Spyware / Malware / Virus Removal

[Resolved]Poker And Winantivirus Pop Ups

19 min read

Looking for the outcome? Ask AI

alamb200

Post #16August 21, 2007, 8:21 AM UTC

Hi
I have run the two scans and attached the log file below
Thanks
alamb200

ComboFix 07-08-09.3 - "Cal" 2007-08-21 8:51:07.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.46 [GMT 1:00]
Command switches used :: C:\Documents and Settings\Cal\Desktop\cfscript.txt
* Created a new restore point

FILE::
C:\Windows\system32\aixxvvw.exe
C:\fjem.exe
C:\Windows\system32\soierw.dll
C:\rvcwni.exe
C:\Documents and Settings\Cal\Desktop\[29]-Submit_2007-08-13_ 94815.18.zip

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\Documents and Settings\Cal\Desktop\[29]-Submit_2007-08-13_ 94815.18.zip
C:\fjem.exe
C:\rvcwni.exe
C:\Windows\system32\aixxvvw.exe
C:\Windows\system32\soierw.dll

((((((((((((((((((((((((( Files Created from 2007-07-21 to 2007-08-21 )))))))))))))))))))))))))))))))

2007-08-20 09:22 d——– C:\WINDOWS\system32\Kaspersky Lab
2007-08-20 09:22 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab
2007-08-20 08:52 75,932 –a—— C:\WINDOWS\system32\drivers\klick.dat
2007-08-20 08:52 75,248 –a—— C:\WINDOWS\zllsputility.exe
2007-08-20 08:52 74,396 –a—— C:\WINDOWS\system32\drivers\klin.dat
2007-08-20 08:52 4,212 —h—– C:\WINDOWS\system32\zllictbl.dat
2007-08-20 08:52 11,264 –a—— C:\WINDOWS\system32\SpOrder.dll
2007-08-20 08:52 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\MailFrontier
2007-08-20 08:51 2,209,824 –ahs—- C:\WINDOWS\system32\drivers\fidbox.dat
2007-08-20 08:50 110,360 –a—— C:\WINDOWS\system32\drivers\kl1.sys
2007-08-20 08:50 1,086,952 –a—— C:\WINDOWS\system32\zpeng24.dll
2007-08-20 08:50 d——– C:\WINDOWS\system32\ZoneLabs
2007-08-20 08:49 d——– C:\WINDOWS\Internet Logs
2007-08-14 14:45 d——– C:\WINDOWS\system32\ActiveScan
2007-08-14 09:57 d——– C:\DOCUME~1\Cal\DoctorWeb
2007-08-13 12:20 10,872 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-08-10 09:25 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-08-08 09:43 d——– C:\Deckard
2007-08-08 09:26 d——– C:\WINDOWS\ERUNT
2007-08-08 08:52 d——– C:\VundoFix Backups
2007-08-07 17:22 d——– C:\Hijackthis
2007-08-07 17:21 d——– C:\hijacjthis
2007-08-07 16:29 d——– C:\DOCUME~1\Cal\.housecall6.6
2007-08-07 11:06 d——– C:\Program Files\MSXML 6.0
2007-08-07 11:02 d——– C:\Program Files\MSBuild
2007-08-07 10:53 d——– C:\WINDOWS\system32\XPSViewer
2007-08-07 10:49 d——– C:\Program Files\Reference Assemblies
2007-08-07 10:46 14,048 ——— C:\WINDOWS\system32\spmsg2.dll
2007-08-07 10:44 d——– C:\a692d0d97c1f801765e25e675332a4
2007-08-07 10:36 d——– C:\Program Files\Windows Media Connect 2
2007-08-07 10:23 d——– C:\WINDOWS\system32\LogFiles
2007-08-07 10:23 d——– C:\WINDOWS\system32\drivers\UMDF
2007-08-07 09:37 36,352 ——— C:\WINDOWS\system32\tsgqec.dll
2007-08-07 09:37 288,768 ——— C:\WINDOWS\system32\rhttpaa.dll
2007-08-07 09:37 116,736 ——— C:\WINDOWS\system32\aaclient.dll
2007-08-06 17:32 33,792 –a—— C:\WINDOWS\system32\dllcache\custsat.dll
2007-08-06 17:32 d——– C:\WINDOWS\network diagnostic
2007-08-06 17:13 23,040 ——— C:\WINDOWS\system32\dllcache\fltmc.exe
2007-08-06 17:13 16,896 ——— C:\WINDOWS\system32\dllcache\fltlib.dll
2007-08-06 17:13 128,896 ——— C:\WINDOWS\system32\dllcache\fltmgr.sys
2007-08-06 14:55 d–h—– C:\WINDOWS\$hf_mig$
2007-08-06 14:55 d——– C:\WINDOWS\system32\PreInstall
2007-08-06 14:35 d——– C:\WINDOWS\Prefetch
2007-08-06 13:48 95,424 ——— C:\WINDOWS\system32\drivers\slnthal.sys
2007-08-06 13:48 937,984 ——— C:\WINDOWS\system32\winbrand.dll
2007-08-06 13:48 9,728 ——— C:\WINDOWS\system32\comsdupd.exe
2007-08-06 13:48 81,408 ——— C:\WINDOWS\system32\wscsvc.dll
2007-08-06 13:48 8,192 ——— C:\WINDOWS\system32\smbinst.exe
2007-08-06 13:48 78,464 ——— C:\WINDOWS\system32\drivers\usbvideo.sys
2007-08-06 13:48 78,336 –a—— C:\WINDOWS\system32\ieencode.dll
2007-08-06 13:48 75,776 ——— C:\WINDOWS\system32\strmfilt.dll
2007-08-06 13:48 73,832 ——— C:\WINDOWS\system32\slcoinst.dll
2007-08-06 13:48 73,796 ——— C:\WINDOWS\system32\slserv.exe
2007-08-06 13:48 73,216 ——— C:\WINDOWS\system32\drivers\atintuxx.sys
2007-08-06 13:48 71,680 ——— C:\WINDOWS\system32\blastcln.exe
2007-08-06 13:48 7,680 ——— C:\WINDOWS\system32\kbdsmsno.dll
2007-08-06 13:48 7,680 ——— C:\WINDOWS\system32\kbdsmsfi.dll
2007-08-06 13:48 7,168 ——— C:\WINDOWS\system32\kbdukx.dll
2007-08-06 13:48 7,168 ——— C:\WINDOWS\system32\kbdno1.dll
2007-08-06 13:48 7,168 ——— C:\WINDOWS\system32\kbdfi1.dll
2007-08-06 13:48 7,168 ——— C:\WINDOWS\system32\hccoin.dll
2007-08-06 13:48 685,056 ——— C:\WINDOWS\system32\drivers\hsfcxts2.sys
2007-08-06 13:48 67,584 ——— C:\WINDOWS\system32\drivers\sdbus.sys
2007-08-06 13:48 63,663 ——— C:\WINDOWS\system32\drivers\ati1rvxx.sys
2007-08-06 13:48 63,488 ——— C:\WINDOWS\system32\drivers\atinxsxx.sys
2007-08-06 13:48 60,416 ——— C:\WINDOWS\system32\fwcfg.dll
2007-08-06 13:48 6,656 ——— C:\WINDOWS\system32\kbdinmal.dll
2007-08-06 13:48 6,656 ——— C:\WINDOWS\system32\kbdinben.dll
2007-08-06 13:48 6,144 ——— C:\WINDOWS\system32\kbdmlt48.dll
2007-08-06 13:48 6,144 ——— C:\WINDOWS\system32\kbdmlt47.dll
2007-08-06 13:48 6,144 ——— C:\WINDOWS\system32\kbdinbe1.dll
2007-08-06 13:48 6,016 ——— C:\WINDOWS\system32\drivers\smbali.sys
2007-08-06 13:48 59,648 ——— C:\WINDOWS\system32\drivers\rfcomm.sys
2007-08-06 13:48 58,880 –a—— C:\WINDOWS\system32\pnrpnsp.dll
2007-08-06 13:48 57,856 ——— C:\WINDOWS\system32\drivers\atinbtxx.sys
2007-08-06 13:48 56,623 ——— C:\WINDOWS\system32\drivers\ati1btxx.sys
2007-08-06 13:48 553,984 –a—— C:\WINDOWS\system32\p2psvc.dll
2007-08-06 13:48 52,224 ——— C:\WINDOWS\system32\drivers\atinraxx.sys
2007-08-06 13:48 516,768 ——— C:\WINDOWS\system32\ativvaxx.dll
2007-08-06 13:48 50,688 ——— C:\WINDOWS\system32\btpanui.dll
2007-08-06 13:48 50,176 ——— C:\WINDOWS\system32\xmlprovi.dll
2007-08-06 13:48 5,632 ——— C:\WINDOWS\system32\kbdmaori.dll
2007-08-06 13:48 49,152 ——— C:\WINDOWS\system32\powercfg.exe
2007-08-06 13:48 46,464 ——— C:\WINDOWS\system32\drivers\gagp30kx.sys
2007-08-06 13:48 452,736 ——— C:\WINDOWS\system32\drivers\mtxparhm.sys
2007-08-06 13:48 44,928 ——— C:\WINDOWS\system32\drivers\agpcpq.sys
2007-08-06 13:48 44,672 ——— C:\WINDOWS\system32\drivers\uagp35.sys
2007-08-06 13:48 44,032 ——— C:\WINDOWS\system32\twext.dll
2007-08-06 13:48 43,008 ——— C:\WINDOWS\system32\drivers\amdagp.sys
2007-08-06 13:48 42,752 ——— C:\WINDOWS\system32\drivers\alim1541.sys
2007-08-06 13:48 42,240 ——— C:\WINDOWS\system32\drivers\viaagp.sys
2007-08-06 13:48 41,088 ——— C:\WINDOWS\system32\drivers\sisagp.sys
2007-08-06 13:48 404,990 ——— C:\WINDOWS\system32\drivers\slntamr.sys
2007-08-06 13:48 40,832 ——— C:\WINDOWS\system32\drivers\irbus.sys
2007-08-06 13:48 4,274,816 ——— C:\WINDOWS\system32\nv4_disp.dll
2007-08-06 13:48 4,255 ——— C:\WINDOWS\system32\drivers\adv01nt5.dll
2007-08-06 13:48 4,096 ——— C:\WINDOWS\system32\dsprpres.dll
2007-08-06 13:48 397,056 ——— C:\WINDOWS\system32\s3gnb.dll
2007-08-06 13:48 38,016 ——— C:\WINDOWS\system32\drivers\bthmodem.sys
2007-08-06 13:48 377,984 ——— C:\WINDOWS\system32\ati2dvaa.dll

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-21 08:57 26972 –ahs—- C:\Windows\system32\drivers\fidbox.idx
2007-08-06 16:57 ——— d——– C:\Program Files\Messenger
2007-08-06 16:36 ——— d——– C:\Program Files\Google
2007-08-06 13:47 ——— d——– C:\Program Files\Movie Maker
2007-08-06 13:38 ——— d——– C:\Program Files\Windows NT
2007-08-06 08:54 ——— d–h—– C:\Program Files\WindowsUpdate
2007-07-18 18:36 392 –a—— C:\Windows\wr21.exe
2007-07-09 21:39 ——— d–h—– C:\Program Files\InstallShield Installation Information
2007-07-09 21:39 ——— d——– C:\Program Files\Activision
2003-04-28 21:23 33712 –a–c— C:\DOCUME~1\Cal\APPLIC~1\GDIPFONTCACHEV1.DAT
2002-10-11 06:28 1938 –a–c— C:\Program Files\Readme.txt

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIModeChange"="Ati2mdxx.exe" [2002-04-07 23:23 C:\WINDOWS\system32\Ati2mdxx.exe]
"AtiPTA"="atiptaxx.exe" []
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-11-04 18:40]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-11-04 18:38]
"eabconfg.cpl"="C:\Program Files\Compaq\EAB\EabServr.exe" [2002-04-09 11:49]
"Cpqset"="c:\compaq\cpqsetup\cpqset.exe" [2002-05-09 14:13]
"GAEA"="C:\Program Files\O2\PCSuite\Launcher.exe" [2006-07-05 21:08]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-08-20 08:03]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-06-21 21:54]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\Windows\system32\ctfmon.exe" [2004-08-04 00:56]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Symantec NetDriver Warning"=C:\PROGRA~1\Symantec\LIVEUP~1\SNDWarn.EXE
"Auto File System Conversion Utility"=C:\Windows\System32\wbem\scricon.exe

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk
backup=C:\Windows\pss\Google Updater.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

R0 caboagp;ATI Cabo AGP Filter;C:\Windows\system32\DRIVERS\atisgkaf.sys
R1 ClntMgmt.sys;ClntMgmt.sys;C:\Windows\system32\Drivers\ClntMgmt.sys
R1 EABFiltr;EABFiltr;\??\C:\Windows\System32\drivers\EABFiltr.sys
R2 cpqdfw;Compaq Diagnostics Driver;\??\C:\Windows\System32\drivers\cpqdfw.sys
R2 cq_mem;Compaq Diagnostics Memory Driver;\??\C:\Windows\System32\drivers\cq_mem.sys
R2 cqcpu;Compaq Diagnostics CPU Driver;\??\C:\Windows\System32\drivers\cqcpu.sys
R3 RTL8023xp;Realtek 10/100/1000 PCI NIC Family NDIS XP Driver;C:\Windows\system32\DRIVERS\Rtnicxp.sys
S3 adxapie;adxapie;\??\C:\DOCUME~1\Cal\LOCALS~1\Temp\adxapie.sys
S3 aliadwdm;ALi Audio Accelerator WDM driver;C:\Windows\system32\drivers\ac97ali.sys
S3 allegro;ESS Allegro Audio Driver (WDM);C:\Windows\system32\drivers\es198x.sys
S3 ATICDSDr;ATICDSDr;\??\C:\DOCUME~1\Dave\LOCALS~1\Temp\ATICDSDr.sys
S3 eabusb;eabusb;\??\C:\Windows\System32\drivers\eabusb.sys
S3 idsvc;Windows CardSpace;"C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe"
S3 ltmodem5;LT Modem Driver;C:\Windows\system32\DRIVERS\ltmdmnt.sys
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service;"C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe"

Contents of the 'Scheduled Tasks' folder
2007-08-21 08:05:49 C:\Windows\Tasks\Symantec NetDetect.job - C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-21 09:01:35
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden registry entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-21 9:10:59 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-08-21 09:10
C:\ComboFix2.txt … 2007-08-13 10:00
C:\ComboFix3.txt … 2007-08-10 09:31

— E O F —

Logfile of HijackThis v1.99.1
Scan saved at 09:14:14, on 21/08/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Windows\system32\wscntfy.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Compaq\EAB\EabServr.exe
C:\Program Files\O2\PCSuite\Launcher.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Windows\system32\ctfmon.exe
C:\Program Files\O2\PCSuite\ConMgmt.exe
C:\Windows\system32\notepad.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Hijackthis\HijackThis.exe
C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\Compaq\EAB\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] c:\compaq\cpqsetup\cpqset.exe
O4 - HKLM\..\Run: [GAEA] "C:\Program Files\O2\PCSuite\Launcher.exe" -tray
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\Windows\system32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.tesco.net
O15 - Trusted Zone: http://register-tesco.qa.business.ntl.com
O15 - Trusted Zone: http://memberservices.tesco.net
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://eu-housecall.trendmicro-europe.com/…ivex/hcImpl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1186386822579
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1186387008717
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\Windows\system32\WPDShServiceObj.dll
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

SNOWHITE

Post #17August 21, 2007, 12:41 PM UTC

Hi alamb200,

Please remove the version of combofix you have, then download the latest one and run new scan with it, post the new log here.

1. Download combofix from one of these links:
Link1
Link2
2. Double click combofix.exe & follow the prompts.
3. When finished, it shall produce a log for you. Post that log in your next reply.

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

Regards,

alamb200

Post #18August 21, 2007, 1:42 PM UTC

Hi again,

I have done as yousaid and the log file is below:

What are you looking for in it?

ComboFix 07-08-17.2 - "Cal" 2007-08-21 14:30:38.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.57 [GMT 1:00]
* Created a new restore point

((((((((((((((((((((((((( Files Created from 2007-07-21 to 2007-08-21 )))))))))))))))))))))))))))))))

2007-08-20 09:22 d——– C:\WINDOWS\system32\Kaspersky Lab
2007-08-20 09:22 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab
2007-08-20 08:52 75,932 –a—— C:\WINDOWS\system32\drivers\klick.dat
2007-08-20 08:52 75,248 –a—— C:\WINDOWS\zllsputility.exe
2007-08-20 08:52 74,396 –a—— C:\WINDOWS\system32\drivers\klin.dat
2007-08-20 08:52 4,212 —h—– C:\WINDOWS\system32\zllictbl.dat
2007-08-20 08:52 11,264 –a—— C:\WINDOWS\system32\SpOrder.dll
2007-08-20 08:52 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\MailFrontier
2007-08-20 08:51 2,209,824 –ahs—- C:\WINDOWS\system32\drivers\fidbox.dat
2007-08-20 08:50 110,360 –a—— C:\WINDOWS\system32\drivers\kl1.sys
2007-08-20 08:50 1,086,952 –a—— C:\WINDOWS\system32\zpeng24.dll
2007-08-20 08:50 d——– C:\WINDOWS\system32\ZoneLabs
2007-08-20 08:49 d——– C:\WINDOWS\Internet Logs
2007-08-14 14:45 d——– C:\WINDOWS\system32\ActiveScan
2007-08-14 09:57 d——– C:\DOCUME~1\Cal\DoctorWeb
2007-08-13 12:20 10,872 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-08-10 09:25 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-08-08 09:43 d——– C:\Deckard
2007-08-08 09:26 d——– C:\WINDOWS\ERUNT
2007-08-08 08:52 d——– C:\VundoFix Backups
2007-08-07 17:22 d——– C:\Hijackthis
2007-08-07 17:21 d——– C:\hijacjthis
2007-08-07 16:29 d——– C:\DOCUME~1\Cal\.housecall6.6
2007-08-07 11:06 d——– C:\Program Files\MSXML 6.0
2007-08-07 11:02 d——– C:\Program Files\MSBuild
2007-08-07 10:53 d——– C:\WINDOWS\system32\XPSViewer
2007-08-07 10:49 d——– C:\Program Files\Reference Assemblies
2007-08-07 10:46 14,048 ——— C:\WINDOWS\system32\spmsg2.dll
2007-08-07 10:44 d——– C:\a692d0d97c1f801765e25e675332a4
2007-08-07 10:36 d——– C:\Program Files\Windows Media Connect 2
2007-08-07 10:23 d——– C:\WINDOWS\system32\LogFiles
2007-08-07 10:23 d——– C:\WINDOWS\system32\drivers\UMDF
2007-08-07 09:37 36,352 ——— C:\WINDOWS\system32\tsgqec.dll
2007-08-07 09:37 288,768 ——— C:\WINDOWS\system32\rhttpaa.dll
2007-08-07 09:37 116,736 ——— C:\WINDOWS\system32\aaclient.dll
2007-08-06 17:32 d——– C:\WINDOWS\network diagnostic
2007-08-06 14:55 d–h—– C:\WINDOWS\$hf_mig$
2007-08-06 14:55 d——– C:\WINDOWS\system32\PreInstall
2007-08-06 14:35 d——– C:\WINDOWS\Prefetch
2007-08-06 13:48 95,424 ——— C:\WINDOWS\system32\drivers\slnthal.sys
2007-08-06 13:48 937,984 ——— C:\WINDOWS\system32\winbrand.dll
2007-08-06 13:48 9,728 ——— C:\WINDOWS\system32\comsdupd.exe
2007-08-06 13:48 81,408 ——— C:\WINDOWS\system32\wscsvc.dll
2007-08-06 13:48 8,192 ——— C:\WINDOWS\system32\smbinst.exe
2007-08-06 13:48 78,464 ——— C:\WINDOWS\system32\drivers\usbvideo.sys
2007-08-06 13:48 78,336 –a—— C:\WINDOWS\system32\ieencode.dll
2007-08-06 13:48 75,776 ——— C:\WINDOWS\system32\strmfilt.dll
2007-08-06 13:48 73,832 ——— C:\WINDOWS\system32\slcoinst.dll
2007-08-06 13:48 73,796 ——— C:\WINDOWS\system32\slserv.exe
2007-08-06 13:48 73,216 ——— C:\WINDOWS\system32\drivers\atintuxx.sys
2007-08-06 13:48 71,680 ——— C:\WINDOWS\system32\blastcln.exe
2007-08-06 13:48 7,680 ——— C:\WINDOWS\system32\kbdsmsno.dll
2007-08-06 13:48 7,680 ——— C:\WINDOWS\system32\kbdsmsfi.dll
2007-08-06 13:48 7,168 ——— C:\WINDOWS\system32\kbdukx.dll
2007-08-06 13:48 7,168 ——— C:\WINDOWS\system32\kbdno1.dll
2007-08-06 13:48 7,168 ——— C:\WINDOWS\system32\kbdfi1.dll
2007-08-06 13:48 7,168 ——— C:\WINDOWS\system32\hccoin.dll
2007-08-06 13:48 685,056 ——— C:\WINDOWS\system32\drivers\hsfcxts2.sys
2007-08-06 13:48 67,584 ——— C:\WINDOWS\system32\drivers\sdbus.sys
2007-08-06 13:48 63,663 ——— C:\WINDOWS\system32\drivers\ati1rvxx.sys
2007-08-06 13:48 63,488 ——— C:\WINDOWS\system32\drivers\atinxsxx.sys
2007-08-06 13:48 60,416 ——— C:\WINDOWS\system32\fwcfg.dll
2007-08-06 13:48 6,656 ——— C:\WINDOWS\system32\kbdinmal.dll
2007-08-06 13:48 6,656 ——— C:\WINDOWS\system32\kbdinben.dll
2007-08-06 13:48 6,144 ——— C:\WINDOWS\system32\kbdmlt48.dll
2007-08-06 13:48 6,144 ——— C:\WINDOWS\system32\kbdmlt47.dll
2007-08-06 13:48 6,144 ——— C:\WINDOWS\system32\kbdinbe1.dll
2007-08-06 13:48 6,016 ——— C:\WINDOWS\system32\drivers\smbali.sys
2007-08-06 13:48 59,648 ——— C:\WINDOWS\system32\drivers\rfcomm.sys
2007-08-06 13:48 58,880 –a—— C:\WINDOWS\system32\pnrpnsp.dll
2007-08-06 13:48 57,856 ——— C:\WINDOWS\system32\drivers\atinbtxx.sys
2007-08-06 13:48 56,623 ——— C:\WINDOWS\system32\drivers\ati1btxx.sys
2007-08-06 13:48 553,984 –a—— C:\WINDOWS\system32\p2psvc.dll
2007-08-06 13:48 52,224 ——— C:\WINDOWS\system32\drivers\atinraxx.sys
2007-08-06 13:48 516,768 ——— C:\WINDOWS\system32\ativvaxx.dll
2007-08-06 13:48 50,688 ——— C:\WINDOWS\system32\btpanui.dll
2007-08-06 13:48 50,176 ——— C:\WINDOWS\system32\xmlprovi.dll
2007-08-06 13:48 5,632 ——— C:\WINDOWS\system32\kbdmaori.dll
2007-08-06 13:48 49,152 ——— C:\WINDOWS\system32\powercfg.exe
2007-08-06 13:48 46,464 ——— C:\WINDOWS\system32\drivers\gagp30kx.sys
2007-08-06 13:48 452,736 ——— C:\WINDOWS\system32\drivers\mtxparhm.sys
2007-08-06 13:48 44,928 ——— C:\WINDOWS\system32\drivers\agpcpq.sys
2007-08-06 13:48 44,672 ——— C:\WINDOWS\system32\drivers\uagp35.sys
2007-08-06 13:48 44,032 ——— C:\WINDOWS\system32\twext.dll
2007-08-06 13:48 43,008 ——— C:\WINDOWS\system32\drivers\amdagp.sys
2007-08-06 13:48 42,752 ——— C:\WINDOWS\system32\drivers\alim1541.sys
2007-08-06 13:48 42,240 ——— C:\WINDOWS\system32\drivers\viaagp.sys
2007-08-06 13:48 41,088 ——— C:\WINDOWS\system32\drivers\sisagp.sys
2007-08-06 13:48 404,990 ——— C:\WINDOWS\system32\drivers\slntamr.sys
2007-08-06 13:48 40,832 ——— C:\WINDOWS\system32\drivers\irbus.sys
2007-08-06 13:48 4,274,816 ——— C:\WINDOWS\system32\nv4_disp.dll
2007-08-06 13:48 4,255 ——— C:\WINDOWS\system32\drivers\adv01nt5.dll
2007-08-06 13:48 4,096 ——— C:\WINDOWS\system32\dsprpres.dll
2007-08-06 13:48 397,056 ——— C:\WINDOWS\system32\s3gnb.dll
2007-08-06 13:48 38,016 ——— C:\WINDOWS\system32\drivers\bthmodem.sys
2007-08-06 13:48 377,984 ——— C:\WINDOWS\system32\ati2dvaa.dll
2007-08-06 13:48 36,463 ——— C:\WINDOWS\system32\drivers\ati1tuxx.sys
2007-08-06 13:48 36,096 ——— C:\WINDOWS\system32\drivers\intelppm.sys
2007-08-06 13:48 35,456 ——— C:\WINDOWS\system32\drivers\bthprint.sys
2007-08-06 13:48 34,735 ——— C:\WINDOWS\system32\drivers\ati1xsxx.sys

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-21 08:57 26972 –ahs—- C:\Windows\system32\drivers\fidbox.idx
2007-08-06 16:57 ——— d——– C:\Program Files\Messenger
2007-08-06 16:36 ——— d——– C:\Program Files\Google
2007-08-06 14:27 3556 –a—— C:\Windows\pchealth\HELPCTR\PackageStore\SkuStore.bin
2007-08-06 14:24 9164 –a–c— C:\Windows\pchealth\HELPCTR\Config\Cntstore.bin
2007-08-06 13:47 ——— d——– C:\Program Files\Movie Maker
2007-08-06 13:38 ——— d——– C:\Program Files\Windows NT
2007-08-06 08:54 ——— d–h—– C:\Program Files\WindowsUpdate
2007-07-18 18:36 392 –a—— C:\Windows\wr21.exe
2007-07-09 21:39 ——— d–h—– C:\Program Files\InstallShield Installation Information
2007-07-09 21:39 ——— d——– C:\Program Files\Activision
2002-10-11 06:28 1938 –a–c— C:\Program Files\Readme.txt

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIModeChange"="Ati2mdxx.exe" [2002-04-07 23:23 C:\WINDOWS\system32\Ati2mdxx.exe]
"AtiPTA"="atiptaxx.exe" []
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-11-04 18:40]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-11-04 18:38]
"eabconfg.cpl"="C:\Program Files\Compaq\EAB\EabServr.exe" [2002-04-09 11:49]
"Cpqset"="c:\compaq\cpqsetup\cpqset.exe" [2002-05-09 14:13]
"GAEA"="C:\Program Files\O2\PCSuite\Launcher.exe" [2006-07-05 21:08]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-08-20 08:03]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-06-21 21:54]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\Windows\system32\ctfmon.exe" [2004-08-04 00:56]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Symantec NetDriver Warning"=C:\PROGRA~1\Symantec\LIVEUP~1\SNDWarn.EXE
"Auto File System Conversion Utility"=C:\Windows\System32\wbem\scricon.exe

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk
backup=C:\Windows\pss\Google Updater.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

R1 ClntMgmt.sys;ClntMgmt.sys;C:\Windows\system32\Drivers\ClntMgmt.sys
R2 cpqdfw;Compaq Diagnostics Driver;\??\C:\Windows\System32\drivers\cpqdfw.sys
R2 cq_mem;Compaq Diagnostics Memory Driver;\??\C:\Windows\System32\drivers\cq_mem.sys
R2 cqcpu;Compaq Diagnostics CPU Driver;\??\C:\Windows\System32\drivers\cqcpu.sys
S3 adxapie;adxapie;\??\C:\DOCUME~1\Cal\LOCALS~1\Temp\adxapie.sys
S3 allegro;ESS Allegro Audio Driver (WDM);C:\Windows\system32\drivers\es198x.sys
S3 ATICDSDr;ATICDSDr;\??\C:\DOCUME~1\Dave\LOCALS~1\Temp\ATICDSDr.sys

Contents of the 'Scheduled Tasks' folder
2007-08-21 12:05:23 C:\Windows\Tasks\Symantec NetDetect.job - C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-21 14:35:43
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-21 14:38:38
C:\ComboFix-quarantined-files.txt … 2007-08-21 14:38
C:\ComboFix2.txt … 2007-08-21 09:11
C:\ComboFix3.txt … 2007-08-13 10:00

— E O F —

SNOWHITE

Post #19August 21, 2007, 6:14 PM UTC last edited August 21, 2007, 6:17 PM UTC

What are you looking for in it?

alamb200, i was just suspecting something and wanted to make sure.

Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\Windows\system32\qyzuirnxi_nav.dat
C:\Windows\system32\qyzuirnxi_navps.dat
C:\Windows\system32\qyzuirnxi.dat
C:\Windows\wr21.exe
C:\Windows\System32\wbem\scricon.exe

Registry::
[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Auto File System Conversion Utility"=-

Save this as "CFScript"

[external image: Posted Image]

Refering to the picture above, drag CFScript into ComboFix.exe

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.

Please let me know how is the computer running.

Regards,

alamb200

Post #20August 22, 2007, 8:07 AM UTC

Hi Snowhite,

I have run the scans and the results are below also the avg scanner was running when I came to the machine today so if I can get the details from this I will.
I would have said the pc is running fairly slowly but it is not the best spec'ed machine I have come across.
Thanks
alamb200

ComboFix 07-08-17.2 - "Cal" 2007-08-22 8:44:25.5 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.60 [GMT 1:00]
Command switches used :: C:\Documents and Settings\Cal\Desktop\cfscript.txt
* Created a new restore point

FILE::
C:\Windows\system32\qyzuirnxi_nav.dat
C:\Windows\system32\qyzuirnxi_navps.dat
C:\Windows\system32\qyzuirnxi.dat
C:\Windows\wr21.exe
C:\Windows\System32\wbem\scricon.exe

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\Windows\system32\qyzuirnxi.dat
C:\Windows\system32\qyzuirnxi_nav.dat
C:\Windows\system32\qyzuirnxi_navps.dat
C:\Windows\wr21.exe

((((((((((((((((((((((((( Files Created from 2007-07-22 to 2007-08-22 )))))))))))))))))))))))))))))))

2007-08-20 09:22 d——– C:\WINDOWS\system32\Kaspersky Lab
2007-08-20 09:22 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab
2007-08-20 08:52 75,932 –a—— C:\WINDOWS\system32\drivers\klick.dat
2007-08-20 08:52 75,248 –a—— C:\WINDOWS\zllsputility.exe
2007-08-20 08:52 74,396 –a—— C:\WINDOWS\system32\drivers\klin.dat
2007-08-20 08:52 4,212 —h—– C:\WINDOWS\system32\zllictbl.dat
2007-08-20 08:52 11,264 –a—— C:\WINDOWS\system32\SpOrder.dll
2007-08-20 08:52 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\MailFrontier
2007-08-20 08:51 2,209,824 –ahs—- C:\WINDOWS\system32\drivers\fidbox.dat
2007-08-20 08:50 110,360 –a—— C:\WINDOWS\system32\drivers\kl1.sys
2007-08-20 08:50 1,086,952 –a—— C:\WINDOWS\system32\zpeng24.dll
2007-08-20 08:50 d——– C:\WINDOWS\system32\ZoneLabs
2007-08-20 08:49 d——– C:\WINDOWS\Internet Logs
2007-08-14 14:45 d——– C:\WINDOWS\system32\ActiveScan
2007-08-14 09:57 d——– C:\DOCUME~1\Cal\DoctorWeb
2007-08-13 12:20 10,872 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-08-10 09:25 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-08-08 09:43 d——– C:\Deckard
2007-08-08 09:26 d——– C:\WINDOWS\ERUNT
2007-08-08 08:52 d——– C:\VundoFix Backups
2007-08-07 17:22 d——– C:\Hijackthis
2007-08-07 17:21 d——– C:\hijacjthis
2007-08-07 16:29 d——– C:\DOCUME~1\Cal\.housecall6.6
2007-08-07 11:06 d——– C:\Program Files\MSXML 6.0
2007-08-07 11:02 d——– C:\Program Files\MSBuild
2007-08-07 10:53 d——– C:\WINDOWS\system32\XPSViewer
2007-08-07 10:49 d——– C:\Program Files\Reference Assemblies
2007-08-07 10:46 14,048 ——— C:\WINDOWS\system32\spmsg2.dll
2007-08-07 10:44 d——– C:\a692d0d97c1f801765e25e675332a4
2007-08-07 10:36 d——– C:\Program Files\Windows Media Connect 2
2007-08-07 10:23 d——– C:\WINDOWS\system32\LogFiles
2007-08-07 10:23 d——– C:\WINDOWS\system32\drivers\UMDF
2007-08-07 09:37 36,352 ——— C:\WINDOWS\system32\tsgqec.dll
2007-08-07 09:37 288,768 ——— C:\WINDOWS\system32\rhttpaa.dll
2007-08-07 09:37 116,736 ——— C:\WINDOWS\system32\aaclient.dll
2007-08-06 17:32 d——– C:\WINDOWS\network diagnostic
2007-08-06 14:55 d–h—– C:\WINDOWS\$hf_mig$
2007-08-06 14:55 d——– C:\WINDOWS\system32\PreInstall
2007-08-06 14:35 d——– C:\WINDOWS\Prefetch
2007-08-06 13:48 95,424 ——— C:\WINDOWS\system32\drivers\slnthal.sys
2007-08-06 13:48 937,984 ——— C:\WINDOWS\system32\winbrand.dll
2007-08-06 13:48 9,728 ——— C:\WINDOWS\system32\comsdupd.exe
2007-08-06 13:48 81,408 ——— C:\WINDOWS\system32\wscsvc.dll
2007-08-06 13:48 8,192 ——— C:\WINDOWS\system32\smbinst.exe
2007-08-06 13:48 78,464 ——— C:\WINDOWS\system32\drivers\usbvideo.sys
2007-08-06 13:48 78,336 –a—— C:\WINDOWS\system32\ieencode.dll
2007-08-06 13:48 75,776 ——— C:\WINDOWS\system32\strmfilt.dll
2007-08-06 13:48 73,832 ——— C:\WINDOWS\system32\slcoinst.dll
2007-08-06 13:48 73,796 ——— C:\WINDOWS\system32\slserv.exe
2007-08-06 13:48 73,216 ——— C:\WINDOWS\system32\drivers\atintuxx.sys
2007-08-06 13:48 71,680 ——— C:\WINDOWS\system32\blastcln.exe
2007-08-06 13:48 7,680 ——— C:\WINDOWS\system32\kbdsmsno.dll
2007-08-06 13:48 7,680 ——— C:\WINDOWS\system32\kbdsmsfi.dll
2007-08-06 13:48 7,168 ——— C:\WINDOWS\system32\kbdukx.dll
2007-08-06 13:48 7,168 ——— C:\WINDOWS\system32\kbdno1.dll
2007-08-06 13:48 7,168 ——— C:\WINDOWS\system32\kbdfi1.dll
2007-08-06 13:48 7,168 ——— C:\WINDOWS\system32\hccoin.dll
2007-08-06 13:48 685,056 ——— C:\WINDOWS\system32\drivers\hsfcxts2.sys
2007-08-06 13:48 67,584 ——— C:\WINDOWS\system32\drivers\sdbus.sys
2007-08-06 13:48 63,663 ——— C:\WINDOWS\system32\drivers\ati1rvxx.sys
2007-08-06 13:48 63,488 ——— C:\WINDOWS\system32\drivers\atinxsxx.sys
2007-08-06 13:48 60,416 ——— C:\WINDOWS\system32\fwcfg.dll
2007-08-06 13:48 6,656 ——— C:\WINDOWS\system32\kbdinmal.dll
2007-08-06 13:48 6,656 ——— C:\WINDOWS\system32\kbdinben.dll
2007-08-06 13:48 6,144 ——— C:\WINDOWS\system32\kbdmlt48.dll
2007-08-06 13:48 6,144 ——— C:\WINDOWS\system32\kbdmlt47.dll
2007-08-06 13:48 6,144 ——— C:\WINDOWS\system32\kbdinbe1.dll
2007-08-06 13:48 6,016 ——— C:\WINDOWS\system32\drivers\smbali.sys
2007-08-06 13:48 59,648 ——— C:\WINDOWS\system32\drivers\rfcomm.sys
2007-08-06 13:48 58,880 –a—— C:\WINDOWS\system32\pnrpnsp.dll
2007-08-06 13:48 57,856 ——— C:\WINDOWS\system32\drivers\atinbtxx.sys
2007-08-06 13:48 56,623 ——— C:\WINDOWS\system32\drivers\ati1btxx.sys
2007-08-06 13:48 553,984 –a—— C:\WINDOWS\system32\p2psvc.dll
2007-08-06 13:48 52,224 ——— C:\WINDOWS\system32\drivers\atinraxx.sys
2007-08-06 13:48 516,768 ——— C:\WINDOWS\system32\ativvaxx.dll
2007-08-06 13:48 50,688 ——— C:\WINDOWS\system32\btpanui.dll
2007-08-06 13:48 50,176 ——— C:\WINDOWS\system32\xmlprovi.dll
2007-08-06 13:48 5,632 ——— C:\WINDOWS\system32\kbdmaori.dll
2007-08-06 13:48 49,152 ——— C:\WINDOWS\system32\powercfg.exe
2007-08-06 13:48 46,464 ——— C:\WINDOWS\system32\drivers\gagp30kx.sys
2007-08-06 13:48 452,736 ——— C:\WINDOWS\system32\drivers\mtxparhm.sys
2007-08-06 13:48 44,928 ——— C:\WINDOWS\system32\drivers\agpcpq.sys
2007-08-06 13:48 44,672 ——— C:\WINDOWS\system32\drivers\uagp35.sys
2007-08-06 13:48 44,032 ——— C:\WINDOWS\system32\twext.dll
2007-08-06 13:48 43,008 ——— C:\WINDOWS\system32\drivers\amdagp.sys
2007-08-06 13:48 42,752 ——— C:\WINDOWS\system32\drivers\alim1541.sys
2007-08-06 13:48 42,240 ——— C:\WINDOWS\system32\drivers\viaagp.sys
2007-08-06 13:48 41,088 ——— C:\WINDOWS\system32\drivers\sisagp.sys
2007-08-06 13:48 404,990 ——— C:\WINDOWS\system32\drivers\slntamr.sys
2007-08-06 13:48 40,832 ——— C:\WINDOWS\system32\drivers\irbus.sys
2007-08-06 13:48 4,274,816 ——— C:\WINDOWS\system32\nv4_disp.dll
2007-08-06 13:48 4,255 ——— C:\WINDOWS\system32\drivers\adv01nt5.dll
2007-08-06 13:48 4,096 ——— C:\WINDOWS\system32\dsprpres.dll
2007-08-06 13:48 397,056 ——— C:\WINDOWS\system32\s3gnb.dll
2007-08-06 13:48 38,016 ——— C:\WINDOWS\system32\drivers\bthmodem.sys
2007-08-06 13:48 377,984 ——— C:\WINDOWS\system32\ati2dvaa.dll
2007-08-06 13:48 36,463 ——— C:\WINDOWS\system32\drivers\ati1tuxx.sys
2007-08-06 13:48 36,096 ——— C:\WINDOWS\system32\drivers\intelppm.sys
2007-08-06 13:48 35,456 ——— C:\WINDOWS\system32\drivers\bthprint.sys
2007-08-06 13:48 34,735 ——— C:\WINDOWS\system32\drivers\ati1xsxx.sys

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-21 08:57 26972 –ahs—- C:\Windows\system32\drivers\fidbox.idx
2007-08-06 16:57 ——— d——– C:\Program Files\Messenger
2007-08-06 16:36 ——— d——– C:\Program Files\Google
2007-08-06 14:27 3556 –a—— C:\Windows\pchealth\HELPCTR\PackageStore\SkuStore.bin
2007-08-06 14:24 9164 –a–c— C:\Windows\pchealth\HELPCTR\Config\Cntstore.bin
2007-08-06 13:47 ——— d——– C:\Program Files\Movie Maker
2007-08-06 13:38 ——— d——– C:\Program Files\Windows NT
2007-08-06 08:54 ——— d–h—– C:\Program Files\WindowsUpdate
2007-07-09 21:39 ——— d–h—– C:\Program Files\InstallShield Installation Information
2007-07-09 21:39 ——— d——– C:\Program Files\Activision
2002-10-11 06:28 1938 –a–c— C:\Program Files\Readme.txt

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIModeChange"="Ati2mdxx.exe" [2002-04-07 23:23 C:\WINDOWS\system32\Ati2mdxx.exe]
"AtiPTA"="atiptaxx.exe" []
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-11-04 18:40]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-11-04 18:38]
"eabconfg.cpl"="C:\Program Files\Compaq\EAB\EabServr.exe" [2002-04-09 11:49]
"Cpqset"="c:\compaq\cpqsetup\cpqset.exe" [2002-05-09 14:13]
"GAEA"="C:\Program Files\O2\PCSuite\Launcher.exe" [2006-07-05 21:08]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-08-20 08:03]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-06-21 21:54]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\Windows\system32\ctfmon.exe" [2004-08-04 00:56]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Symantec NetDriver Warning"=C:\PROGRA~1\Symantec\LIVEUP~1\SNDWarn.EXE

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk
backup=C:\Windows\pss\Google Updater.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

R1 ClntMgmt.sys;ClntMgmt.sys;C:\Windows\system32\Drivers\ClntMgmt.sys
R2 cpqdfw;Compaq Diagnostics Driver;\??\C:\Windows\System32\drivers\cpqdfw.sys
R2 cq_mem;Compaq Diagnostics Memory Driver;\??\C:\Windows\System32\drivers\cq_mem.sys
R2 cqcpu;Compaq Diagnostics CPU Driver;\??\C:\Windows\System32\drivers\cqcpu.sys
S3 adxapie;adxapie;\??\C:\DOCUME~1\Cal\LOCALS~1\Temp\adxapie.sys
S3 allegro;ESS Allegro Audio Driver (WDM);C:\Windows\system32\drivers\es198x.sys
S3 ATICDSDr;ATICDSDr;\??\C:\DOCUME~1\Dave\LOCALS~1\Temp\ATICDSDr.sys

Contents of the 'Scheduled Tasks' folder
2007-08-22 04:05:14 C:\Windows\Tasks\Symantec NetDetect.job - C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-22 08:48:59
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-22 8:51:01
C:\ComboFix-quarantined-files.txt … 2007-08-22 08:51
C:\ComboFix2.txt … 2007-08-21 14:38
C:\ComboFix3.txt … 2007-08-21 09:11

— E O F —

Logfile of HijackThis v1.99.1
Scan saved at 08:54:46, on 22/08/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Windows\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Windows\system32\wscntfy.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Compaq\EAB\EabServr.exe
C:\Program Files\O2\PCSuite\Launcher.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Windows\system32\ctfmon.exe
C:\Program Files\O2\PCSuite\ConMgmt.exe
C:\Windows\explorer.exe
C:\Windows\system32\notepad.exe
C:\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\Compaq\EAB\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] c:\compaq\cpqsetup\cpqset.exe
O4 - HKLM\..\Run: [GAEA] "C:\Program Files\O2\PCSuite\Launcher.exe" -tray
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\Windows\system32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.tesco.net
O15 - Trusted Zone: http://register-tesco.qa.business.ntl.com
O15 - Trusted Zone: http://memberservices.tesco.net
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://eu-housecall.trendmicro-europe.com/…ivex/hcImpl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1186386822579
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1186387008717
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\Windows\system32\WPDShServiceObj.dll
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

AVGScan
c:\QooBox\Quarantine\C\rvcwni.exe.vir trojan horse BHO.AQL deleted
c:\QooBox\Quarantine\c\windows\system32\soierw.dll.vir trojan Horse PSW.Banker3.X3P deleted

SNOWHITE

Post #21August 23, 2007, 10:58 PM UTC

Hello,

Your logs doesn't look bad, check the next two files at Virus Total :

1. Go to this website: www.virustotal.com
2. Upload this file by copy/pasting it in to the file box: C:\DOCUME~1\Cal\LOCALS~1\Temp\adxapie.sys
3. Submit the file and copy/paste the results back into this thread.
4. Repeat the same instructions for the next files too:C:\DOCUME~1\Dave\LOCALS~1\Temp\ATICDSDr.sys

Next, if you still have ATF Cleaner run it again, otherwise follow these steps:

Please download ATF Cleaner by Atribune.
This program is for XP and Windows 2000 only
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

After that, please run this online scan and post the report back here:

Please run the F-Secure Online Scanner

Note: This Scanner is for Internet Explorer Only!

Follow the Instruction Here for installation.
Accept the License Agreement.
Once the ActiveX installs,Click Full System Scan
Once the download completes,the scan will begin automatically.
The scan will take some time to finish,so please be patient.
When the scan completes, click the Automatic cleaning (recommended) button.
Click the Show Report button and Copy&Paste the entire report in your next reply.

Regards,

alamb200

Post #22August 24, 2007, 12:14 PM UTC

Hi Snowhite, Itried to submit the files but they were not there anymore I have run the F-Secure scan though and the results are below. Thanks alamb200 Scanning Report Friday, August 24, 2007 11:23:33 - 13:05:39 Computer name: CPQ30465550619 Scanning type: Scan system for viruses, rootkits, spyware Target: C:\ ——————————————————————————– Result: 2 malware found Vundo.gen38 (virus) C:\WINDOWS\SYSTEM32\KGJPJPFR.INI (Submitted) W32/BHO.QG (virus) C:\HIJACKTHIS\BACKUPS\BACKUP-20070813-093438-616.DLL (Submitted) ——————————————————————————– Statistics Scanned: Files: 35357 System: 4124 Not scanned: 3 Actions: Disinfected: 0 Renamed: 0 Deleted: 0 None: 2 Submitted: 2 Files not scanned: C:\HIBERFIL.SYS C:\PAGEFILE.SYS C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT ——————————————————————————– Options Scanning engines: F-Secure Libra: 2.4.2, 2007-08-23 F-Secure AVP: 7.0.171, 2007-08-24 F-Secure Orion: 1.2.37, 2007-08-24 F-Secure Blacklight: 1.0.64 F-Secure Draco: 1.0.35, 2007-08-20 F-Secure Pegasus: 1.19.0, 2007-07-20 Scanning options: Scan defined files: COM EXE SYS OV? BIN SCR DLL SHS HTM HTML HTT VBS JS INF VXD DO? XL? RTF CPL WIZ HTA PP? PWZ P?T MSO PIF . ACM ASP AX CNV CSC DRV INI MDB MPD MPP MPT OBD OBT OCX PCI TLB TSP WBK WBT WPC WSH VWP WML BOO HLP TD0 TT6 MSG ASD JSE VBE WSC CHM EML PRC SHB BAT LNK ANI AVB CEO CMD LSP MAP MHT MIF PDF PHP POT WMF NWS TAR TGZ WSF ZL? {* ZIP JAR ARJ LZH TAR TGZ GZ CAB RAR BZ2 HQX Use Advanced heuristics ——————————————————————————– Copyright © 1998-2006 Product support |Send virus sample to F-Secure F-Secure assumes no responsibility for material created or published by third parties that F-Secure World Wide Web pages have a link to. Unless you have clearly stated otherwise, by submitting material to any of our servers, for example by E-mail or via our F-Secure's CGI E-mail, you agree that the material you make available may be published in the F-Secure World Wide Pages or hard-copy publications. You will reach F-Secure public web site by clicking on underlined links. While doing this, your access will be logged to our private access statistics with your domain name.This information will not be given to any third party. You agree not to take action against us in relation to material that you submit. Unless you have clearly stated otherwise, by submitting material you warrant that F-Secure may incorporate any concepts described in it in the F-Secure products/publications without liability.

SNOWHITE

Post #23August 24, 2007, 5:33 PM UTC

Hello,

Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\WINDOWS\SYSTEM32\KGJPJPFR.INI

alamb200

Post #24August 25, 2007, 12:59 PM UTC

Hi
I am back again, I have run the scan and the details are posted below:
Thanks
alamb200

ComboFix 07-08-17.2 - "Cal" 2007-08-25 13:32:45.6 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.59 [GMT 1:00]
Command switches used :: C:\Documents and Settings\Cal\Desktop\cfscript.txt
* Created a new restore point

FILE::
C:\WINDOWS\SYSTEM32\KGJPJPFR.INI

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\WINDOWS\SYSTEM32\KGJPJPFR.INI

((((((((((((((((((((((((( Files Created from 2007-07-25 to 2007-08-25 )))))))))))))))))))))))))))))))

2007-08-20 09:22 d——– C:\WINDOWS\system32\Kaspersky Lab
2007-08-20 09:22 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab
2007-08-20 08:52 75,932 –a—— C:\WINDOWS\system32\drivers\klick.dat
2007-08-20 08:52 75,248 –a—— C:\WINDOWS\zllsputility.exe
2007-08-20 08:52 74,396 –a—— C:\WINDOWS\system32\drivers\klin.dat
2007-08-20 08:52 4,212 —h—– C:\WINDOWS\system32\zllictbl.dat
2007-08-20 08:52 11,264 –a—— C:\WINDOWS\system32\SpOrder.dll
2007-08-20 08:52 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\MailFrontier
2007-08-20 08:51 3,067,936 –ahs—- C:\WINDOWS\system32\drivers\fidbox.dat
2007-08-20 08:50 110,360 –a—— C:\WINDOWS\system32\drivers\kl1.sys
2007-08-20 08:50 1,086,952 –a—— C:\WINDOWS\system32\zpeng24.dll
2007-08-20 08:50 d——– C:\WINDOWS\system32\ZoneLabs
2007-08-20 08:49 d——– C:\WINDOWS\Internet Logs
2007-08-14 14:45 d——– C:\WINDOWS\system32\ActiveScan
2007-08-14 09:57 d——– C:\DOCUME~1\Cal\DoctorWeb
2007-08-13 12:20 10,872 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-08-10 09:25 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-08-08 09:43 d——– C:\Deckard
2007-08-08 09:26 d——– C:\WINDOWS\ERUNT
2007-08-08 08:52 d——– C:\VundoFix Backups
2007-08-07 17:22 d——– C:\Hijackthis
2007-08-07 17:21 d——– C:\hijacjthis
2007-08-07 16:29 d——– C:\DOCUME~1\Cal\.housecall6.6
2007-08-07 11:06 d——– C:\Program Files\MSXML 6.0
2007-08-07 11:02 d——– C:\Program Files\MSBuild
2007-08-07 10:53 d——– C:\WINDOWS\system32\XPSViewer
2007-08-07 10:49 d——– C:\Program Files\Reference Assemblies
2007-08-07 10:46 14,048 ——— C:\WINDOWS\system32\spmsg2.dll
2007-08-07 10:44 d——– C:\a692d0d97c1f801765e25e675332a4
2007-08-07 10:36 d——– C:\Program Files\Windows Media Connect 2
2007-08-07 10:23 d——– C:\WINDOWS\system32\LogFiles
2007-08-07 10:23 d——– C:\WINDOWS\system32\drivers\UMDF
2007-08-07 09:37 36,352 ——— C:\WINDOWS\system32\tsgqec.dll
2007-08-07 09:37 288,768 ——— C:\WINDOWS\system32\rhttpaa.dll
2007-08-07 09:37 116,736 ——— C:\WINDOWS\system32\aaclient.dll
2007-08-06 17:32 d——– C:\WINDOWS\network diagnostic
2007-08-06 14:55 d–h—– C:\WINDOWS\$hf_mig$
2007-08-06 14:55 d——– C:\WINDOWS\system32\PreInstall
2007-08-06 14:35 d——– C:\WINDOWS\Prefetch
2007-08-06 13:48 95,424 ——— C:\WINDOWS\system32\drivers\slnthal.sys
2007-08-06 13:48 937,984 ——— C:\WINDOWS\system32\winbrand.dll
2007-08-06 13:48 9,728 ——— C:\WINDOWS\system32\comsdupd.exe
2007-08-06 13:48 81,408 ——— C:\WINDOWS\system32\wscsvc.dll
2007-08-06 13:48 8,192 ——— C:\WINDOWS\system32\smbinst.exe
2007-08-06 13:48 78,464 ——— C:\WINDOWS\system32\drivers\usbvideo.sys
2007-08-06 13:48 78,336 –a—— C:\WINDOWS\system32\ieencode.dll
2007-08-06 13:48 75,776 ——— C:\WINDOWS\system32\strmfilt.dll
2007-08-06 13:48 73,832 ——— C:\WINDOWS\system32\slcoinst.dll
2007-08-06 13:48 73,796 ——— C:\WINDOWS\system32\slserv.exe
2007-08-06 13:48 73,216 ——— C:\WINDOWS\system32\drivers\atintuxx.sys
2007-08-06 13:48 71,680 ——— C:\WINDOWS\system32\blastcln.exe
2007-08-06 13:48 7,680 ——— C:\WINDOWS\system32\kbdsmsno.dll
2007-08-06 13:48 7,680 ——— C:\WINDOWS\system32\kbdsmsfi.dll
2007-08-06 13:48 7,168 ——— C:\WINDOWS\system32\kbdukx.dll
2007-08-06 13:48 7,168 ——— C:\WINDOWS\system32\kbdno1.dll
2007-08-06 13:48 7,168 ——— C:\WINDOWS\system32\kbdfi1.dll
2007-08-06 13:48 7,168 ——— C:\WINDOWS\system32\hccoin.dll
2007-08-06 13:48 685,056 ——— C:\WINDOWS\system32\drivers\hsfcxts2.sys
2007-08-06 13:48 67,584 ——— C:\WINDOWS\system32\drivers\sdbus.sys
2007-08-06 13:48 63,663 ——— C:\WINDOWS\system32\drivers\ati1rvxx.sys
2007-08-06 13:48 63,488 ——— C:\WINDOWS\system32\drivers\atinxsxx.sys
2007-08-06 13:48 60,416 ——— C:\WINDOWS\system32\fwcfg.dll
2007-08-06 13:48 6,656 ——— C:\WINDOWS\system32\kbdinmal.dll
2007-08-06 13:48 6,656 ——— C:\WINDOWS\system32\kbdinben.dll
2007-08-06 13:48 6,144 ——— C:\WINDOWS\system32\kbdmlt48.dll
2007-08-06 13:48 6,144 ——— C:\WINDOWS\system32\kbdmlt47.dll
2007-08-06 13:48 6,144 ——— C:\WINDOWS\system32\kbdinbe1.dll
2007-08-06 13:48 6,016 ——— C:\WINDOWS\system32\drivers\smbali.sys
2007-08-06 13:48 59,648 ——— C:\WINDOWS\system32\drivers\rfcomm.sys
2007-08-06 13:48 58,880 –a—— C:\WINDOWS\system32\pnrpnsp.dll
2007-08-06 13:48 57,856 ——— C:\WINDOWS\system32\drivers\atinbtxx.sys
2007-08-06 13:48 56,623 ——— C:\WINDOWS\system32\drivers\ati1btxx.sys
2007-08-06 13:48 553,984 –a—— C:\WINDOWS\system32\p2psvc.dll
2007-08-06 13:48 52,224 ——— C:\WINDOWS\system32\drivers\atinraxx.sys
2007-08-06 13:48 516,768 ——— C:\WINDOWS\system32\ativvaxx.dll
2007-08-06 13:48 50,688 ——— C:\WINDOWS\system32\btpanui.dll
2007-08-06 13:48 50,176 ——— C:\WINDOWS\system32\xmlprovi.dll
2007-08-06 13:48 5,632 ——— C:\WINDOWS\system32\kbdmaori.dll
2007-08-06 13:48 49,152 ——— C:\WINDOWS\system32\powercfg.exe
2007-08-06 13:48 46,464 ——— C:\WINDOWS\system32\drivers\gagp30kx.sys
2007-08-06 13:48 452,736 ——— C:\WINDOWS\system32\drivers\mtxparhm.sys
2007-08-06 13:48 44,928 ——— C:\WINDOWS\system32\drivers\agpcpq.sys
2007-08-06 13:48 44,672 ——— C:\WINDOWS\system32\drivers\uagp35.sys
2007-08-06 13:48 44,032 ——— C:\WINDOWS\system32\twext.dll
2007-08-06 13:48 43,008 ——— C:\WINDOWS\system32\drivers\amdagp.sys
2007-08-06 13:48 42,752 ——— C:\WINDOWS\system32\drivers\alim1541.sys
2007-08-06 13:48 42,240 ——— C:\WINDOWS\system32\drivers\viaagp.sys
2007-08-06 13:48 41,088 ——— C:\WINDOWS\system32\drivers\sisagp.sys
2007-08-06 13:48 404,990 ——— C:\WINDOWS\system32\drivers\slntamr.sys
2007-08-06 13:48 40,832 ——— C:\WINDOWS\system32\drivers\irbus.sys
2007-08-06 13:48 4,274,816 ——— C:\WINDOWS\system32\nv4_disp.dll
2007-08-06 13:48 4,255 ——— C:\WINDOWS\system32\drivers\adv01nt5.dll
2007-08-06 13:48 4,096 ——— C:\WINDOWS\system32\dsprpres.dll
2007-08-06 13:48 397,056 ——— C:\WINDOWS\system32\s3gnb.dll
2007-08-06 13:48 38,016 ——— C:\WINDOWS\system32\drivers\bthmodem.sys
2007-08-06 13:48 377,984 ——— C:\WINDOWS\system32\ati2dvaa.dll
2007-08-06 13:48 36,463 ——— C:\WINDOWS\system32\drivers\ati1tuxx.sys
2007-08-06 13:48 36,096 ——— C:\WINDOWS\system32\drivers\intelppm.sys
2007-08-06 13:48 35,456 ——— C:\WINDOWS\system32\drivers\bthprint.sys
2007-08-06 13:48 34,735 ——— C:\WINDOWS\system32\drivers\ati1xsxx.sys

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-24 13:15 36812 –ahs—- C:\Windows\system32\drivers\fidbox.idx
2007-08-06 16:57 ——— d——– C:\Program Files\Messenger
2007-08-06 16:36 ——— d——– C:\Program Files\Google
2007-08-06 14:27 3556 –a—— C:\Windows\pchealth\HELPCTR\PackageStore\SkuStore.bin
2007-08-06 14:24 9164 –a–c— C:\Windows\pchealth\HELPCTR\Config\Cntstore.bin
2007-08-06 13:47 ——— d——– C:\Program Files\Movie Maker
2007-08-06 13:38 ——— d——– C:\Program Files\Windows NT
2007-08-06 08:54 ——— d–h—– C:\Program Files\WindowsUpdate
2007-07-09 21:39 ——— d–h—– C:\Program Files\InstallShield Installation Information
2007-07-09 21:39 ——— d——– C:\Program Files\Activision
2002-10-11 06:28 1938 –a–c— C:\Program Files\Readme.txt

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIModeChange"="Ati2mdxx.exe" [2002-04-07 23:23 C:\WINDOWS\system32\Ati2mdxx.exe]
"AtiPTA"="atiptaxx.exe" []
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-11-04 18:40]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-11-04 18:38]
"eabconfg.cpl"="C:\Program Files\Compaq\EAB\EabServr.exe" [2002-04-09 11:49]
"Cpqset"="c:\compaq\cpqsetup\cpqset.exe" [2002-05-09 14:13]
"GAEA"="C:\Program Files\O2\PCSuite\Launcher.exe" [2006-07-05 21:08]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-08-20 08:03]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-06-21 21:54]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\Windows\system32\ctfmon.exe" [2004-08-04 00:56]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Symantec NetDriver Warning"=C:\PROGRA~1\Symantec\LIVEUP~1\SNDWarn.EXE

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk
backup=C:\Windows\pss\Google Updater.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

R1 ClntMgmt.sys;ClntMgmt.sys;C:\Windows\system32\Drivers\ClntMgmt.sys
R2 cpqdfw;Compaq Diagnostics Driver;\??\C:\Windows\System32\drivers\cpqdfw.sys
R2 cq_mem;Compaq Diagnostics Memory Driver;\??\C:\Windows\System32\drivers\cq_mem.sys
R2 cqcpu;Compaq Diagnostics CPU Driver;\??\C:\Windows\System32\drivers\cqcpu.sys
S3 adxapie;adxapie;\??\C:\DOCUME~1\Cal\LOCALS~1\Temp\adxapie.sys
S3 allegro;ESS Allegro Audio Driver (WDM);C:\Windows\system32\drivers\es198x.sys
S3 ATICDSDr;ATICDSDr;\??\C:\DOCUME~1\Dave\LOCALS~1\Temp\ATICDSDr.sys

Contents of the 'Scheduled Tasks' folder
2007-08-25 12:27:05 C:\Windows\Tasks\Symantec NetDetect.job

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-25 13:37:05
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-25 13:39:09
C:\ComboFix-quarantined-files.txt … 2007-08-25 13:39
C:\ComboFix2.txt … 2007-08-22 08:51
C:\ComboFix3.txt … 2007-08-21 14:38

— E O F —

SNOWHITE

Post #25August 25, 2007, 5:02 PM UTC

Hello alamb200,

Looks good to me

Please download the OTMoveIt by OldTimer.

Save it to your desktop.

Next, double click OTMoveIt and you should see a CleanUp! button, press that button, you may get prompt by your firewall that OTMoveIt tries to contact internet, allow this, a cleanup.txt will be downloaded, a message dialog will ask you if you want to proceed with the cleanup process, click Yes.

NOTE: This will remove some of the tools we used so far, including OTMoveIt.

I will keep your thread open for a couple of days, if the malware problem reappear feel free to post here.

Should you have any questions, please feel free to ask.

Click start then run, type prefetch then press enter, click edit then select all, (all files will highlight), right click any file, click delete, confirm.
Clean your Cache and Cookies in IE:
- Close all instances of Outlook Express and Internet Explorer
- Go to Control Panel > Internet Options > General tab
- Click the "Delete Cookies" button
- Next to it, Click the "Delete Files" button
- When prompted, place a check in: "Delete all offline content", click OK
Clean your Cache and Cookies in Firefox (In case you also have Firefox installed):
- Go to Tools > Options.
- Click Privacy in the menu on the left side of the Options window.
- Click the Clear button located to the right of each option (History, Cookies, Cache).
- Click OK to close the Options window
  Alternatively, you can clear all information stored while browsing by clicking Clear All.
  A confirmation dialog box will be shown before clearing the information.
Clean other Temporary files + Recycle bin
- Go to start > run and type: cleanmgr and click ok.
- Let it scan your system for files to remove.
- Make sure Temporary Files, Temporary Internet Files, and Recycle Bin are the only things checked.
- Press OK to remove them.

DISABLE THE VIEWING OF SYSTEM FILES
From Windows Explorer, go to Tools>Folder Options> View tab.
Untick - Show hidden files and folder
Tick - Hide file extensions for known types
Tick - Hide protected operating system files

Click Yes to confirm & then click OK

CLEAR & RESET SYSTEM RESTORE'S CACHE - (System Volume Information folder)
Go to Start >> Run - type control sysdm.cpl,,4 & press Enter
Tick on the checkbox - Turn off System Restore on all drives
Click Apply

Turn it back 'On' by unticking the same checkbox & click OK

SECURING INTERNET EXPLORER
From within Internet Explorer click on the Tools menu and then click on Internet Options.
Select the Security tab
Click once on the Internet icon so it becomes highlighted.
Select Custom Level .

Change 'Download signed ActiveX controls' to Prompt
Change 'Download unsigned ActiveX controls' to Disable
Change 'Initialize and script ActiveX controls not marked as safe' to Disable
Change 'Installation of desktop items' to Prompt
Change 'Launching programs and files in an IFRAME' to Prompt
Change 'Navigate sub-frames across different domains' to Prompt
When all these changes have been made, click on the OK button.

If it prompts you as to whether or not you want to save the settings, press the Yes button.

[*]Select OK to exit the Internet Properties page.

Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is susceptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly.

For a tutorial on Firewalls and a listing of some available ones see this link:
Understanding and Using Firewalls

SPYWAREBLASTER
SpywareBlaster prevents the installation of malicious ActiveX, adware, browser hijackers, dialers, and other potentially unwanted software. Blocks spyware/tracking cookies & restricts the actions of potentially unwanted sites.

Unlike other programs, SpywareBlaster does not have to remain running in the background. A tutorial on installing & using this product can be found here:
http://www.bleepingcomputer.com/forums/tutorial49.html

IE-SPYAD
IE/Spyad places more than 4000 dubious websites and domains in the IE Restricted list. This severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites. A tutorial on installing this product can be found here:
http://www.spywarewarrior.com/uiuc/resource.htm

COMODO BOClean
BOClean runs automatically in the background without interfering with your work and kills malwares INSTANTLY the moment they activate without giving them the chance to invade your machine. A tutorial on installing this product can be found here:
http://www.comodo.com/boclean/boclean.html

WINPATROL
Download and install the free version of Winpatrol. A tutorial for this product is located here:
http://www.winpatrol.com/features.html

A-SQUARED Anti-Dialer
This is a free program that provides defense against Dialers, scans the harddisk and provides a permanent background guard protection against new Dialer infections.
"Dialers are small programs that change the Internet access number of a modem-equipped computer to a much more expensive number"
To understand this treat better read this article The Dialer-Problem in Detail. a-squared Anti-Dialer can be downloaded at the following link:
http://download5.emsisoft.com/a2AntiDialerSetup.exe

A-SQUARED Free
This program is completely free of charge for private use, it removes infections of Trojans, Spyware, Adware, Worms, Keyloggers, Rootkits, Dialers and other malicious programs. It can be downloaded at the following link:
http://www.emsisoft.com/en/software/free

SUPERAntiSpyware Home Edition
Another effective program for helping remove some of the more difficult infections.
http://www.superantispyware.com/downloadfile.html

More Secure Browser - Internet Explorer is not the most secure and best browser. There are safer and better alternatives available. I recommend Firefox, and Opera
Google Toolbar - Free google toolbar that allows you to use the powerful Google search engine from the bar, but also blocks pop up windows.

See these links for more information:

Foistware & How To Avoid It
Browser Hijacking & How to Stop It
Rogue/Suspect Anti-Spyware Products & Web Sites
So how did I get infected in the first place?

Stand Up and Be Counted —> [external image: Posted Image] <— where you can make difference!

The site offers people who have been (or are) victims of malware the opportunity to document their story and, in that way, launch a complaint against the malware and the makers of the malware.

Happy surfing and stay clean!

Best regards,

alamb200

Post #26August 28, 2007, 5:20 PM UTC

Hi Snowhite, I just wanted to let you know all is going okay now and thank you very much for all your help. Regards alamb200

SNOWHITE

Post #27August 29, 2007, 11:28 PM UTC

Hello alamb200

Hi Snowhite,

I just wanted to let you know all is going okay now and thank you very much for all your help.

Regards

alamb200

Thanks for letting me know, glad i could help

Best regards,

SNOWHITE

Post #28August 29, 2007, 11:28 PM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved]Poker And Winantivirus Pop Ups

✨ Ask AI

Ask AI