What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Baseline..here Is My Log ...

7 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
thanks. Logfile of HijackThis v1.99.1 Scan saved at 4:17:28 PM, on 9/1/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Windows\system32\ZoneLabs\vsmon.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\uTorrent\uTorrent.exe I:\mirc\mirc.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Maxthon2\Maxthon.exe C:\Program Files\Hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch O2 - BHO: (no name) - {47B83D78-F986-4E96-9769-2C55EF14DA0B} - C:\WINDOWS\system32\__c0059810.dat O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O3 - Toolbar: (no name) - {F06E2ABE-3A50-4079-BE25-FC100D9EAA25} - (no file) O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAudPropShortcut.exe O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Babylon Client] C:\Program Files\Babylon\Babylon-Pro\Babylon.exe -AutoStart O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKLM\..\RunOnce: [srePostpone] rundll32.exe c:\windows\system32\zonelabs\srescan.dll,DoSpecialAction O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://prerelease.trendmicro-europe.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab O16 - DPF: {32305793-C19A-48E7-AD2F-D87FF7B264A4} (TenebrilSpywareScanner Control) - http://www.tenebril.com/assets/activeX/SpywareScannerV2.ocx O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{162106A7-3379-4B6A-B5A4-E5483028579F}: NameServer = 4.2.2.1 4.2.2.2 O17 - HKLM\System\CS2\Services\Tcpip\..\{162106A7-3379-4B6A-B5A4-E5483028579F}: NameServer = 4.2.2.1 4.2.2.2 O17 - HKLM\System\CS3\Services\Tcpip\..\{162106A7-3379-4B6A-B5A4-E5483028579F}: NameServer = 4.2.2.1 4.2.2.2 O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - AppInit_DLLs: C:\WINDOWS\system32\__c00E1585.dat O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\Windows\system32\ati2sgag.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Messenger Sharing Folders USN Journal Reader service (usnjsvc) - Unknown owner - C:\Program Files\MSN Messenger\usnsvc.exe (file missing) O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\Windows\system32\ZoneLabs\vsmon.exe
Post #2
Hi! Welcome to the WTT forums.
My name is Scotty. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research.
Please be patient and I'd be grateful if you would note the following:
  • I will working be on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for this issue on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.

Please make a uninstall list using HijackThis
To access the Uninstall Manager you would do the following:

1. Start HijackThis
2. Click on the Config button
3. Click on the Misc Tools button
4. Click on the Open Uninstall Manager button.
5. Click on the Save list… button and specify where you would like to save this file. When you press Save button a notepad will open with the contents of that file. Simply copy and paste the contents of that notepad here in a reply.

Download and Run ComboFix
  • Download this file from below:

    Here
  • Disconnect from the Internet, than disable your anti-virus and any real-time anti-spyware monitors that are running.
  • Then double click combofix.exe & follow the prompts.
  • When finished, it shall produce a log for you. Post that log in your next reply with a new HijackThis log.
Note 1: Do not mouseclick combofix's window whilst it's running. That may cause it to stall
Note 2:Remember to re-enable your anti-virus and anti-spyware before reconnecting to the Internet.
Post #3
hello..

here is the uninstall log :

Adobe Bridge 1.0
Adobe Common File Installer
Adobe Help Center 1.0
Adobe Photoshop CS2
Adobe Shockwave Player
Adobe Stock Photos 1.0
ATI - Software Uninstall Utility
ATI Catalyst Control Center
ATI Display Driver
ATI Parental Control & Encoder
Babylon
CCleaner (remove only)
C-Media High Definition Audio Driver
Combined Community Codec Pack 2007-07-22
Free RM to MP3 Converter 1.12
GOM Player
High Definition Audio Driver Package - KB835221
Hijackthis 1.99.1
HijackThis 1.99.1
Hotfix for Windows XP (KB926239)
HouseCall 6.6
Internet Download Manager
Maxthon2 Browser (remove only)
Microsoft .NET Framework 1.1
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft User-Mode Driver Framework Feature Pack 1.5
mIRC
Mozilla Firefox (2.0.0.6)
Nero 7
neroxml
Nokia Connectivity Cable Driver
Nokia PC Suite
Nokia PC Suite
PaintStar 2.70
Panda ActiveScan
PC Connectivity Solution
PerfectDisk
QuickTime
Real Alternative 1.52
Sandlot Games Client Services
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB936782)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901190)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB937143)
Security Update for Windows XP (KB938127)
Security Update for Windows XP (KB938829)
SunPlus PMP Transcoding
TMNT
Trend Micro TrendProtect for Firefox
TrueCrypt
Update for Windows XP (KB894391)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB927891)
Update for Windows XP (KB930916)
Update for Windows XP (KB931836)
Update for Windows XP (KB936357)
Update for Windows XP (KB938828)
USB MP3 Player WIN98 Drivers
Windows Driver Package - Nokia (WUDFRd) WPD (06/01/2007 6.84.33.0)
Windows Driver Package - Nokia Modem (02/15/2007 3.1)
Windows Driver Package - Nokia Modem (02/15/2007 3.1)
Windows Driver Package - Nokia Modem (05/24/2007 6.84.0.1)
Windows Installer 3.1 (KB893803)
Windows Live Messenger
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
ZoneAlarm


—————-
here is combofix log :

ComboFix 07-08-30.3 - "me2" 2007-09-02 21:41:02.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.209 [GMT 3:00]


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\system32\__c0059810.dat
C:\WINDOWS\system32\__c00E1585.dat


((((((((((((((((((((((((( Files Created from 2007-08-02 to 2007-09-02 )))))))))))))))))))))))))))))))


2007-09-02 21:39 51,200 –a—— C:\Windows\nircmd.exe
2007-09-01 18:56 d—-c— C:\DOCUME~1\me2\APPLIC~1\IDM
2007-09-01 18:56 d—-c— C:\DOCUME~1\me2\APPLIC~1\DMCache
2007-09-01 18:56 d——– C:\Program Files\Internet Download Manager
2007-09-01 16:15 d—-c— C:\DOCUME~1\me2\APPLIC~1\Real
2007-09-01 16:15 d—-c— C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Real
2007-09-01 16:02 d——– C:\Program Files\Free RM to MP3 Converter
2007-08-31 04:31 d——– C:\Program Files\PaintStar
2007-08-30 15:14 d——– C:\Program Files\Trend Micro
2007-08-30 15:11 d——– C:\Windows\pss
2007-08-30 14:17 288,417 –a—— C:\Windows\system32\SrchSTS.exe
2007-08-30 14:17 1,952 –a—— C:\Windows\system32\tmp.reg
2007-08-30 14:03 94,480 –a—— C:\Windows\system32\drivers\tmcomm.sys
2007-08-30 14:03 d—-c— C:\DOCUME~1\me2\APPLIC~1\HouseCall 6.6
2007-08-30 14:03 d——– C:\Windows\system32\HouseCall 6.6
2007-08-30 03:24 d-a–c— C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\TEMP
2007-08-29 14:05 d——– C:\Program Files\CCleaner
2007-08-28 23:48 d——– C:\Program Files\FlashGet
2007-08-28 22:21 d—-c— C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Babylon
2007-08-28 22:21 d——– C:\Program Files\Babylon
2007-08-28 22:20 d—-c— C:\DOCUME~1\me2\APPLIC~1\Babylon
2007-08-28 22:00 d—-c— C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Raxco
2007-08-28 22:00 d——– C:\Program Files\Common Files\Raxco
2007-08-28 21:57 d——– C:\Program Files\RAXCO
2007-08-28 21:50 d——– C:\Program Files\DAEMON Tools
2007-08-28 19:43 74,752 –a—— C:\Windows\system32\storprop.dll
2007-08-28 19:43 57,472 –a—— C:\Windows\system32\drivers\redbook.sys
2007-08-28 19:43 49,536 –a—— C:\Windows\system32\drivers\cdrom.sys
2007-08-28 19:43 41,856 –a—— C:\Windows\system32\drivers\imapi.sys
2007-08-28 16:56 685,816 –a—— C:\Windows\system32\drivers\sptd.sys
2007-08-28 13:11 d——– C:\Program Files\KONAMI
2007-08-28 12:13 d——– C:\Program Files\Wanadoo Edition
2007-08-27 23:43 d—-c— C:\DOCUME~1\me2\APPLIC~1\MxBoost
2007-08-27 17:40 d—-c— C:\DOCUME~1\me2\APPLIC~1\Ahead
2007-08-27 17:36 d——– C:\Program Files\Windows Media Connect 2
2007-08-27 17:34 d——– C:\Windows\system32\LogFiles
2007-08-27 17:34 d——– C:\Windows\system32\drivers\UMDF
2007-08-27 17:20 d—-c— C:\DOCUME~1\me2\APPLIC~1\Nokia Multimedia Player
2007-08-26 20:23 d—-c— C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Trymedia
2007-08-26 20:23 d—-c— C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Sandlot Games
2007-08-26 20:23 d——– C:\Program Files\Common Files\Sandlot Shared
2007-08-26 13:22 d—-c— C:\DOCUME~1\meend\Phone Browser
2007-08-25 12:27 d—-c— C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Adobe Systems
2007-08-25 03:41 d—-c— C:\DOCUME~1\me2\APPLIC~1\Media Player Classic
2007-08-25 01:27 d—-c— C:\DOCUME~1\me2\APPLIC~1\GRETECH
2007-08-24 17:34 864,256 –a—— C:\Windows\system32\FreeImage.dll
2007-08-24 17:34 69,632 –a—— C:\Windows\system32\akrip32.dll
2007-08-24 17:34 55,808 –a—— C:\Windows\system32\zlib1.dll
2007-08-24 17:34 2,965,504 –a—— C:\Windows\system32\TranscodingDLL.dll
2007-08-24 17:34 172,032 –a—— C:\Windows\system32\lame_enc.dll
2007-08-24 17:34 147,456 –a—— C:\Windows\system32\536enc.dll
2007-08-24 17:34 d——– C:\Program Files\SunPlus
2007-08-24 16:55 d—-c— C:\DOCUME~1\meend\APPLIC~1\Paltalk
2007-08-24 16:40 86,016 –a—— C:\Windows\unvise32qt.exe
2007-08-24 16:40 d——– C:\Windows\system32\QuickTime
2007-08-24 16:39 d—-c— C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\QuickTime
2007-08-24 16:31 d—-c— C:\DOCUME~1\meend\APPLIC~1\ImgBurn
2007-08-24 15:27 d—-c— C:\DOCUME~1\meend\APPLIC~1\Ahead
2007-08-24 15:26 d—-c— C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Ahead
2007-08-24 15:24 d—-c— C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Nero
2007-08-24 15:24 d——– C:\Program Files\Common Files\Ahead
2007-08-23 04:56 d—-c— C:\DOCUME~1\ADMINI~1.AFR\APPLIC~1\PC Suite
2007-08-23 04:56 d—-c— C:\DOCUME~1\ADMINI~1.AFR\APPLIC~1\ATI
2007-08-22 23:37 d—-c— C:\DOCUME~1\meend\APPLIC~1\PC Suite
2007-08-22 23:36 d—-c— C:\DOCUME~1\me2\APPLIC~1\uTorrent
2007-08-22 18:16 d—sc— C:\DOCUME~1\me2\UserData
2007-08-22 18:13 d—-c— C:\DOCUME~1\me2\Phone Browser
2007-08-22 18:12 d—-c— C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\PC Suite
2007-08-22 18:02 d—-c— C:\DOCUME~1\me2\APPLIC~1\Nokia
2007-08-22 18:01 d——– C:\Program Files\DIFX
2007-08-22 18:01 d——– C:\Program Files\Common Files\PCSuite
2007-08-22 18:01 d——– C:\Program Files\Common Files\Nokia
2007-08-22 17:44 8,320 –a—— C:\Windows\system32\drivers\nmwcdc.sys
2007-08-22 17:44 65,536 –a—— C:\Windows\system32\nmwcdcocls.dll
2007-08-22 17:44 137,216 –a—— C:\Windows\system32\drivers\nmwcd.sys
2007-08-22 17:44 12,288 –a—— C:\Windows\system32\drivers\nmwcdcm.sys
2007-08-22 17:44 12,288 –a—— C:\Windows\system32\drivers\nmwcdcj.sys
2007-08-22 17:44 d—-c— C:\DOCUME~1\me2\APPLIC~1\PC Suite
2007-08-22 17:44 d——– C:\Program Files\PC Connectivity Solution
2007-08-22 17:43 90,624 –a—— C:\Windows\system32\nmwcdcls.dll
2007-08-22 17:39 d—-c— C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Installations
2007-08-22 05:50 d—-c— C:\DOCUME~1\meend\APPLIC~1\Yahoo!
2007-08-22 01:51 d—-c— C:\DOCUME~1\meend\APPLIC~1\Lavasoft
2007-08-19 13:55 d—-c— C:\DOCUME~1\meend\APPLIC~1\Help
2007-08-16 20:28 d—-c— C:\DOCUME~1\me2\Contacts
2007-08-15 17:19 23,856 –a—— C:\Windows\system32\spupdsvc.exe
2007-08-14 20:13 28,672 ——— C:\Windows\system32\verclsid.exe
2007-08-14 20:13 27,648 —–c— C:\Windows\system32\dllcache\jgpl400.dll
2007-08-14 20:13 163,840 —–c— C:\Windows\system32\dllcache\jgdw400.dll
2007-08-14 20:11 d–h—– C:\Windows\$hf_mig$
2007-08-13 12:59 d—-c— C:\DOCUME~1\me2\APPLIC~1\ATI
2007-08-12 12:02 d—sc— C:\DOCUME~1\meend\UserData
2007-08-12 02:28 d—-c— C:\DOCUME~1\meend\APPLIC~1\Media Player Classic
2007-08-12 00:38 d—-c— C:\DOCUME~1\meend\APPLIC~1\GRETECH
2007-08-11 17:56 d——– C:\Program Files\GRETECH
2007-08-11 17:54 d——– C:\Program Files\Combined Community Codec Pack
2007-08-11 16:10 d—-c— C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Spybot - Search & Destroy
2007-08-11 04:42 d—-c— C:\DOCUME~1\meend\APPLIC~1\vlc
2007-08-11 04:40 d——– C:\Program Files\VideoLAN
2007-08-11 03:56 d—-c— C:\DOCUME~1\meend\APPLIC~1\TrueCrypt


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-09-02 01:50 ——— d——– C:\Program Files\MSN Messenger
2007-09-01 16:15 ——— d——– C:\Program Files\Real Alternative
2007-09-01 16:15 ——— d——– C:\Program Files\Media Player Classic
2007-08-31 19:55 ——— d——– C:\Program Files\Maxthon2
2007-08-30 20:18 ——— d——– C:\Program Files\Pocket Tanks Deluxe
2007-08-28 13:15 ——— d–h—– C:\Program Files\InstallShield Installation Information
2007-08-24 16:53 ——— d——– C:\Program Files\Net Tools
2007-08-24 16:53 ——— d——– C:\Program Files\DivX
2007-08-24 16:53 ——— d——– C:\Program Files\ChickenInvadersROTYXmas
2007-08-23 23:16 ——— d——– C:\Program Files\Trillian
2007-08-11 17:49 359040 –a—— C:\WINDOWS\system32\drivers\TCPIP.SYS.ORIGINAL
2007-08-01 14:35 ——— d——– C:\Program Files\Common Files\LightScribe
2007-08-01 03:45 ——— d——– C:\Program Files\SmartSoftVideoConverterPro
2007-07-30 19:19 92504 –a—— C:\WINDOWS\system32\cdm.dll
2007-07-30 19:19 549720 –a—— C:\WINDOWS\system32\wuapi.dll
2007-07-30 19:19 53080 –a—— C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 43352 –a—— C:\WINDOWS\system32\wups2.dll
2007-07-30 19:19 325976 –a—— C:\WINDOWS\system32\wucltui.dll
2007-07-30 19:19 203096 –a—— C:\WINDOWS\system32\wuweb.dll
2007-07-30 19:19 1712984 –a—— C:\WINDOWS\system32\wuaueng.dll
2007-07-30 19:18 33624 –a—— C:\WINDOWS\system32\wups.dll
2007-07-28 00:47 40960 –a—— C:\AntiTosh1.0.exe
2007-07-23 11:39 202160 –a—— C:\WINDOWS\system32\idmmbc.dll
2007-07-20 00:57 267112 –a—— C:\WINDOWS\system32\xactengine2_9.dll
2007-07-20 00:54 18280 –a—— C:\WINDOWS\system32\x3daudio1_2.dll
2007-07-19 18:14 444776 –a—— C:\WINDOWS\system32\d3dx10_35.dll
2007-07-19 18:14 3727720 –a—— C:\WINDOWS\system32\d3dx9_35.dll
2007-07-19 18:14 1358192 –a—— C:\WINDOWS\system32\D3DCompiler_35.dll
2007-07-15 20:50 ——— d——– C:\Program Files\DOSBox-0.63
2007-07-12 05:36 ——— d——– C:\Program Files\Conquer 2.0
2007-07-09 21:07 ——— d——– C:\Program Files\PicaLoader
2007-07-08 19:06 ——— d——– C:\Program Files\Common Files\Real
2007-07-06 11:59 ——— d——– C:\Program Files\Cake Mania
2007-07-05 17:09 ——— d——– C:\Program Files\7-Zip
2007-06-26 09:08 1104896 –a—— C:\WINDOWS\system32\msxml3.dll
2007-06-20 20:46 266088 –a—— C:\WINDOWS\system32\xactengine2_8.dll
2007-06-19 16:31 282112 –a—— C:\WINDOWS\system32\gdi32.dll
2007-06-13 13:23 1033216 –a—— C:\WINDOWS\explorer.exe
2007-06-08 08:11 831048 –a—— C:\WINDOWS\system32\WudfUpdate_01005.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-04 15:00]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 15:00]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 15:00]
"High Definition Audio Property Page Shortcut"="HDAudPropShortcut.exe" [2004-03-17 17:10 C:\Windows\system32\Hdaudpropshortcut.exe]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2005-08-12 15:43]
"Zone Labs Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2006-08-24 00:38]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-08-24 16:40]
"Babylon Client"="C:\Program Files\Babylon\Babylon-Pro\Babylon.exe" [2006-04-30 19:12]
"MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2004-08-04 15:00]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-08-22 15:06]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15:00]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 13:54]
"IDMan"="C:\Program Files\Internet Download Manager\IDMan.exe" [2007-07-27 17:56]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Nokia.PCSync"=C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog

C:\DOCUME~1\me2\STARTM~1\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 20:16:50]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=C:\WINDOWS\system32\__c00E1585.dat

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
"C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cmaudio]
RunDll32 cmicnfg.cpl,CMICtrlWnd

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
"C:\Program Files\MSN Messenger\msnmsgr.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup

R3 cmudax;C-Media High Definition Audio Interface;C:\WINDOWS\system32\drivers\cmudax.sys


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4ec6f409-51c3-11dc-9e6d-0011097fde6b}]
AutoRun\command- G:\autorun.exe


**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-02 21:44:15
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-09-02 21:46:26 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-09-02 21:46

— E O F —

—————–

and finaly the new hijackthis log :

Logfile of HijackThis v1.99.1
Scan saved at 9:47:04 PM, on 9/2/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Windows\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\cmd.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Babylon\Babylon-Pro\Babylon.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: (no name) - {F06E2ABE-3A50-4079-BE25-FC100D9EAA25} - (no file)
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Babylon Client] C:\Program Files\Babylon\Babylon-Pro\Babylon.exe -AutoStart
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: Download All Links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://prerelease.trendmicro-europe.com/ho…ivex/hcImpl.cab
O16 - DPF: {32305793-C19A-48E7-AD2F-D87FF7B264A4} (TenebrilSpywareScanner Control) - http://www.tenebril.com/assets/activeX/SpywareScannerV2.ocx
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{162106A7-3379-4B6A-B5A4-E5483028579F}: NameServer = 4.2.2.1 4.2.2.2
O17 - HKLM\System\CS2\Services\Tcpip\..\{162106A7-3379-4B6A-B5A4-E5483028579F}: NameServer = 4.2.2.1 4.2.2.2
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: C:\WINDOWS\system32\__c00E1585.dat
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\Windows\system32\ati2sgag.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\Windows\system32\ZoneLabs\vsmon.exe

———-

thanks.
Post #4
Hi
Before we continue, do you know what this is?

AntiTosh1.0.exe

If not, follow the next instruction.

Upload a File to Virustotal
Please visit Virustotal
  • Click the Browse… button
  • Navigate to the file C:\AntiTosh1.0.exe
  • Click the Open button
  • Click the Send button
  • Copy and paste the results back here please.
Post #5
i know it is a program to repel flies. here : File AntiTosh1.0.exe received on 09.03.2007 00:47:03 (CET) Current status: Loading … queued waiting scanning finished NOT FOUND STOPPED Result: 1/32 (3.13%) Loading server information… Your file is queued in position: ___. Estimated start time is between ___ and ___ . Do not close the window until scan is complete. The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result. If you are waiting for more than five minutes you have to resend your file. Your file is being scanned by VirusTotal in this moment, results will be shown as they're generated. Compact Print results Your file has expired or does not exists. Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time. You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished. Email: Antivirus Version Last Update Result AhnLab-V3 2007.9.1.0 2007.09.01 - AntiVir 7.4.1.66 2007.09.02 - Authentium 4.93.8 2007.09.02 - Avast 4.7.1029.0 2007.09.02 - AVG 7.5.0.484 2007.09.02 - BitDefender 7.2 2007.09.02 - CAT-QuickHeal 9.00 2007.09.01 - ClamAV 0.91.2 2007.09.02 - DrWeb 4.33 2007.09.03 - eSafe 7.0.15.0 2007.09.02 - eTrust-Vet 31.1.5100 2007.08.31 - Ewido 4.0 2007.09.02 - FileAdvisor 1 2007.09.03 - Fortinet 3.11.0.0 2007.09.02 - F-Prot 4.3.2.48 2007.09.02 - F-Secure 6.70.13030.0 2007.09.02 - Ikarus T3.1.1.12 2007.09.02 - Kaspersky 4.0.2.24 2007.09.03 - McAfee 5110 2007.08.31 - Microsoft 1.2803 2007.09.03 - NOD32v2 2498 2007.09.03 - Norman 5.80.02 2007.09.02 - Panda 9.0.0.4 2007.09.02 Suspicious file Prevx1 V2 2007.09.03 - Rising 19.38.62.00 2007.09.02 - Sophos 4.21.0 2007.09.02 - Sunbelt 2.2.907.0 2007.08.31 - Symantec 10 2007.09.03 - TheHacker 6.1.9.175 2007.09.02 - VBA32 3.12.2.3 2007.09.01 - VirusBuster 4.3.26:9 2007.09.02 - Webwasher-Gateway 6.0.1 2007.09.02 - Additional information File size: 40960 bytes MD5: cf5be0851718e3504c7872a258ca9d78 SHA1: 30aaa8ad8d9e71d28ee16e1277fcce4dfd4e8790
Post #6
Hi

Open Notepad and Copy/Paste the text in the codebox below into it: 

File::
C:\Windows\system32\536enc.dll
C:\Windows\unvise32qt.exe
C:\WINDOWS\system32\__c00E1585.dat

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=""

Save this as "CFScript"

[external image: Posted Image]


Refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log.

Run HijackThis, select Do a system scan only and place checks against the following entries (if they are still present):
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: (no name) - {F06E2ABE-3A50-4079-BE25-FC100D9EAA25} - (no file)


WITH ALL OTHER WINDOWS CLOSED Click on Fix Checked and exit HijackThis and reboot.
  • Please go HERE to run PandaActiveScan…

  • Once you are on the Panda site click the Scan your PC button
  • A new window will open…click the Check Now button
  • Enter your Country
  • Enter your State/Province
  • Enter your e-mail address and click send
  • Select either Home User or Company
  • Click the big Scan Now button
  • If it wants to install an ActiveX component allow it
  • It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)

  • When download is complete, click on My Computer to start the scan
  • When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to your desktop.
Your log shows that MSConfig is running at startup. This indicates that you may be using "diagnostic startup" rather than "normal startup" to stop something from running. While this is normally OK, it is possible that you have disabled something that will affect how we clean your machine. Please don't change anything in MSConfig yet, these instructions will produce a report of what programs are currently disabled so I can see the entries without requiring any changes:

Go to Start > Run and type Notepad
Copy/paste the following quote box into a new notepad (not wordpad) document. Make sure that wordwrap is unchecked.

regedit /a /e %systemdrive%\regkey.txt "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig"
notepad %systemdrive%\regkey.txt
del /q %systemdrive%\regkey.txt

Go to the menu at the top of the Notepad File and Save as
Save it to your Desktop as "mslook.bat" (you MUST include the quotes)
Locate mslook.bat on your Desktop and double-click it. When notepad opens, copy/paste the content in your reply. When you close Notepad the CMD window will close automatically and the text file will be deleted.

Enable disabled items with msconfig
You have a small list of start ups, do you have any disabled items in msconfig? If so you will need to post back a new HijackThislog after you re-enable them.

Go to Start> Run type msconfig and click OK.

Under the Services tab click Enable All

Under the Startup tab click Enable All> Apply> OK> Reboot now.

Then post a new HijackThis log, with the new Combofix log, and the Pandascan report.
Post #7
new hijackthis log after enabling all in msconfig:

Logfile of HijackThis v1.99.1
Scan saved at 10:45:29 PM, on 9/3/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Windows\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Hijackthis\HijackThis.exe

O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Babylon Client] C:\Program Files\Babylon\Babylon-Pro\Babylon.exe -AutoStart
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: Download All Links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://prerelease.trendmicro-europe.com/ho…ivex/hcImpl.cab
O16 - DPF: {32305793-C19A-48E7-AD2F-D87FF7B264A4} (TenebrilSpywareScanner Control) - http://www.tenebril.com/assets/activeX/SpywareScannerV2.ocx
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{162106A7-3379-4B6A-B5A4-E5483028579F}: NameServer = 4.2.2.1 4.2.2.2
O17 - HKLM\System\CS2\Services\Tcpip\..\{162106A7-3379-4B6A-B5A4-E5483028579F}: NameServer = 4.2.2.1 4.2.2.2
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\Windows\system32\ati2sgag.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\Windows\system32\ZoneLabs\vsmon.exe

=======================


new combofix :

ComboFix 07-08-30.3 - "me2" 2007-09-03 20:32:27.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.174 [GMT 3:00]
Command switches used :: I:\CFScript.txt

FILE::
C:\Windows\system32\536enc.dll
C:\Windows\unvise32qt.exe
C:\WINDOWS\system32\__c00E1585.dat


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\Windows\system32\536enc.dll
C:\Windows\unvise32qt.exe


((((((((((((((((((((((((( Files Created from 2007-08-03 to 2007-09-03 )))))))))))))))))))))))))))))))


2007-09-03 19:04 d—-c— C:\DOCUME~1\me2\APPLIC~1\ImgBurn
2007-09-03 18:43 d——– C:\Program Files\ImgBurn
2007-09-02 21:39 51,200 –a—— C:\Windows\nircmd.exe
2007-09-01 18:56 d—-c— C:\DOCUME~1\me2\APPLIC~1\IDM
2007-09-01 18:56 d—-c— C:\DOCUME~1\me2\APPLIC~1\DMCache
2007-09-01 18:56 d——– C:\Program Files\Internet Download Manager
2007-09-01 16:15 d—-c— C:\DOCUME~1\me2\APPLIC~1\Real
2007-09-01 16:15 d—-c— C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Real
2007-09-01 16:02 d——– C:\Program Files\Free RM to MP3 Converter
2007-08-31 04:31 d——– C:\Program Files\PaintStar
2007-08-30 15:14 d——– C:\Program Files\Trend Micro
2007-08-30 15:11 d——– C:\Windows\pss
2007-08-30 14:17 288,417 –a—— C:\Windows\system32\SrchSTS.exe
2007-08-30 14:17 1,952 –a—— C:\Windows\system32\tmp.reg
2007-08-30 14:03 94,480 –a—— C:\Windows\system32\drivers\tmcomm.sys
2007-08-30 14:03 d—-c— C:\DOCUME~1\me2\APPLIC~1\HouseCall 6.6
2007-08-30 14:03 d——– C:\Windows\system32\HouseCall 6.6
2007-08-30 03:24 d-a–c— C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\TEMP
2007-08-29 14:05 d——– C:\Program Files\CCleaner
2007-08-28 23:48 d——– C:\Program Files\FlashGet
2007-08-28 22:21 d—-c— C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Babylon
2007-08-28 22:21 d——– C:\Program Files\Babylon
2007-08-28 22:20 d—-c— C:\DOCUME~1\me2\APPLIC~1\Babylon
2007-08-28 22:00 d—-c— C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Raxco
2007-08-28 22:00 d——– C:\Program Files\Common Files\Raxco
2007-08-28 21:57 d——– C:\Program Files\RAXCO
2007-08-28 21:50 d——– C:\Program Files\DAEMON Tools
2007-08-28 19:43 74,752 –a—— C:\Windows\system32\storprop.dll
2007-08-28 19:43 57,472 –a—— C:\Windows\system32\drivers\redbook.sys
2007-08-28 19:43 49,536 –a—— C:\Windows\system32\drivers\cdrom.sys
2007-08-28 19:43 41,856 –a—— C:\Windows\system32\drivers\imapi.sys
2007-08-28 16:56 685,816 –a—— C:\Windows\system32\drivers\sptd.sys
2007-08-28 13:11 d——– C:\Program Files\KONAMI
2007-08-28 12:13 d——– C:\Program Files\Wanadoo Edition
2007-08-27 23:43 d—-c— C:\DOCUME~1\me2\APPLIC~1\MxBoost
2007-08-27 17:40 d—-c— C:\DOCUME~1\me2\APPLIC~1\Ahead
2007-08-27 17:36 d——– C:\Program Files\Windows Media Connect 2
2007-08-27 17:34 d——– C:\Windows\system32\LogFiles
2007-08-27 17:34 d——– C:\Windows\system32\drivers\UMDF
2007-08-27 17:20 d—-c— C:\DOCUME~1\me2\APPLIC~1\Nokia Multimedia Player
2007-08-26 20:23 d—-c— C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Trymedia
2007-08-26 20:23 d—-c— C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Sandlot Games
2007-08-26 20:23 d——– C:\Program Files\Common Files\Sandlot Shared
2007-08-26 13:22 d—-c— C:\DOCUME~1\meend\Phone Browser
2007-08-25 12:27 d—-c— C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Adobe Systems
2007-08-25 03:41 d—-c— C:\DOCUME~1\me2\APPLIC~1\Media Player Classic
2007-08-25 01:27 d—-c— C:\DOCUME~1\me2\APPLIC~1\GRETECH
2007-08-24 17:34 864,256 –a—— C:\Windows\system32\FreeImage.dll
2007-08-24 17:34 69,632 –a—— C:\Windows\system32\akrip32.dll
2007-08-24 17:34 55,808 –a—— C:\Windows\system32\zlib1.dll
2007-08-24 17:34 2,965,504 –a—— C:\Windows\system32\TranscodingDLL.dll
2007-08-24 17:34 172,032 –a—— C:\Windows\system32\lame_enc.dll
2007-08-24 17:34 d——– C:\Program Files\SunPlus
2007-08-24 16:55 d—-c— C:\DOCUME~1\meend\APPLIC~1\Paltalk
2007-08-24 16:40 d——– C:\Windows\system32\QuickTime
2007-08-24 16:39 d—-c— C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\QuickTime
2007-08-24 16:31 d—-c— C:\DOCUME~1\meend\APPLIC~1\ImgBurn
2007-08-24 15:27 d—-c— C:\DOCUME~1\meend\APPLIC~1\Ahead
2007-08-24 15:26 d—-c— C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Ahead
2007-08-24 15:24 d—-c— C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Nero
2007-08-24 15:24 d——– C:\Program Files\Common Files\Ahead
2007-08-23 04:56 d—-c— C:\DOCUME~1\ADMINI~1.AFR\APPLIC~1\PC Suite
2007-08-23 04:56 d—-c— C:\DOCUME~1\ADMINI~1.AFR\APPLIC~1\ATI
2007-08-22 23:37 d—-c— C:\DOCUME~1\meend\APPLIC~1\PC Suite
2007-08-22 23:36 d—-c— C:\DOCUME~1\me2\APPLIC~1\uTorrent
2007-08-22 18:16 d—sc— C:\DOCUME~1\me2\UserData
2007-08-22 18:13 d—-c— C:\DOCUME~1\me2\Phone Browser
2007-08-22 18:12 d—-c— C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\PC Suite
2007-08-22 18:02 d—-c— C:\DOCUME~1\me2\APPLIC~1\Nokia
2007-08-22 18:01 d——– C:\Program Files\DIFX
2007-08-22 18:01 d——– C:\Program Files\Common Files\PCSuite
2007-08-22 18:01 d——– C:\Program Files\Common Files\Nokia
2007-08-22 17:44 8,320 –a—— C:\Windows\system32\drivers\nmwcdc.sys
2007-08-22 17:44 65,536 –a—— C:\Windows\system32\nmwcdcocls.dll
2007-08-22 17:44 137,216 –a—— C:\Windows\system32\drivers\nmwcd.sys
2007-08-22 17:44 12,288 –a—— C:\Windows\system32\drivers\nmwcdcm.sys
2007-08-22 17:44 12,288 –a—— C:\Windows\system32\drivers\nmwcdcj.sys
2007-08-22 17:44 d—-c— C:\DOCUME~1\me2\APPLIC~1\PC Suite
2007-08-22 17:44 d——– C:\Program Files\PC Connectivity Solution
2007-08-22 17:43 90,624 –a—— C:\Windows\system32\nmwcdcls.dll
2007-08-22 17:39 d—-c— C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Installations
2007-08-22 05:50 d—-c— C:\DOCUME~1\meend\APPLIC~1\Yahoo!
2007-08-22 01:51 d—-c— C:\DOCUME~1\meend\APPLIC~1\Lavasoft
2007-08-19 13:55 d—-c— C:\DOCUME~1\meend\APPLIC~1\Help
2007-08-16 20:28 d—-c— C:\DOCUME~1\me2\Contacts
2007-08-15 17:19 23,856 –a—— C:\Windows\system32\spupdsvc.exe
2007-08-14 20:13 28,672 ——— C:\Windows\system32\verclsid.exe
2007-08-14 20:13 27,648 —–c— C:\Windows\system32\dllcache\jgpl400.dll
2007-08-14 20:13 163,840 —–c— C:\Windows\system32\dllcache\jgdw400.dll
2007-08-14 20:11 d–h—– C:\Windows\$hf_mig$
2007-08-13 12:59 d—-c— C:\DOCUME~1\me2\APPLIC~1\ATI
2007-08-12 12:02 d—sc— C:\DOCUME~1\meend\UserData
2007-08-12 02:28 d—-c— C:\DOCUME~1\meend\APPLIC~1\Media Player Classic
2007-08-12 00:38 d—-c— C:\DOCUME~1\meend\APPLIC~1\GRETECH
2007-08-11 17:56 d——– C:\Program Files\GRETECH
2007-08-11 17:54 d——– C:\Program Files\Combined Community Codec Pack
2007-08-11 16:10 d—-c— C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Spybot - Search & Destroy
2007-08-11 04:42 d—-c— C:\DOCUME~1\meend\APPLIC~1\vlc
2007-08-11 04:40 d——– C:\Program Files\VideoLAN
2007-08-11 03:56 d—-c— C:\DOCUME~1\meend\APPLIC~1\TrueCrypt


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-09-02 01:50 ——— d——– C:\Program Files\MSN Messenger
2007-09-01 16:15 ——— d——– C:\Program Files\Real Alternative
2007-09-01 16:15 ——— d——– C:\Program Files\Media Player Classic
2007-08-31 19:55 ——— d——– C:\Program Files\Maxthon2
2007-08-30 20:18 ——— d——– C:\Program Files\Pocket Tanks Deluxe
2007-08-28 13:15 ——— d–h—– C:\Program Files\InstallShield Installation Information
2007-08-24 16:53 ——— d——– C:\Program Files\Net Tools
2007-08-24 16:53 ——— d——– C:\Program Files\DivX
2007-08-24 16:53 ——— d——– C:\Program Files\ChickenInvadersROTYXmas
2007-08-23 23:16 ——— d——– C:\Program Files\Trillian
2007-08-11 17:49 359040 –a—— C:\WINDOWS\system32\drivers\TCPIP.SYS.ORIGINAL
2007-08-02 04:30 ——— d——– C:\Program Files\PMP Transcoding Tool
2007-08-01 14:35 ——— d——– C:\Program Files\Common Files\LightScribe
2007-08-01 03:45 ——— d——– C:\Program Files\SmartSoftVideoConverterPro
2007-07-30 19:19 92504 –a—— C:\WINDOWS\system32\cdm.dll
2007-07-30 19:19 549720 –a—— C:\WINDOWS\system32\wuapi.dll
2007-07-30 19:19 53080 –a—— C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 43352 –a—— C:\WINDOWS\system32\wups2.dll
2007-07-30 19:19 325976 –a—— C:\WINDOWS\system32\wucltui.dll
2007-07-30 19:19 203096 –a—— C:\WINDOWS\system32\wuweb.dll
2007-07-30 19:19 1712984 –a—— C:\WINDOWS\system32\wuaueng.dll
2007-07-30 19:18 33624 –a—— C:\WINDOWS\system32\wups.dll
2007-07-23 11:39 202160 –a—— C:\WINDOWS\system32\idmmbc.dll
2007-07-20 00:57 267112 –a—— C:\WINDOWS\system32\xactengine2_9.dll
2007-07-20 00:54 18280 –a—— C:\WINDOWS\system32\x3daudio1_2.dll
2007-07-19 18:14 444776 –a—— C:\WINDOWS\system32\d3dx10_35.dll
2007-07-19 18:14 3727720 –a—— C:\WINDOWS\system32\d3dx9_35.dll
2007-07-19 18:14 1358192 –a—— C:\WINDOWS\system32\D3DCompiler_35.dll
2007-07-15 20:50 ——— d——– C:\Program Files\DOSBox-0.63
2007-07-12 05:36 ——— d——– C:\Program Files\Conquer 2.0
2007-07-09 21:07 ——— d——– C:\Program Files\PicaLoader
2007-07-08 19:06 ——— d——– C:\Program Files\Common Files\Real
2007-07-06 11:59 ——— d——– C:\Program Files\Cake Mania
2007-07-05 17:09 ——— d——– C:\Program Files\7-Zip
2007-06-26 09:08 1104896 –a—— C:\WINDOWS\system32\msxml3.dll
2007-06-20 20:46 266088 –a—— C:\WINDOWS\system32\xactengine2_8.dll
2007-06-19 16:31 282112 –a—— C:\WINDOWS\system32\gdi32.dll
2007-06-13 13:23 1033216 –a—— C:\WINDOWS\explorer.exe
2007-06-08 08:11 831048 –a—— C:\WINDOWS\system32\WudfUpdate_01005.dll


((((((((((((((((((((((((((((( snapshot_2007-09-02_214605.07 )))))))))))))))))))))))))))))))))))))))))

—h–w 4,212 2007-09-03 12:13:49 C:\WINDOWS\system32\zllictbl.dat

—h–w 4,212 2007-09-02 12:32:07 C:\WINDOWS\system32\zllictbl.dat

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-04 15:00]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 15:00]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 15:00]
"High Definition Audio Property Page Shortcut"="HDAudPropShortcut.exe" [2004-03-17 17:10 C:\Windows\system32\Hdaudpropshortcut.exe]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2005-08-12 15:43]
"Zone Labs Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2006-08-24 00:38]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-08-24 16:40]
"Babylon Client"="C:\Program Files\Babylon\Babylon-Pro\Babylon.exe" [2006-04-30 19:12]
"MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2004-08-04 15:00]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-08-22 15:06]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15:00]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 13:54]
"IDMan"="C:\Program Files\Internet Download Manager\IDMan.exe" [2007-07-27 17:56]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Nokia.PCSync"=C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog

C:\DOCUME~1\me2\STARTM~1\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 20:16:50]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
"C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cmaudio]
RunDll32 cmicnfg.cpl,CMICtrlWnd

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
"C:\Program Files\MSN Messenger\msnmsgr.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup

R3 cmudax;C-Media High Definition Audio Interface;C:\WINDOWS\system32\drivers\cmudax.sys


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4ec6f409-51c3-11dc-9e6d-0011097fde6b}]
AutoRun\command- G:\autorun.exe


**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-03 20:35:53
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-09-03 20:38:01 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-09-03 20:38
C:\ComboFix2.txt … 2007-09-02 21:46

— E O F —

-========——-


regkey :


REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\services]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NMBgMonitor"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\Common Files\\Ahead\\Lib\\NMBgMonitor.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Cmaudio]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="RunDll32 cmicnfg"
"hkey"="HKLM"
"command"="RunDll32 cmicnfg.cpl,CMICtrlWnd"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ctfmon.exe]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ctfmon"
"hkey"="HKCU"
"command"="C:\\WINDOWS\\system32\\ctfmon.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\msnmsgr]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="msnmsgr"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\NeroFilterCheck]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NeroCheck"
"hkey"="HKLM"
"command"="C:\\Program Files\\Common Files\\Ahead\\Lib\\NeroCheck.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\PCSuiteTrayApplication]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="LaunchApplication"
"hkey"="HKLM"
"command"="C:\\Program Files\\Nokia\\Nokia PC Suite 6\\LaunchApplication.exe -startup"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\state]
"system.ini"=dword:00000000
"win.ini"=dword:00000000
"bootini"=dword:00000000
"services"=dword:00000000
"startup"=dword:00000002



——————-


panda activescan report :


Incident Status Location

Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\me2\Cookies\me2@advertising[1].txt
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\me2\Cookies\me2@atdmt[2].txt
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\me2\Cookies\me2@com[1].txt
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\me2\Cookies\me2@doubleclick[1].txt
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\me2\Cookies\me2@tribalfusion[1].txt
Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\Documents and Settings\me2\My Documents\Downloads\Programs\ComboFix.exe[nircmd.exe]
Spyware:Cookie/FortuneCity Not disinfected C:\Documents and Settings\meend\Application Data\Mozilla\Firefox\Profiles\hl9sjnoo.default\cookies.txt[.fortunecity.com/]
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\meend\Cookies\meend@2o7[1].txt
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\meend\Cookies\[removed][1].txt
Spyware:Cookie/AdDynamix Not disinfected C:\Documents and Settings\meend\Cookies\[removed][1].txt
Spyware:Cookie/Adserver Not disinfected C:\Documents and Settings\meend\Cookies\[removed][2].txt
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\meend\Cookies\meend@advertising[1].txt
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\meend\Cookies\meend@atdmt[2].txt
Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\meend\Cookies\meend@atwola[1].txt
Spyware:Cookie/Bluestreak Not disinfected C:\Documents and Settings\meend\Cookies\meend@bluestreak[2].txt
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\meend\Cookies\[removed]-sys[1].txt
Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\meend\Cookies\meend@casalemedia[1].txt
Spyware:Cookie/Cgi-bin Not disinfected C:\Documents and Settings\meend\Cookies\meend@cgi-bin[3].txt
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\meend\Cookies\meend@com[1].txt
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\meend\Cookies\meend@doubleclick[1].txt
Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\meend\Cookies\meend@fastclick[2].txt
Spyware:Cookie/Itrack Not disinfected C:\Documents and Settings\meend\Cookies\[removed][1].txt
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\meend\Cookies\meend@mediaplex[1].txt
Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\meend\Cookies\meend@questionmarket[1].txt
Spyware:Cookie/Searchportal Not disinfected C:\Documents and Settings\meend\Cookies\[removed][2].txt
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\meend\Cookies\[removed][1].txt
Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\meend\Cookies\meend@statcounter[2].txt
Spyware:Cookie/Tickle Not disinfected C:\Documents and Settings\meend\Cookies\meend@tickle[1].txt
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\meend\Cookies\meend@tribalfusion[1].txt
Spyware:Cookie/Tickle Not disinfected C:\Documents and Settings\meend\Cookies\[removed][1].txt
Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\meend\Cookies\meend@zedo[2].txt
Virus:W32/ZLFake.A.drp Disinfected C:\temp\svcipa.exe
Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\Windows\nircmd.exe
Hacktool:Hacktool/Dialupass.D Not disinfected E:\dialupass2.zip[dialupass.exe]
Potentially unwanted tool:Application/NirCmd.A Not disinfected I:\ComboFix.exe[nircmd.exe]
Spyware:Cookie/YieldManager Not disinfected I:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\aewt7j8v.default\cookies.txt[ad.yieldmanager.com/]
Spyware:Cookie/Screensavers Not disinfected I:\Documents and Settings\Administrator\Cookies\[removed][1].txt


—=======–
Post #8
Hi

First delete the Combofix icon from your Desktop.

Then navigate to and delete these folders

C:\Combofix
C:\Qoobox

This is my usual speech for when you are clean, which you appear to be.

Please follow these simple steps in order to keep your computer clean and secure:
Disable and Enable System Restore.
  • Click Start | Help and Support | Undo changes to your computer with System Restore.
  • Click Create A Restore Point then click Next. Give it a name it and then click Create, then Close.
  • Close the Help and Support Center box.
  • Click Start | Run and type Cleanmgr
  • Select (C: ) then click OK.
  • Click the More Options tab.
  • Click Clean Up in the System Restore Section.
This will remove all previous restore points except the newly created one.

Here are some free programs, I recommend.

Spybot Search and Destroy
Download it from here . Just choose a mirror and off you go.
Find here the tutorial on how to use Spybot properly here

Install Spyware Guard
Download it from here
Find here the tutorial on how to use Spyware Guard here

Install SpyWare Blaster
Download it from here
Find here the tutorial on how to use Spyware Blaster here

Install WinPatrol
Download it from here
Here you can find information about how WinPatrol works here


Make sure your Windows is ALWAYS up to date!

An unpatched Windows is vulnerable and even with the "best" Antivirus and Firewall installed, malware will find its way through.
So visit http://windowsupdate.microsoft.com/ to download and install the latest updates.


Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.

Please check out Tony Klein's article "How did I get infected in the first place?"


Follow this list and your potential for being infected again will reduce dramatically.

Glad I was able to help.
Post #10
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI