What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] Hjt Log - Possible Windowsantivirus2007 Infection

5 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Posting this for my father, as his machine seems to have eaten some good spyjunk. Dell machine, few years old, running XP Home.

Logfile of HijackThis v1.99.1
Scan saved at 5:37:11 PM, on 8/20/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Nhksrv.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Citrix\ICA Client\ssonsvr.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\DELLMMKB.EXE
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\BellSouth Internet Tools\blsloader.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Netropa\OSD.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\BellSouth\Connection Manager\CManager.exe
C:\PROGRA~1\BROADJ~1\CORREC~1\CCD.exe
C:\WINDOWS\system32\xwddhrbr.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Documents and Settings\DK\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.otjpjjhmqzqm.us/ChCsIJXErFUE/sH…Vbwbc7_yZ_c.jpg
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=566…tiKgOV7lH/M.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by BellSouth
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [DellTouch] C:\WINDOWS\DELLMMKB.EXE
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe
O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [blspcloader] "C:\Program Files\BellSouth Internet Tools\blsloader.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [TrustSoftAntiSpyware] C:\Program Files\TrustSoft AntiSpyware\TrustSoftAntiSpyware.exe /STARTUP
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [mewele] C:\Program Files\Internet Explorer\mewele22011.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DW4] "C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe"
O4 - Startup: Connection Manager.lnk = C:\Program Files\BellSouth\Connection Manager\CManager.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Camio Viewer 2000.lnk = C:\Program Files\Sierra Imaging\Image Expert 2000\IXApplet.exe
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.bellsouth.net
O16 - DPF: {01112B00-3E00-11D2-8470-0060089874ED} (Support.com RemoteControl Class) - http://support.fastaccess.com/sdccommon/download/tgrc.cab
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://support.fastaccess.com/sdccommon/download/tgctlcm.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212…meInstaller.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1157326943241
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: DomainService - - C:\WINDOWS\system32\xwddhrbr.exe
O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Roxio Inc. - C:\WINDOWS\System32\ImapiRox.exe
O23 - Service: MSSQL$MICROSOFTSMLBIZ - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe" -sMICROSOFTSMLBIZ (file missing)
O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINDOWS\Nhksrv.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SQLAgent$MICROSOFTSMLBIZ - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlagent.EXE" -i MICROSOFTSMLBIZ (file missing)
Post #2
Hello skullsuga and welcome to the SpywareSupport Forums

My name is Trevuren and I will be helping you with your problem.


Please download this file - combofix.exe by sUBs
  • You must download it to and run it from your Desktop
  • Double click combofix.exe & follow the prompts.
  • When finished, it will produce a log. Please save that log to post in your next reply along with a fresh HJT log.
Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

Regards,

Trevuren
Post #3
combofix log for the machine -

ComboFix 07-08-23.5 - "DK" 2007-08-23 13:15:50.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.73 [GMT -4:00]
* Created a new restore point


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\DOCUME~1\ALLUSE~1\APPLIC~1\Starware325
C:\DOCUME~1\DK\APPLIC~1\ecurit~1
C:\DOCUME~1\DK\APPLIC~1\smante~1
C:\DOCUME~1\DK\APPLIC~1\Starware325
C:\DOCUME~1\DK\err.log
C:\DOCUME~1\DK\STARTM~1\Programs.\Outerinfo
C:\DOCUME~1\DK\STARTM~1\Programs.\Outerinfo\Terms.lnk
C:\DOCUME~1\DK\STARTM~1\Programs.\Outerinfo\Uninstall.lnk
C:\DOCUME~1\Jay\APPLIC~1\Starware325
C:\Program Files\Common Files\dobe~1
C:\Program Files\Common Files\dobe~1\?dobe\
C:\Program Files\Common Files\dobe~1\explorer.exe
C:\Program Files\Common Files\Yazzle1281OinAdmin.exe
C:\Program Files\Common Files\Yazzle1281OinUninstaller.exe
C:\Program Files\Dell\quba507.dll
C:\Program Files\Dell\rteke.html
C:\Program Files\inetget2
C:\Program Files\inetget2\popinstall.exe
C:\Program Files\Internet Explorer\mewele22011.exe
C:\Program Files\outerinfo
C:\Program Files\outerinfo\Terms.rtf
C:\Program Files\Starware325
C:\Program Files\winpop
C:\Program Files\winpop\UnInstall.exe
C:\Temp\1cb
C:\Temp\1cb\syscheck.log
C:\Temp\fse
C:\Temp\fse\tmpZTF.log
C:\WINDOWS\b122.exe
C:\WINDOWS\system32\abdlvcin.exe
C:\WINDOWS\system32\awvvu.dll
C:\WINDOWS\system32\B1
C:\WINDOWS\system32\bkxsrdmt.exe
C:\WINDOWS\system32\config\systemprofile\Start Menu\Programs\Startup
C:\WINDOWS\system32\drivers\Dshelper.exe
C:\WINDOWS\system32\f02WtR
C:\WINDOWS\system32\fktjeqvy.dll
C:\WINDOWS\SYSTEM32\gesavbvh.ini
C:\WINDOWS\system32\hvbvaseg.dll
C:\WINDOWS\SYSTEM32\ijkkj.bak1
C:\WINDOWS\SYSTEM32\ijkkj.bak2
C:\WINDOWS\SYSTEM32\ijkkj.ini
C:\WINDOWS\SYSTEM32\ijkkj.ini2
C:\WINDOWS\SYSTEM32\ijkkj.tmp
C:\WINDOWS\system32\jgpxcpup.dll
C:\WINDOWS\system32\jkkji.dll
C:\WINDOWS\SYSTEM32\lflmjwis.ini
C:\WINDOWS\system32\llnmp.ini
C:\WINDOWS\system32\msnav32.ax
C:\WINDOWS\system32\oanbvqjv.dll
C:\WINDOWS\SYSTEM32\ogwpbkip.ini
C:\WINDOWS\system32\pikbpwgo.dll
C:\WINDOWS\system32\qikwpsmb.dll
C:\WINDOWS\system32\sgkqqula.exe
C:\WINDOWS\system32\siwjmlfl.dll
C:\WINDOWS\system32\ssqpmki.dll
C:\WINDOWS\SYSTEM32\tdwediyw.ini
C:\WINDOWS\SYSTEM32\uvvwa.bak1
C:\WINDOWS\SYSTEM32\uvvwa.bak2
C:\WINDOWS\SYSTEM32\uvvwa.ini
C:\WINDOWS\SYSTEM32\vjqvbnao.ini
C:\WINDOWS\system32\wtsicomsv32.exe
C:\WINDOWS\system32\wvutuuv.dll
C:\WINDOWS\system32\wyidewdt.dll
C:\WINDOWS\system32\X1
C:\WINDOWS\system32\xwddhrbr.exe
C:\WINDOWS\system32\xxyxurs.dll
C:\WINDOWS\system32\ylhdlilw.exe
C:\WINDOWS\tk58.exe
C:\WINDOWS\wr.txt


((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


——-\LEGACY_DOMAINSERVICE
——-\DomainService


((((((((((((((((((((((((( Files Created from 2007-07-23 to 2007-08-23 )))))))))))))))))))))))))))))))


2007-08-23 13:07 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-08-17 22:37 6,473 –ahs—- C:\WINDOWS\SYSTEM32\qtvwa.bak1
2007-08-17 21:27 6,538 –ahs—- C:\WINDOWS\SYSTEM32\gjjlm.bak1
2007-08-17 18:12 6,473 –ahs—- C:\WINDOWS\SYSTEM32\jjkkj.bak1
2007-08-17 17:05 6,473 –ahs—- C:\WINDOWS\SYSTEM32\llnmp.bak1
2007-08-17 15:22 6,473 –ahs—- C:\WINDOWS\SYSTEM32\xbeeg.bak1
2007-08-17 11:52 6,473 –ahs—- C:\WINDOWS\SYSTEM32\pqtss.bak1
2007-08-17 10:23 6,473 –ahs—- C:\WINDOWS\SYSTEM32\rtvwa.bak1
2007-08-17 09:18 6,473 –ahs—- C:\WINDOWS\SYSTEM32\ccbeg.bak1
2007-08-17 00:32 6,473 –ahs—- C:\WINDOWS\SYSTEM32\efhkj.bak1
2007-08-16 23:23 6,473 –ahs—- C:\WINDOWS\SYSTEM32\rstwa.bak1
2007-08-16 16:36 d——– C:\Program Files\RegCure
2007-08-16 15:27 d——– C:\WINDOWS\SYSTEM32\FxsTmp
2007-08-16 15:25 31,744 –a—— C:\WINDOWS\SYSTEM32\fxsroute.dll
2007-08-16 15:25 132,608 –a—— C:\WINDOWS\SYSTEM32\fxsclntR.dll
2007-08-16 15:25 111,104 –a—— C:\WINDOWS\SYSTEM32\fxscfgwz.dll
2007-08-16 15:25 11,264 –a—— C:\WINDOWS\SYSTEM32\fxssend.exe
2007-08-15 15:31 d——– C:\Program Files\ErrorSafe Free
2007-08-14 23:32 d——– C:\DOCUME~1\DK\APPLIC~1\Error Safe Free
2007-08-14 23:09 d——– C:\Program Files\Windows Defender
2007-08-13 23:23 d——– C:\WINDOWS\SYSTEM32\checkdll
2007-08-07 16:46 d——– C:\Program Files\Windows Media Connect 2
2007-08-07 16:43 d——– C:\WINDOWS\SYSTEM32\LogFiles
2007-08-07 16:43 d——– C:\WINDOWS\SYSTEM32\DRIVERS\UMDF
2007-08-07 16:29 d——– C:\Program Files\The Weather Channel FW


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-23 13:34 ——— d——– C:\Program Files\BellSouth Internet Tools
2007-08-23 13:23 ——— d——– C:\Program Files\Dell
2007-08-22 06:04 ——— d——– C:\Program Files\TrustSoft AntiSpyware
2007-07-26 11:37 ——— d——– C:\Program Files\PhoneTools
2007-07-19 02:59 3583488 –a—— C:\WINDOWS\system32\dllcache\mshtml.dll
2007-07-12 19:31 765952 –a—— C:\WINDOWS\system32\dllcache\vgx.dll
2007-06-27 10:34 823808 –a—— C:\WINDOWS\system32\dllcache\wininet.dll
2007-06-27 10:34 671232 –a—— C:\WINDOWS\system32\dllcache\mstime.dll
2007-06-27 10:34 6058496 ——— C:\WINDOWS\system32\dllcache\ieframe.dll
2007-06-27 10:34 52224 ——— C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2007-06-27 10:34 477696 –a—— C:\WINDOWS\system32\dllcache\mshtmled.dll
2007-06-27 10:34 459264 ——— C:\WINDOWS\system32\dllcache\msfeeds.dll
2007-06-27 10:34 44544 ——— C:\WINDOWS\system32\dllcache\iernonce.dll
2007-06-27 10:34 384512 ——— C:\WINDOWS\system32\dllcache\iedkcs32.dll
2007-06-27 10:34 383488 ——— C:\WINDOWS\system32\dllcache\ieapfltr.dll
2007-06-27 10:34 27648 –a—— C:\WINDOWS\system32\dllcache\jsproxy.dll
2007-06-27 10:34 267776 ——— C:\WINDOWS\system32\dllcache\iertutil.dll
2007-06-27 10:34 232960 ——— C:\WINDOWS\system32\dllcache\webcheck.dll
2007-06-27 10:34 230400 ——— C:\WINDOWS\system32\dllcache\ieaksie.dll
2007-06-27 10:34 193024 –a—— C:\WINDOWS\system32\dllcache\msrating.dll
2007-06-27 10:34 153088 ——— C:\WINDOWS\system32\dllcache\ieakeng.dll
2007-06-27 10:34 132608 –a—— C:\WINDOWS\system32\dllcache\extmgr.dll
2007-06-27 10:34 124928 ——— C:\WINDOWS\system32\dllcache\advpack.dll
2007-06-27 10:34 1152000 –a—— C:\WINDOWS\system32\dllcache\urlmon.dll
2007-06-27 10:34 105984 ——— C:\WINDOWS\system32\dllcache\url.dll
2007-06-27 10:34 102400 ——— C:\WINDOWS\system32\dllcache\occache.dll
2007-06-27 04:27 63488 ——— C:\WINDOWS\system32\dllcache\ie4uinit.exe
2007-06-27 04:27 625152 ——— C:\WINDOWS\system32\dllcache\iexplore.exe
2007-06-27 04:27 13824 ——— C:\WINDOWS\system32\dllcache\ieudinit.exe
2007-06-27 03:00 161792 ——— C:\WINDOWS\system32\dllcache\ieakui.dll
2007-06-26 02:08 1104896 –a—— C:\WINDOWS\system32\msxml3.dll
2007-06-26 02:08 1104896 ——— C:\WINDOWS\system32\dllcache\msxml3.dll
2007-06-19 09:31 282112 –a—— C:\WINDOWS\system32\gdi32.dll
2007-06-19 09:31 282112 ——— C:\WINDOWS\system32\dllcache\gdi32.dll
2007-06-13 06:23 1033216 –a—— C:\WINDOWS\explorer.exe
2007-06-13 06:23 1033216 ——— C:\WINDOWS\system32\dllcache\explorer.exe
2007-06-11 23:51 10834944 –a—— C:\WINDOWS\system32\dllcache\wmp.dll
2004-04-22 19:52 368784 –a—— C:\Program Files\popup-setup.exe
2003-01-23 10:41 5026031 –a—— C:\Program Files\rs16e301.exe
2002-12-18 00:28 3544744 –a—— C:\Program Files\InstallQBeezBL.exe
2002-08-05 21:52 6061384 –a—— C:\Program Files\msnsetup_min.exe
2002-07-29 17:58 508240 –a—— C:\Program Files\ie6setup.exe
2002-07-24 15:03 2130408 –a—— C:\Program Files\CZ110100.EXE


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2072D928-C350-2E47-5507-E9C2444D2019}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7BB12C8E-5E8E-2A1F-033E-F2248098B8D5}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellTouch"="C:\WINDOWS\DELLMMKB.EXE" [2001-09-23 09:14]
"AdaptecDirectCD"="C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe" [2001-09-04 17:31]
"AHQInit"="C:\Program Files\Creative\SBLive\Program\AHQInit.exe" [2001-03-28 03:00]
"Disc Detector"="C:\Program Files\Creative\ShareDLL\CtNotify.exe" [1999-08-30 03:55]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2003-01-29 22:33]
"blspcloader"="C:\Program Files\BellSouth Internet Tools\blsloader.exe" [2004-04-22 19:53]
"Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2006-01-12 21:52]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2005-04-29 20:22]
"TrustSoftAntiSpyware"="C:\Program Files\TrustSoft AntiSpyware\TrustSoftAntiSpyware.exe" [2005-10-17 17:09]
"NvCplDaemon"="NvQTwk" []
"BJCFD"="C:\Program Files\BroadJump\Client Foundation\CFD.exe" [2002-09-10 22:26]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 12:24]
"DW4"="C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe" [2007-03-16 07:51]

C:\DOCUME~1\Andy\STARTM~1\Programs\Startup\
DESKTOP.INI [2001-08-31 12:50:56]

C:\DOCUME~1\DEFAUL~1\STARTM~1\Programs\Startup\
DESKTOP.INI [2001-08-31 12:50:56]

C:\DOCUME~1\DK\STARTM~1\Programs\Startup\
Connection Manager.lnk - C:\Program Files\BellSouth\Connection Manager\CManager.exe [2003-03-24 23:18:32]
DESKTOP.INI [2001-08-31 12:50:56]

C:\DOCUME~1\Jay\STARTM~1\Programs\Startup\
DESKTOP.INI [2001-08-31 12:50:56]

C:\DOCUME~1\Owner\STARTM~1\Programs\Startup\
DESKTOP.INI [2001-08-31 12:50:56]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
@=

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
Source= C:\Program Files\Dell\rteke.html
FriendlyName=


R1 cdudf_xp;cdudf_xp;C:\WINDOWS\system32\drivers\cdudf_xp.sys
R1 pwd_2K;pwd_2K;C:\WINDOWS\system32\drivers\pwd_2K.sys
R1 UdfReadr_xp;UdfReadr_xp;C:\WINDOWS\system32\drivers\UdfReadr_xp.sys
R2 Nhksrv;Netropa NHK Server;C:\WINDOWS\Nhksrv.exe
R3 DNE;Deterministic Network Enhancer Miniport;C:\WINDOWS\system32\DRIVERS\dne2000.sys
R3 mmc_2K;mmc_2K;C:\WINDOWS\system32\drivers\mmc_2K.sys
R3 Msikbd2k;DellTouch;C:\WINDOWS\system32\DRIVERS\msikbd2k.sys
S3 3COMADSL;3Com ADSL PCI Modem LAN/RFC1483 (Win 2000);C:\WINDOWS\system32\DRIVERS\3csalr2K.sys
S3 CVirtA;Cisco Systems VPN Adapter;C:\WINDOWS\system32\DRIVERS\CVirtA.sys
S3 dvd_2K;dvd_2K;C:\WINDOWS\system32\drivers\dvd_2K.sys
S4 hpt3xx;hpt3xx;C:\WINDOWS\system32\DRIVERS\hpt3xx.sys


Contents of the 'Scheduled Tasks' folder
2007-08-23 17:36:11 C:\WINDOWS\Tasks\MP Scheduled Scan.job
2007-08-23 17:33:21 C:\WINDOWS\Tasks\RegCure Program Check.job - C:\Program Files\RegCure\RegCure.exe
2007-08-23 07:00:00 C:\WINDOWS\Tasks\RegCure.job - C:\Program Files\RegCure\RegCure.exe
2007-08-23 16:00:00 C:\WINDOWS\Tasks\{056788F6-A808-4348-8E7E-91239D0B8E03}_DAD_Jay.job - C:\WINDOWS\system32\MOBSYNC.EXE
2007-08-23 12:00:00 C:\WINDOWS\Tasks\{EA4B3747-5550-467E-84FE-557EBA1DB695}_DAD_DK.job - C:\WINDOWS\system32\MOBSYNC.EXE

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-23 13:33:40
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Disc Detector = C:\Program Files\Creative\ShareDLL\CtNotify.exe?????D?????Ow?%B???????????????????B???A~??A~&?????????????????@?$?@?? C?????U?@?????????@?B???A???????A?P ????B???@?????P???????? ????????A~??????????@?s?????????????????B?T???\ ??????????????????&?????????B

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-23 13:37:26 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-08-23 13:37

— E O F —
Post #4
fresh HJT log -

Logfile of HijackThis v1.99.1
Scan saved at 13:42, on 2007-08-23
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Citrix\ICA Client\ssonsvr.exe
C:\WINDOWS\Nhksrv.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\DELLMMKB.EXE
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\BellSouth Internet Tools\blsloader.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Netropa\OSD.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\BellSouth\Connection Manager\CManager.exe
C:\PROGRA~1\BROADJ~1\CORREC~1\CCD.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Documents and Settings\DK\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=566…tiKgOV7lH/M.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: BlspcHlpr Class - {15C9938F-CB96-496D-800A-B827F2E34EA1} - C:\Program Files\BellSouth Internet Tools\blspc.dll
O2 - BHO: (no name) - {2072D928-C350-2E47-5507-E9C2444D2019} - (no file)
O2 - BHO: (no name) - {7BB12C8E-5E8E-2A1F-033E-F2248098B8D5} - (no file)
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [DellTouch] C:\WINDOWS\DELLMMKB.EXE
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe
O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [blspcloader] "C:\Program Files\BellSouth Internet Tools\blsloader.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [TrustSoftAntiSpyware] C:\Program Files\TrustSoft AntiSpyware\TrustSoftAntiSpyware.exe /STARTUP
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DW4] "C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe"
O4 - Startup: Connection Manager.lnk = C:\Program Files\BellSouth\Connection Manager\CManager.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Camio Viewer 2000.lnk = C:\Program Files\Sierra Imaging\Image Expert 2000\IXApplet.exe
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.bellsouth.net
O16 - DPF: {01112B00-3E00-11D2-8470-0060089874ED} (Support.com RemoteControl Class) - http://support.fastaccess.com/sdccommon/download/tgrc.cab
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://support.fastaccess.com/sdccommon/download/tgctlcm.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212…meInstaller.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1157326943241
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Roxio Inc. - C:\WINDOWS\System32\ImapiRox.exe
O23 - Service: MSSQL$MICROSOFTSMLBIZ - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe" -sMICROSOFTSMLBIZ (file missing)
O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINDOWS\Nhksrv.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SQLAgent$MICROSOFTSMLBIZ - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlagent.EXE" -i MICROSOFTSMLBIZ (file missing)
Post #5
A. Please RUN HijackThis
  • Click the SCAN button to produce a log.

  • Place a check mark beside each one of the following items:

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    O2 - BHO: (no name) - {2072D928-C350-2E47-5507-E9C2444D2019} - (no file)
    O2 - BHO: (no name) - {7BB12C8E-5E8E-2A1F-033E-F2248098B8D5} - (no file)

  • Now with all the items selected, and all windows closed except for HJT, delete them by clicking the FIX checked button. Close the HijackThis window.

B. 1. Please open Notepad
  • Click Start , then Run
  • Type notepad .exe in the Run Box.
2. Now copy/paste the entire content of the codebox below into the Notepad window:

http://forums.tomcoyote.org/Hjt_Log_Possible_Windowsantivirus2007_Infection_t82546.html#entry396906

Collect::
C:\WINDOWS\SYSTEM32\checkdll
C:\Program Files\popup-setup.exe
C:\Program Files\rs16e301.exe
C:\Program Files\InstallQBeezBL.exe

File::
C:\WINDOWS\SYSTEM32\qtvwa.bak1
C:\WINDOWS\SYSTEM32\gjjlm.bak1
C:\WINDOWS\SYSTEM32\jjkkj.bak1
C:\WINDOWS\SYSTEM32\llnmp.bak1
C:\WINDOWS\SYSTEM32\xbeeg.bak1
C:\WINDOWS\SYSTEM32\pqtss.bak1
C:\WINDOWS\SYSTEM32\rtvwa.bak1
C:\WINDOWS\SYSTEM32\ccbeg.bak1
C:\WINDOWS\SYSTEM32\efhkj.bak1
C:\WINDOWS\SYSTEM32\rstwa.bak1
C:\Program Files\CZ110100.EXE
C:\Program Files\Dell\rteke.html

Folder::
C:\Program Files\ErrorSafe Free
C:\DOCUME~1\DK\Applic~1\Error Safe Free

Registry::
[-HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]

3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

[external image: Posted Image]


5. Additonally, ComboFix will generate the following files on your desktop
  • A zipped file on your desktop called Submit [Date Time].zip
  • And another file named - CF-Submit.htm
6. ComboFix may need to reboot to finish its work. Let it.

7. When CF has finished running, it will generate the ComboFix.log which will appear on your screen.

8. Next, a window will popup prompting you to "Submit Files for further analysis". Click "OK"

9. Your system's browser will automatically respond by loading the CF-Submit.htm file and open a window :
  • Click the "Browse" button and locate the Submit [Date Time].zip file on your desktop.
  • Click on the file to Select it.
  • Submit the file by clicking "OK"
10. Once the file has been submitted, you may DELETE both files on your desktop.

11. Post the following reports/logs into your next reply:
  • Combofix.txt
  • A new HijackThis log.
Post #6
posting new combofix log. Combofix for whatever reason didn't post the cf-submit and the zip file to the desktop. if need be, i'll have my dad re-run it.

ComboFix 07-08-23.5 - "DK" 2007-08-23 17:25:58.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.87 [GMT -4:00]


((((((((((((((((((((((((( Files Created from 2007-07-23 to 2007-08-23 )))))))))))))))))))))))))))))))


2007-08-23 13:07 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-08-17 22:37 6,473 –ahs—- C:\WINDOWS\SYSTEM32\qtvwa.bak1
2007-08-17 21:27 6,538 –ahs—- C:\WINDOWS\SYSTEM32\gjjlm.bak1
2007-08-17 18:12 6,473 –ahs—- C:\WINDOWS\SYSTEM32\jjkkj.bak1
2007-08-17 17:05 6,473 –ahs—- C:\WINDOWS\SYSTEM32\llnmp.bak1
2007-08-17 15:22 6,473 –ahs—- C:\WINDOWS\SYSTEM32\xbeeg.bak1
2007-08-17 11:52 6,473 –ahs—- C:\WINDOWS\SYSTEM32\pqtss.bak1
2007-08-17 10:23 6,473 –ahs—- C:\WINDOWS\SYSTEM32\rtvwa.bak1
2007-08-17 09:18 6,473 –ahs—- C:\WINDOWS\SYSTEM32\ccbeg.bak1
2007-08-17 00:32 6,473 –ahs—- C:\WINDOWS\SYSTEM32\efhkj.bak1
2007-08-16 23:23 6,473 –ahs—- C:\WINDOWS\SYSTEM32\rstwa.bak1
2007-08-16 16:36 d——– C:\Program Files\RegCure
2007-08-16 15:27 d——– C:\WINDOWS\SYSTEM32\FxsTmp
2007-08-16 15:25 31,744 –a—— C:\WINDOWS\SYSTEM32\fxsroute.dll
2007-08-16 15:25 132,608 –a—— C:\WINDOWS\SYSTEM32\fxsclntR.dll
2007-08-16 15:25 111,104 –a—— C:\WINDOWS\SYSTEM32\fxscfgwz.dll
2007-08-16 15:25 11,264 –a—— C:\WINDOWS\SYSTEM32\fxssend.exe
2007-08-15 15:31 d——– C:\Program Files\ErrorSafe Free
2007-08-14 23:32 d——– C:\DOCUME~1\DK\APPLIC~1\Error Safe Free
2007-08-14 23:09 d——– C:\Program Files\Windows Defender
2007-08-13 23:23 d——– C:\WINDOWS\SYSTEM32\checkdll
2007-08-07 16:46 d——– C:\Program Files\Windows Media Connect 2
2007-08-07 16:43 d——– C:\WINDOWS\SYSTEM32\LogFiles
2007-08-07 16:43 d——– C:\WINDOWS\SYSTEM32\DRIVERS\UMDF
2007-08-07 16:29 d——– C:\Program Files\The Weather Channel FW


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-23 17:12 ——— d——– C:\Program Files\BellSouth Internet Tools
2007-08-23 13:23 ——— d——– C:\Program Files\Dell
2007-08-22 06:04 ——— d——– C:\Program Files\TrustSoft AntiSpyware
2007-07-26 11:37 ——— d——– C:\Program Files\PhoneTools
2007-07-19 02:59 3583488 –a—— C:\WINDOWS\system32\dllcache\mshtml.dll
2007-07-12 19:31 765952 –a—— C:\WINDOWS\system32\dllcache\vgx.dll
2007-06-27 10:34 823808 –a—— C:\WINDOWS\system32\dllcache\wininet.dll
2007-06-27 10:34 671232 –a—— C:\WINDOWS\system32\dllcache\mstime.dll
2007-06-27 10:34 6058496 ——— C:\WINDOWS\system32\dllcache\ieframe.dll
2007-06-27 10:34 52224 ——— C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2007-06-27 10:34 477696 –a—— C:\WINDOWS\system32\dllcache\mshtmled.dll
2007-06-27 10:34 459264 ——— C:\WINDOWS\system32\dllcache\msfeeds.dll
2007-06-27 10:34 44544 ——— C:\WINDOWS\system32\dllcache\iernonce.dll
2007-06-27 10:34 384512 ——— C:\WINDOWS\system32\dllcache\iedkcs32.dll
2007-06-27 10:34 383488 ——— C:\WINDOWS\system32\dllcache\ieapfltr.dll
2007-06-27 10:34 27648 –a—— C:\WINDOWS\system32\dllcache\jsproxy.dll
2007-06-27 10:34 267776 ——— C:\WINDOWS\system32\dllcache\iertutil.dll
2007-06-27 10:34 232960 ——— C:\WINDOWS\system32\dllcache\webcheck.dll
2007-06-27 10:34 230400 ——— C:\WINDOWS\system32\dllcache\ieaksie.dll
2007-06-27 10:34 193024 –a—— C:\WINDOWS\system32\dllcache\msrating.dll
2007-06-27 10:34 153088 ——— C:\WINDOWS\system32\dllcache\ieakeng.dll
2007-06-27 10:34 132608 –a—— C:\WINDOWS\system32\dllcache\extmgr.dll
2007-06-27 10:34 124928 ——— C:\WINDOWS\system32\dllcache\advpack.dll
2007-06-27 10:34 1152000 –a—— C:\WINDOWS\system32\dllcache\urlmon.dll
2007-06-27 10:34 105984 ——— C:\WINDOWS\system32\dllcache\url.dll
2007-06-27 10:34 102400 ——— C:\WINDOWS\system32\dllcache\occache.dll
2007-06-27 04:27 63488 ——— C:\WINDOWS\system32\dllcache\ie4uinit.exe
2007-06-27 04:27 625152 ——— C:\WINDOWS\system32\dllcache\iexplore.exe
2007-06-27 04:27 13824 ——— C:\WINDOWS\system32\dllcache\ieudinit.exe
2007-06-27 03:00 161792 ——— C:\WINDOWS\system32\dllcache\ieakui.dll
2007-06-26 02:08 1104896 –a—— C:\WINDOWS\system32\msxml3.dll
2007-06-26 02:08 1104896 ——— C:\WINDOWS\system32\dllcache\msxml3.dll
2007-06-19 09:31 282112 –a—— C:\WINDOWS\system32\gdi32.dll
2007-06-19 09:31 282112 ——— C:\WINDOWS\system32\dllcache\gdi32.dll
2007-06-13 06:23 1033216 –a—— C:\WINDOWS\explorer.exe
2007-06-13 06:23 1033216 ——— C:\WINDOWS\system32\dllcache\explorer.exe
2007-06-11 23:51 10834944 –a—— C:\WINDOWS\system32\dllcache\wmp.dll
2004-04-22 19:52 368784 –a—— C:\Program Files\popup-setup.exe
2003-01-23 10:41 5026031 –a—— C:\Program Files\rs16e301.exe
2002-12-18 00:28 3544744 –a—— C:\Program Files\InstallQBeezBL.exe
2002-08-05 21:52 6061384 –a—— C:\Program Files\msnsetup_min.exe
2002-07-29 17:58 508240 –a—— C:\Program Files\ie6setup.exe
2002-07-24 15:03 2130408 –a—— C:\Program Files\CZ110100.EXE


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellTouch"="C:\WINDOWS\DELLMMKB.EXE" [2001-09-23 09:14]
"AdaptecDirectCD"="C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe" [2001-09-04 17:31]
"AHQInit"="C:\Program Files\Creative\SBLive\Program\AHQInit.exe" [2001-03-28 03:00]
"Disc Detector"="C:\Program Files\Creative\ShareDLL\CtNotify.exe" [1999-08-30 03:55]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2003-01-29 22:33]
"blspcloader"="C:\Program Files\BellSouth Internet Tools\blsloader.exe" [2004-04-22 19:53]
"Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2006-01-12 21:52]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2005-04-29 20:22]
"TrustSoftAntiSpyware"="C:\Program Files\TrustSoft AntiSpyware\TrustSoftAntiSpyware.exe" [2005-10-17 17:09]
"NvCplDaemon"="NvQTwk" []
"BJCFD"="C:\Program Files\BroadJump\Client Foundation\CFD.exe" [2002-09-10 22:26]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 12:24]
"DW4"="C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe" [2007-03-16 07:51]

C:\DOCUME~1\Andy\STARTM~1\Programs\Startup\
DESKTOP.INI [2001-08-31 12:50:56]

C:\DOCUME~1\DEFAUL~1\STARTM~1\Programs\Startup\
DESKTOP.INI [2001-08-31 12:50:56]

C:\DOCUME~1\DK\STARTM~1\Programs\Startup\
Connection Manager.lnk - C:\Program Files\BellSouth\Connection Manager\CManager.exe [2003-03-24 23:18:32]
DESKTOP.INI [2001-08-31 12:50:56]

C:\DOCUME~1\Jay\STARTM~1\Programs\Startup\
DESKTOP.INI [2001-08-31 12:50:56]

C:\DOCUME~1\Owner\STARTM~1\Programs\Startup\
DESKTOP.INI [2001-08-31 12:50:56]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
@=

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
Source= C:\Program Files\Dell\rteke.html
FriendlyName=


R1 cdudf_xp;cdudf_xp;C:\WINDOWS\system32\drivers\cdudf_xp.sys
R1 pwd_2K;pwd_2K;C:\WINDOWS\system32\drivers\pwd_2K.sys
R1 UdfReadr_xp;UdfReadr_xp;C:\WINDOWS\system32\drivers\UdfReadr_xp.sys
R2 Nhksrv;Netropa NHK Server;C:\WINDOWS\Nhksrv.exe
R3 DNE;Deterministic Network Enhancer Miniport;C:\WINDOWS\system32\DRIVERS\dne2000.sys
R3 mmc_2K;mmc_2K;C:\WINDOWS\system32\drivers\mmc_2K.sys
R3 Msikbd2k;DellTouch;C:\WINDOWS\system32\DRIVERS\msikbd2k.sys
S3 3COMADSL;3Com ADSL PCI Modem LAN/RFC1483 (Win 2000);C:\WINDOWS\system32\DRIVERS\3csalr2K.sys
S3 CVirtA;Cisco Systems VPN Adapter;C:\WINDOWS\system32\DRIVERS\CVirtA.sys
S3 dvd_2K;dvd_2K;C:\WINDOWS\system32\drivers\dvd_2K.sys
S4 hpt3xx;hpt3xx;C:\WINDOWS\system32\DRIVERS\hpt3xx.sys


Contents of the 'Scheduled Tasks' folder
2007-08-23 17:36:11 C:\WINDOWS\Tasks\MP Scheduled Scan.job
2007-08-23 21:00:00 C:\WINDOWS\Tasks\RegCure Program Check.job - C:\Program Files\RegCure\RegCure.exe
2007-08-23 07:00:00 C:\WINDOWS\Tasks\RegCure.job - C:\Program Files\RegCure\RegCure.exe
2007-08-23 16:00:00 C:\WINDOWS\Tasks\{056788F6-A808-4348-8E7E-91239D0B8E03}_DAD_Jay.job - C:\WINDOWS\system32\MOBSYNC.EXE
2007-08-23 20:00:00 C:\WINDOWS\Tasks\{EA4B3747-5550-467E-84FE-557EBA1DB695}_DAD_DK.job - C:\WINDOWS\system32\MOBSYNC.EXE

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-23 17:28:17
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Disc Detector = C:\Program Files\Creative\ShareDLL\CtNotify.exe?????D?????Ow?%B???????????????????B???A~??A~&?????????????????@?$?@?? C?????U?@?????????@?B???A???????A?P ????B???@?????P???????? ????????A~??????????@?s?????????????????B?T???\ ??????????????????&?????????B

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-23 17:29:28
C:\ComboFix-quarantined-files.txt … 2007-08-23 17:29
C:\ComboFix2.txt … 2007-08-23 16:51
C:\ComboFix3.txt … 2007-08-23 13:37

— E O F —
Post #7
latest HJT log -

Logfile of HijackThis v1.99.1
Scan saved at 20:49, on 2007-08-23
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Nhksrv.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Citrix\ICA Client\ssonsvr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\DELLMMKB.EXE
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\BellSouth Internet Tools\blsloader.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\TrustSoft AntiSpyware\TrustSoftAntiSpyware.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Netropa\OSD.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\BellSouth\Connection Manager\CManager.exe
C:\PROGRA~1\BROADJ~1\CORREC~1\CCD.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Documents and Settings\DK\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=566…tiKgOV7lH/M.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: BlspcHlpr Class - {15C9938F-CB96-496D-800A-B827F2E34EA1} - C:\Program Files\BellSouth Internet Tools\blspc.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [DellTouch] C:\WINDOWS\DELLMMKB.EXE
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe
O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [blspcloader] "C:\Program Files\BellSouth Internet Tools\blsloader.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [TrustSoftAntiSpyware] C:\Program Files\TrustSoft AntiSpyware\TrustSoftAntiSpyware.exe /STARTUP
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DW4] "C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe"
O4 - Startup: Connection Manager.lnk = C:\Program Files\BellSouth\Connection Manager\CManager.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Camio Viewer 2000.lnk = C:\Program Files\Sierra Imaging\Image Expert 2000\IXApplet.exe
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.bellsouth.net
O16 - DPF: {01112B00-3E00-11D2-8470-0060089874ED} (Support.com RemoteControl Class) - http://support.fastaccess.com/sdccommon/download/tgrc.cab
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://support.fastaccess.com/sdccommon/download/tgctlcm.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212…meInstaller.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1157326943241
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Roxio Inc. - C:\WINDOWS\System32\ImapiRox.exe
O23 - Service: MSSQL$MICROSOFTSMLBIZ - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe" -sMICROSOFTSMLBIZ (file missing)
O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINDOWS\Nhksrv.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SQLAgent$MICROSOFTSMLBIZ - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlagent.EXE" -i MICROSOFTSMLBIZ (file missing)
Post #8
You will have to run the Script again unfortunately as it did not run at all. Remember: 1. ComboFix and CFScript must BOTH be on your desktop 2. CFScript.txt must ne a Notepad file 3, You must physically drag the CFScript icon on top of the ComboFix.exe icon as illustrated. I all of the above are not true. ComboFix will run but without a script.
Post #9
Sorry for the delay, got the script-based logfile this weekend.

ComboFix 07-08-23.5 - "DK" 2007-08-23 17:25:58.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.87 [GMT -4:00]


((((((((((((((((((((((((( Files Created from 2007-07-23 to 2007-08-23 )))))))))))))))))))))))))))))))


2007-08-23 13:07 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-08-17 22:37 6,473 –ahs—- C:\WINDOWS\SYSTEM32\qtvwa.bak1
2007-08-17 21:27 6,538 –ahs—- C:\WINDOWS\SYSTEM32\gjjlm.bak1
2007-08-17 18:12 6,473 –ahs—- C:\WINDOWS\SYSTEM32\jjkkj.bak1
2007-08-17 17:05 6,473 –ahs—- C:\WINDOWS\SYSTEM32\llnmp.bak1
2007-08-17 15:22 6,473 –ahs—- C:\WINDOWS\SYSTEM32\xbeeg.bak1
2007-08-17 11:52 6,473 –ahs—- C:\WINDOWS\SYSTEM32\pqtss.bak1
2007-08-17 10:23 6,473 –ahs—- C:\WINDOWS\SYSTEM32\rtvwa.bak1
2007-08-17 09:18 6,473 –ahs—- C:\WINDOWS\SYSTEM32\ccbeg.bak1
2007-08-17 00:32 6,473 –ahs—- C:\WINDOWS\SYSTEM32\efhkj.bak1
2007-08-16 23:23 6,473 –ahs—- C:\WINDOWS\SYSTEM32\rstwa.bak1
2007-08-16 16:36 d——– C:\Program Files\RegCure
2007-08-16 15:27 d——– C:\WINDOWS\SYSTEM32\FxsTmp
2007-08-16 15:25 31,744 –a—— C:\WINDOWS\SYSTEM32\fxsroute.dll
2007-08-16 15:25 132,608 –a—— C:\WINDOWS\SYSTEM32\fxsclntR.dll
2007-08-16 15:25 111,104 –a—— C:\WINDOWS\SYSTEM32\fxscfgwz.dll
2007-08-16 15:25 11,264 –a—— C:\WINDOWS\SYSTEM32\fxssend.exe
2007-08-15 15:31 d——– C:\Program Files\ErrorSafe Free
2007-08-14 23:32 d——– C:\DOCUME~1\DK\APPLIC~1\Error Safe Free
2007-08-14 23:09 d——– C:\Program Files\Windows Defender
2007-08-13 23:23 d——– C:\WINDOWS\SYSTEM32\checkdll
2007-08-07 16:46 d——– C:\Program Files\Windows Media Connect 2
2007-08-07 16:43 d——– C:\WINDOWS\SYSTEM32\LogFiles
2007-08-07 16:43 d——– C:\WINDOWS\SYSTEM32\DRIVERS\UMDF
2007-08-07 16:29 d——– C:\Program Files\The Weather Channel FW


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-23 17:12 ——— d——– C:\Program Files\BellSouth Internet Tools
2007-08-23 13:23 ——— d——– C:\Program Files\Dell
2007-08-22 06:04 ——— d——– C:\Program Files\TrustSoft AntiSpyware
2007-07-26 11:37 ——— d——– C:\Program Files\PhoneTools
2007-07-19 02:59 3583488 –a—— C:\WINDOWS\system32\dllcache\mshtml.dll
2007-07-12 19:31 765952 –a—— C:\WINDOWS\system32\dllcache\vgx.dll
2007-06-27 10:34 823808 –a—— C:\WINDOWS\system32\dllcache\wininet.dll
2007-06-27 10:34 671232 –a—— C:\WINDOWS\system32\dllcache\mstime.dll
2007-06-27 10:34 6058496 ——— C:\WINDOWS\system32\dllcache\ieframe.dll
2007-06-27 10:34 52224 ——— C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2007-06-27 10:34 477696 –a—— C:\WINDOWS\system32\dllcache\mshtmled.dll
2007-06-27 10:34 459264 ——— C:\WINDOWS\system32\dllcache\msfeeds.dll
2007-06-27 10:34 44544 ——— C:\WINDOWS\system32\dllcache\iernonce.dll
2007-06-27 10:34 384512 ——— C:\WINDOWS\system32\dllcache\iedkcs32.dll
2007-06-27 10:34 383488 ——— C:\WINDOWS\system32\dllcache\ieapfltr.dll
2007-06-27 10:34 27648 –a—— C:\WINDOWS\system32\dllcache\jsproxy.dll
2007-06-27 10:34 267776 ——— C:\WINDOWS\system32\dllcache\iertutil.dll
2007-06-27 10:34 232960 ——— C:\WINDOWS\system32\dllcache\webcheck.dll
2007-06-27 10:34 230400 ——— C:\WINDOWS\system32\dllcache\ieaksie.dll
2007-06-27 10:34 193024 –a—— C:\WINDOWS\system32\dllcache\msrating.dll
2007-06-27 10:34 153088 ——— C:\WINDOWS\system32\dllcache\ieakeng.dll
2007-06-27 10:34 132608 –a—— C:\WINDOWS\system32\dllcache\extmgr.dll
2007-06-27 10:34 124928 ——— C:\WINDOWS\system32\dllcache\advpack.dll
2007-06-27 10:34 1152000 –a—— C:\WINDOWS\system32\dllcache\urlmon.dll
2007-06-27 10:34 105984 ——— C:\WINDOWS\system32\dllcache\url.dll
2007-06-27 10:34 102400 ——— C:\WINDOWS\system32\dllcache\occache.dll
2007-06-27 04:27 63488 ——— C:\WINDOWS\system32\dllcache\ie4uinit.exe
2007-06-27 04:27 625152 ——— C:\WINDOWS\system32\dllcache\iexplore.exe
2007-06-27 04:27 13824 ——— C:\WINDOWS\system32\dllcache\ieudinit.exe
2007-06-27 03:00 161792 ——— C:\WINDOWS\system32\dllcache\ieakui.dll
2007-06-26 02:08 1104896 –a—— C:\WINDOWS\system32\msxml3.dll
2007-06-26 02:08 1104896 ——— C:\WINDOWS\system32\dllcache\msxml3.dll
2007-06-19 09:31 282112 –a—— C:\WINDOWS\system32\gdi32.dll
2007-06-19 09:31 282112 ——— C:\WINDOWS\system32\dllcache\gdi32.dll
2007-06-13 06:23 1033216 –a—— C:\WINDOWS\explorer.exe
2007-06-13 06:23 1033216 ——— C:\WINDOWS\system32\dllcache\explorer.exe
2007-06-11 23:51 10834944 –a—— C:\WINDOWS\system32\dllcache\wmp.dll
2004-04-22 19:52 368784 –a—— C:\Program Files\popup-setup.exe
2003-01-23 10:41 5026031 –a—— C:\Program Files\rs16e301.exe
2002-12-18 00:28 3544744 –a—— C:\Program Files\InstallQBeezBL.exe
2002-08-05 21:52 6061384 –a—— C:\Program Files\msnsetup_min.exe
2002-07-29 17:58 508240 –a—— C:\Program Files\ie6setup.exe
2002-07-24 15:03 2130408 –a—— C:\Program Files\CZ110100.EXE


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellTouch"="C:\WINDOWS\DELLMMKB.EXE" [2001-09-23 09:14]
"AdaptecDirectCD"="C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe" [2001-09-04 17:31]
"AHQInit"="C:\Program Files\Creative\SBLive\Program\AHQInit.exe" [2001-03-28 03:00]
"Disc Detector"="C:\Program Files\Creative\ShareDLL\CtNotify.exe" [1999-08-30 03:55]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2003-01-29 22:33]
"blspcloader"="C:\Program Files\BellSouth Internet Tools\blsloader.exe" [2004-04-22 19:53]
"Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2006-01-12 21:52]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2005-04-29 20:22]
"TrustSoftAntiSpyware"="C:\Program Files\TrustSoft AntiSpyware\TrustSoftAntiSpyware.exe" [2005-10-17 17:09]
"NvCplDaemon"="NvQTwk" []
"BJCFD"="C:\Program Files\BroadJump\Client Foundation\CFD.exe" [2002-09-10 22:26]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 12:24]
"DW4"="C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe" [2007-03-16 07:51]

C:\DOCUME~1\Andy\STARTM~1\Programs\Startup\
DESKTOP.INI [2001-08-31 12:50:56]

C:\DOCUME~1\DEFAUL~1\STARTM~1\Programs\Startup\
DESKTOP.INI [2001-08-31 12:50:56]

C:\DOCUME~1\DK\STARTM~1\Programs\Startup\
Connection Manager.lnk - C:\Program Files\BellSouth\Connection Manager\CManager.exe [2003-03-24 23:18:32]
DESKTOP.INI [2001-08-31 12:50:56]

C:\DOCUME~1\Jay\STARTM~1\Programs\Startup\
DESKTOP.INI [2001-08-31 12:50:56]

C:\DOCUME~1\Owner\STARTM~1\Programs\Startup\
DESKTOP.INI [2001-08-31 12:50:56]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
@=

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
Source= C:\Program Files\Dell\rteke.html
FriendlyName=


R1 cdudf_xp;cdudf_xp;C:\WINDOWS\system32\drivers\cdudf_xp.sys
R1 pwd_2K;pwd_2K;C:\WINDOWS\system32\drivers\pwd_2K.sys
R1 UdfReadr_xp;UdfReadr_xp;C:\WINDOWS\system32\drivers\UdfReadr_xp.sys
R2 Nhksrv;Netropa NHK Server;C:\WINDOWS\Nhksrv.exe
R3 DNE;Deterministic Network Enhancer Miniport;C:\WINDOWS\system32\DRIVERS\dne2000.sys
R3 mmc_2K;mmc_2K;C:\WINDOWS\system32\drivers\mmc_2K.sys
R3 Msikbd2k;DellTouch;C:\WINDOWS\system32\DRIVERS\msikbd2k.sys
S3 3COMADSL;3Com ADSL PCI Modem LAN/RFC1483 (Win 2000);C:\WINDOWS\system32\DRIVERS\3csalr2K.sys
S3 CVirtA;Cisco Systems VPN Adapter;C:\WINDOWS\system32\DRIVERS\CVirtA.sys
S3 dvd_2K;dvd_2K;C:\WINDOWS\system32\drivers\dvd_2K.sys
S4 hpt3xx;hpt3xx;C:\WINDOWS\system32\DRIVERS\hpt3xx.sys


Contents of the 'Scheduled Tasks' folder
2007-08-23 17:36:11 C:\WINDOWS\Tasks\MP Scheduled Scan.job
2007-08-23 21:00:00 C:\WINDOWS\Tasks\RegCure Program Check.job - C:\Program Files\RegCure\RegCure.exe
2007-08-23 07:00:00 C:\WINDOWS\Tasks\RegCure.job - C:\Program Files\RegCure\RegCure.exe
2007-08-23 16:00:00 C:\WINDOWS\Tasks\{056788F6-A808-4348-8E7E-91239D0B8E03}_DAD_Jay.job - C:\WINDOWS\system32\MOBSYNC.EXE
2007-08-23 20:00:00 C:\WINDOWS\Tasks\{EA4B3747-5550-467E-84FE-557EBA1DB695}_DAD_DK.job - C:\WINDOWS\system32\MOBSYNC.EXE

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-23 17:28:17
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Disc Detector = C:\Program Files\Creative\ShareDLL\CtNotify.exe?????D?????Ow?%B???????????????????B???A~??A~&?????????????????@?$?@?? C?????U?@?????????@?B???A???????A?P ????B???@?????P???????? ????????A~??????????@?s?????????????????B?T???\ ??????????????????&?????????B

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-23 17:29:28
C:\ComboFix-quarantined-files.txt … 2007-08-23 17:29
C:\ComboFix2.txt … 2007-08-23 16:51
C:\ComboFix3.txt … 2007-08-23 13:37

— E O F —
Post #10
There is something that you are not doing correctly. So we will change tactics.

A. B. b]Launch Notepad, and copy/paste everything in the codebox below into the new document, including the word REGEDIT4. Go up to "File Save As" and click the drop-down box to change the "Save As Type" to "All Files" and save it to your desktop as fixme.reg.

REGEDIT4

[-HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]


3. Locate fixme.reg on your Desktop. It should look like this [external image: Posted Image]. Double-click on it. You will receive a prompt similar to: "Do you wish to merge the information into the registry?". Answer Yes and wait for a message to appear similar to Merged Successfully.

4. Restart your computer.


B. DownloadOTMoveIt by OldTimer.
  • Save it to your desktop.
  • Please double-click OTMoveIt.exe to run it.
  • Copy the content of the quotebox below to the clipboard by highlighting ALL of
    the file paths and pressing CTRL + C (or, after highlighting, right-click and choose
    copy):

    C:\WINDOWS\SYSTEM32\checkdll
    C:\Program Files\popup-setup.exe
    C:\Program Files\rs16e301.exe
    C:\Program Files\InstallQBeezBL.exe
    C:\WINDOWS\SYSTEM32\qtvwa.bak1
    C:\WINDOWS\SYSTEM32\gjjlm.bak1
    C:\WINDOWS\SYSTEM32\jjkkj.bak1
    C:\WINDOWS\SYSTEM32\llnmp.bak1
    C:\WINDOWS\SYSTEM32\xbeeg.bak1
    C:\WINDOWS\SYSTEM32\pqtss.bak1
    C:\WINDOWS\SYSTEM32\rtvwa.bak1
    C:\WINDOWS\SYSTEM32\ccbeg.bak1
    C:\WINDOWS\SYSTEM32\efhkj.bak1
    C:\WINDOWS\SYSTEM32\rstwa.bak1
    C:\Program Files\CZ110100.EXE
    C:\Program Files\Dell\rteke.html
    C:\Program Files\ErrorSafe Free
    C:\DOCUME~1\DK\Applic~1\Error Safe Free



  • Return to OTMoveIt, right click on the "Paste List of Files/Folders to be
    moved"     window and choose Paste.
  • Click the red Moveit! button.
  • Close OTMoveIt
If a file or folder cannot be moved immediately you may be asked to reboot
the machine to finish the move process. If you are asked to reboot the machine
choose Yes.

Please "Copy" the results from the "Results" window (to the right) and then "Paste"
them into your next reply on the forum. Reboot into Normal Mode if you have to reboot.





B. Now, please post the results from OTMoveIt as well as a fresh HJT log.


Trevuren
Post #11
below are the results from the moveit file paste, as well as the latest HJT log. Moveit spit out the same results both before and after a reboot

File/Folder C:\WINDOWS\SYSTEM32\checkdll not found.
File/Folder C:\Program Files\popup-setup.exe not found.
File/Folder C:\Program Files\rs16e301.exe not found.
File/Folder C:\Program Files\InstallQBeezBL.exe not found.
File/Folder C:\WINDOWS\SYSTEM32\qtvwa.bak1 not found.
File/Folder C:\WINDOWS\SYSTEM32\gjjlm.bak1 not found.
File/Folder C:\WINDOWS\SYSTEM32\jjkkj.bak1 not found.
File/Folder C:\WINDOWS\SYSTEM32\llnmp.bak1 not found.
File/Folder C:\WINDOWS\SYSTEM32\xbeeg.bak1 not found.
File/Folder C:\WINDOWS\SYSTEM32\pqtss.bak1 not found.
File/Folder C:\WINDOWS\SYSTEM32\rtvwa.bak1 not found.
File/Folder C:\WINDOWS\SYSTEM32\ccbeg.bak1 not found.
File/Folder C:\WINDOWS\SYSTEM32\efhkj.bak1 not found.
File/Folder C:\WINDOWS\SYSTEM32\rstwa.bak1 not found.
File/Folder C:\Program Files\CZ110100.EXE not found.
File/Folder C:\Program Files\Dell\rteke.html not found.
File/Folder C:\Program Files\ErrorSafe Free not found.
File/Folder C:\DOCUME~1\DK\Applic~1\Error Safe Free not found.

Created on 08-28-2007 13:38:20

Logfile of HijackThis v1.99.1
Scan saved at 12:18, on 2007-08-28
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Nhksrv.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Citrix\ICA Client\ssonsvr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\DELLMMKB.EXE
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\BellSouth Internet Tools\blsloader.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\Netropa\OSD.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\TrustSoft AntiSpyware\TrustSoftAntiSpyware.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\BellSouth\Connection Manager\CManager.exe
C:\PROGRA~1\BROADJ~1\CORREC~1\CCD.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Documents and Settings\DK\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=566…tiKgOV7lH/M.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: BlspcHlpr Class - {15C9938F-CB96-496D-800A-B827F2E34EA1} - C:\Program Files\BellSouth Internet Tools\blspc.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [DellTouch] C:\WINDOWS\DELLMMKB.EXE
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe
O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [blspcloader] "C:\Program Files\BellSouth Internet Tools\blsloader.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [TrustSoftAntiSpyware] C:\Program Files\TrustSoft AntiSpyware\TrustSoftAntiSpyware.exe /STARTUP
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DW4] "C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe"
O4 - Startup: Connection Manager.lnk = C:\Program Files\BellSouth\Connection Manager\CManager.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Camio Viewer 2000.lnk = C:\Program Files\Sierra Imaging\Image Expert 2000\IXApplet.exe
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.bellsouth.net
O16 - DPF: {01112B00-3E00-11D2-8470-0060089874ED} (Support.com RemoteControl Class) - http://support.fastaccess.com/sdccommon/download/tgrc.cab
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://support.fastaccess.com/sdccommon/download/tgctlcm.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212…meInstaller.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1157326943241
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Roxio Inc. - C:\WINDOWS\System32\ImapiRox.exe
O23 - Service: MSSQL$MICROSOFTSMLBIZ - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe" -sMICROSOFTSMLBIZ (file missing)
O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINDOWS\Nhksrv.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SQLAgent$MICROSOFTSMLBIZ - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlagent.EXE" -i MICROSOFTSMLBIZ (file missing)
Post #12
A. There is something funny going on here. If OTMoveIT says that they are not there then they had to be removed by CFScript previously run. However the CFScript log shows that the files are still present and there is no written indication that the script ran. One of the two are wrong.


B. One way to find out:

Open HJT, click scan and place a checkmark beside the following entry:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

Now with all windows closed, click on Fix checked and Exit the program.


C. Please use the Internet Explorer browser, and do an online scan with Kaspersky Online Scanner
Click Yes, when prompted to install its ActiveX component.
(Note.. for Internet Explorer 7 users: If at any time you have trouble with the "Accept" button of the license, click on the "Zoom" tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license has been accepted, reset to 100%.)
The program launches and downloads the latest definition files.
  • Once the files are downloaded click on Next
  • Click on Scan Settings and configure as follows:
    • Scan using the following Anti-Virus database:
      • Extended
    • Scan Options:Scan Archives
      Scan Mail Bases
  • Click OK and, under select a target to scan, select My Computer
When the scan is done, in the Scan is completed window (below), any infection is displayed.
There is no option to clean/disinfect, however, we need to analyze the information on the report.
[external image: Posted Image]
[external image: Posted Image]
To obtain the report:
Click on: Save Report As (above - red blinking arrow)
Next, in the Save as prompt, Save in area, select: Desktop
In the File name area, use KScan, or something similar
In Save as type, click the drop arrow and select: Text file [*.txt]
Then, click: Save
Please post the Kaspersky Online Scanner Report in your reply, along with a fresh HijackThis log

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI