiPTA"="atiptaxx.exe" []
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-11-04 18:40]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-11-04 18:38]
"eabconfg.cpl"="C:\Program Files\Compaq\EAB\EabServr.exe" [2002-04-09 11:49]
"Cpqset"="c:\compaq\cpqsetup\cpqset.exe" [2002-05-09 14:13]
"GAEA"="C:\Program Files\O2\PCSuite\Launcher.exe" [2006-07-05 21:08]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-08-06 10:30]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\Windows\system32\ctfmon.exe" [2004-08-04 00:56]
"johnj3155"="C:\Windows\system32\srvcc.exe" []

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices]
"Network Host Service"=qranbsw32.exe

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Symantec NetDriver Warning"=C:\PROGRA~1\Symantec\LIVEUP~1\SNDWarn.EXE
"Auto File System Conversion Utility"=C:\Windows\System32\wbem\scricon.exe

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk
backup=C:\Windows\pss\Google Updater.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Auto File System Conversion Utility]
C:\Windows\System32\wbem\scricon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Network Host Service]
qranbsw32.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

R0 caboagp;ATI Cabo AGP Filter;C:\Windows\system32\DRIVERS\atisgkaf.sys
R1 ClntMgmt.sys;ClntMgmt.sys;C:\Windows\system32\Drivers\ClntMgmt.sys
R1 EABFiltr;EABFiltr;\??\C:\Windows\System32\drivers\EABFiltr.sys
R2 cpqdfw;Compaq Diagnostics Driver;\??\C:\Windows\System32\drivers\cpqdfw.sys
R2 cq_mem;Compaq Diagnostics Memory Driver;\??\C:\Windows\System32\drivers\cq_mem.sys
R2 cqcpu;Compaq Diagnostics CPU Driver;\??\C:\Windows\System32\drivers\cqcpu.sys
R3 RTL8023xp;Realtek 10/100/1000 PCI NIC Family NDIS XP Driver;C:\Windows\system32\DRIVERS\Rtnicxp.sys
S3 adxapie;adxapie;\??\C:\DOCUME~1\Cal\LOCALS~1\Temp\adxapie.sys
S3 aliadwdm;ALi Audio Accelerator WDM driver;C:\Windows\system32\drivers\ac97ali.sys
S3 allegro;ESS Allegro Audio Driver (WDM);C:\Windows\system32\drivers\es198x.sys
S3 ATICDSDr;ATICDSDr;\??\C:\DOCUME~1\Dave\LOCALS~1\Temp\ATICDSDr.sys
S3 eabusb;eabusb;\??\C:\Windows\System32\drivers\eabusb.sys
S3 idsvc;Windows CardSpace;"C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe"
S3 ltmodem5;LT Modem Driver;C:\Windows\system32\DRIVERS\ltmdmnt.sys
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service;"C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe"


Contents of the 'Scheduled Tasks' folder
2007-08-10 06:38:12 C:\Windows\Tasks\Symantec NetDetect.job

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-10 09:30:11
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden registry entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-10 9:31:41
C:\ComboFix-quarantined-files.txt … 2007-08-10 09:31

— E O F —


Logfile of HijackThis v1.99.1
Scan saved at 09:45:14, on 10/08/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\spoolsv.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Compaq\EAB\EabServr.exe
C:\Program Files\O2\PCSuite\Launcher.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Windows\system32\ctfmon.exe
C:\Program Files\O2\PCSuite\ConMgmt.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Windows\system32\wscntfy.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Windows\explorer.exe
C:\Windows\system32\notepad.exe
C:\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {06F509AE-5405-4A3A-9AF9-E2EDA3E4C20F} - C:\Windows\System32\ddccy.dll (file missing)
O2 - BHO: H - {395AFD48-29EF-4dd4-B00B-70BA74BD1B7A} - soierw.dll (file missing)
O2 - BHO: (no name) - {DC1B5EFC-472D-40BD-BF89-E8521E72E7E0} - C:\Windows\System32\yeegifll.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\Compaq\EAB\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] c:\compaq\cpqsetup\cpqset.exe
O4 - HKLM\..\Run: [GAEA] "C:\Program Files\O2\PCSuite\Launcher.exe" -tray
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\RunServices: [Network Host Service] qranbsw32.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\Windows\system32\ctfmon.exe
O4 - HKCU\..\Run: [johnj3155] C:\Windows\system32\srvcc.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.tesco.net
O15 - Trusted Zone: http://register-tesco.qa.business.ntl.com
O15 - Trusted Zone: http://memberservices.tesco.net
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://eu-housecall.trendmicro-europe.com/…ivex/hcImpl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1186386822579
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1186387008717
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\Windows\system32\WPDShServiceObj.dll
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe

Hello alamb200,

PLEASE READ THIS POST COMPLETELY, IT MAY MAKE IT EASIER FOR YOU IF YOU COPY AND PASTE THIS POST INTO A NEW TEXT DOCUMENT OR PRINT IT FOR REFERENCE LATER

Please follow the steps below exactly in the order they are written:

Step #1

CLICK THIS TO LINK TO BE SURE YOU CAN VIEW HIDDEN FILES

Please go to UploadMalware to upload a suspicious file for analysis.

• Enter your username from this forum
• Copy and paste the link to this thread
• In the Browse empty box, copy&paste (Ctrl+V) this file path:
  • C:\Windows\System32\yeegifll.dll
• In the comments, please mention that I asked you to upload this file
• Click on Send File

Step #2

Please re-open HiJackThis and click on "Do a system scan only". Check the boxes next to all the entries listed below.

O2 - BHO: (no name) - {06F509AE-5405-4A3A-9AF9-E2EDA3E4C20F} - C:\Windows\System32\ddccy.dll (file missing)
O2 - BHO: H - {395AFD48-29EF-4dd4-B00B-70BA74BD1B7A} - soierw.dll (file missing)
O2 - BHO: (no name) - {DC1B5EFC-472D-40BD-BF89-E8521E72E7E0} - C:\Windows\System32\yeegifll.dll
O4 - HKLM\..\RunServices: [Network Host Service] qranbsw32.exe
O4 - HKCU\..\Run: [johnj3155] C:\Windows\system32\srvcc.exe

Now close all windows other than HiJackThis, then click Fix Checked. Close HiJackThis.


Step #3

Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\Windows\System32\yeegifll.dll
C:\Windows\system32\srvcc.exe
C:\Windows\System32\wbem\scricon.exe

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Auto File System Conversion Utility]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Network Host Service]

Suspect::[29]
C:\Windows\system32\qyzuirnxi_nav.dat
C:\Windows\system32\qyzuirnxi_navps.dat
C:\Windows\system32\qyzuirnxi.dat
C:\Windows\system32\avfrhrvd.dll
C:\Windows\system32\aixxvvw.exe
C:\Windows\system32\scjrknus.dll
C:\fjem.exe
C:\Windows\system32\soierw.dll 
C:\rvcwni.exe
C:\Windows\wr21.exe

Save this as "CFScript"


[external image: Posted Image]

Refering to the picture above, drag CFScript into ComboFix.exe

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt.

Step #4

Using Windows Explorer (to get there right-click your Start button and go to "Explore"), please use the search option find and delete the following file (if present):

qranbsw32.exe

Close Windows Explorer.

Please go to Start > Control Panel > Add/Remove Programs and remove the following (if present):

* Optional

The next program is very likely the reason your system is infested with malware. Even when a program like this is not infected itself, it will still bring malware into your system because more than half of all files available for download from peer-to-peer networks have been deliberately infected with some form of malware. I recommend that you remove this programs from your system.

LimeWire 4.12.15

Please note any other programs that you don't recognize in that list in your next response

Step #5

- Please download ATF Cleaner by Atribune.
This program is for XP and Windows 2000 only

• - Start AVG Anti-Spyware
  On the main screen select the icon "Update" then select the "Update now" link.Next select the "Start Update" button, the update will start and a progress bar will show the updates being installed.
  
  If you are having problems with the updater, you can use this link for manual update.
  AVG Anti-Spyware manual updates.
  Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that AVG Anti-Spyware is closed before installing the update.
  
  If you are unable to run scan with AVG Anti-Spyware in Safe Mode, Click the next link http://fileserver.ewido.net/public.cgi?id=20990 and download AVG_Anti-Spyware_7.5.1.36_Safe_Mode_Registry_Patch.reg to your desktop. It should look like this -> [external image: Posted Image] double click on it. You will receive a prompt similar to: "Do you wish to merge the information into the registry?".
  Answer "Yes" and wait for a message to appear similar to "Merged Successfully".
  
  - Reboot your computer in Safe Mode.
• If the computer is running, shut down Windows, and then turn off the power.
• Wait 30 seconds, and then turn the computer on.
• Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
• Ensure that the Safe Mode option is selected.
• Press Enter. The computer then begins to start in Safe mode.
• Login on your usual account.

- Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

- Close ALL open Windows / Programs / Folders. Please start AVG Anti-Spyware and run a full scan.

• Click on Scanner on the toolbar.
• Click on the Settings tab.
  • Under How to act?
  • Click on Recommended Action and choose Quarantine from the popup menu.
• Under How to scan?
  • All checkboxes should be ticked.
• Under Possibly unwanted software:
  • All checkboxes should be ticked.
• Under Reports:
  • Select Automatically generate report after every scan and uncheck Only if threats were found.
• Under What to scan?
  • Select Scan every file.

[*]Click on the Scan tab.

[*]Click on Complete System Scan to start the scan process.

[*]Let the program scan the machine.

[*]When the scan has finished, follow the instructions below.

IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.

• Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
• At the bottom of the window click on the Apply all Actions button. (3)
  [external image: Posted Image]

[*]When done, click the Save Scan Report button. (4)

• Click the Save Report as button.
• Save the report to your Desktop.

[*]Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.

Reboot in Normal Mode.

Step #6

Please run this online scan:

Panda ActiveScan

• Once you are on the Panda site, click the Scan your PC button
• A new window will open…click the Check Now button
• Enter your Country
• Enter your State/Province
• Enter your e-mail address and click send
• Select either Home User or Company
• Click the big Scan Now button
• If it wants to install an ActiveX component allow it
• It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
• When download is complete, click on Local Disks to start the scan
• When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location.

Post the contents of the Panda scan report, along with a new HijackThis Log



In your next post please include the following reports:

• Combofix report
• AVG Anti-Spyware scan report
• Panda scan report
• New HijackThis log

Let me know how the things went.


Regards,

Hi Snowhite,

Sorry about not posting the other logs they are attached to this reply

Combofix log

ComboFix 07-08-09.3 - "Cal" 2007-08-13 9:48:22.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.75 [GMT 1:00]
Command switches used :: C:\Documents and Settings\Cal\Desktop\CFScript.txt
* Created a new restore point

FILE::
C:\Windows\System32\yeegifll.dll
C:\Windows\system32\srvcc.exe
C:\Windows\System32\wbem\scricon.exe


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\Windows\System32\yeegifll.dll


((((((((((((((((((((((((( Files Created from 2007-07-13 to 2007-08-13 )))))))))))))))))))))))))))))))


2007-08-10 09:25 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-08-08 09:43 d——– C:\Deckard
2007-08-08 09:26 d——– C:\WINDOWS\ERUNT
2007-08-08 08:52 d——– C:\VundoFix Backups
2007-08-07 17:22 d——– C:\Hijackthis
2007-08-07 17:21 d——– C:\hijacjthis
2007-08-07 16:29 d——– C:\DOCUME~1\Cal\.housecall6.6
2007-08-07 11:06 d——– C:\Program Files\MSXML 6.0
2007-08-07 11:02 d——– C:\Program Files\MSBuild
2007-08-07 10:53 d——– C:\WINDOWS\system32\XPSViewer
2007-08-07 10:49 d——– C:\Program Files\Reference Assemblies
2007-08-07 10:46 14,048 ——— C:\WINDOWS\system32\spmsg2.dll
2007-08-07 10:44 d——– C:\a692d0d97c1f801765e25e675332a4
2007-08-07 10:36 d——– C:\Program Files\Windows Media Connect 2
2007-08-07 10:23 d——– C:\WINDOWS\system32\LogFiles
2007-08-07 10:23 d——– C:\WINDOWS\system32\drivers\UMDF
2007-08-07 09:37 36,352 ——— C:\WINDOWS\system32\tsgqec.dll
2007-08-07 09:37 288,768 ——— C:\WINDOWS\system32\rhttpaa.dll
2007-08-07 09:37 116,736 ——— C:\WINDOWS\system32\aaclient.dll
2007-08-06 17:32 33,792 –a—— C:\WINDOWS\system32\dllcache\custsat.dll
2007-08-06 17:32 d——– C:\WINDOWS\network diagnostic
2007-08-06 17:13 23,040 ——— C:\WINDOWS\system32\dllcache\fltmc.exe
2007-08-06 17:13 16,896 ——— C:\WINDOWS\system32\dllcache\fltlib.dll
2007-08-06 17:13 128,896 ——— C:\WINDOWS\system32\dllcache\fltmgr.sys
2007-08-06 14:55 d–h—– C:\WINDOWS\$hf_mig$
2007-08-06 14:55 d——– C:\WINDOWS\system32\PreInstall
2007-08-06 14:35 d——– C:\WINDOWS\Prefetch
2007-08-06 13:48 95,424 ——— C:\WINDOWS\system32\drivers\slnthal.sys
2007-08-06 13:48 937,984 ——— C:\WINDOWS\system32\winbrand.dll
2007-08-06 13:48 9,728 ——— C:\WINDOWS\system32\comsdupd.exe
2007-08-06 13:48 81,408 ——— C:\WINDOWS\system32\wscsvc.dll
2007-08-06 13:48 8,192 ——— C:\WINDOWS\system32\smbinst.exe
2007-08-06 13:48 78,464 ——— C:\WINDOWS\system32\drivers\usbvideo.sys
2007-08-06 13:48 78,336 –a—— C:\WINDOWS\system32\ieencode.dll
2007-08-06 13:48 75,776 ——— C:\WINDOWS\system32\strmfilt.dll
2007-08-06 13:48 73,832 ——— C:\WINDOWS\system32\slcoinst.dll
2007-08-06 13:48 73,796 ——— C:\WINDOWS\system32\slserv.exe
2007-08-06 13:48 73,216 ——— C:\WINDOWS\system32\drivers\atintuxx.sys
2007-08-06 13:48 71,680 ——— C:\WINDOWS\system32\blastcln.exe
2007-08-06 13:48 7,680 ——— C:\WINDOWS\system32\kbdsmsno.dll
2007-08-06 13:48 7,680 ——— C:\WINDOWS\system32\kbdsmsfi.dll
2007-08-06 13:48 7,168 ——— C:\WINDOWS\system32\kbdukx.dll
2007-08-06 13:48 7,168 ——— C:\WINDOWS\system32\kbdno1.dll
2007-08-06 13:48 7,168 ——— C:\WINDOWS\system32\kbdfi1.dll
2007-08-06 13:48 7,168 ——— C:\WINDOWS\system32\hccoin.dll
2007-08-06 13:48 685,056 ——— C:\WINDOWS\system32\drivers\hsfcxts2.sys
2007-08-06 13:48 67,584 ——— C:\WINDOWS\system32\drivers\sdbus.sys
2007-08-06 13:48 63,663 ——— C:\WINDOWS\system32\drivers\ati1rvxx.sys
2007-08-06 13:48 63,488 ——— C:\WINDOWS\system32\drivers\atinxsxx.sys
2007-08-06 13:48 60,416 ——— C:\WINDOWS\system32\fwcfg.dll
2007-08-06 13:48 6,656 ——— C:\WINDOWS\system32\kbdinmal.dll
2007-08-06 13:48 6,656 ——— C:\WINDOWS\system32\kbdinben.dll
2007-08-06 13:48 6,144 ——— C:\WINDOWS\system32\kbdmlt48.dll
2007-08-06 13:48 6,144 ——— C:\WINDOWS\system32\kbdmlt47.dll
2007-08-06 13:48 6,144 ——— C:\WINDOWS\system32\kbdinbe1.dll
2007-08-06 13:48 6,016 ——— C:\WINDOWS\system32\drivers\smbali.sys
2007-08-06 13:48 59,648 ——— C:\WINDOWS\system32\drivers\rfcomm.sys
2007-08-06 13:48 58,880 –a—— C:\WINDOWS\system32\pnrpnsp.dll
2007-08-06 13:48 57,856 ——— C:\WINDOWS\system32\drivers\atinbtxx.sys
2007-08-06 13:48 56,623 ——— C:\WINDOWS\system32\drivers\ati1btxx.sys
2007-08-06 13:48 553,984 –a—— C:\WINDOWS\system32\p2psvc.dll
2007-08-06 13:48 52,224 ——— C:\WINDOWS\system32\drivers\atinraxx.sys
2007-08-06 13:48 516,768 ——— C:\WINDOWS\system32\ativvaxx.dll
2007-08-06 13:48 50,688 ——— C:\WINDOWS\system32\btpanui.dll
2007-08-06 13:48 50,176 ——— C:\WINDOWS\system32\xmlprovi.dll
2007-08-06 13:48 5,632 ——— C:\WINDOWS\system32\kbdmaori.dll
2007-08-06 13:48 49,152 ——— C:\WINDOWS\system32\powercfg.exe
2007-08-06 13:48 46,464 ——— C:\WINDOWS\system32\drivers\gagp30kx.sys
2007-08-06 13:48 452,736 ——— C:\WINDOWS\system32\drivers\mtxparhm.sys
2007-08-06 13:48 44,928 ——— C:\WINDOWS\system32\drivers\agpcpq.sys
2007-08-06 13:48 44,672 ——— C:\WINDOWS\system32\drivers\uagp35.sys
2007-08-06 13:48 44,032 ——— C:\WINDOWS\system32\twext.dll
2007-08-06 13:48 43,008 ——— C:\WINDOWS\system32\drivers\amdagp.sys
2007-08-06 13:48 42,752 ——— C:\WINDOWS\system32\drivers\alim1541.sys
2007-08-06 13:48 42,240 ——— C:\WINDOWS\system32\drivers\viaagp.sys
2007-08-06 13:48 41,088 ——— C:\WINDOWS\system32\drivers\sisagp.sys
2007-08-06 13:48 404,990 ——— C:\WINDOWS\system32\drivers\slntamr.sys
2007-08-06 13:48 40,832 ——— C:\WINDOWS\system32\drivers\irbus.sys
2007-08-06 13:48 4,274,816 ——— C:\WINDOWS\system32\nv4_disp.dll
2007-08-06 13:48 4,255 ——— C:\WINDOWS\system32\drivers\adv01nt5.dll
2007-08-06 13:48 4,096 ——— C:\WINDOWS\system32\dsprpres.dll
2007-08-06 13:48 397,056 ——— C:\WINDOWS\system32\s3gnb.dll
2007-08-06 13:48 38,016 ——— C:\WINDOWS\system32\drivers\bthmodem.sys
2007-08-06 13:48 377,984 ——— C:\WINDOWS\system32\ati2dvaa.dll
2007-08-06 13:48 36,463 ——— C:\WINDOWS\system32\drivers\ati1tuxx.sys
2007-08-06 13:48 36,096 ——— C:\WINDOWS\system32\drivers\intelppm.sys
2007-08-06 13:48 35,456 ——— C:\WINDOWS\system32\drivers\bthprint.sys
2007-08-06 13:48 34,735 ——— C:\WINDOWS\system32\drivers\ati1xsxx.sys
2007-08-06 13:48 327,040 ——— C:\WINDOWS\system32\drivers\ati2mtaa.sys
2007-08-06 13:48 32,866 ——— C:\WINDOWS\system32\slrundll.exe
2007-08-06 13:48 32,866 ——— C:\WINDOWS\slrundll.exe
2007-08-06 13:48 32,768 ——— C:\WINDOWS\system32\ativtmxx.dll
2007-08-06 13:48 32,768 ——— C:\WINDOWS\system32\asr_pfu.exe
2007-08-06 13:48 32,285 ——— C:\WINDOWS\system32\hsfcisp2.dll
2007-08-06 13:48 313,344 –a—— C:\WINDOWS\system32\p2pgraph.dll
2007-08-06 13:48 31,744 ——— C:\WINDOWS\system32\drivers\atinxbxx.sys
2007-08-06 13:48 30,671 ——— C:\WINDOWS\system32\drivers\ati1raxx.sys
2007-08-06 13:48 30,208 ——— C:\WINDOWS\system32\bthserv.dll
2007-08-06 13:48 30,080 ——— C:\WINDOWS\system32\drivers\rndismpx.sys
2007-08-06 13:48 3,967 ——— C:\WINDOWS\system32\drivers\adv02nt5.dll


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-06 16:57 ——— d——– C:\Program Files\Messenger
2007-08-06 16:36 ——— d——– C:\Program Files\Google
2007-08-06 13:47 ——— d——– C:\Program Files\Movie Maker
2007-08-06 13:38 ——— d——– C:\Program Files\Windows NT
2007-08-06 08:54 ——— d–h—– C:\Program Files\WindowsUpdate
2007-07-09 21:39 ——— d–h—– C:\Program Files\InstallShield Installation Information
2007-07-09 21:39 ——— d——– C:\Program Files\Activision
2007-07-05 17:56 ——— d——– C:\Program Files\LimeWire
2007-05-16 16:12 86528 ——— C:\Windows\system32\dllcache\directdb.dll
2007-05-16 16:12 85504 ——— C:\Windows\system32\dllcache\wabimp.dll
2007-05-16 16:12 683520 –a—— C:\Windows\system32\inetcomm.dll
2007-05-16 16:12 683520 ——— C:\Windows\system32\dllcache\inetcomm.dll
2007-05-16 16:12 510976 ——— C:\Windows\system32\dllcache\wab32.dll
2007-05-16 16:12 1314816 ——— C:\Windows\system32\dllcache\msoe.dll
2003-04-28 21:23 33712 –a–c— C:\DOCUME~1\Cal\APPLIC~1\GDIPFONTCACHEV1.DAT
2002-10-11 06:28 1938 –a–c— C:\Program Files\Readme.txt


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIModeChange"="Ati2mdxx.exe" [2002-04-07 23:23 C:\WINDOWS\system32\Ati2mdxx.exe]
"AtiPTA"="atiptaxx.exe" []
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-11-04 18:40]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-11-04 18:38]
"eabconfg.cpl"="C:\Program Files\Compaq\EAB\EabServr.exe" [2002-04-09 11:49]
"Cpqset"="c:\compaq\cpqsetup\cpqset.exe" [2002-05-09 14:13]
"GAEA"="C:\Program Files\O2\PCSuite\Launcher.exe" [2006-07-05 21:08]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-08-06 10:30]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\Windows\system32\ctfmon.exe" [2004-08-04 00:56]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Symantec NetDriver Warning"=C:\PROGRA~1\Symantec\LIVEUP~1\SNDWarn.EXE
"Auto File System Conversion Utility"=C:\Windows\System32\wbem\scricon.exe

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk
backup=C:\Windows\pss\Google Updater.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

R0 caboagp;ATI Cabo AGP Filter;C:\Windows\system32\DRIVERS\atisgkaf.sys
R1 ClntMgmt.sys;ClntMgmt.sys;C:\Windows\system32\Drivers\ClntMgmt.sys
R1 EABFiltr;EABFiltr;\??\C:\Windows\System32\drivers\EABFiltr.sys
R2 cpqdfw;Compaq Diagnostics Driver;\??\C:\Windows\System32\drivers\cpqdfw.sys
R2 cq_mem;Compaq Diagnostics Memory Driver;\??\C:\Windows\System32\drivers\cq_mem.sys
R2 cqcpu;Compaq Diagnostics CPU Driver;\??\C:\Windows\System32\drivers\cqcpu.sys
R3 RTL8023xp;Realtek 10/100/1000 PCI NIC Family NDIS XP Driver;C:\Windows\system32\DRIVERS\Rtnicxp.sys
S3 adxapie;adxapie;\??\C:\DOCUME~1\Cal\LOCALS~1\Temp\adxapie.sys
S3 aliadwdm;ALi Audio Accelerator WDM driver;C:\Windows\system32\drivers\ac97ali.sys
S3 allegro;ESS Allegro Audio Driver (WDM);C:\Windows\system32\drivers\es198x.sys
S3 ATICDSDr;ATICDSDr;\??\C:\DOCUME~1\Dave\LOCALS~1\Temp\ATICDSDr.sys
S3 eabusb;eabusb;\??\C:\Windows\System32\drivers\eabusb.sys
S3 idsvc;Windows CardSpace;"C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe"
S3 ltmodem5;LT Modem Driver;C:\Windows\system32\DRIVERS\ltmdmnt.sys
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service;"C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe"


Contents of the 'Scheduled Tasks' folder
2007-08-13 08:57:34 C:\Windows\Tasks\Symantec NetDetect.job - C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-13 09:53:41
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden registry entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-13 10:00:23 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-08-13 09:59
C:\ComboFix2.txt … 2007-08-10 09:31

— E O F —


Activescan log


Incident Status Location

Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Cal\Cookies\cal@adrevolver[1].txt
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Cal\Cookies\cal@atdmt[2].txt
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Cal\Cookies\cal@doubleclick[1].txt
Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Cal\Cookies\[removed][1].txt
Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\Documents and Settings\Cal\Desktop\ComboFix.exe[nircmd.exe]
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Cal\Desktop\SDFix.exe[SDFix\apps\Process.exe]
Spyware:Spyware/Virtumonde Not disinfected C:\Documents and Settings\Cal\Desktop\[29]-Submit_2007-08-13_ 94815.18.zip[avfrhrvd.dll.vir]
Spyware:Spyware/Virtumonde Not disinfected C:\Documents and Settings\Cal\Desktop\[29]-Submit_2007-08-13_ 94815.18.zip[scjrknus.dll.vir]
Spyware:Spyware/Virtumonde Not disinfected C:\Documents and Settings\Cal\DoctorWeb\Quarantine\A0010580.dll
Spyware:Spyware/Virtumonde Not disinfected C:\Documents and Settings\Cal\DoctorWeb\Quarantine\A0010581.dll
Spyware:Spyware/Virtumonde Not disinfected C:\Documents and Settings\Cal\DoctorWeb\Quarantine\avfrhrvd.dll
Spyware:Spyware/Virtumonde Not disinfected C:\Documents and Settings\Cal\DoctorWeb\Quarantine\scjrknus.dll
Potentially unwanted tool:Application/Processor Not disinfected C:\SDFix\apps\Process.exe
Virus:W32/Sdbot.ftp.worm Disinfected C:\SDFix\backups\backups.zip[backups/i]
Potentially unwanted tool:Application/ErrorSafe Not disinfected C:\SDFix\backups\backups.zip[backups/UERS_9999_N91S1502NetInstaller.exe]
Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\WINDOWS\nircmd.exe


Hijack this

Logfile of HijackThis v1.99.1
Scan saved at 16:03:56, on 14/08/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\spoolsv.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Compaq\EAB\EabServr.exe
C:\Program Files\O2\PCSuite\Launcher.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Windows\system32\ctfmon.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\O2\PCSuite\ConMgmt.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Windows\system32\wscntfy.exe
C:\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\Compaq\EAB\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] c:\compaq\cpqsetup\cpqset.exe
O4 - HKLM\..\Run: [GAEA] "C:\Program Files\O2\PCSuite\Launcher.exe" -tray
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\Windows\system32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.tesco.net
O15 - Trusted Zone: http://register-tesco.qa.business.ntl.com
O15 - Trusted Zone: http://memberservices.tesco.net
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://eu-housecall.trendmicro-europe.com/…ivex/hcImpl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1186386822579
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1186387008717
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\Windows\system32\WPDShServiceObj.dll
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe