What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Search-daily, Hacktool.roorkit

10 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
ComboFix 07-10-03.7 - ydeschenes 2007-10-05 10:54:46.3 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.66 [GMT -4:00]
Running from: C:\Documents and Settings\[removed]\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\jlroberge\Bureau\CFScript.txt
* Created a new restore point

FILE::
C:\WINDOWS\system32\adsmsextt.dll
C:\WINDOWS\system32\b2selxshs6s.exe
C:\WINDOWS\system32\bgajhvxq.dat
C:\WINDOWS\system32\byvqzrbl.dll
C:\WINDOWS\system32\cabinetg.dll
C:\WINDOWS\system32\comaddind.dll
C:\WINDOWS\system32\crtdllq.dll
C:\WINDOWS\system32\cuhxtfgj.dat
C:\WINDOWS\system32\d3dpmesha.dll
C:\WINDOWS\system32\drivers\zbblupvo.sys
C:\WINDOWS\system32\dsprpresu.dll
C:\WINDOWS\system32\htonptjm.dat
C:\WINDOWS\system32\ioahjmcc.dll
C:\WINDOWS\system32\rylsoici.dat
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\VundoFix Backups
C:\VundoFix Backups\cdmodemt.dll.bad
C:\WINDOWS\system32\adsmsextt.dll
C:\WINDOWS\system32\bgajhvxq.dat
C:\WINDOWS\system32\byvqzrbl.dll
C:\WINDOWS\system32\comaddind.dll
C:\WINDOWS\system32\cuhxtfgj.dat
C:\WINDOWS\system32\d3dpmesha.dll
C:\WINDOWS\system32\drivers\zbblupvo.sys
C:\WINDOWS\system32\htonptjm.dat
C:\WINDOWS\system32\ioahjmcc.dll
C:\WINDOWS\system32\rylsoici.dat

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


——-\LEGACY_UIJRIBUW
——-\uijribuw


((((((((((((((((((((((((((((( Fichiers créés 2007-09-05 to 2007-10-05 ))))))))))))))))))))))))))))))))))))
.

2007-10-03 16:22 d——– C:\Program Files\Lavasoft
2007-10-03 16:22 d——– C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-10-03 16:20 d——– C:\Program Files\SpywareBlaster
2007-10-03 16:12 d——– C:\Documents and Settings\jlroberge\Application Data\ParetoLogic
2007-10-03 16:11 d——– C:\Program Files\ParetoLogic
2007-10-03 16:11 d——– C:\Program Files\Fichiers communs\ParetoLogic
2007-10-03 16:11 d——– C:\Documents and Settings\All Users\Application Data\ParetoLogic
2007-10-03 15:50 d——– C:\Documents and Settings\All Users\Application Data\Downloaded Installations
2007-10-03 15:19 3,968 –a—— C:\WINDOWS\system32\drivers\AvgArCln.sys
2007-10-03 11:35 d——– C:\Program Files\Kaspersky Lab
2007-10-03 11:33 d——– C:\kav
2007-10-02 14:17 d——– C:\WINDOWS\system32\Kaspersky Lab
2007-10-02 14:17 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-10-02 13:57 d——– C:\Documents and Settings\jlroberge\Application Data\TuneUp Software
2007-09-27 14:41 29,704 –a—— C:\WINDOWS\system32\uxtuneup.dll
2007-09-27 14:41 d——– C:\Documents and Settings\administrator\Application Data\TuneUp Software
2007-09-27 14:40 d——– C:\Program Files\TuneUp Utilities 2007
2007-09-27 14:40 d——– C:\Documents and Settings\All Users\Application Data\TuneUp Software
2007-09-27 11:01 d——– C:\Program Files\Fichiers communs\Wise Installation Wizard
2007-09-21 15:28 d——– C:\WINDOWS\system32\fr-fr
2007-09-21 15:24 33,792 –a—— C:\WINDOWS\system32\dllcache\custsat.dll
2007-09-21 15:15 23,040 ——— C:\WINDOWS\system32\dllcache\fltmc.exe
2007-09-21 15:15 16,896 ——— C:\WINDOWS\system32\dllcache\fltlib.dll
2007-09-21 15:15 128,896 ——— C:\WINDOWS\system32\dllcache\fltmgr.sys
2007-09-21 14:41 d——– C:\Documents and Settings\LocalService\Menu D‚marrer
2007-09-21 13:26 d——– C:\WINDOWS\provisioning
2007-09-21 13:26 d——– C:\WINDOWS\peernet
2007-09-21 09:03 4,569 ——— C:\WINDOWS\system32\secupd.dat
2007-09-21 09:03 11,776 ——— C:\WINDOWS\system32\spnpinst.exe
2007-09-20 12:38 614,912 –a—— C:\WINDOWS\system32\h323msp.dll
2007-09-20 12:38 608,256 ——— C:\WINDOWS\system32\dllcache\xpsp2res.dll
2007-09-20 12:38 332,800 –a—— C:\WINDOWS\system32\ipnathlp.dll
2007-09-20 12:38 26,112 –a—— C:\WINDOWS\system32\xpsp1hfm.exe
2007-09-20 11:10 1,097,728 –a—— C:\WINDOWS\system32\esent.dll
2007-09-20 10:49 51,200 –a—— C:\WINDOWS\NirCmd.exe
2007-09-20 10:45 22,752 –a—— C:\WINDOWS\system32\spupdsvc.exe
2007-09-20 10:45 d–h—– C:\WINDOWS\$hf_mig$
2007-09-20 10:44 d——– C:\WINDOWS\system32\bits
2007-09-20 10:43 8,192 ——— C:\WINDOWS\system32\bitsprx2.dll
2007-09-20 10:43 7,168 ——— C:\WINDOWS\system32\bitsprx3.dll
2007-09-20 10:43 351,232 –a—— C:\WINDOWS\system32\winhttp.dll
2007-09-20 10:43 18,944 –a—— C:\WINDOWS\system32\qmgrprxy.dll
2007-09-20 10:41 43,352 –a—— C:\WINDOWS\system32\wups2.dll
2007-09-20 10:13 d——– C:\HJTH
2007-09-20 09:55 d-a—— C:\Documents and Settings\All Users\Application Data\TEMP
2007-09-20 09:34 d——– C:\yo
2007-09-14 15:53 d——– C:\Program Files\Yahoo!
2007-09-14 15:52 d——– C:\Program Files\CCleaner
2007-09-14 14:37 1,732 –a—— C:\WINDOWS\system32\tmp.reg
2007-09-14 14:03 d–hs—- C:\Documents and Settings\jlroberge\UserData
2007-09-14 13:28 549,720 –a—— C:\WINDOWS\system32\wuapi.dll
2007-09-14 13:28 33,624 –a—— C:\WINDOWS\system32\wups.dll
2007-09-14 13:28 325,976 –a—— C:\WINDOWS\system32\wucltui.dll
2007-09-14 13:28 187,160 –a—— C:\WINDOWS\system32\wuaueng1.dll
2007-09-14 13:28 170,776 –a—— C:\WINDOWS\system32\wuauclt1.exe
2007-09-07 15:57 d——– C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-09-07 15:37 684,567 –a—— C:\WINDOWS\system32\libeay32.dll
2007-09-07 15:37 165,888 –a—— C:\WINDOWS\system32\msvcr71.dll
2007-09-07 15:37 147,729 –a—— C:\WINDOWS\system32\libssl32.dll
2007-09-07 15:27 81,408 –a—— C:\WINDOWS\system32\cdmodemt.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-08-07 13:58 8320 –a—— C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-08-07 13:56 9344 –a—— C:\WINDOWS\system32\drivers\NSDriver.sys
2007-07-30 19:19 92504 –a—— C:\WINDOWS\system32\dllcache\cdm.dll
2007-07-30 19:19 92504 –a—— C:\WINDOWS\system32\cdm.dll
2007-07-30 19:19 53080 –a—— C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 53080 –a—— C:\WINDOWS\system32\dllcache\wuauclt.exe
2007-07-30 19:19 203096 –a—— C:\WINDOWS\system32\wuweb.dll
2007-07-30 19:19 1712984 –a—— C:\WINDOWS\system32\wuaueng.dll
2007-07-30 19:19 1712984 –a—— C:\WINDOWS\system32\dllcache\wuaueng.dll
2007-07-19 02:58 3583488 ——— C:\WINDOWS\system32\dllcache\mshtml.dll
2007-07-12 19:30 765952 ——— C:\WINDOWS\system32\dllcache\vgx.dll
2006-02-01 10:06 2210 –a—— C:\Program Files\INSTALL.LOG
2002-07-26 18:02 153088 –a—— C:\Program Files\UNWISE.EXE
.

((((((((((((((((((((((((((((( snapshot_2007-10-03_12.59.29.71 )))))))))))))))))))))))))))))))))))))))))
.
—-a-r 29,926 2007-10-03 20:12:13 C:\WINDOWS\Installer\{742DFC87-1703-46D8-AC24-F87FDCD7C1AB}\ARPPRODUCTICON.exe
—-a-r 69,632 2007-10-03 20:12:13 C:\WINDOWS\Installer\{742DFC87-1703-46D8-AC24-F87FDCD7C1AB}\Pareto_PC.exe1_F8A3DDDC322C4426A983FE236C5E2876.exe
—-a-r 69,632 2007-10-03 20:12:13 C:\WINDOWS\Installer\{742DFC87-1703-46D8-AC24-F87FDCD7C1AB}\Pareto_PC.exe_6AF85B59EED54E0F98F608BF7E8F8FA0.exe
—-a-r 1,038,336 2007-10-03 20:23:05 C:\WINDOWS\Installer\{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}\Icon0E6AB9FC.exe
—-a-r 178,688 2007-10-03 20:23:05 C:\WINDOWS\Installer\{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}\Icon0E6AB9FC1.exe
—-a-r 171,008 2007-10-03 20:23:05 C:\WINDOWS\Installer\{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}\IconDED53B0B.exe
—-a-r 8,704 2007-10-03 20:23:05 C:\WINDOWS\Installer\{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}\IconDED53B0B1.exe
—-a-w 7,680 2007-04-13 19:19:52 C:\WINDOWS\system32\lsdelete.exe
—-a-w 32,768 2007-10-05 14:46:05 C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
—-a-w 32,768 2007-10-05 14:46:05 C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat
—-a-w 5,632 2007-01-31 13:33:46 C:\WINDOWS\system32\drivers\avgarkt.sys
—-a-w 6,272 2007-07-11 18:37:26 C:\WINDOWS\system32\drivers\AWRTPD.sys
.
—-a-w 32,768 2007-09-21 18:40:15 C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
—-a-w 32,768 2007-09-21 18:40:15 C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{83209E61-3FA9-48D5-9EF2-F189F69DB707}]
2007-10-03 11:31 81408 –a—— c:\windows\system32\cdmodemt.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="NvQTwk" []
"Smapp"="C:\Program Files\Analog Devices\SoundMAX\Smtray.exe" [2002-06-07 08:54]
"Mouse Suite 98 Daemon"="PELMICED.EXE" [2001-06-18 05:57 C:\WINDOWS\system32\PELMICED.EXE]
"ConfigSafe"="C:\CFGSAFE\NTFSCLUP.EXE" [2001-05-18 09:17]
"vptray"="C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe" [2003-04-25 19:18]
"CSScheduleCheck"="C:\CFGSAFE\SCHWIZEX.exe" [2001-05-03 10:03]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" [2007-06-28 12:51]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 19:09]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 12:24]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1229272821-839522115-682003330-1109\Scripts\Logon\]
"Script"=cmst.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1229272821-839522115-682003330-1109\Scripts\Logon\1]
"Script"=Compta.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1229272821-839522115-682003330-1109\Scripts\Logon\2]
"Script"=numlock.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1229272821-839522115-682003330-1118\Scripts\Logon\]
"Script"=cmst.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1229272821-839522115-682003330-1118\Scripts\Logon\1]
"Script"=Compta.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1229272821-839522115-682003330-1118\Scripts\Logon\2]
"Script"=numlock.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1229272821-839522115-682003330-1119\Scripts\Logon\]
"Script"=cmst.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1229272821-839522115-682003330-1119\Scripts\Logon\1]
"Script"=Compta.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1229272821-839522115-682003330-1119\Scripts\Logon\2]
"Script"=numlock.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1229272821-839522115-682003330-1120\Scripts\Logon\]
"Script"=cmst.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1229272821-839522115-682003330-1120\Scripts\Logon\1]
"Script"=Compta.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1229272821-839522115-682003330-1120\Scripts\Logon\2]
"Script"=numlock.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1229272821-839522115-682003330-1121\Scripts\Logon\]
"Script"=cmst.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1229272821-839522115-682003330-1121\Scripts\Logon\1]
"Script"=Compta.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1229272821-839522115-682003330-1121\Scripts\Logon\2]
"Script"=numlock.vbs

R1 pelmouse;Mouse Suite Driver;C:\WINDOWS\system32\DRIVERS\pelmouse.sys
R2 UxTuneUp;TuneUp Extension de thème;C:\WINDOWS\System32\svchost.exe -k netsvcs
R3 pelps2m;PS/2 Mouse Filter Driver;C:\WINDOWS\system32\DRIVERS\pelps2m.sys
S3 VPREMOTE;VPRemote Install Bootstrap Service;C:\TEMP\Clt-Inst\vpremote.exe

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

*Newly Created Service* - UIJRIBUW
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2007-05-14 13:00:35 C:\WINDOWS\Tasks\Image planifiée.job"
"2007-09-27 18:41:22 C:\WINDOWS\Tasks\Maintenance en 1 clic.job"
- C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe
.
**************************************************************************

catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-05 10:59:53
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-10-05 11:01:59 - machine was rebooted
C:\ComboFix … 2007-10-05 11:01
C:\ComboFix-quarantined-files.txt … 2007-10-05 11:01
C:\ComboFix2.txt … 2007-10-03 13:00
C:\ComboFix3.txt … 2007-09-20 10:55
.
— E O F —

Logfile of HijackThis v1.99.1
Scan saved at 11:03, on 2007-10-05
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\cmd.exe
C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
C:\WINDOWS\system32\PELMICED.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\RealVNC\WinVNC\winvnc.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\HJTH\HijackThis222.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/ig?hl=fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {83209E61-3FA9-48D5-9EF2-F189F69DB707} - c:\windows\system32\cdmodemt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] PELMICED.EXE
O4 - HKLM\..\Run: [ConfigSafe] C:\CFGSAFE\NTFSCLUP.EXE
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [CSScheduleCheck] C:\CFGSAFE\SCHWIZEX.EXE -CHECK
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Run VNC Server.lnk = C:\Program Files\RealVNC\WinVNC\winvnc.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1190299259906
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = cmst.lan
O17 - HKLM\Software\..\Telephony: DomainName = cmst.lan
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = cmst.lan
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = cmst.lan
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" -r (file missing)
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: VPRemote Install Bootstrap Service (VPREMOTE) - Unknown owner - C:\TEMP\Clt-Inst\vpremote.exe (file missing)
Post #17
Hi donjuan

Open HijackThis. Hit Do A System Scan Only. Place a check next to the following items (if present):
O2 - BHO: (no name) - {83209E61-3FA9-48D5-9EF2-F189F69DB707} - c:\windows\system32\cdmodemt.dll

Close all browsers and windows except for HijackThis and click Fix Checked.


1. Please open Notepad
  • Click Start , then Run
  • Type notepad .exe in the Run Box.
2. Now copy/paste the entire content of the codebox below into the Notepad window:

File::
c:\windows\system32\cdmodemt.dll

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{83209E61-3FA9-48D5-9EF2-F189F69DB707}]


3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

[external image: Posted Image]


5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
  • Combofix.txt
  • A new HijackThis log.
Thanks,

jpshortstuff
Post #18
ComboFix 07-10-03.7 - ydeschenes 2007-10-05 13:37:55.4 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.50 [GMT -4:00]
Running from: C:\Documents and Settings\[removed]\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\jlroberge\Bureau\CFScript.txt
* Created a new restore point

FILE::
c:\windows\system32\cdmodemt.dll
.

((((((((((((((((((((((((((((( Fichiers créés 2007-09-05 to 2007-10-05 ))))))))))))))))))))))))))))))))))))
.

2007-10-05 11:18 d——– C:\WINDOWS\DED53B0BB67C4244AE6AD6FD3C28D1EF.TMP
2007-10-05 11:15 d——– C:\Documents and Settings\ldesloriers\Application Data\TuneUp Software
2007-10-03 16:22 d——– C:\Program Files\Lavasoft
2007-10-03 16:22 d——– C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-10-03 16:20 d——– C:\Program Files\SpywareBlaster
2007-10-03 16:12 d——– C:\Documents and Settings\jlroberge\Application Data\ParetoLogic
2007-10-03 16:11 d——– C:\Program Files\ParetoLogic
2007-10-03 16:11 d——– C:\Program Files\Fichiers communs\ParetoLogic
2007-10-03 16:11 d——– C:\Documents and Settings\All Users\Application Data\ParetoLogic
2007-10-03 15:50 d——– C:\Documents and Settings\All Users\Application Data\Downloaded Installations
2007-10-03 15:19 3,968 –a—— C:\WINDOWS\system32\drivers\AvgArCln.sys
2007-10-03 11:35 d——– C:\Program Files\Kaspersky Lab
2007-10-03 11:33 d——– C:\kav
2007-10-02 14:17 d——– C:\WINDOWS\system32\Kaspersky Lab
2007-10-02 14:17 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-10-02 13:57 d——– C:\Documents and Settings\jlroberge\Application Data\TuneUp Software
2007-09-27 14:41 29,704 –a—— C:\WINDOWS\system32\uxtuneup.dll
2007-09-27 14:41 d——– C:\Documents and Settings\administrator\Application Data\TuneUp Software
2007-09-27 14:40 d——– C:\Program Files\TuneUp Utilities 2007
2007-09-27 14:40 d——– C:\Documents and Settings\All Users\Application Data\TuneUp Software
2007-09-27 11:01 d——– C:\Program Files\Fichiers communs\Wise Installation Wizard
2007-09-21 15:28 d——– C:\WINDOWS\system32\fr-fr
2007-09-21 15:24 33,792 –a—— C:\WINDOWS\system32\dllcache\custsat.dll
2007-09-21 15:15 23,040 ——— C:\WINDOWS\system32\dllcache\fltmc.exe
2007-09-21 15:15 16,896 ——— C:\WINDOWS\system32\dllcache\fltlib.dll
2007-09-21 15:15 128,896 ——— C:\WINDOWS\system32\dllcache\fltmgr.sys
2007-09-21 14:41 d——– C:\Documents and Settings\LocalService\Menu D‚marrer
2007-09-21 13:26 d——– C:\WINDOWS\provisioning
2007-09-21 13:26 d——– C:\WINDOWS\peernet
2007-09-21 09:03 4,569 ——— C:\WINDOWS\system32\secupd.dat
2007-09-21 09:03 11,776 ——— C:\WINDOWS\system32\spnpinst.exe
2007-09-20 12:38 614,912 –a—— C:\WINDOWS\system32\h323msp.dll
2007-09-20 12:38 608,256 ——— C:\WINDOWS\system32\dllcache\xpsp2res.dll
2007-09-20 12:38 332,800 –a—— C:\WINDOWS\system32\ipnathlp.dll
2007-09-20 12:38 26,112 –a—— C:\WINDOWS\system32\xpsp1hfm.exe
2007-09-20 11:10 1,097,728 –a—— C:\WINDOWS\system32\esent.dll
2007-09-20 10:49 51,200 –a—— C:\WINDOWS\NirCmd.exe
2007-09-20 10:45 22,752 –a—— C:\WINDOWS\system32\spupdsvc.exe
2007-09-20 10:45 d–h—– C:\WINDOWS\$hf_mig$
2007-09-20 10:44 d——– C:\WINDOWS\system32\bits
2007-09-20 10:43 8,192 ——— C:\WINDOWS\system32\bitsprx2.dll
2007-09-20 10:43 7,168 ——— C:\WINDOWS\system32\bitsprx3.dll
2007-09-20 10:43 351,232 –a—— C:\WINDOWS\system32\winhttp.dll
2007-09-20 10:43 18,944 –a—— C:\WINDOWS\system32\qmgrprxy.dll
2007-09-20 10:41 43,352 –a—— C:\WINDOWS\system32\wups2.dll
2007-09-20 10:13 d——– C:\HJTH
2007-09-20 09:55 d-a—— C:\Documents and Settings\All Users\Application Data\TEMP
2007-09-20 09:34 d——– C:\yo
2007-09-14 15:53 d——– C:\Program Files\Yahoo!
2007-09-14 15:52 d——– C:\Program Files\CCleaner
2007-09-14 14:37 1,732 –a—— C:\WINDOWS\system32\tmp.reg
2007-09-14 14:03 d–hs—- C:\Documents and Settings\jlroberge\UserData
2007-09-14 13:28 549,720 –a—— C:\WINDOWS\system32\wuapi.dll
2007-09-14 13:28 33,624 –a—— C:\WINDOWS\system32\wups.dll
2007-09-14 13:28 325,976 –a—— C:\WINDOWS\system32\wucltui.dll
2007-09-14 13:28 187,160 –a—— C:\WINDOWS\system32\wuaueng1.dll
2007-09-14 13:28 170,776 –a—— C:\WINDOWS\system32\wuauclt1.exe
2007-09-07 15:57 d——– C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-09-07 15:37 684,567 –a—— C:\WINDOWS\system32\libeay32.dll
2007-09-07 15:37 165,888 –a—— C:\WINDOWS\system32\msvcr71.dll
2007-09-07 15:37 147,729 –a—— C:\WINDOWS\system32\libssl32.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-08-07 13:58 8320 –a—— C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-08-07 13:56 9344 –a—— C:\WINDOWS\system32\drivers\NSDriver.sys
2007-07-30 19:19 92504 –a—— C:\WINDOWS\system32\dllcache\cdm.dll
2007-07-30 19:19 92504 –a—— C:\WINDOWS\system32\cdm.dll
2007-07-30 19:19 53080 –a—— C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 53080 –a—— C:\WINDOWS\system32\dllcache\wuauclt.exe
2007-07-30 19:19 203096 –a—— C:\WINDOWS\system32\wuweb.dll
2007-07-30 19:19 1712984 –a—— C:\WINDOWS\system32\wuaueng.dll
2007-07-30 19:19 1712984 –a—— C:\WINDOWS\system32\dllcache\wuaueng.dll
2007-07-19 02:58 3583488 ——— C:\WINDOWS\system32\dllcache\mshtml.dll
2007-07-12 19:30 765952 ——— C:\WINDOWS\system32\dllcache\vgx.dll
2006-02-01 10:06 2210 –a—— C:\Program Files\INSTALL.LOG
2002-07-26 18:02 153088 –a—— C:\Program Files\UNWISE.EXE
.

((((((((((((((((((((((((((((( snapshot_2007-10-03_12.59.29.71 )))))))))))))))))))))))))))))))))))))))))
.
—-a-w 37,376 2007-10-05 15:18:25 C:\WINDOWS\DED53B0BB67C4244AE6AD6FD3C28D1EF.TMP\WiseCustCall64.dll
—-a-w 22,195 2007-10-05 15:18:25 C:\WINDOWS\DED53B0BB67C4244AE6AD6FD3C28D1EF.TMP\WiseCustomCall.dll
—-a-w 73,728 2007-10-05 15:18:25 C:\WINDOWS\DED53B0BB67C4244AE6AD6FD3C28D1EF.TMP\WiseCustomCalla.dll
—-a-r 29,926 2007-10-03 20:12:13 C:\WINDOWS\Installer\{742DFC87-1703-46D8-AC24-F87FDCD7C1AB}\ARPPRODUCTICON.exe
—-a-r 69,632 2007-10-03 20:12:13 C:\WINDOWS\Installer\{742DFC87-1703-46D8-AC24-F87FDCD7C1AB}\Pareto_PC.exe1_F8A3DDDC322C4426A983FE236C5E2876.exe
—-a-r 69,632 2007-10-03 20:12:13 C:\WINDOWS\Installer\{742DFC87-1703-46D8-AC24-F87FDCD7C1AB}\Pareto_PC.exe_6AF85B59EED54E0F98F608BF7E8F8FA0.exe
—-a-r 1,038,336 2007-10-03 20:23:05 C:\WINDOWS\Installer\{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}\Icon0E6AB9FC.exe
—-a-r 178,688 2007-10-03 20:23:05 C:\WINDOWS\Installer\{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}\Icon0E6AB9FC1.exe
—-a-r 171,008 2007-10-03 20:23:05 C:\WINDOWS\Installer\{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}\IconDED53B0B.exe
—-a-r 8,704 2007-10-03 20:23:05 C:\WINDOWS\Installer\{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}\IconDED53B0B1.exe
—-a-w 7,680 2007-04-13 19:19:52 C:\WINDOWS\system32\lsdelete.exe
—-a-w 32,768 2007-10-05 15:12:32 C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
—-a-w 32,768 2007-10-05 15:12:32 C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat
–sha-w 32,768 2007-10-05 15:12:32 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
—-a-w 5,632 2007-01-31 13:33:46 C:\WINDOWS\system32\drivers\avgarkt.sys
—-a-w 6,272 2007-07-11 18:37:26 C:\WINDOWS\system32\drivers\AWRTPD.sys
.
—-a-w 32,768 2007-09-21 18:40:15 C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
—-a-w 32,768 2007-09-21 18:40:15 C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat
—-a-w 32,768 2007-09-21 18:40:15 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="NvQTwk" []
"Smapp"="C:\Program Files\Analog Devices\SoundMAX\Smtray.exe" [2002-06-07 08:54]
"Mouse Suite 98 Daemon"="PELMICED.EXE" [2001-06-18 05:57 C:\WINDOWS\system32\PELMICED.EXE]
"ConfigSafe"="C:\CFGSAFE\NTFSCLUP.EXE" [2001-05-18 09:17]
"vptray"="C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe" [2003-04-25 19:18]
"CSScheduleCheck"="C:\CFGSAFE\SCHWIZEX.exe" [2001-05-03 10:03]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 19:09]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 12:24]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1229272821-839522115-682003330-1109\Scripts\Logon\]
"Script"=cmst.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1229272821-839522115-682003330-1109\Scripts\Logon\1]
"Script"=Compta.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1229272821-839522115-682003330-1109\Scripts\Logon\2]
"Script"=numlock.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1229272821-839522115-682003330-1118\Scripts\Logon\]
"Script"=cmst.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1229272821-839522115-682003330-1118\Scripts\Logon\1]
"Script"=Compta.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1229272821-839522115-682003330-1118\Scripts\Logon\2]
"Script"=numlock.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1229272821-839522115-682003330-1119\Scripts\Logon\]
"Script"=cmst.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1229272821-839522115-682003330-1119\Scripts\Logon\1]
"Script"=Compta.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1229272821-839522115-682003330-1119\Scripts\Logon\2]
"Script"=numlock.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1229272821-839522115-682003330-1120\Scripts\Logon\]
"Script"=cmst.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1229272821-839522115-682003330-1120\Scripts\Logon\1]
"Script"=Compta.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1229272821-839522115-682003330-1120\Scripts\Logon\2]
"Script"=numlock.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1229272821-839522115-682003330-1121\Scripts\Logon\]
"Script"=cmst.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1229272821-839522115-682003330-1121\Scripts\Logon\1]
"Script"=Compta.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1229272821-839522115-682003330-1121\Scripts\Logon\2]
"Script"=numlock.vbs

R1 pelmouse;Mouse Suite Driver;C:\WINDOWS\system32\DRIVERS\pelmouse.sys
R2 UxTuneUp;TuneUp Extension de thème;C:\WINDOWS\System32\svchost.exe -k netsvcs
R3 pelps2m;PS/2 Mouse Filter Driver;C:\WINDOWS\system32\DRIVERS\pelps2m.sys
S3 VPREMOTE;VPRemote Install Bootstrap Service;C:\TEMP\Clt-Inst\vpremote.exe

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2007-05-14 13:00:35 C:\WINDOWS\Tasks\Image planifiée.job"
"2007-09-27 18:41:22 C:\WINDOWS\Tasks\Maintenance en 1 clic.job"
- C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe
.
**************************************************************************

catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-05 13:39:58
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-10-05 13:41:09
C:\ComboFix … 2007-10-05 13:41
C:\ComboFix-quarantined-files.txt … 2007-10-05 13:40
C:\ComboFix2.txt … 2007-10-05 11:02
C:\ComboFix3.txt … 2007-10-03 13:00
.
— E O F —


Logfile of HijackThis v1.99.1
Scan saved at 13:41, on 2007-10-05
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\cmd.exe
C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
C:\WINDOWS\system32\PELMICED.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\RealVNC\WinVNC\winvnc.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\HJTH\HijackThis222.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/ig?hl=fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] PELMICED.EXE
O4 - HKLM\..\Run: [ConfigSafe] C:\CFGSAFE\NTFSCLUP.EXE
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [CSScheduleCheck] C:\CFGSAFE\SCHWIZEX.EXE -CHECK
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Run VNC Server.lnk = C:\Program Files\RealVNC\WinVNC\winvnc.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1190299259906
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = cmst.lan
O17 - HKLM\Software\..\Telephony: DomainName = cmst.lan
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = cmst.lan
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = cmst.lan
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" -r (file missing)
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: VPRemote Install Bootstrap Service (VPREMOTE) - Unknown owner - C:\TEMP\Clt-Inst\vpremote.exe (file missing)
Post #19
Hi donjuan

Log are looking better. Just want to do another general scan.

I'd like you to scan your system with Panda ActiveScan:

Panda ActiveScan
  • Once you are on the Panda site, click the Scan your PC button
  • A new window will open…click the Check Now button
  • Enter your Country
  • Enter your State/Province
  • Enter your e-mail address and click send
  • Select either Home User or Company
  • Click the big Scan Now button
  • If it wants to install an ActiveX component allow it
  • It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
  • When download is complete, click on Local Disks to start the scan
  • When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location.
Post the contents of the Panda scan report, along with a new HijackThis Log

Also, could you describe how your computer is behaving now.

Thanks,

jpshortstuff
Post #20
No more redirection in Google. Received two warnings from my symantec software but before the panda scan.

Logfile of HijackThis v1.99.1
Scan saved at 16:06, on 2007-10-05
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\cmd.exe
C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
C:\WINDOWS\system32\PELMICED.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\RealVNC\WinVNC\winvnc.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINDOWS\explorer.exe
C:\HJTH\HijackThis222.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/ig?hl=fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] PELMICED.EXE
O4 - HKLM\..\Run: [ConfigSafe] C:\CFGSAFE\NTFSCLUP.EXE
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [CSScheduleCheck] C:\CFGSAFE\SCHWIZEX.EXE -CHECK
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Run VNC Server.lnk = C:\Program Files\RealVNC\WinVNC\winvnc.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1190299259906
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = cmst.lan
O17 - HKLM\Software\..\Telephony: DomainName = cmst.lan
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = cmst.lan
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = cmst.lan
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" -r (file missing)
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: VPRemote Install Bootstrap Service (VPREMOTE) - Unknown owner - C:\TEMP\Clt-Inst\vpremote.exe (file missing)

Incident Status Location

Adware:adware/exact.bargainbuddy Not disinfected c:\windows\launcher.exe
Adware:adware/windowenhancer Not disinfected c:\windows\system32\SBUtils
Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\Documents and Settings\jlroberge\Bureau\ComboFix.exe[nircmd.exe]
Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\Documents and Settings\jlroberge\Bureau\ComboFix.exe[nircmd.cfexe]
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\jlroberge\Bureau\SmitfraudFix\Process.exe
Virus:Trj/Rebooter.J Disinfected C:\Documents and Settings\jlroberge\Bureau\SmitfraudFix\Reboot.exe
Potentially unwanted tool:Application/SuperFast Not disinfected C:\Documents and Settings\jlroberge\Bureau\SmitfraudFix\restart.exe
Virus:Trj/Rebooter.J Disinfected C:\Documents and Settings\jlroberge\Bureau\SmitfraudFix.exe
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\jlroberge\Cookies\ydeschenes@com[1].txt
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\jlroberge\Cookies\ydeschenes@tribalfusion[1].txt
Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\jlroberge\Cookies\ydeschenes@xiti[1].txt
Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\fixwareout\FindT\nircmd.exe
Virus:Trj/Bho.M Disinfected C:\qoobox\Quarantine\C\WINDOWS\system32\comaddind.dll.vir
Virus:Trj/Bho.M Disinfected C:\qoobox\Quarantine\C\WINDOWS\system32\d3dpmesha.dll.vir
Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\WINDOWS\NirCmd.exe
Virus:Generic Trojan Disinfected C:\WINDOWS\system32\adsmsextt.1
Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\yo\ComboFix.exe[nircmd.exe]
Post #21
Hi donjuan


Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.


Log looks good :thumbup:


You can now delete ComboFix.exe, VundoFix.exe and the C:\Qoobox folder. Also, I recommend you delete these items that were picked up by Panda:
C:\WINDOWS\launcher.exe <<File
C:\WINDOWS\System32\SBUtils <<Folder


Hide protected/system files:
Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Check "Hide file extensions for known file types."
Under the "Hidden files" folder, Uncheck "Show hidden files and folders."
Check "Hide protected operating system files."
Click Apply, and then click OK.


Now that you're clean, theres just a few steps I'd like you to take to prevent any future infections.
  • Use Mozilla Firefox or Opera as your internet browser.
    These are more secure than Internet Explorer and can be downloaded for free from here:
    Download Mozilla FireFox
    Download Opera

  • Make sure your update your Anti-Virus software regularly, new viruses are being developed all the time.

  • If you don't have these programs, or any similar ones, i recommend you download and install these:
    SpywareGuard detects any changes to Internet Explorer settings BEFORE they happen, and gives you the option to change them or keep the old ones.
    SpywareBlaster is another real-time scanner that prevents most spyware from even being installed.
    You can get them for free from here:
    Download SpywareGuard
    Download SpywareBlaster
    I recommend getting both these programs, together they will stop a large amount of Spyware.

  • Some more programs that it would be useful to have:
    Download Spybot Search and Destroy 1.5 from here
    Check for Updates/ Immunize and run a Full System Scan on a regular basis.
    Download Ad-Aware 2007 SE Personal 7.1.06 from here
    Check for Updates and run a Full System Scan on a regular basis.

  • System restore:
    Clean and create new system restore point regularly.
    How do I clean my system restore and create new system restore point?
    Here are the instructions!
Also, please read this great article by Tony Klein: So How Did I Get Infected In First Place

Glad we could be of assistance

Stay Clean!

jpshortstuff
Post #23
Since this issue appears resolved … this Topic is closed. If you need this topic reopened, please request this by sending the moderating team a PM with the address of the thread. This applies only to the original topic starter. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI